32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb

Analysis

max time kernel
131s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb.exe
Size 59KB
Sample260920-3bp2cadh65
SHA256 32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb
MD5 b933af1e9cc8921f63638f0693c77f2e
SHA1 1152990ae0b4e987a4279aa00e99e5cde5d6d29b
SHA512 5d535d6afe322a8b9119e07061afc5abf3a2bab0952e753c3214fca3dc846db2955cca6f6b0f4577b750e5e9b01a302d1faac23c47c0ec3ffe4018ffbb006466
SSDEEP 1536:NJsXcv+bxpkmitg1IxdsHfRhx83US4HRiA:NL+bxmc+kHfrx83SAA
TLSH
T1CD53F1A594948F3EE8D7FAB29FB542709C3539FA4F5A42190F0D743E9769AC00A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	3004	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
5072	Eupdate Helper.exe
2928	eup_rotate_5072.exe
2228	Eupdate Helper.exe
3516	Eupdate Helper.exe
4456	eup_rotate_2228.exe
3004	Eupdate Helper.exe
2840	Eupdate Helper.exe
820	eup_rotate_2840.exe
1288	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4920-0-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x0007000000011392-2.dat	upx
behavioral2/memory/4920-4-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/5072-10-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x0007000000011392-17.dat	upx
behavioral2/memory/2928-19-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/3516-27-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/2228-38-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x0007000000011392-43.dat	upx
behavioral2/memory/4456-47-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000700000001b872-64.dat	upx
behavioral2/memory/2840-70-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/2840-78-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/820-89-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/3004-90-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000700000001b872-87.dat	upx
behavioral2/memory/3004-93-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/1288-268-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1120995496\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_457251696\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_457251696\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1277654680\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5964_1277654680\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_2228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_2840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344201578336032"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{78CBCE6C-104F-4921-9C91-6E87544955D6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5964	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5072	4920	32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb.exe	91
PID 5072 wrote to memory of 2928	5072	Eupdate Helper.exe	92
PID 2928 wrote to memory of 2228	2928	eup_rotate_5072.exe	93
PID 2228 wrote to memory of 4456	2228	Eupdate Helper.exe	96
PID 4456 wrote to memory of 3004	4456	eup_rotate_2228.exe	97
PID 3004 wrote to memory of 2840	3004	Eupdate Helper.exe	98
PID 2840 wrote to memory of 820	2840	Eupdate Helper.exe	99
PID 3004 wrote to memory of 5964	3004	Eupdate Helper.exe	100
PID 820 wrote to memory of 1288	820	eup_rotate_2840.exe	101
PID 5964 wrote to memory of 3768	5964	msedge.exe	102
PID 5964 wrote to memory of 1308	5964	msedge.exe	103
PID 5964 wrote to memory of 5616	5964	msedge.exe	105
PID 5964 wrote to memory of 1308	5964	msedge.exe	103
PID 5964 wrote to memory of 1308	5964	msedge.exe	103
PID 5964 wrote to memory of 2516	5964	msedge.exe	106
PID 5964 wrote to memory of 2516	5964	msedge.exe	106
PID 5964 wrote to memory of 5320	5964	msedge.exe	107
PID 5964 wrote to memory of 5320	5964	msedge.exe	107
PID 5964 wrote to memory of 5164	5964	msedge.exe	108
PID 5964 wrote to memory of 5320	5964	msedge.exe	107
PID 5964 wrote to memory of 5164	5964	msedge.exe	108
PID 5964 wrote to memory of 5164	5964	msedge.exe	108
PID 5964 wrote to memory of 5888	5964	msedge.exe	109
PID 5964 wrote to memory of 2216	5964	msedge.exe	110
PID 5964 wrote to memory of 5888	5964	msedge.exe	109
PID 5964 wrote to memory of 5888	5964	msedge.exe	109
PID 5964 wrote to memory of 2216	5964	msedge.exe	110
PID 5964 wrote to memory of 2216	5964	msedge.exe	110
PID 5964 wrote to memory of 3756	5964	msedge.exe	112
PID 5964 wrote to memory of 3756	5964	msedge.exe	112
PID 5964 wrote to memory of 2816	5964	msedge.exe	114
PID 5964 wrote to memory of 6016	5964	msedge.exe	115
PID 5964 wrote to memory of 2816	5964	msedge.exe	114
PID 5964 wrote to memory of 6016	5964	msedge.exe	115
PID 5964 wrote to memory of 4620	5964	msedge.exe	117
PID 5964 wrote to memory of 6064	5964	msedge.exe	118
PID 5964 wrote to memory of 6064	5964	msedge.exe	118
PID 5964 wrote to memory of 4892	5964	msedge.exe	119
PID 5964 wrote to memory of 4892	5964	msedge.exe	119
PID 5964 wrote to memory of 1528	5964	msedge.exe	123
PID 5964 wrote to memory of 3020	5964	msedge.exe	124
PID 5964 wrote to memory of 8	5964	msedge.exe	125
PID 5964 wrote to memory of 4940	5964	msedge.exe	126
PID 5964 wrote to memory of 4940	5964	msedge.exe	126
PID 5964 wrote to memory of 1572	5964	msedge.exe	130
PID 5964 wrote to memory of 1572	5964	msedge.exe	130
PID 5964 wrote to memory of 3476	5964	msedge.exe	131
PID 5964 wrote to memory of 3476	5964	msedge.exe	131
PID 5964 wrote to memory of 4588	5964	msedge.exe	132
PID 5964 wrote to memory of 4588	5964	msedge.exe	132
PID 5964 wrote to memory of 5200	5964	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb.exe
"C:\Users\Admin\AppData\Local\Temp\32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_5072.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5072.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5072
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_2228.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_2228.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 2228
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_2840.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_2840.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 2840
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a0
        8⤵
        
