ateraagent | d25311bbc7e7fc0b401c1d3c63d33972dd24fef3572c79901b89b152e2e2001b

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/10/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 8.5MB
Sample261008-astfwayz3n
SHA256 d25311bbc7e7fc0b401c1d3c63d33972dd24fef3572c79901b89b152e2e2001b
MD5 7c7efe125192ed4b0a45fb12972d57f7
SHA1 6ad2f489646154e631033fe3e8bca70e70234d2a
SHA512 4e301d490723a7322ff0004816532b42f95181bceed4af56b3bcc8021747a3ee91d7dc5c54d0a4f2f98818964195818d1f5457e5d0d12c62e2fd2b5ab132d578
SSDEEP 49152:NMRYgewmozc9/NOqVXq4HR+yLgy408AvUUc3NeYyfenr+IdApNcLpPNQoGBxaOI5:e
TLSH
T1859608F33EEE66461B05335B974FD9580F1BCC271A83AED490DB0AD4540F78B2A9099E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery ateraagent persistence ransomware rat

Malware Config

Signatures

Family: AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000000697c-51.dat	family_ateraagent

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{7276D2BA-5661-46C8-90A3-49162C74AA88}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 5132	4436	msedge.exe	89
PID 4436 wrote to memory of 1240	4436	msedge.exe	91
PID 4436 wrote to memory of 1404	4436	msedge.exe	90
PID 4436 wrote to memory of 1240	4436	msedge.exe	91
PID 4436 wrote to memory of 1240	4436	msedge.exe	91
PID 4436 wrote to memory of 5592	4436	msedge.exe	92
PID 4436 wrote to memory of 5592	4436	msedge.exe	92
PID 4436 wrote to memory of 2908	4436	msedge.exe	93
PID 4436 wrote to memory of 5708	4436	msedge.exe	94
PID 4436 wrote to memory of 2908	4436	msedge.exe	93
PID 4436 wrote to memory of 2908	4436	msedge.exe	93
PID 4436 wrote to memory of 5708	4436	msedge.exe	94
PID 4436 wrote to memory of 5708	4436	msedge.exe	94
PID 4436 wrote to memory of 3888	4436	msedge.exe	96
PID 4436 wrote to memory of 3888	4436	msedge.exe	96
PID 4436 wrote to memory of 3888	4436	msedge.exe	96
PID 4436 wrote to memory of 5344	4436	msedge.exe	97
PID 4436 wrote to memory of 5344	4436	msedge.exe	97
PID 4436 wrote to memory of 5344	4436	msedge.exe	97
PID 4436 wrote to memory of 3624	4436	msedge.exe	98
PID 4436 wrote to memory of 1448	4436	msedge.exe	100
PID 4436 wrote to memory of 3624	4436	msedge.exe	98
PID 4436 wrote to memory of 3624	4436	msedge.exe	98
PID 4436 wrote to memory of 4256	4436	msedge.exe	99
PID 4436 wrote to memory of 4256	4436	msedge.exe	99
PID 4436 wrote to memory of 4048	4436	msedge.exe	102
PID 4436 wrote to memory of 3540	4436	msedge.exe	103
PID 4436 wrote to memory of 4048	4436	msedge.exe	102
PID 4436 wrote to memory of 3540	4436	msedge.exe	103
PID 4436 wrote to memory of 3004	4436	msedge.exe	105
PID 4436 wrote to memory of 4288	4436	msedge.exe	109
PID 4436 wrote to memory of 4352	4436	msedge.exe	110
PID 4436 wrote to memory of 3204	4436	msedge.exe	111
PID 4436 wrote to memory of 2996	4436	msedge.exe	112
PID 4436 wrote to memory of 2996	4436	msedge.exe	112
PID 4436 wrote to memory of 6064	4436	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x324,0x7fff0dccc188,0x7fff0dccc194,0x7fff0dccc1a0
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,8609657006913724281,5884085665794042267,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,13891706677118730227,13475632741693516117,262144 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,186978658869064907,6368575711713507020,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,8943351043427122148,5595361365231704302,2097152 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,759060177521585982,7471173866127547705,2097152 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,2824514197779880955,12188997238640712989,2097152 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10473945329289287330,1869214398580769037,2097152 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5420,i,8240037576081353402,15233286651214398511,2097152 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,264959929182165889,13142188054821003874,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,1908670928164035216,1331577611835353348,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,6631097683956189308,8825678648775139536,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11855390301505530899,13945943317631337728,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,2834071357272392871,14820670513170632904,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,2834071357272392871,14820670513170632904,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,11816152766722954906,12005669968424450851,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,13078204565461230181,14821987863006056522,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13192334153998637545,17627640913901283119,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,16330377344798670000,12460780023644980261,524288 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7040,i,18348344613380680197,2460714381311107693,262144 --field-trial-handle=2472,i,17528533784174177664,10812245089860102216,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2fe15d49-17c1-4a08-a3e1-e77555f5b7c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2fe15d49-17c1-4a08-a3e1-e77555f5b7c7.tmp
Size 33KB
SHA256 c10da58912cb73188b2bd915d0df8cc6012770e4bff0b2107fdf145f7e8e9950
MD5 458f91a414840b4ebce6a6a071524af2
SHA1 743a3c48db25bad91cd0fc9ae87dc8c7bd699432
SHA512 8d49db7217dea71739ad2e7d2f8f26fc44bc60d40efc63d7cb2e4d44903215514f8b0be6946c7af7d408b91381d7880d21ef815664f9164b6b32dd56bd7c8070
SSDEEP 384:jZcII38Ngkrtn5AzKs7p9xfIbNbpCCHrOc1RMOLLZyW6efTov+He0DUYRjBP8Ll2:7I3AtnGfybNbg+rOeRFZD1fTos7RjBLp
TLSH
T119F2AF35BCA49D734CF9D245B2467A43BFF49263DACD198458DC6E0E04DBBAE130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

