038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414.exe
Size 59KB
Sample260925-xbhdlsvs9p
SHA256 038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414
MD5 c222bd70da9edf6546f79b3d481191d6
SHA1 7ce2cd87626954c52ac28943ce9e31e6206add57
SHA512 0338991e5e3e3587885d5400a245c6dd51c9f93f05ebbfc8d88a62134cf7583d3913dca7d28d5f434d85c4cf5465808045c6a4e28cb464c435b948643199aaa9
SSDEEP 1536:jJsXcv+bxpkmitg1IxdsHfRhx83US4HRiv:jL+bxmc+kHfrx83SAv
TLSH
T1B153F1A9A4948F3EE8D7FAB29FB542709C3539FA4F5A42190F0D743E9779A800A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
29	5952	Eupdate Helper.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
6068	Eupdate Helper.exe
6132	eup_rotate_6068.exe
5716	Eupdate Helper.exe
2312	Eupdate Helper.exe
3356	eup_rotate_5716.exe
5952	Eupdate Helper.exe
6036	Eupdate Helper.exe
536	eup_rotate_6036.exe
1972	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1196-0-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/files/0x0005000000023432-4.dat	upx
behavioral1/memory/6068-8-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/1196-7-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/6068-16-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/5716-26-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/6132-25-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/files/0x0005000000023432-23.dat	upx
behavioral1/memory/2312-30-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/2312-35-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/5716-49-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/files/0x0005000000023432-55.dat	upx
behavioral1/memory/3356-57-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/files/0x00070000000245cd-74.dat	upx
behavioral1/memory/6036-78-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/6036-91-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/5952-88-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/536-89-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/files/0x00070000000245cd-97.dat	upx
behavioral1/memory/536-100-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1972-98-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/5952-106-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/1972-262-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_868365760\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_868365760\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_1860579199\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_1860579199\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_1982362963\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_1982362963\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_868365760\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1264_868365760\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_6068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_6036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{A93A6E0A-DF6D-414C-BBE9-500F88FA77D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 6068	1196	038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414.exe	85
PID 6068 wrote to memory of 6132	6068	Eupdate Helper.exe	86
PID 6132 wrote to memory of 5716	6132	eup_rotate_6068.exe	87
PID 5716 wrote to memory of 3356	5716	Eupdate Helper.exe	93
PID 3356 wrote to memory of 5952	3356	eup_rotate_5716.exe	94
PID 5952 wrote to memory of 6036	5952	Eupdate Helper.exe	104
PID 6036 wrote to memory of 536	6036	Eupdate Helper.exe	105
PID 536 wrote to memory of 1972	536	eup_rotate_6036.exe	106
PID 5952 wrote to memory of 1264	5952	Eupdate Helper.exe	108
PID 1264 wrote to memory of 5996	1264	msedge.exe	109
PID 1264 wrote to memory of 2860	1264	msedge.exe	110
PID 1264 wrote to memory of 2744	1264	msedge.exe	111
PID 1264 wrote to memory of 2744	1264	msedge.exe	111
PID 1264 wrote to memory of 2744	1264	msedge.exe	111
PID 1264 wrote to memory of 1520	1264	msedge.exe	112
PID 1264 wrote to memory of 1520	1264	msedge.exe	112
PID 1264 wrote to memory of 672	1264	msedge.exe	113
PID 1264 wrote to memory of 672	1264	msedge.exe	113
PID 1264 wrote to memory of 672	1264	msedge.exe	113
PID 1264 wrote to memory of 396	1264	msedge.exe	114
PID 1264 wrote to memory of 396	1264	msedge.exe	114
PID 1264 wrote to memory of 396	1264	msedge.exe	114
PID 1264 wrote to memory of 4780	1264	msedge.exe	118
PID 1264 wrote to memory of 2564	1264	msedge.exe	119
PID 1264 wrote to memory of 4780	1264	msedge.exe	118
PID 1264 wrote to memory of 2564	1264	msedge.exe	119
PID 1264 wrote to memory of 5664	1264	msedge.exe	121
PID 1264 wrote to memory of 3576	1264	msedge.exe	134
PID 1264 wrote to memory of 4844	1264	msedge.exe	135
PID 1264 wrote to memory of 2136	1264	msedge.exe	136
PID 1264 wrote to memory of 1280	1264	msedge.exe	137
PID 1264 wrote to memory of 1280	1264	msedge.exe	137
PID 1264 wrote to memory of 3064	1264	msedge.exe	142
PID 1264 wrote to memory of 3064	1264	msedge.exe	142
PID 1264 wrote to memory of 2252	1264	msedge.exe	144
PID 1264 wrote to memory of 2252	1264	msedge.exe	144
PID 1264 wrote to memory of 3312	1264	msedge.exe	145
PID 1264 wrote to memory of 4936	1264	msedge.exe	146
PID 1264 wrote to memory of 4936	1264	msedge.exe	146

