4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b.exe
Size 135KB
Sample260925-yftg4sysdt
SHA256 4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b
MD5 0b80f8bb474454e3d5f8f2891acfc129
SHA1 e538db550de036fa0a93bbe1f2738d8e5c787579
SHA512 c0e8c698fbdadbc22bd362377d026e65bdd333bcfa0fd7a0c0c6991b8d9a2d4f9f902f4c89f34211ad1a218ac799594a0d1d8e6279dde1f1a5ff92974557dca3
SSDEEP 3072:HNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0P:OqZ4h4fIqPWQd/4KUNNF2
TLSH
T138D32849EB8310F1FE6301B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	4708	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
5144	Eupdate Helper.exe
3436	eup_rotate_5144.exe
5848	Eupdate Helper.exe
2884	Eupdate Helper.exe
3860	eup_rotate_5848.exe
4708	Eupdate Helper.exe
3324	Eupdate Helper.exe
5856	eup_rotate_3324.exe
880	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c603-62.dat	upx
behavioral2/memory/3324-68-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/3324-76-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/files/0x000e00000001c603-83.dat	upx
behavioral2/memory/5856-85-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/880-266-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_347811127\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_87019463\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_87019463\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_661378306\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_637617784\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_661378306\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_637617784\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_637617784\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_637617784\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_3324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{61DB60D7-A675-4C84-B692-A2AA010AA278}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4360	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5144	4612	4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b.exe	89
PID 5144 wrote to memory of 3436	5144	Eupdate Helper.exe	90
PID 3436 wrote to memory of 5848	3436	eup_rotate_5144.exe	91
PID 5848 wrote to memory of 3860	5848	Eupdate Helper.exe	94
PID 3860 wrote to memory of 4708	3860	eup_rotate_5848.exe	95
PID 4708 wrote to memory of 3324	4708	Eupdate Helper.exe	96
PID 3324 wrote to memory of 5856	3324	Eupdate Helper.exe	97
PID 5856 wrote to memory of 880	5856	eup_rotate_3324.exe	98
PID 4708 wrote to memory of 4360	4708	Eupdate Helper.exe	99
PID 4360 wrote to memory of 3108	4360	msedge.exe	100
PID 4360 wrote to memory of 2508	4360	msedge.exe	101
PID 4360 wrote to memory of 5900	4360	msedge.exe	102
PID 4360 wrote to memory of 2508	4360	msedge.exe	101
PID 4360 wrote to memory of 2508	4360	msedge.exe	101
PID 4360 wrote to memory of 1200	4360	msedge.exe	103
PID 4360 wrote to memory of 1200	4360	msedge.exe	103
PID 4360 wrote to memory of 592	4360	msedge.exe	105
PID 4360 wrote to memory of 592	4360	msedge.exe	105
PID 4360 wrote to memory of 592	4360	msedge.exe	105
PID 4360 wrote to memory of 1648	4360	msedge.exe	106
PID 4360 wrote to memory of 1648	4360	msedge.exe	106
PID 4360 wrote to memory of 1648	4360	msedge.exe	106
PID 4360 wrote to memory of 4848	4360	msedge.exe	107
PID 4360 wrote to memory of 4848	4360	msedge.exe	107
PID 4360 wrote to memory of 4848	4360	msedge.exe	107
PID 4360 wrote to memory of 3080	4360	msedge.exe	108
PID 4360 wrote to memory of 3080	4360	msedge.exe	108
PID 4360 wrote to memory of 3080	4360	msedge.exe	108
PID 4360 wrote to memory of 4364	4360	msedge.exe	109
PID 4360 wrote to memory of 4364	4360	msedge.exe	109
PID 4360 wrote to memory of 5612	4360	msedge.exe	111
PID 4360 wrote to memory of 2984	4360	msedge.exe	112
PID 4360 wrote to memory of 5612	4360	msedge.exe	111
PID 4360 wrote to memory of 2984	4360	msedge.exe	112
PID 4360 wrote to memory of 5512	4360	msedge.exe	114
PID 4360 wrote to memory of 688	4360	msedge.exe	115
PID 4360 wrote to memory of 688	4360	msedge.exe	115
PID 4360 wrote to memory of 2476	4360	msedge.exe	118
PID 4360 wrote to memory of 2476	4360	msedge.exe	118
PID 4360 wrote to memory of 1980	4360	msedge.exe	120
PID 4360 wrote to memory of 3036	4360	msedge.exe	121
PID 4360 wrote to memory of 4816	4360	msedge.exe	122
PID 4360 wrote to memory of 6132	4360	msedge.exe	123
PID 4360 wrote to memory of 6132	4360	msedge.exe	123
PID 4360 wrote to memory of 1504	4360	msedge.exe	127
PID 4360 wrote to memory of 1504	4360	msedge.exe	127
PID 4360 wrote to memory of 3600	4360	msedge.exe	128
PID 4360 wrote to memory of 3600	4360	msedge.exe	128
PID 4360 wrote to memory of 3168	4360	msedge.exe	129
PID 4360 wrote to memory of 3168	4360	msedge.exe	129
PID 4360 wrote to memory of 3472	4360	msedge.exe	130
PID 4360 wrote to memory of 5860	4360	msedge.exe	131
PID 4360 wrote to memory of 5860	4360	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b.exe
"C:\Users\Admin\AppData\Local\Temp\4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_5144.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5144.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5144
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_5848.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5848.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5848
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_3324.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_3324.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 3324
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x370,0x7fffbe68c188,0x7fffbe68c194,0x7fffbe68c1a0
        8⤵
        
