9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae.exe
Size 135KB
Sample260920-2sjp8adf89
SHA256 9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae
MD5 cf7de1feb92e11d9c5a45c78c2eb5a57
SHA1 70b3d55533e3c87d77317450a757d6650bad30ff
SHA512 74f76eb098aabd62a53d2c4f9d7df8f1c0e24c7acd4a3028d4fb23ae2b0c9037cad9429333f1a53af802a769fb46fc72fcc52bef27a5df97d409b0343a04578c
SSDEEP 3072:MNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0E:1qZ4h4fIqPWQd/4KUNNFN
TLSH
T17FD32849EB8310F1FE6701B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	5124	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
4900	Eupdate Helper.exe
4988	eup_rotate_4900.exe
4464	Eupdate Helper.exe
764	Eupdate Helper.exe
4784	eup_rotate_4464.exe
5124	Eupdate Helper.exe
4488	Eupdate Helper.exe
5640	eup_rotate_4488.exe
6128	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c4f8-60.dat	upx
behavioral2/memory/4488-66-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/4488-74-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/files/0x000e00000001c4f8-81.dat	upx
behavioral2/memory/5640-82-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/6128-262-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_1878306008\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_855851318\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_553057852\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_553057852\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_1953425706\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_855851318\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_1953425706\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_1953425706\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2984_1953425706\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344182777768169"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{A799BA2D-216E-45FA-8144-FA878405076C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4900	4132	9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae.exe	90
PID 4900 wrote to memory of 4988	4900	Eupdate Helper.exe	91
PID 4988 wrote to memory of 4464	4988	eup_rotate_4900.exe	92
PID 4464 wrote to memory of 4784	4464	Eupdate Helper.exe	95
PID 4784 wrote to memory of 5124	4784	eup_rotate_4464.exe	96
PID 5124 wrote to memory of 4488	5124	Eupdate Helper.exe	97
PID 4488 wrote to memory of 5640	4488	Eupdate Helper.exe	98
PID 5640 wrote to memory of 6128	5640	eup_rotate_4488.exe	99
PID 5124 wrote to memory of 2984	5124	Eupdate Helper.exe	100
PID 2984 wrote to memory of 4112	2984	msedge.exe	101
PID 2984 wrote to memory of 2816	2984	msedge.exe	103
PID 2984 wrote to memory of 2408	2984	msedge.exe	104
PID 2984 wrote to memory of 2816	2984	msedge.exe	103
PID 2984 wrote to memory of 2816	2984	msedge.exe	103
PID 2984 wrote to memory of 3224	2984	msedge.exe	105
PID 2984 wrote to memory of 3224	2984	msedge.exe	105
PID 2984 wrote to memory of 1080	2984	msedge.exe	106
PID 2984 wrote to memory of 1080	2984	msedge.exe	106
PID 2984 wrote to memory of 1080	2984	msedge.exe	106
PID 2984 wrote to memory of 5268	2984	msedge.exe	107
PID 2984 wrote to memory of 5268	2984	msedge.exe	107
PID 2984 wrote to memory of 5268	2984	msedge.exe	107
PID 2984 wrote to memory of 1648	2984	msedge.exe	108
PID 2984 wrote to memory of 1648	2984	msedge.exe	108
PID 2984 wrote to memory of 1648	2984	msedge.exe	108
PID 2984 wrote to memory of 1824	2984	msedge.exe	109
PID 2984 wrote to memory of 1824	2984	msedge.exe	109
PID 2984 wrote to memory of 1824	2984	msedge.exe	109
PID 2984 wrote to memory of 2944	2984	msedge.exe	110
PID 2984 wrote to memory of 2944	2984	msedge.exe	110
PID 2984 wrote to memory of 5564	2984	msedge.exe	112
PID 2984 wrote to memory of 4748	2984	msedge.exe	113
PID 2984 wrote to memory of 5564	2984	msedge.exe	112
PID 2984 wrote to memory of 4748	2984	msedge.exe	113
PID 2984 wrote to memory of 6076	2984	msedge.exe	115
PID 2984 wrote to memory of 1816	2984	msedge.exe	117
PID 2984 wrote to memory of 1816	2984	msedge.exe	117
PID 2984 wrote to memory of 4736	2984	msedge.exe	119
PID 2984 wrote to memory of 4736	2984	msedge.exe	119
PID 2984 wrote to memory of 3616	2984	msedge.exe	121
PID 2984 wrote to memory of 5176	2984	msedge.exe	122
PID 2984 wrote to memory of 5832	2984	msedge.exe	123
PID 2984 wrote to memory of 4424	2984	msedge.exe	124
PID 2984 wrote to memory of 4424	2984	msedge.exe	124
PID 2984 wrote to memory of 6052	2984	msedge.exe	127
PID 2984 wrote to memory of 6052	2984	msedge.exe	127
PID 2984 wrote to memory of 2736	2984	msedge.exe	128
PID 2984 wrote to memory of 2736	2984	msedge.exe	128
PID 2984 wrote to memory of 4640	2984	msedge.exe	129
PID 2984 wrote to memory of 4640	2984	msedge.exe	129
PID 2984 wrote to memory of 3076	2984	msedge.exe	130
PID 2984 wrote to memory of 3380	2984	msedge.exe	131
PID 2984 wrote to memory of 3380	2984	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae.exe
"C:\Users\Admin\AppData\Local\Temp\9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4900.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4900.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4900
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4464.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4464.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4464
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_4488.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4488.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4488
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x248,0x7ff83eefc188,0x7ff83eefc194,0x7ff83eefc1a0
        8⤵
        