C:\Users\Admin\AppData\Local\Temp\038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414.exe
"C:\Users\Admin\AppData\Local\Temp\038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_6068.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_6068.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 6068
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_5716.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5716.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5716
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_6036.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_6036.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 6036
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffb641fc188,0x7ffb641fc194,0x7ffb641fc1a0
        8⤵
        
        PID:5996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,2221363635701721465,16922019180354212419,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:2860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,5292407593197339195,3444174353826939440,262144 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
        8⤵
        
        PID:2744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,1316760030770804143,10698640771330439511,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
        8⤵
        
        PID:1520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,262749065346361163,3681376739554516076,2097152 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        8⤵
        
        PID:672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,12067921308885810008,5397188106383118212,2097152 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        8⤵
        
        PID:396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,17631440543045915415,3448116041124718944,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
        8⤵
        
        PID:4780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,8599705132485270210,1094865748920953030,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
        8⤵
        
        PID:2564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,1943687934965574426,716068960509002975,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
        8⤵
        
        PID:2984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,1943687934965574426,716068960509002975,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
        8⤵
        
        PID:5664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,1724707381603347627,1924504625559602624,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
        8⤵
        
        PID:3576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,7905036160024781240,14213151784496921043,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
        8⤵
        
        PID:4844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1630402045382769095,14827572920793182170,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
        8⤵
        
        PID:2136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,14797396554908310946,5159212507243965545,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
        8⤵
        
        PID:1280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,8268067106640574651,9615017413830305694,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
        8⤵
        
        PID:3064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,16065333256021989016,1235452723854514864,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
        8⤵
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,13760805251934600599,10358935887439922118,262144 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,7106406587829355507,4779406116377746869,524288 --field-trial-handle=2308,i,5933829630627107759,2184693891034977839,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
        8⤵
        