849502d0-0b29-43e5-a966-e41be41bc508.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\849502d0-0b29-43e5-a966-e41be41bc508.tmp
Size 36KB
SHA256 8816fa5c94226dc3a5a5b1f0c6f8e45393a0afd40e1265aa3b7be1e04338bddf
MD5 b704d2b58c564f5140169855b5e8000e
SHA1 12823049becb61d5d5f39e2129d451aa9a32db28
SHA512 53cf187ce3e353822724737a46e4733a0daa747a374ee1f1f1444a666f8eb1320f0fd14c82b452a3c6820e603245b1fe9a026382aee986128115b847339a67e2
SSDEEP 768:2FQG3PwgwtnGfybNbg+hOeRFZD1fTos7RjBLp:9G3qtnqdY1fT/RNLp
TLSH
T139F29D36ACD48D779CF9D684F24A7643AFF482A3C98D598495CC6E0E009BAED130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cd3bbc0-f8f6-4d9c-a766-7886df6cba43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9cd3bbc0-f8f6-4d9c-a766-7886df6cba43.tmp
Size 33KB
SHA256 ed433322a3ee39a686ad9cf9e11a0fe7f04e008effd9da660696c4af3ac57d6a
MD5 c5ba48d9b752f546a6ad44e2b2544500
SHA1 57b3f4b07da7509e3f49439967c8daa17d7dc720
SHA512 822ce4575c3415d474dee9f15d934558e112d95873631cedea26f339afe4b51f33c2b26e758c9cc292201ebbbbc618eef3ec4b91a5db61b701d153e0a7b8842e
SSDEEP 384:3ZcII38Ng1rtn5AnKs7p9xfIbNbpCCHrOc1RMOLLZyW6efTov+He0DUYRjBP8Ll2:/I3TtnCfybNbg+rOeRFZD1fTos7RjBLp
TLSH
T1D9F2AF35BCA49D734CF9D245B2467A437FF49263DACD198458DC6E0E04DBBAE130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