        PID:4112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2036,i,11048990589641986856,2563068667172858343,262144 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        8⤵
        
        PID:2816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,7013040572728117671,9567183848318002297,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:2408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,9810351091233062618,16733119605417283985,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:13
        8⤵
        
        PID:3224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,10860316842684234828,15720204248336666722,2097152 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
        8⤵
        
        PID:1080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,17333318074312782028,7969379640682354189,2097152 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
        8⤵
        
        PID:5268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,10505752060739520586,12539645839155470852,2097152 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
        8⤵
        
        PID:1648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,10669452340525869559,8399324097033656910,2097152 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
        8⤵
        
        PID:1824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,14100056905275934562,11943890324135123396,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
        8⤵
        
        PID:2944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,8871794332363716858,2925604418488656009,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
        8⤵
        
        PID:5564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13323721558171016016,16303212315068559297,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
        8⤵
        
        PID:4748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,13303142571762005912,1550881797033571760,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
        8⤵
        
        PID:5368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,13303142571762005912,1550881797033571760,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
        8⤵
        
        PID:6076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,17594628043390628126,2224421271371573057,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
        8⤵
        
        PID:1816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,2606587852015311808,5845970797840458121,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
        8⤵
        
        PID:4736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,13574059273674426395,181693380015030608,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:14
        8⤵
        
        PID:3616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,10684852562857316925,4467047187619616986,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
        8⤵
        
        PID:5176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1320,i,5583170851781859377,15396133716359379616,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
        8⤵
        
        PID:5832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,13735233184650305624,16040998829720563031,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        8⤵
        
        PID:4424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,8531456126207985342,2681709489134956811,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
        8⤵
        
        PID:6052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8751046221090944445,848089578880805512,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
        8⤵
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,11034168918404846848,9251561505507628848,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
        8⤵
        
        PID:4640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5988,i,9174660296611382110,16276174149931620694,262144 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,1392801429554521062,98734593854022677,524288 --field-trial-handle=2548,i,12251867448472978719,3723638481067116536,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
        8⤵
        