        PID:4936

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1264_1860579199\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1264_1982362963\manifest.json
Size 118B
SHA256 c6eebd0273c922a59053afc3c0826749a7afbd59e7c743670b933d1850f07685
MD5 4141fdb2fc82caa132e685ffd8ba20a8
SHA1 7fe9e456ce19e842359c55d9eb42f4472f65c006
SHA512 d9637e504de6bf3c1c157a4a4235599c23de37c92aec7f2ff09942e07ed35aef94b62e2b05f378db3f52944fe029449200fd63a7fa2135559046f6444990ea43
TLSH
T128B092B00C1AA03B22849720ECA06A8683F80219E8065B1A089036481F8827881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1264_868365760\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1264_868365760\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ca29362ce13b8aa79bf3931be1ca547cadfb9327851de828ee02b51aa12351aa
MD5 e0802885ea6254c84ee2678846ccf51d
SHA1 07281db4ce85fbcdaa8da59af410abeb8e524f81
SHA512 fbe55efb87811f2c59e755a78fb8d2d0cf0888ae9d0f205a6d4689bcbc2e595d4a9a15640d5bc5a728a3d41b9bc0d504ed029cb29c21ecf58210ecaa863a8461
TLSH
T184F02DF9CC25BC3B08FD5B2920541746F75113672B81988B3B3D911D8FF163B854685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4a6c3cc4d5a040f7cfff82a57e2e2e7c277ab285647b1eddd6f0e0cd1284b129
MD5 45e139ac5d68908b5925e2f0fdf8a724
SHA1 dfa536e1f570a378137d8a56fd2a790895d0304e
SHA512 5358f23f7fa2595a2c05311d97e62d4f0c884ccbf6a7c98405f5d34d8b2fddfa259a57a39b6313a424c4debc1113af91f2bc75a49cce9bb9e43b153177980c9b
TLSH
T13B41F2F7C3E8866EC90196F0AB18AE2BDE1D0954432C7D5AC8E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 96ed8ffb6fdbca2710f4c452e25d5024957bced83179ad8cbc84d21f22c55072
MD5 9d86104c4370014946c9fb411fcaa51e
SHA1 79aad8d4274cc37e270a56e835f0594927db2972
SHA512 065fadfbb1a89c343feda11a73172e13d53305c0cb0fa80a5297badcc2dc97d8267ce88bc0e69934c656c082f15bd395104ed26bc7318f2bbccc27bea0a8d45b
SSDEEP 192:sxZeaRCig/fQs6QZZNINvrzodphXHW6+WNScl/YbIqpYDDIg5jZ8J:sxZeadg/fQs6OZNYwhHbH/FWYf7g
TLSH
T1A442C819AD38A97B8CCBD619BB55BF52D3F95033A0C41E44A6FC8B1C05EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 894330d6a0d967480cbe7c42a6b30a588f8a41533d6ad372906fb29cdc0e74c5
MD5 820ae714ca1734e2009c80a354bfd1b6
SHA1 54fd830d32bf2979505f43fad661c96c88d359b0
SHA512 24e16d881552b7963f78e903657b917146eccfe67712e93d063088d8cc51e51907e064c5037a4bf68eced7308488602d762daddd7e6839cededa7f732ebe2347
SSDEEP 192:sxZeaRCig/fQslQZZNINvrzodphXHW6+WNScl/YbIqppYDDIg5jrJrJ:sxZeadg/fQslOZNYwhHbH/FqPYff9
TLSH
T1B542C81DAD38A97B9CCBD219AB55BF52E3F9503390841E44AAFC8B1C05EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8db9d270afa90198eb917e9a0d563a88d57fd78f70c407671dccc5cde002281b
MD5 c48a1aaf8d54eaa5dc2ee9b89239dc09
SHA1 0f5bc320464b085ca1393333c59016253c8fc400
SHA512 2e6d0f385f35adecfb3cf6b8952705798a35ff8f5555ddf001a16c303ccd5bb3b9822648c802ff341060beaab2245edc7912f319890690d32e8c8c6a9b0ff790
SSDEEP 192:sxZeaRCig/fQslQZZNINvrzodphXHW6+WNScl/YbIqpYDDIgj8J:sxZeadg/fQslOZNYwhHbH/FWYfjg
TLSH
T19742D819AD28A93B8CCBD619BB55BF52E3F95033A0845E44A6FC8B1C05EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ffddbf02fee70db64a6d25bb3ff9375a140da39c8e294e0efdc7654f0a9c9f17
MD5 88803dd7eb0ac5c313cd9d196c50141c
SHA1 1b0751a4ef92dca5e8b95ca85f075e38fcce26ea