66cec162-0aec-4950-b794-067df44b514d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66cec162-0aec-4950-b794-067df44b514d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6854ced6-e849-4ae7-9c89-d66a772be6fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6854ced6-e849-4ae7-9c89-d66a772be6fa.tmp
Size 11KB
SHA256 d9fea18a6a3b4c1b10c064197fe5affccc055f4e69266ac5896a080372c2639d
MD5 8456ee19dae3cea8f38bfe5b17e6cd21
SHA1 6e8ffa6283e73e5a3f62cda7374aadac7468e683
SHA512 d5b71bdce8fd9db2ee22721938b1d816974305dc7894081ad6de9baa049a61de28d813de7c3b5f7eeb8053fa293ff31595bb023090313322472adc051ca2484c
SSDEEP 192:sxRdRDOL/f5soK7xkyrzoA8p40S/g6+WNIYDFsG+rEIgD+J:sxRd8L/f5so6a9JS/5IOe
TLSH
T1DB32C715AE28A97B4CCBD21DBB55BF53D6FD1032A0941E48B6FC961C04E66DD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

994a6f37-6a94-43b7-a55a-7815137af33a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\994a6f37-6a94-43b7-a55a-7815137af33a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 cb070dc7b417f42af7b1b75223fc3096a2a87c4a75bdcc5070a02509f6c844eb
MD5 b660f63f96ac6424febf855189ee3ff7
SHA1 5468a7018a2b69160378d04fead043b34761c132
SHA512 62c760b001a07a486455432651bf6e86d0df47d51189001f9dc86f2023c04c0fbfaaf32290ff219f874206e7a7a7593bbfaa3faa9923587c4244e02669054c3e
TLSH
T106514DB145BC7222D3949C3941C7288BFA74D6B176C33EBA2BE6D4354F6B314B80682C
MD5 SHA1 SHA512 TLSH

Submit Download

830bc89b-e026-4557-9824-ddab68dbb161.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\830bc89b-e026-4557-9824-ddab68dbb161.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

66b7f331-b421-402f-9d37-88b95f486314.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\66b7f331-b421-402f-9d37-88b95f486314.tmp
Size 2KB
SHA256 debf4df926268e936e7944fa2434ac28347c70d38ea2666001b41cfe3bea8d83
MD5 be55d11a98c30eaca39a9327589b5ff1
SHA1 0c5d080661d4821ed7ebdb487ddd56e694987fc8
SHA512 32245d6ba8735982e537239a2480bef77266e875dc62c1667a3452f0b195552b62549c67e04fd91c6d0857cec26dd8926024ac007add0f65866ad40d22bc50d5
TLSH
T10541A0F7C3E8867D8D0156F4AA186E1BCE1D0955832C3C5AC8D4AE6BA3E24B1D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