        PID:3380

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

4ae367d0-1329-4e2a-b2f0-cf616d13b975.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ae367d0-1329-4e2a-b2f0-cf616d13b975.tmp
Size 11KB
SHA256 fd9f36de577ff23879697b8bd39c004416d926db42a4bce8d05f9a02e65b46c2
MD5 47776f3b4f45761f9526b19fcf6e589c
SHA1 699017664b4956b070046f3ae3852802987a80d6
SHA512 5ca916e3c5b0253ffd114582c9402d8e68efadbdcfa56d8f82fe5a7d461aae75c62976db45842c5183c4a6c2d1d81fc1d9c5930e382129142a4c928a16a9d97a
SSDEEP 192:sxRDRfCd/fasZWZZDzoA8pUr/g6+WNQA//YtXAGAIgVJJ:sxRDAd/fasZgZyy/57/bt
TLSH
T11732C719AD28B93B4CC7D21DFB59BF53E2F92132A0D51E48A6FD8A1C14E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 43e356364bc407fa547439409ab426baae6303b522364c126389aff404359d2e
MD5 a479d7f09ebc70073e5154da323a1e76
SHA1 fe8836ba847d3c7583e6590a6272902a18339191
SHA512 d42406d6806390b4a7c60da0691e1fce591aa34c382357ae5a0f26155dae5566aaa6dd9adfff525d59076b696bfb0aa1264cab769f9ed0fd9c7ebf085a30e988
TLSH
T1A661B38167809D58D7DC90F390DCC2CF3BBB95B8198B0D4203ACC777A84632C02B5234
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b3b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b3b6.TMP
Size 3KB
SHA256 e52e8017a33796db5f5e3cb13d9d3d8e44038cf665c3dbe8877fa81004446cf2
MD5 d3a940440f11e4c555f98f8cb3acd6c4
SHA1 8ae9c5160e94a4fc1a2ad81ee0bf9dbe0fdaad03
SHA512 360611816f8b05b1d1ba4f5e6e494f5ed29f3efc4ae3b66fb779f893e84261ef1a76d36848ed2aa55a3411cfc080d9eabe14168abb9d805d66a7df036db02f89
TLSH
T1E86193816B809D58D7DC90F790DCD2CF7BBB95B8198B0D4207ACC777A84636C02B5274
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 53dce07be28f57e6e3e95252f8d19cec1d02c4cabb3b0269f31c420bce21e825
MD5 390f65a1b477b45878c43e14be1f0f55
SHA1 6d7dcd16ee8ac5bccb3b0d7525cb01937b49802b
SHA512 c9c14d03f1b96c4c9225a1812efc7d4ae5ba48b379a68367f3111b9b15ae1ca7cc54b85c88fd77ecbc52bee50ee6fdae362b0f5fcb19311117369f20b0bcf2df
TLSH
T1E651BDF7C3E8866E890156F0AB146E2BCE2D0914432C3D5AC9E4AF1B93F3871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 efd9343248e7968aa6a20869cc32fd437ee17a87604c5031a346d5f0226d7352
MD5 a4c4f8d758ff7ef994658044625aa32b
SHA1 84e28cdd0771d07bec5c20c1658e78924ac666ec
SHA512 d1f85ba35e168c81471bdc28063b414d49c7146b4b19c35480059fb66ae90a5920a43e7467d915bdb2affb1a8b55f6a3e9dc9b26939bf5208208059ee265e947
SSDEEP 192:sxRkRfCd/fasOwWZZDzoA8pUr/g6+WNQA//YtUAGAIgDtJJ:sxRkAd/fasHgZyy/57/Mp
TLSH
T1F142C719AD28AD3B4CD7D21DFB59BF53E2F9613260911E48A6FD8B1C10E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 558169d0e915e7de8b6f6f5a03d4661839658c552c757a59084c9926fc43af03
MD5 b64c97287f1896ee0afe8fecc54b3f9a
SHA1 2e50e859c230c11d0e4635edc35ec3142c6b52dc
SHA512 b916d5d5a4d38e1e04f5f2b5953bd601eb80cd575c253dd93c7392461dd73c69e384cf1817e4b32db7144973fefebef4a9b4e6c90a4ead21f32fb8971535e54d
SSDEEP 192:sxRkRfCd/fasOGWZZDzoA8pUr/g6+WNQA//YtXAGAIgDfJJ:sxRkAd/fasBgZyy/57/b/