SHA512 ea082317dee881e5cefdb15e1ae4d1dfa6bf35f11fa380eedb4399c7adbeba93755eb75b51a622c36868850bb3a8f0694be9bd27fa4df8f58bc21711e2843fa0
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7wLWLlMC7fnroE:0RyktjYEbvnWvDBltu1ja2wLWLywf0Lg
TLSH
T182E2EA3F780CCB7E4FC04E9DDD6A7F8B6DA802CB9598894047FA945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 21a3761763621f096bca316d7b55a72ef8ae3e8501a171aa9a305a8a7a6d225d
MD5 196fae88ed05c2deb961af8810a25a01
SHA1 5df763725faa80f037fde1fb221bf727ff7915bd
SHA512 78325db4e3b0702bdfd12c34d8c1a18b50428e187cc96b7dc606b3b28f99a0e7aee61397a904cb2bec965a19df467c2c89dfc0d2fe8b8f069efd066e5e64acdb
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXil7W:OtfFvpopPxrB4RhfixW
TLSH
T167B2241571BB021138FE690C81B5971E464232B33259EB2B7FBD14A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 5c2cdf5a7e634bd9b63d99a4ac0f541321b189bdb61c07a0248a092489c22366
MD5 ae402e0f7810a8ac557562e089197c67
SHA1 71a26b1adf854c329abf435147f20f164d56ee31
SHA512 aee117a771d9bd9794fec818a665c67de7c599dcb36b040748acf60e059c0d346414f48ead028cd080208521e6b25a8000b008bcb5c82a28725faf5d17d8ee06
SSDEEP 384:nUyiFiZcIE43sNi8TUNTUlI4F5mgfiM4zf8BeX1vDzIoJo7VtgOIwZOyhpRgL/7P:U5FQ53Lwg9xSBeX1bzIo6VXsagZ
TLSH
T1E2E2B3F594D78977E8AE8787A37E6E429ABCC053B5885984B7D44D1CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ad93c2b1e675e0910dd8fc21d828920f2bfaa9ffaf12f454b14a3135c2640682
MD5 b73fc1147a03bc2ffc43219ec7bf0d67
SHA1 7ff531c8930fadf419c5a01ed498723e06ae33a5
SHA512 a0edca992e1ce3922153737804efb9af5ba9b33a057c7e9aabfce326f4d764901478bc5e0f5c1e88f68004da2a890c747d6a666e4e4630f8ae2f419875258db5
SSDEEP 384:npiFiZcI63sNY8TUNTUlIm25mg57n4zf8BeX1vDzIofpE7O6R2FeobgL/7IzpoZ:AFQ63FwgSQJBeX1bzIofu7TRkm
TLSH
T18AC24A76EC98DABBECFB8F99A74A7A07DEF00163859C59C0DAD85E1D008759D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cee70e4461c356eb33cb74ca3e2295efe8f5f6edc40f899f2c1ce03e3bc5bbca
MD5 5a3246abab26f1536d283aa5ae55ed73
SHA1 68a7415519253428ec1e7ff321d9d85b70469d82
SHA512 f47a77fcb2dfe9ed5cdfd12682bf8663128869f7663e5659b693ac95defd5149d1e9f7d6c76f299f23ee4fbbfe32e1a8642fdff8f9e9880c40296c44d4e2fd3f
SSDEEP 384:nUXiFiZcI63sNi8TUNTUlI4F5mgfuM4zf8BeX1vDzIoJoDVhTfgL/7IzKof:USFQ63Lwg99SBeX1bzIowVhTqk
TLSH
T128C24B75E8A8CDBBECEB8B95B74A7A43DEF00163898C9AD4D5D84D1D00872DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e9553a7dd7a1e9bd628f764022c38a43d328ce82d35621081e32545e7afe2c47
MD5 6e0055049d35bdf253c8d60d0626270b
SHA1 1499ec2686be711f99295fdfcde4d1b6a36fcd15
SHA512 643c841a95cf023461fd2c185bf6512d028902d3d2fc431503e4bcf20a5c43af1ad1734ba5df296770d456669ed6757796cf164c32b66d32c9764ba2f3f8471a
SSDEEP 384:nUXiFiZcI63sNi8TUNTUlI4F5mgfuM4zf8BeX1vDzIoJolVtgOIwZOyhpRgL/7IA:USFQ63Lwg99SBeX1bzIoQVXsagZ
TLSH
T141C26C76E8A8CEBBECEB8B95F74A7643DEF0016389889AC4E5D84D5D00871DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.25.1\typosquatting_list.pb
Size 1.4MB
SHA256 ede1a934bf940f7a151989b0a8e57ced78979f95c4e629355f8ba4d44574612b
MD5 f03aa35cacb3c16a74e5757c5af1dee9
SHA1 42734d91ac5e64d2ba3b0eaf653e4f9ff7bc7961
SHA512 038e985fb24a46e7629fc788a0bc8ee2aefdb692dc9ce2932516d9233a90793ea1a3c018fb1fc687be4e377ba1521cfc4ccb339439bdfe631c3f0c659483d5cb
SSDEEP 12288:3JH1o/AtTKm9uuIE8jHZhnuniHSYKhDJcZz:wgKm938j5hnVSC
TLSH