        PID:3768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,11610087342400308654,7589824191560611593,262144 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
        8⤵
        
        PID:1308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,10844016891869455556,16914539809867875019,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:5616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,8868165986732948854,10251367325001116670,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
        8⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,12130881449490811884,11595255552902599923,2097152 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        8⤵
        
        PID:5320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,18116444099801241049,17905957080905029802,2097152 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        8⤵
        
        PID:5164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,11800571012831782798,6929567572354754618,2097152 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
        8⤵
        
        PID:5888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,394795140941521107,1578381320925953448,2097152 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:9
        8⤵
        
        PID:2216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,5945463998086133280,3737695094971143197,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
        8⤵
        
        PID:3756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,5954646012746347546,821951612477840800,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
        8⤵
        
        PID:2816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,14003020971950097036,3782259627278677023,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
        8⤵
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,221954905774340391,4825805514481604111,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
        8⤵
        
        PID:3372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,221954905774340391,4825805514481604111,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
        8⤵
        
        PID:4620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,348294548301911196,2318599842903389068,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
        8⤵
        
        PID:6064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,11736192514383819480,5074083386678348709,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
        8⤵
        
        PID:4892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,8049660708111249830,5864149311397803776,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
        8⤵
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,7028809427312174985,16352468284949467575,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        8⤵
        
        PID:3020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,15479758068381253556,14858356495452820020,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
        8⤵
        
        PID:8
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,13248123129726076069,15379918126952290681,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
        8⤵
        
        PID:4940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,10371870254301500516,10289109289900568480,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
        8⤵
        
        PID:1572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,4475237839367102095,11524492213713250579,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
        8⤵
        
        PID:3476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,5880515124602892249,262398776330722151,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
        8⤵
        
        PID:4588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,16787240397662718606,13555620146129040110,262144 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,5958319079658528502,13689584177145192210,524288 --field-trial-handle=2416,i,3559097891840103918,17629236106502437222,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
        8⤵
        