TLSH
T10542C819AD28B93B4CD7D21DFB59BF53E2F9213260D11E48A6FD8B1C04E66DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3444c10246153be2a9958aa20682e23b19b50c581a3bedb644841f14d5826156
MD5 06306e51ed0b5bd39c4b85cb5b630efa
SHA1 4ce66b494ad1d4235a6f0257fd7c2a45eb5df3fd
SHA512 cb7c7375fdd4a83397a4b9ff7c994fa78f52b6d1a4885d928d19f5963c9d66c56dd3391da1d960a5ed672b64bd04361c6d1a9553f0391bad3be8b0505c970821
SSDEEP 768:dmGxKF7pLuLb1sWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OVc9IUGe/romLRMB:dmGxKTEb1sWgmMfk6u1jab9IVesr
TLSH
T127D2D97B740CCB7F4F804ADDAD197A9F6DA802CB9698CD8047FA941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4f89.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4f89.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3e7d0bc1f01624c0bfb2e7abd93086bcb1ca46d4c04abecdb5904483d62a2a24
MD5 4f6f4e475322c17bdc3110fd88a388f9
SHA1 fe517d16a62fb06dbfc3c004ade89261bb7d1719
SHA512 587bdb2e7235010e6177d5b4df93503a9412b2ce48e1712f7f940644cdae9aa0b882e746de1ec0bf6dc70897298ab40a2c772dcf3f69a1f0fc3a5de16c1e23cf
SSDEEP 768:fi3m/7KnJ6aYnxDc9bsMSJz/Fn/4ycTRS1H:fi3XwxnVQbs7JTSycTRS1H
TLSH
T105F2CFB1AC505DA38CEBA3807A9B7A477FF9159388891D44D5DEAF0D05873ED2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8690497bb17c34815a04d0e0e86538e744bf2963331fb6a6ccd5c5432a6873df
MD5 a3487dc9f30070595047d4465a8cd5e1
SHA1 0ea2ec1d6c53ffaec317a1aae3f0198ba4a6035c
SHA512 47cecbc8114e73ea1049686b26ac678a3feef4fcadb88481574f637658f05593ebe8201b0ddc749f07ffc97308497c2686e005757b04e61ce6ddc78dd493f874
SSDEEP 768:z/UxvxjgC+U3k9KnJOxDc9bsMSJz/Fnn5SHXPyK/:GZj3+U3nYVQbs7JTHSb/
TLSH
T10C03D03AEC5058A7CCF767803A8AA747AFF84953D5C52A9449DE6E0D07CB3AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5c881f6c571b09139e6983ad2885040e8c00268abcc1068891f7f7e8a16e2392
MD5 884aa35b63ac494558323bb179151ee8
SHA1 50f4ac7cf773572188b29167a59d8d5a1d7c5897
SHA512 2f5854961c8c81ed2a2361aefa3bbe9e181361ba9002f38eeab63f0814723e53cde2773cb75f4324db385d11fbbaccc983d6dc1f61f5e34a6384188bfa7a59d7
SSDEEP 768:D/UxvxjgC+j3XV7KnJ6aYlxDc9bsMSJz/Fn/4yKo:WZj3+j3swxlVQbs7JTSyKo
TLSH
T1A503BF79AC906C53CCE7A7403A9F6B97BFF4199384C91D9889DE6E0D06873ED2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d519427cfcb73cc5f718c4924dce36805329c2efab095e120311c6c125b72333
MD5 a5be57f753b132d15130fa3e010e4b26
SHA1 052c29bc068b1c5c02fca36b359b57a470dbbc7e
SHA512 916e00afb19e40080d97b60575006512636b810c1e10586a6494e60eec2f62c187185d36479a0ea621a11c350fa78cb04ee3dce1475e9ff0890b88b40ce94bd1
SSDEEP 768:PFQK3cwgcS40nJ6aYxxDc9bsMSJz/Fn/4ycTRS1H:SK30wxxVQbs7JTSycTRS1H
TLSH
T1EE1338F698D38976D8AE5783677D6E06AEFCC193B4885884B7C95D0CCC822BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d41abe2f8adcff956fef9a4cd7b4dd7e0aaea2f3564a7102ba64aa046dd54b01
MD5 0fb72334621a8ad592a85d4d695bd750
SHA1 4d01685fbdcef1ba3aea43fe9b8b3026e9038d12