        PID:3108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1486150585982709918,12222146291265012458,262144 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        8⤵
        
        PID:2508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,4958858136138779509,11634162134024762920,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:5900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,2532717209682796132,14695679512807759954,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:13
        8⤵
        
        PID:1200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,9270695253965197826,7234036438567244940,2097152 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        8⤵
        
        PID:592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,7165710814672000016,12155721445624167004,2097152 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
        8⤵
        
        PID:1648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,15903275261454819816,6634587577605379026,2097152 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
        8⤵
        
        PID:4848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,2539179611031027534,3156559379631523355,2097152 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
        8⤵
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,14510984320493591334,13814722994826051202,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
        8⤵
        
        PID:4364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,14119157055313224891,13204221421169764756,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
        8⤵
        
        PID:5612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13353921489060005564,17129211387163817353,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
        8⤵
        
        PID:2984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,13666200325990876773,1734840064104488170,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
        8⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,13666200325990876773,1734840064104488170,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
        8⤵
        
        PID:5512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5894767972796111632,14462626877564411952,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
        8⤵
        
        PID:688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11004426241187098186,2643348678408588055,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
        8⤵
        
        PID:2476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,14174812922043034331,2501525597016331328,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
        8⤵
        
        PID:1980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,12250515891927614108,14331673323557394674,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        8⤵
        
        PID:3036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,4169562791674774612,16995852420967616269,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
        8⤵
        
        PID:4816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,5002549296065641015,8195089452693407042,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
        8⤵
        
        PID:6132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,18307014832224383313,12772468935807193416,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
        8⤵
        
        PID:1504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,1908080021630419021,9684441910366126327,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:14
        8⤵
        
        PID:3600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9341493400736356399,1655494096399648341,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
        8⤵
        
        PID:3168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6828,i,17942151389211215441,10936602924579231662,262144 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,16932627578373609869,2822378505151514406,524288 --field-trial-handle=2292,i,8215426214488106679,4362334173376320222,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:14
        8⤵
        