6904d925-546d-4ece-a97e-236c1292d298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6904d925-546d-4ece-a97e-236c1292d298.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6d40273f-3d24-4a71-b68e-0763676866d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6d40273f-3d24-4a71-b68e-0763676866d9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9cc55be89278b712924245f513d34efa52dacc34039919618f186cb1bc9ec96e
MD5 35fe79f6d20370cfb035fd45665590c2
SHA1 93806f4ce72db66b684dfa40cadf63b248a76fb7
SHA512 2adad7c971c79e53bd71ce3d10ef67700f76c83ce85bb6b20945f066897bce7aa7882eab6c6ef0eab6fc2cf52e999bab8f0d58736fb01b6f23b64b71f0e29a8a
SSDEEP 24:KomJGQcIdKChU1GSb4lyXm16xcJI/K1hS1GSw3SRm7RlR6R7aRopRkRwRkgRkRot:KoLIdKUU4jyZSI/KzS4fVIlK2QonyQ
TLSH
T1BF916D11317F1200387D394D69B5862A529231B33408E5BFBBAD84B68E2FE415DFEDCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a3b6ea67-2697-4755-9979-808b60d236c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3b6ea67-2697-4755-9979-808b60d236c7.tmp
Size 11KB
SHA256 aa124f3166f8839ac6c8c3ef4f11805c3afdaf24a3bbe3ddfea193ea7f95d0a0
MD5 5ea333d10f244a2b8ece84bd266a0603
SHA1 d6989f51ed15b33a3ca0f1c09b8fe9f374de834c
SHA512 81622bba54dc32f50b2e413574804238c6bec72d2a8ecd84c1fc86ed6b7bd176796155e3404e1ef105ada8251043d80493ccdb25d87a7e3b517f4efbcf4ca82e
SSDEEP 192:sxRWRDOL/f5sqK7xkyrzoA8p40S/g6+WNIYDFsG+rEIgIJ:sxRW8L/f5sq6a9JS/5IOs
TLSH
T1DE32C615AE28A97B8CCBD21DBB55BF53D6FD1032A0941E48B6FC961C04EA6DD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad73782f-6de4-4666-8adb-3620638582a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad73782f-6de4-4666-8adb-3620638582a1.tmp
Size 11KB
SHA256 cd822999ebd9ca1ffabf2860bc57d3199249b6496a26ee87bf8ec27c3fd379d7
MD5 54976e207e99170a9297753b8e9a90eb
SHA1 b45e44204ec22bf8500b8d8a0621446fa41de07b
SHA512 2aad548b59d6fbbbe2ae352ba587decef8f7096d4fee8c55602cdb22419c8cb8bb9bc7a9afd69a920da0bd1ec24fb6def09536a9e55e6468a237c4bf1795c67f
SSDEEP 192:sxRdRDOL/f5sHNK7xkyrzoA8p40S/g6+WNIYDlssG+rEIgDEJ:sxRd8L/f5st6a9JS/5Inc
TLSH
T13942C715AE28AD7B8CCBE21DBB55BF53D6FD5032A0941E08B6FC961C04E66CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee809f52-0691-4cd0-88cb-a5c217beab7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee809f52-0691-4cd0-88cb-a5c217beab7d.tmp
Size 23KB
SHA256 9b90224db68e48393ee7076a64c84b594b584e3b2a56ce46ed5b878adbe7d0f9
MD5 da681cdf74035618a452a77ea74491ed
SHA1 4b0614b99396bf8e726ff1f6d3405ff58a99f26f
SHA512 97eb85d9ff93cdb3c009fbc9e5b20ec33c96fac4a5c93cd5f245153d4fca35defc9305fa8cba667af5af0e7dcda58063f295f6eef1ca548ad19f6a7139162503
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9RroTy9:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0VC
TLSH
T154B2DA2B640CC77E4F805AADAC1A6F967D5802C796988D4047FE994C03C77EFA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92e42d76-7ba3-4028-afb7-f57b856233ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\92e42d76-7ba3-4028-afb7-f57b856233ec.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ebadadfe-ea9f-4211-9e0e-12b6d065ad7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebadadfe-ea9f-4211-9e0e-12b6d065ad7c.tmp
Size 37KB
SHA256 25e1b66eaddf9ef539853149ee58e62a7ef678179998b522404110b2ed05b3cb
MD5 8d63761715e2d0aca80320be320365d8
SHA1 1cb09ebe454abd1a11889bf8c35fd93a53318156
SHA512 30952ebc88b2a250fbac288ba3e7613523db7855cba765ab467e986f9b9b694856c43e7b163ed87c414a70107572a10ffdac3ddea307742956244cc6e173739e
SSDEEP 768:z/UxvxjgC+k3IDpybNbgrOeRFZD1fTos7RzN/+Pu:GZj3+k3ItoY1fT/RhKu
TLSH
T17F03C03AF8D46D338CF6E244720AB64BBFF455B389C91A9809EC6F0E058B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7cc75f8-5bfa-4cec-b849-05d76a248dde.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7cc75f8-5bfa-4cec-b849-05d76a248dde.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

84725da4-b926-4d3f-b162-b8a35a788e85.tmp

Path C:\Users\Admin\Downloads\84725da4-b926-4d3f-b162-b8a35a788e85.tmp
Size 2.6MB
SHA256 45b699e1cf2eb23bb13fc5e1199930606564978e4cc645f2114d947e7a177eb7
MD5 3f19b511a7a674709576de31a2c272e5
SHA1 d75fa1ac3b0d95a0febc1b8667a64cf3a61464ed
SHA512 7ea07058a6d0f47f00e7227252cc0d6181dc79519174b60c39e3e69d7654108f82a7bc9330559c56ee5819bf9382fe9454af14196e40015837bcd85db3da2a6d
SSDEEP 49152:p51VAM5R2KAHlcp8qFmmzDza2Rqr+kMdPTEe/pjO8xn+ch/TlOFNOnUI:pPCMr2NMRmk/XeM9TEeRvx+ch/TlAr
TLSH
T111D5232275904439E7FF1A355D3A96A16EBEFE200B70C98E8348751D2EB05C067B6B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download