SHA512 bab1c9a346b7a8c3eb8e5f3c6de456798fb4b974ebe1f7d741cd3064d6fc401570ab01aaab8f593a72008f8a9909e205742ab5c020e8f44a7427d2aa5cf04c34
SSDEEP 768:Ci33/7KnJ6aYnxDc9bsMSJz/Fn/4ycTRS1H:Ci3mwxnVQbs7JTSycTRS1H
TLSH
T1E0F2CFB1AC505DA38CEBA3807A9B7A477FF9159388891E44D5DEAF0D05873ED2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 dcd0b23987a1eecb106a814542567fa9dd089f311fbaf2b027a6284de228b675
MD5 e488c587f3125b553f1e8ad05cec607d
SHA1 b26fbdea94d1d06a9dadf6d006c99d83afead9ed
SHA512 38327ccbba4505a876645fb37470b74dad8a5fdb1eb144cb450781c595c4fdad993c7072abe5c6897aa48dc9a2db53121feb888350b5f2ef780f01078bbfedbb
SSDEEP 3072:MNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0o:1qZ4h4fIqPWQd/4KUNNFN
TLSH
T1D2D32849EB8310F1FE6701B010AAEBFF4236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 faa481286dda966c4093c40929d54b905f717f61e1f4f190c718cef50d532f5b
MD5 077ebe75b3141a72287504eadeeab638
SHA1 7ee18a29689f1b86da8d6fb321e13778887920a6
SHA512 a1c93fdd969879cf0a3bf1e86d42059cf94a57316a91425cbdece1d67535fc910185c31a83924becf14233092d33a9a5c913ef5a9775196dc3fa6ac642e280f7
SSDEEP 3072:MNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0G:1qZ4h4fIqPWQd/4KUNNF7
TLSH
T1B8D32849EB8310F1FE6701B010AAEBFF4236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 3b8e6b296ed7148926bd0fa5944834295f50a27e11ab08035e6ba6fcf33bb6aa
MD5 6e032855ae786d6c26a70c6384af97d4
SHA1 d42a5dcb00e3d2d4eaae1713556d0957488f0151
SHA512 70c030f8ff17c36ce8b5fd9c95f9e10e55cb17cfc2a635fa36223117c28e1aecc3709c1d1043755105a621217a566827a65abc1a499cf1323fdc8c10c60ef165
SSDEEP 1536:sE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:7EuSllYhhjm+kLZ
TLSH
T1617302516690F933E82E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 7a2c35b19e0d01af0c2457e691351fe3adf75be4b23e82c3ad7687bd8a75662d
MD5 9509a66fd6c28c7ee582d7835656a6e9
SHA1 de947f1f34f979aa763401c2ee2a3a8513f498e2
SHA512 63e9693f1734efb5f7a4f53eceb2bff1aa97bc5f3dbdc510deff323f55d9a1789733c070bef4b6fab564ef001a652910560663b048755ac31c46ca667f7d1811
SSDEEP 1536:sE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be5:7EuSllYhhjm+kLZ5
TLSH
T1B37302516690F933E82E9F721B76C12CDFF8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 710B
SHA256 187bae7eddcc161a10acb9c0f577015263f507e62dbe99619edf248ec5c685e4
MD5 245a94fb508bdd73f7a965db0d98d239
SHA1 03592120308f7d308bf94e8224f0d53838b6e323
SHA512 58366c0f440a493ce287a4be951c3a690d719c00543fe140cd1291185b53934046c6c7183133cf1d5dd33d6f03d1b9215985c1878122a99a57ebde06546f058a
TLSH
T10F011D1F5EE90195E5BBEB1664F250279A727EB26835ED0C12C14B8C0DB1B14F820BA7
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 1c79eae6ad34cc4057e471de92b24caa969747e34f608bfd6588349224a3f031
MD5 df7d27d8800ceb98cb1696e8d175cbf4
SHA1 51dfe76c9df906c0cb0031f942726c7082d2ff21
SHA512 083bb3886e012246f5727883648957d1255aaae5aabfc4f532fb619d31017acd29d2762a412be727d60172dfc97095ac7310451767cd3f644c0db58d59092d87