        PID:4856

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

58def2b8-bcec-4ab4-96a0-ef8db2f1ef6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58def2b8-bcec-4ab4-96a0-ef8db2f1ef6d.tmp
Size 11KB
SHA256 b20e69239889b5ee8b5804e987154875f68e70ae41c4f739913427affcec388d
MD5 f0bacec2914ffbe3ab654190b0db84fc
SHA1 fb31ff8325fd279d4c52d066a8b7a6a2a015c7c0
SHA512 b67e664f991100a901751560dc0f63717e44f4a2bd31c79e346372e810e231e9c6dc67ca752b30821af1ee9ec64dbaf01c6ed03c33f2da429394aa2da95f0279
SSDEEP 192:sxRiRBCI/fsRsF+ZSr4sjazoA8pUF/g6+WNQY+/Y2WcL+GNgIgtJ:sxRiuI/fsRsF4S0sDU/5C/9Lo3
TLSH
T19532C819AD28A93B8CC7D61DBB59BF23D6F91132A1D05E48A6FC871C14E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f9d1213113ce30e03d26825561c1b9d51d9948d03bb16640168f0d28db1821ef
MD5 19ff3b56641d48e2e16876071935f8b3
SHA1 0088c17ebf21aaaaebf84d70927316c6c86846e6
SHA512 7f1cf11bb86bbca6788590750c44da2ee28d0cbae7f4893347be3a9f83decc6573d34631f432e16dbdc0a9dbdab84e0a0eba4e5dc1f0bbd4316d6b9f78699fad
TLSH
T16C41728496B57295FFB93A75C9C176873AF08A81E5C3AE530594CDF98F093D883C4304
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f53b71ce47e3582b0b32f914d9b381d5242f22175e8dc0aa2b68b5517e9ce9ec
MD5 765d2dab2f30f0f543378c879f8e3cd2
SHA1 06a52e06896637ed9ea2c48e49d6768332ed4338
SHA512 99c5313df4aa3a3ac26712c5b76189e38d36444d4cf165b7936da3a2b63b867466531550f8ccd6967df2c6862b341eb1b7f1c788a8c384a2b72bc3d1fa55db50
TLSH
T1EA51AFF7C3E8866E890156F0AB186E2BCE1D0915432C3D5A89E4AF1B93E24B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7bf361848719e06a79aa13c21602c549861112813f151872e26ad8f9735ad98f
MD5 d1e6bddb677d2796f9da314766a0a78e
SHA1 a3f6e195346ceece1996ac05d09a7030a332f215
SHA512 e62fd22915dc4ddf01d4c132c02f2bf5262c181fa3c1d9c785b9cc8f54017ce3e6ff3d9bc10d33f53544dbc6b9a7e57ef8052409114b2f6d8299162b35310e0b
SSDEEP 192:sxRtRBCI/fsRs4+ZSr4sjazoA8pUF/g6+WNQY+/Y2ncL+GNgIgD+J:sxRtuI/fsRs44S0sDU/5C/2Lo2
TLSH
T1F142C919AD28A93B8CC7D61DBB59BF63E6F91132A1D01E48A6FC871C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b49ff83c0dfcc44b1497582e8d0ea9ee9b445e9062b9d25e1a8fe58603a6466e
MD5 924d97b6f2b737e345ac2d6805a8a162
SHA1 18c91635fd00bf0366851d9adc0351bfc9b5bad4
SHA512 fe772e86cab7b6b03eb21a7e7ccac7de4850167ff24b2eec0b5af58554981a9f9a5b80f9bae62307ebcf56e981c3c8149e9a54a659c99132127bd8585878beaf
SSDEEP 192:sxRtRBCI/fsRsy+ZSr4sjazoA8pUF/g6+WNQY+/Y2WcL+GNgIgD4J:sxRtuI/fsRsy4S0sDU/5C/9LoY
TLSH
T10842C919AD28A93B8CCBD61DBB59BF63D6F91132A1D01E48A6FC871C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d12fbe3ff90a843b9ca50344d5922ba1315ffaef8ff2349e9f9b6e640ae05644
MD5 649eb8605e6b358bf60b3b78344f304e
SHA1 76e8c36d051591243a305010fdfbff0d05ec0c77
SHA512 bbcb56b0144c981b778ce870d5496f3c18095a4829f24da7780bbe042239022ccd8168cb5153cc72b7fa8c6f69c652d2475ccb2948e7524cb5b8b70d196caa54