T13565B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C859F2BC6AC977E45E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 96e9becb84067c67a6e2ba424a6c0d985d1ca1bc899b02b81236f454f286ca8e
MD5 133eca54e24e0711651de6045568e3a5
SHA1 8325f2bc6dbb92ce76a490f51006b1911d5c26cb
SHA512 6acf758b9ffb669ff4c8580b08565617d9d53acfa259282d157e4989af0a20c62632ef93e212c590ce9364a3484f205187c811ad6d5b9282b977b24b9b8d77f3
TLSH
T1354123E0483D1ED1C4BD0DBEB48B35EC94EC9722B8A4343D289CEDA89A7E51D210083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 537de7cbcab10f3731aa5ac413709ce83c96c8203398184ea753cdc205bd9371
MD5 4b41b6d04d45cf65d26104097648b30a
SHA1 e50ff84be36564700fc7627bbd8e59f113cf1f29
SHA512 f8c816f6c617dbd360fdd03e7c149b1b1d6177c963e1f62567c9c5d4b8343204984f17acd9e55b4347dc6eac7dde6b825140e0bd8348cad9bbc2367c9e01190d
TLSH
T1C34111E05C381AD1D0BD0DBEB09739EC94E89722B4A434792C9CEDA8967A60D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d4fdc52c5031cf870b9a0b57ee1143f48b7b2ab633f81ddbb7011a591a10803a
MD5 6db34e5b5412a7b0a18a8a898879a745
SHA1 3c2721a218694ac1ed83674b5001eadbfb8c436e
SHA512 c6fd57b38bedf9ed24376f2c3b7ced24e60f9f6ccfe0054acf5ffd869d884335cb32549d450fa396e5222a1e21b98d645df7324b7f4f6cd611915a0a4b10f622
TLSH
T1484125E0583C1AD1D4BD0DBEB08735EC94E8D322B4E4347D685CED98967A61D200083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bef0f7f7b5514c4a620685361757ad4cf520a84d0bf334efb7ebe56a5b08c422
MD5 25ab399432ab53c40706dfcbdd81ecac
SHA1 9e278b68645aa5115ff26d99b59206672aa63032
SHA512 49766bb138d09f88abc83889c13cf54545d50342e8b3f63f786b14c5e246d77ac665fff00f40216d940e1d233ea1d88b9502755d4c9dfa977a2be4859d7af86b
TLSH
T1CA41396CB6E91148B3B36F5AAFF6686D487BBD372E0A949E00110D4F4663B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 6f296da719f0b3076a5eeb0b47a31f6073eab10eae7b177c2515378fbbc1fe58
MD5 15ed0041976d223ab1d5c2aa35a57591
SHA1 bfa24005c1a3bca4918239e6bd00e6b870ff00db
SHA512 8224c63e9e06cf90d41b97482a0b04ce8c3f5e15aab547d8a39bfa2a9973979be6e6651e95b31d05c45db9efc7ad8346f939af76a6347bc44e0666a2c9b512a6
SSDEEP 1536:jJsXcv+bxpkmitg1IxdsHfRhx83US4HRiR:jL+bxmc+kHfrx83SAR
TLSH
T11F53F1A5A4948F3EE8D7FAB29FB542749C3539FA4F5A42150F0D743E9779AC00A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 038204f50d754f88fa19f49434f7d1cf6625f243eb9aa61894285021ae112414
MD5 c222bd70da9edf6546f79b3d481191d6
SHA1 7ce2cd87626954c52ac28943ce9e31e6206add57
SHA512 0338991e5e3e3587885d5400a245c6dd51c9f93f05ebbfc8d88a62134cf7583d3913dca7d28d5f434d85c4cf5465808045c6a4e28cb464c435b948643199aaa9
SSDEEP 1536:jJsXcv+bxpkmitg1IxdsHfRhx83US4HRiv:jL+bxmc+kHfrx83SAv
TLSH
T1B153F1A9A4948F3EE8D7FAB29FB542709C3539FA4F5A42190F0D743E9779A800A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 ff0bb91456f75067ba2522d7f3802e6aff873411234bdc7b9fd1483927d1dbd2
MD5 ff15c595b7fc8b29e5b11b82b3143c16
SHA1 dd3e427668cde3d41464a6e79e08f3d878b58b84
SHA512 9ac8360e9d81414c3883440046300b2939593891ac06ea4c6cbf45f5419ce5b302876d9f7973b34d633575c0901f83c93199b8e445892708085c26ce81f397f1
SSDEEP 1536:jJsXcv+bxpkmitg1IxdsHfRhx83US4HRia:jL+bxmc+kHfrx83SAa
TLSH
T18253F1A5A4A48F3EE8D7FAB29FB542749C3539FA4F5A42150F0D743E9779AC00A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 7bce6f3b1d057dd73b149a4af438c8e3087290e7e41ca932469a85cc70f2d6ab