TLSH
T17881531E1EF801A5F5BBEB1694F2502BAA777EA15835F90C12C24B8C0D71B15B910F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 5989a7605fa12829311bc507d3301debeeac8a13fcc5496388139715018da30e
MD5 6f1ace90a824e71c047edfc57f3d394c
SHA1 233fdaec3ff7d2715fe2d6dc239fd0b36f4ee609
SHA512 fea3381954be7c414ca53d6ee4a618b0ddbec288a007dafda3a380911bc0fb2ed0625fa196691518e2b11e938fe3567dafbc31818f35de1c12de5c974349da99
TLSH
T1CE11522F5DE90195E6BBEB1268F250279A767E726835ED0C02C18B8C0C71B14F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 22c17f632b88ea3f4b0e61ece13f8587524bdacc296c11807c95b45b336060c3
MD5 efb8183e09f27f2808dda22faaa0bac0
SHA1 51c083e2439a16dd1f25d0dc7a9a7e457370ef9d
SHA512 b08b57647be16c4b84e280a7d2ef65364bb985c18704447b9af18d087e8e4f7db02d065c938935889685255f3788fee5541e2b8e99b473d306b87ad10a731dff
TLSH
T18621571E5EE40155F6BBEB1658F250276A72BEA26835ED0C02C14B8C0C71B14B820F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 f977c1277c05fe5356a4abf9594cc8504ec7d0865dd171f9f2650820e61662af
MD5 903d49b114a707af90215ad6528f23d4
SHA1 f0346fb7f80c850391efa0c47e56dd1d5d7ba77d
SHA512 7bce4c1462439e27ee88685aa10fc3fd72733ade1c3eaf7afc52e114a97c3773e3ada5212fcf152c0835dddfee67280802d42548604f7c4cf4bade163d589991
TLSH
T1F2219B1F5EE80195F5BBEB1698F25027AE76BEA26835ED4C02C14B8C0D71B04B820F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 8ed02d667d6f8af5a6159681debee5445eb5d3db1919fb23434db6f55e97044f
MD5 a446c5e230c081748a0a1e12a0b648f9
SHA1 9c55bc085c9e3ed49d4e90db2a7187899c9adf0f
SHA512 85d98493473faad9b178a08cf45ecbe5b3821b835b3be80b8870c082b797c0726f8f2ede14b781b8782ec6f8344cdbd067504bf7c8b45a0f0641332f3a18ae1b
TLSH
T18E41481F4EE50595F5BBEB1794F25027AE72BEA15835ED4C02C14B8C0D71B15B820F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 62c575f45669387c8f9dafeb61b59233f3c4851e4ede1e42a1daf05a6a184c1d
MD5 0937df847deea64aa13826ed4bba686e
SHA1 335d18cff8747b1d58fb8c8e153f14f97c5bc9e9
SHA512 8375320fda81498f91add52045183f460ec9361dacef2de3c28913088089dc7a03c047460912869a4f0b0a93b8dca6ab4b5d76d91039d93b02786fe3ca77d9cf
TLSH
T1DF41381F4EE50695F5BBEB1794F25027AE727EA15835ED4C02C14B8C0D71B15B820F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 94b6a69b7302389a1dac2bc74a7392ec1cbe37392fb29e31ed5acebb6d45745a
MD5 d8a380037182a464188553ce63754eb2
SHA1 58d0f38db7d8426b43c0e6bfdb3f8add26b9fa49
SHA512 fb55816c689e725d2f08a533f9b037e3695299552a7e0c7f8a90e480a5518b3f51ceb8a080ad03e415420ea097d05ec0753f224b263c5ed0ed4fb408c631c0c7
TLSH
T127F0821F5DF50155E5B7EF1268F250265A73BE622835E90D02C18B8C0C71B04F920B67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 47b7b4ac818f9805c6d358d57010377e292c6fd3312d2a9f0cc5344e24ebaff8
MD5 688a1085449b4bce4dc000d032e29cb1
SHA1 c0a6d5a14f9ffd8767f63d74967820f8eea533d6
SHA512 c27fbbc927e5b4150742e872df5e25655531ac4094ff5f8e64a775568a824fcc5778ff4a91b254c480f914f8a11c27781b95bd3cb4b1227138daf9b8e5bf2b02