SSDEEP 768:L7aa3W7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaiFdNMDroH4:L7aa32Eb6DWgptfvDu1jadiFrMwY
TLSH
T1A4D2DA7B640CCB7F4F900ADDEC197E9F6D6802CB9698CD4047FA945C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 05a1c7b101b9522113af0b625017da8fbdde01dc82ff81089438183dbe81d4ea
MD5 8d0c0919d4084ec549f99b35c62050c8
SHA1 b0bebcbd623b85685d84be7f6f1c71b3ddbb7afa
SHA512 4cdc75b410112ce6a73946254340fd3799c069fb8628eb86e5449b8638529430a01d718c5ce4ea065911e0ac3bbd88d6766711fdb4daaaa8ac9c1282118e87d9
SSDEEP 48:KsgIzKxSU/yUGBq2MYUkkYXPIXekKiBK0kOW0R3MW5yxyIfKrC0Pz:KsgQKxSOGvyKAE2SywKrCwz
TLSH
T1FA91AE5171BE064039BE29C99174CB3B524232F33418EA7A3E7D14B58E6BE156EBC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d01acb34-d402-4120-b5f7-64e566d44bfb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d01acb34-d402-4120-b5f7-64e566d44bfb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7ff07fe3cb9ed1eeb07fd91080fda1e1d94bc67273730a2c9206d327fc0dd787
MD5 243cea631c4f0bbadf44ae4dfae55921
SHA1 451ed0fcf304b6e3350ae5c18efbe279647c3301
SHA512 0537d348c6fc7cecf1bce8327b72aa7a5c5129c4bd0aeb80950e5554e68d982e189636bc3b6fd9323a6613a7229d3d2687a0f1cf1ba86c7e04b751075d35bb1c
SSDEEP 768:Bj33Agm1VXwyK3DmGA5b65Q92RQMPbhYrgWe:Bj3wKxAF65dQEYrgWe
TLSH
T12EF2BF71AC51DEB39CB992C13A8773457FB84573D4C8969499E9AF0D04C76DE030B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 100299f33d9c240365b9e633c9e5439707421b296b0416ff51e7c2aa5d4dce2a
MD5 010529b7862694a68985d8fc30e25a4a
SHA1 b95286c41417781056c325b05f6a317451b66cd8
SHA512 8f521cced10cdb0f9c417237162517aafed97e782d4a29e6aabe31d2d1924c9212756b4ed789784b7220404e21c85edd7c4c3590b87a2f03809b63a4c82e3705
SSDEEP 768:uj3iAgm1VXwyK3DmGA5b65Q92RQMPbhYrgWe:uj3BKxAF65dQEYrgWe
TLSH
T102F2BF71AC51EEB39CB992C13A8773467FB84573D4C8969499E9AF0D04C76DE030B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ab64320c23abd630e2e445f577274fb546846a34662be5472d1b9062b0aa29e3
MD5 97a82a0f13690a1250cf2fe309cf291e
SHA1 6083f276c3546d1e975aba94eb49e0c1740b0029
SHA512 edf3ab11ed82041702e07fea510dd9598808b83739effd8f0137f93f80c2697496aafb44e1074872755472d80f829504523ad69fbd829b32ae11560c82834384
SSDEEP 768:U/UxvxjgC+B38SeMgm1VXYtDmGA5b65Q92RQMPbtFj0O:BZj3+B3RW3AF65dQiFQO
TLSH
T1BC03C036EC94AE77DCF95280364BB35AAFB88463C0C852A049FD6F1D06C768C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 55a2ab1f0cc42a78884d89d8b1b3d32eddb2740e6687fb8890b8738105a36255
MD5 d9254b7ffb2bc22dc97cd2a173e969be
SHA1 4f2a6bcebc393545bd03e9d8abc28ffee5a14981
SHA512 662f1332f4ef8164a7b137deddd5e5200ee93d865a3931507950e9c6eb3aed6e93028e640c78cd0dc4a5fb4fc11706cb126f4a029e98039ba3479ced5f7e0ce1
SSDEEP 768:0FQf3Cwg6nHe1VXwyFDmGA5b65Q92RQMPbhYrgWe:Xf3sPAF65dQEYrgWe
TLSH
T1041327F598D39A77E8AE4783677E6E059EBCC163B4889590B7D45E0CCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