MD5 5b8fabe1b34e74a55fb085ff0b7fa16c
SHA1 1142ab14c21cb3b77b18ac8d61032e43f4dbe980
SHA512 afafe36fcc0a912764fb4de54422892214e7dd3012628d2ec0937d06fbddca5bd11ad999ce020c63d8a749797ef89caccd0923bdbcdce4f7c535056ec2da4e3b
SSDEEP 1536:dE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:wEuSllYhhjm+kLZ
TLSH
T1A27302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 432721a3988bc876f4dfe031e97d8651ec50e04c08adb1f9c070e9835dce3bfa
MD5 5ef590841972a2645ea0bf788c07c020
SHA1 e56e3334f46de3a0834a2c6148f57fd912ec7ef1
SHA512 48d6d6c97c1bbd126840b3f76ffcbf7cc0ad79d8d74c18e05d1c2bfd7b9f5817d2a434661f14b9d97639686e8b1351a9b26679bc95f0a98778871ec60e1e8c2e
SSDEEP 1536:dE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Bef:wEuSllYhhjm+kLZf
TLSH
T1097302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 8d281765e0cde4f646895453a94d28951ec35bed0112334cb19c23e6b7d66704
MD5 a3e43a8ee71e5715fc3501a7bba1e76f
SHA1 5ffcf50aff6f67d0fe7868c0191158bea8a336bc
SHA512 a6820f6eb65c704d2f7e6420770938e83cc6894c73f119c22ba0246d21495e81a9a5d6ea989bd86a4fb28618a6d9c8f1e698aaa2a26d9c62fad2a35c4d474ce3
TLSH
T1B1717F2E1EF81267A6BBEB4758F34417AB767FA16835D90C12C1478D0872705F920FAB
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 13ce25c560735b904cf627a03a92b83d106e05b28699cc8358e1581b3835d286
MD5 bfb5034ba51fa77740b3ec4c87029c6f
SHA1 05d7cb8fbbd72d530778f6a8421b54f390a152de
SHA512 cb8aedceef7c7d27fe9a8137fe9bc831c7d6ef04f36c25e4ce1e1c05b1771f11c75f7492159147c5bea33d459d9bfcaefc684e0db3cd85c3bc14bedec735889b
TLSH
T1B5818F2E1EF81267A6BBEB4758F34417AB767FA16835D90C12C1478D0872705F920F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 663c2fd1b6e30f182600825e6cee7047ce62469e50f654dee3d783fd2d24eee7
MD5 cd241558bc5e7a1614ab2fdbe1ba6198
SHA1 0473d246920010a8ce58738fc3f2048166e441b6
SHA512 aa82bad0063d64b0d34ed0c448ff2b168324bab4fa46163147ce1cfc2d370d4c8d864185e8254b92078bfaac7c2d998074d66b8b712ef9463ab403ccdf8f98f3
TLSH
T1BAF0121A5DF51167D6B7EF432CF344125B76BF612935D40D0280878D0872704E920B67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 7067d5f1dc8e99a74e87c6b2c35b41b6cc40a5e12d9b9b0eb959799419294841
MD5 59da1899406a56639375598fa344f12c
SHA1 00d2b2992344560287152df997db764e1adb40e7
SHA512 1a0e307cfba60f8e698c45e3736328a090b49434531e33b48f605fa4378f1f3559c2fee170010a3a806479cb07beab71c07f376fbd93e593968dd733d7a38535
TLSH
T1BD81911E1EF812A7A6BAEB4758F34417AB367FA16835D90C12C1478D0872705F910F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 710B
SHA256 312032ddba328e7b7ecb91d60590798f60b041b9ca89cddc3face00f9209f458
MD5 e31697f380c39091eb8777d920a0bef0
SHA1 412fedf5650349006331c09e9d82852b2bb5c394
SHA512 02cc3afb1f9cf5a838a3cd2732fa4d1a8aa084f9df5db18b9487a7bec67444f105d8d56762e35717c06eb776310c0b6553a36f5a66e903de69678c9f16ae5f7f
TLSH
T11C016D1A5EF91167D6B7EA432CF344139B727FB16935D41C02C0478D0CB2704E920BA7
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 f69c381c2d633c414a132ca15e9e3ac462c14bbcd79caa8450202af753572955
MD5 d035e4c8af2e6698f6fa44bdd385016a
SHA1 aab066bff0aa84e92e92e69114393f310c0abe90
SHA512 21d9e1669605b4c5054e7b74a2a60c4b4d23971c04dbacb4817acb74c982b26c29079dd81551c025200346f6337cf4efba616134fca5744a8b3464fd7c892b88
TLSH
T144113C2A5EF91167D7BBEA432CF384139B767FB16935D40C02C08B8D0C72704EA21B66