TLSH
T17651751E1EF802A5F5BBEB1794F250279A777EA16835E94C02C24B8C0D71B15B910F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 33da6940f1c7339024499ba507ada9268a375115800abcecbc0d4913e306287d
MD5 b04d226cb7c20b634aac822e4c366eef
SHA1 bc3ec7d0ac770f013723f0c172b92286476550b7
SHA512 0a2205aeb029ec1d2b7c71a30635ee278cd873c45759d3a2c8a10caa62d9eaf70ba96eda66f1165e5975d07b88b825011b491b347e69ff03e42229138bf8ac95
TLSH
T13D61531E1EF802A5E5BBEB1694F250279A777EA26835FD0C02C24B8C0D71B15B810F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 1c2fc4ee560228bcffb3f6cc81395d06f1ea0121c5e2a477857a0ae65bd8d97d
MD5 5aaf1d0fb0d4e8191ee7306b43939b46
SHA1 d67538441d9e801cece4f1addcb7d3a20bd9ab17
SHA512 e55d9c1188bbf675b5e4870517e985f1a6c3d70f29c5ed306752d7bedfc7564cf50269e3e604e87b78a64f8ae9e43811920c0900b8da0a3fb52c2cb28d9a4913
TLSH
T16C71551E1EF802A5F5BBEB1694F250279A777EA26835FD0C02C24B8C0D71B15B910F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 b8d78f6405e9be82f1c5ca1ef4365ccd28f4a966ccb601573483bc1e5c8c389e
MD5 cf0bf8c763a69edd1355fa9bebce23c6
SHA1 a10f0a0d60d5ab76719ce257ee5845fc54c8bfaa
SHA512 f700af53721e7e5ec802798e2f90f671534b0d943ff5a9cc2fa16b4689cae14654b5df7e16c23bfcc1d56c35b746b17e4cdba89452c36abccb8875b49a43bbe4
TLSH
T16C71541E1EF801A5F5BBEB1694F250279A777EA26835FD0C02C24B8C0D71B15B920F6B
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

eup_rotate_4900.exe

Path C:\Users\Admin\AppData\Local\Temp\eup_rotate_4900.exe
Size 135KB
SHA256 9ceab18c8f79fef6f7987abcdc1e06183882f61459a1488d99a541c13fc0f8ae
MD5 cf7de1feb92e11d9c5a45c78c2eb5a57
SHA1 70b3d55533e3c87d77317450a757d6650bad30ff
SHA512 74f76eb098aabd62a53d2c4f9d7df8f1c0e24c7acd4a3028d4fb23ae2b0c9037cad9429333f1a53af802a769fb46fc72fcc52bef27a5df97d409b0343a04578c
SSDEEP 3072:MNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0E:1qZ4h4fIqPWQd/4KUNNFN
TLSH
T17FD32849EB8310F1FE6701B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2984_2144474135\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4132-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4132-0-0x0000000000424000-0x0000000000425000-memory.dmp

Download

memory/4464-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4488-66-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4488-74-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4784-45-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4900-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4900-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4988-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4988-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5124-87-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5640-82-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/6128-262-0x0000000000400000-0x0000000000442000-memory.dmp

Download