10b718fc-1dbe-4255-bc25-78b0aba40c64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\10b718fc-1dbe-4255-bc25-78b0aba40c64.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 10e94315d3529800e123f6e0db8e00014aea81941dbbe2416262fa1b7500f4f1
MD5 96544a89165ddd991e1525c15215d712
SHA1 64c9cb82b9e58e033ebd13c7a3966bd2dd12f85c
SHA512 14a054326bd09854d7415ad51c99ca8413b5836951478952de8b2b1260a1ab24739f7b7d14f1180d3a89c6a988c16914029ce764c236afbac0637b92751a0961
SSDEEP 1536:NJsXcv+bxpkmitg1IxdsHfRhx83US4HRiq:NL+bxmc+kHfrx83SAq
TLSH
T11753F1A994948F3EE8D7FAB29FB542709C3539FA4F5A42190F0D743E9769AC00A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 32d6543f194a531344e63ca3ec9dc60cbaaf15edaa3170a90b0834381095e9bb
MD5 b933af1e9cc8921f63638f0693c77f2e
SHA1 1152990ae0b4e987a4279aa00e99e5cde5d6d29b
SHA512 5d535d6afe322a8b9119e07061afc5abf3a2bab0952e753c3214fca3dc846db2955cca6f6b0f4577b750e5e9b01a302d1faac23c47c0ec3ffe4018ffbb006466
SSDEEP 1536:NJsXcv+bxpkmitg1IxdsHfRhx83US4HRiA:NL+bxmc+kHfrx83SAA
TLSH
T1CD53F1A594948F3EE8D7FAB29FB542709C3539FA4F5A42190F0D743E9769AC00A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 d1cd9f175db69a7034c70d8d44a7e9356166a2b7efa45e3c5d6f4d392faf10e0
MD5 37989d2bb87cf17575acc888761463df
SHA1 6e81bfb6c0520ad280b1660c63acb38ff96c10ab
SHA512 f8065c8029e2b0ec46f3149c018a445ebc0c3b23082a5b52715e3f06cf9838db5d9cd39a6232ea18a0a858d426b359d6f0f9e3b121e6728ca19493712837b1cb
SSDEEP 1536:NJsXcv+bxpkmitg1IxdsHfRhx83US4HRiA:NL+bxmc+kHfrx83SAA
TLSH
T17D53F1A994A48F3EE8D7FAB29FB542709C3539FA4F5A42190F0D743E9769AC00A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 09df42be1704137f866c67eaa3c20e419d1d94a487a92bf244912b96c477a497
MD5 f540d26542b7ad8db6bb262260d48ce9
SHA1 8b6d4a168a764cd778fc9c7b38f5188aaec72954
SHA512 729c78f8337fc37c5d920cdd7ec14bec87675c1b65dc0ec1a1cf165d92ca92946d59868483434e5d66c96d36a05148c0b8a866cb5b3676a1c86c07c8dac1168e
SSDEEP 1536:iE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:dEuSllYhhjm+kLZ
TLSH
T16B7302516690F923E92A9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 8bab993663dacec8119909cda61f0977ea5bb28c2efd86c398ba4e8bd4c94139
MD5 f900cfc92c29c598c484145679e57762
SHA1 e6a7c85fad2eec3e86edc47fb8a8915eab2a241b
SHA512 ab7857964e28741d9c38f9bd5666cc2a353a8bea044a7bd6ed8c75382f376047c00a7e0f84e9dc37d9908b67f6e41d325a38e3c8320df4665137a59f3b2b96d4
SSDEEP 1536:iE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Ber:dEuSllYhhjm+kLZr
TLSH
T10E7302516690F923E92A9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 712B
SHA256 f337c89645cd69de89de1b72e38e863790614012a2e8ae3dacf375d6a43bb415
MD5 bb7f565b8e941dcd2f28721b30ce6649
SHA1 69f677970f9540251cdcf7f20075ee6b79949c53
SHA512 ac8eb90acda6b1010bca2373c66ec7b53a2e3275dfaf4e77c229c944170b970707e5380971e010a8b2872424276890dc5c549c95df39fda532b320ebd8acd41f
TLSH
T123011D1F5EF91195E5F7EB0224F350175AB67EE56835E80E12C04B8C09B1705F820BA7
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 922B
SHA256 e7ab80ae111c313aee90c4842b54c5ba15f94e21df4781c813a888b8d7a00575
MD5 1e366c9cba5dc626b7c242301aa450be
SHA1 ca2829aa102cb6ff0fd0fa1707d4d021967e73d8
SHA512 46520a7f39129dac3e2ce9417c68efa467aba0779a3803e88032629325cdc1e67bd3bd7b766aab5a1e6ab08749bc3c91531988e113e661736ff3ec843a29a0ba
TLSH
T133111E2F5EF91195E6BBEB0268F390175AB67EE56835E80E12C08B8C0D71705F920F66
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 07379ea8eb51e01389f5395b3569346b9e2987f738f0646c0ea6aadd52a8acfd
MD5 b365fa0ef73726178510b50ba09099a3
SHA1 8988de1cacb644fc97af8a73b0cc2f1b52391b9b
SHA512 2e8eb63d52b5894990bd1e0c812967269b7759bfe2153165d9e9cc2876ead02d629f63ceb84dd8f8a79be9fd81ffff99cb1bf797e55924cc86f4ab1db7aaae0b
TLSH
T14E214F2F5EF811A5F6F7EB0268F250176AB6BEE56835E80E02C04B8C0C71705F820F66