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 888439806d2836c2ddd33d905a2861ceab3e23a51ff1bc7ac47e96c0f1f9aa9c
MD5 eb26c0f83a1dc75ec3cfd1aa430898b4
SHA1 a148eb3a82ef71afb5e385c535dcd8956cce7927
SHA512 40385440496a317703b1fcd85aa03e4f040bd2158899d374b9d59ecbb36f9aa04c9a5a50cd1bc6afacd00e865f68e937d5bb52b2abce3e6b6bb9ce4ab4072355
TLSH
T1D621212A5EF91167E6BBEB476CF34416AB76BEA16936D80C02C0478D0C72704E921F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 90a8e5024baa4083d405070e1779b54c02ec765edffce41d15f483d7b28e46d3
MD5 9c2660e72b7ab6ea910dff75751cb83c
SHA1 2005574624ba3a4c93c05f40c03b0d950f9beeaf
SHA512 ac1af180147695bca1173d12944f54d8910ffd148769e5cc736ce7b97c54c4a1db5e4c9249c643d2b77739502fd52ac959e4c105b365dc5ad9be5866f3cf77eb
TLSH
T1D3412E1E4EF91667A6B7EB475CF34417AB72BEA16835D80C12C0478D0872705F960FAB
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 ee7b9a2e3c2d1b91f1dd0c102d89261d4eea7862d8684eb2c0d8b33f445d948e
MD5 5041f91ce34168f3ea2b588308beb283
SHA1 f0b859359b54b9615f7142dbffc309e14ff60cc0
SHA512 efe64354b639fcbaf52ce720e6d1e84ec8484c63104a070b45d74cc06af5713b20dd6236e4fa62ae6fb0d2442ee40a89c21d2da38efa29857275d9f517964108
TLSH
T15D41501E0EF91667E6B6EB475CF34417AB72BEA16835D80C12C1478D0872705F920FAB
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 6836f73e0751d8154fbbaa56cb2e064a4993ac85b4db6c1c4f0c0635bef2e6d8
MD5 85dae48a9aecb17f53873be7cbb5c2b5
SHA1 c5d8e948142e148cc69ef8df3d08edffb0b4e42a
SHA512 a8c1a490b8776364ce99201188028ac8cb4517485ec7815fe370d85e4860fa4578b1f2d126697aa4e8ddb455a2c44f28b9b96a80834558d18b44c89f094ed23d
TLSH
T17B518F2E1EF81267A6BBEB475CF34417AB367EA16835D90C12C1478D0872705F960F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 385b9aa80b7bf70729d35e896cada8ceeef0bcb9b55a3676e493eab8bcf421ee
MD5 fab7c826a60c650221acf72be4ff4878
SHA1 c670ff06f1273dbc9e1518324a2d652f7d8c27dc
SHA512 b257e67f5c522e0bc13250f87ccac150246a3bf1d91646a6a2d26601693bbf0b8461ac8d05d3b7bc8085c646be96c0507e272bd1864a17593e64d1a2b678faea
TLSH
T13671702E1EF81267A6BBEB4758F34417AB727FA16835D90C12C1478D0872705F920FAB
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-89-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/536-100-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1196-7-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1196-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1972-262-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1972-98-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2312-30-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2312-35-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3356-57-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5716-49-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5716-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5952-106-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5952-88-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/6036-78-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/6036-91-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/6068-16-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/6068-8-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/6132-25-0x0000000000400000-0x000000000042C000-memory.dmp

Download