        PID:5860

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6d37a2b3-ee89-4879-bd30-dbd19e4baa5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d37a2b3-ee89-4879-bd30-dbd19e4baa5c.tmp
Size 38KB
SHA256 c90db2217b330daa3f8fd547a318d4750a5d9b8ef0ac2f8148f778cddc3a1e6c
MD5 3b5912d87492de9ba1d062f71d597dfa
SHA1 3717201da2de85df980d2447241a356c5323a9f4
SHA512 9421b14f4ad4e4be83aeb08d7aed7b2876d4aa591c81a20dd97ef3f64e18f526a80c5cf26fdcbb5b2b7bf795ee01890f1b1fbcb05a8eaab8508f34d6b6e9458f
SSDEEP 768:h/UxvxjgC+i3Ta9TOf7fTfqt9yJYe1ELsAvC8/YNPSHrkw:0Zj3+i3xf7fTfrYe1EQujYhS4w
TLSH
T1D303CF31EC65CC731EF6A788738A5757EEF8412398C45AA896D92B0D05C33AC230F45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4d2455dc68197b6ecbf7bf34fa3dc0d97f3a17623eda1bede3d51b028a443de2
MD5 05f1fe67d10f3872a6041c9c4e16dfdc
SHA1 845c26fe6b78b92d5b5d179559b18468083166be
SHA512 90589ab0b237ae4c62bbcfbabaf942b02880ab693f3b699dbc2bcabbce1e42a4711cee9e0c0572f20b6e25e66d5022ebb438f966e0677587d0e46ebeccc15e6f
TLSH
T1236195BE596C8956F75808338CD26C873AF4B3C1408B2E1307B4E5BDE897751A1E805B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bc80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bc80.TMP
Size 3KB
SHA256 ea5369c26dd5c30260804203c4fbe9ef118a5897f1ff1d7002682860f7341869
MD5 1ad57bc23d0710c912fe7b3a1e8bff27
SHA1 6bda7dbcdae78747f9b25e3b2799329eb0eb24fe
SHA512 8dfc62c841b466e3dfba9f139abcdd12e3e95a48cb7eb5fed403fa2d09d9a2cf27b16cf43c09b43d53ca10d0c686104a9a9eb430aa38eaa6956b4cefffa1bd4b
TLSH
T1906195BE596C8955F75804338CD22C873AF4B3C2404B2E1307B4E5BEE8D7751A1E805B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bbf7f6265f1699ce83fc55c618c7e133b655b2d6345f9c2073930135bb793a36
MD5 8c84c25b3283c2d42f65e3e9830eb394
SHA1 30d878a31589ce0fbfa2a5cb4d26520ea6cf1deb
SHA512 01a223146576fa78bccace9916b774c67c5ca53986e8a3a662e0af5b3d3c8dca406c44f666d7689444a8339d6e4e08cde9737bbda27329353238545cebf8ce52
TLSH
T1B3519EF7C3E8866D890196F0AB14AE2BCE1C0A15432C3D5AC9E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0748a1d0ccfb090ef47f04edd5e04b0ded18353aa378ce691c619b1817d278af
MD5 2ed170e754c469e3aaebb9bbf1283943
SHA1 8ac79fa5684f51a6206826ab25a94f118b1acfed
SHA512 00c394e22896a06d3948cd8d7897bd23c88ee64774badb434799d5424f7c5baa53f66c321238d6d644b0873b9a3265181ab7135cbb01380ad3204b73c0c669d3
SSDEEP 192:sxR/RkCh/fek+skjZugazoA8pUV/g6+WNQmE/Yx/qUG++G7IgDTZqJ:sxR/dh/fsskNLXM/5e/FUG+VBm
TLSH
T1EF42951DAD28A93B4CCBE319BB65BF53E2FD503260951F44A6FC8A1C14E76DD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fa6e5679d35907185932511017af4a695140e5e2747dd21b8c87950a3d98082e