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 34c553865c761f9f8a3c0ced1af2b773db4eb6317b5fdd3da8691c8115ef7a19
MD5 7355ed546d36b524312550b2ccba43d5
SHA1 27612e8d9bd79cf1bb4b7bb6fd768201565fd9b6
SHA512 d34dd67568facddaf556f79cef2102ea09a95276728228e02c8ca846af630cb65a2329cdb2a1a121c6a541ce8168e8d3abd6dae563547297fa487f121c36d1e4
TLSH
T1B2213E1F5EF812A5F6B7EB4268F250176EB5BEE56835E94E02C04B8C0D71705F820F66
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 a6ee88b4be3f4db777560676828d2af3e2bfa74eb93adf56111e652b9e915a2a
MD5 9d185f9d9641334e1cfc38b3a68a7bf1
SHA1 d3d19e029e50974766404fb562c5d74b4d52e27a
SHA512 b08528beafd930008635e223196e3d9324fa0947e926bdcb65e1dc2dbbbb5aa801d876f3bb1888a13f102ee175a5df375ee04c454144a8eb72aa37fa74954523
TLSH
T196410C1F5EF906A5B5B7EB0364F250176AB2BEE56839E94E12C04B8C0971705F820FA7
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 8573b6be3fab119423036f42adaa5eea16ed51c029ae3ed45e21575e2175eeb7
MD5 5ccd3a6113f3ec00633cdc7bc46e2573
SHA1 971a07ad9af6bbd098caf99c54481674ad1edaec
SHA512 cba84a1b6bf8de57b2fb28568dfe5c46c72bf77d0affe31cc4d49a1369695e44d02d26c8d2ff49d195b39857715476d8ae3d93b971fe004993d9f44913408a51
TLSH
T1C0411D1F5EF906A5B5B6EB0364F250176AB2BEE56839E84E12C04B8D0971705F820FA7
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 1acccf5c52ef2236c3868c1712dc64b0955b2d1ea3b1d23e5882714f12c2e68c
MD5 63988bece9c5ac8fbbb4fff11a5930b7
SHA1 e6a1d7be9eb64ebde630a3f424df80e9f5f0b786
SHA512 7dd962d9ceb83023c3299dd0dbcff62dc761c5cb731be28c66bf9afb3223a2b31f39808f17cd4182f901cff416a09ae69f77f4e2fa95582b879def57f8ccda48
TLSH
T180F0121F5DF51155E5F7EF4238F2501259B6BEA52835E40E02C08B8D0971705F920B63
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 d06096f495e4e07ae233eb8668697dd620bd9952fa30eae749cd1f4789115afc
MD5 66c5b6d0a03b9bcd431fd6fbfdfd6e4a
SHA1 30e75075b37f14c20c24e32cc5cb5f3309ece3ff
SHA512 a38cc0f08f4dbf71d024d7ac0f3763827c238acd9bead2d73a064ce4aa0bb8084a858096cc1591d0fa66e9eebc2be0b978aa617b6377b7eee3bb02fbfd53b74e
TLSH
T16651722F1EF802A6B5BBEB0364F350176A767EE56835E94E02C04B8C1971706F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 d576706d629909a384f1d82ab1f2c1a099f2fa929656a3c3d1995f78306b4d48
MD5 253b5fccbe3c2b5091b4ce82e544dda1
SHA1 a399657d0842576a4befe3b5381ebf268f1acd54
SHA512 355dabb8f72c163e9e2c087cddc6f0e91354b1b5ed74711198d8ddacbc4f976c2ef68a4f3c866072bcf8bfe7a4c141d1a1f0bc90898ba8cdce3211753ddbfd21
TLSH
T10271641F1EF802A6B5BAEB0364F350176A767EE56835E94E02C04B8C1971706F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 ea6cb1544b7d1a019c816d8f2e6b01268320d0fe93d903ea47405d9bcdf9112a
MD5 b15719bd0c980caa7fc22fef066102a3
SHA1 d95caff66a874560805b36142fc67acc56fdbe5b
SHA512 6164c7bc9acd6080bcbc91003c0c9aeb0ca787fb40530286d034335c8aca4684473a645fd58e2105e75aa41ceafeaac30351a88a450f13c86dc9a6a11fc696a0
TLSH
T17881532F1EF802A6B5BBEB0364F350176AB67EE56835E94E02C04B8C1971705F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_71066476\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-89-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1288-268-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2228-38-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2840-78-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2840-70-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2928-19-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3004-90-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3004-93-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3516-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4456-47-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4620-296-0x00000211EB000000-0x00000211EB3BB000-memory.dmp

Download

memory/4920-4-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5072-10-0x0000000000400000-0x000000000042C000-memory.dmp

Download