MD5 27a936e26f5742f79e1ee0ce9e8a549e
SHA1 d6fe4470b97199ef83a9b71f50644388fc0de46b
SHA512 dbe75ffc2e7e501f961826f8d0976d6daad3546c9b8f510fb4a9a7b7a334769f6773db45975e27afda309d767318edd31d135a7a569d9a4824e17d48fe516e07
SSDEEP 192:sxR/RkCh/fek+snjZugazoA8pUV/g6+WNQmE/YxaqUG++G7IgD5ZqJ:sxR/dh/fssnNLXM/5e/CUG+Vnm
TLSH
T1EC42841DAD28A93B4CCBE319BB65BF53D2FD5032A1951F44A6FC8A1C14E76DD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 04cd30d684953fa2708813cf44574f02c7bbcb4c2ed8056a7338513a916b52d8
MD5 b03e1c28a8217b17b6b5efa2fb031234
SHA1 6292061e3825c2387d39c7e953285c081664ad4e
SHA512 4a946caca163e8a1ab312078f8b7554b302b08c4ba3d973de404d43f680128c72c075f428f28aa20d1f7100e5b9d08b732244dd673b551b2fb212f7d9e25b3b9
SSDEEP 192:sxRIRkCh/fek+s/jZugazoA8pUV/g6+WNQmE/YxaqUG++G7IgVZqJ:sxRIdh/fss/NLXM/5e/CUG+VHm
TLSH
T1AC328419AD28A93B4CCBE319BB65BF53D2FD5032A1951F44A6FC8A1C14E76DD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8038d598fdefab109078de1d7a66459e0fccfb88069b04cea7921c8af1d174bc
MD5 3779c976cc1587e65dfd97fcc35e1a58
SHA1 451ce0b8602d9f7b6bba5d2ed0b7f7d0106d31ea
SHA512 6858f8aa28b07ed0006d92fe128666f3caa26f8d5391a8a03c679076239291ebd08fb9bd70cc706d74e58739a98812ee149a7cc14a377496c8d6a6289226985b
SSDEEP 768:zBDnVx7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVknSZBK3TrowTt:zBDnVnEbYFWgbjfkWu1jaXnSZ03gqt
TLSH
T1E9D2D97B784CCA7F4F800A9D9C197E9E6DA802CB9698CD4047FE945C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d3f3a47-e6cd-4133-9edf-a7e4cacbd502.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0d3f3a47-e6cd-4133-9edf-a7e4cacbd502.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c698d57b38fc44c06092aecc5ada69bce61e16dff4d7f7336522092c2a000c84
MD5 0ffbf87121927346fa67bc6a6b84f908
SHA1 25fa91175d4a47ab71bd65dd19f9aa8a71ad3e67
SHA512 3e4a20e92174c4054fdd8db6e993c0fa5e1c0874aaf8a15331ef07b720e551e0b94b5a7ef26e6b510242c7f0b0398736561f311009c53a2c94f934391dc3431a
SSDEEP 768:p/UxvxjgC+C3O0s9TOf7fTfqteyJYe1ELsAvC8/YEP2sP6H:cZj3+C3jf7fTfcYe1EQujYi2sCH
TLSH
T1FD03CF35EC789D731DF6A698734A1753EEB8052384C45AA8C6DA2B0D05C33ED274F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5318a33c5e45cc42858cf28ea1fceeced10c52096af937c7336e629317f2e728
MD5 677e43a07424f5132676d6d47eb02e46
SHA1 2c0d965720df849148abc7f9260855b5ea0911d0
SHA512 d13b9a6818b67bf04cf023ef3656533b21a734bd80270bfb1e18685c0b4e22eef31f36b7612ec9df17c7f35ff0ea265d1221af9fdf40c8fcb39f2c31da9ed641
SSDEEP 768:VL3OYs9TOf7fTfqtWyJYe1ELsAvC8/YEP2sPOX:VL3pf7fTfCYe1EQujYi2sGX
TLSH
T1F6F2AEB1EC74CD771CF9A789B38A2B43AEB8412394C84B54D5DA270D44C36ED274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 777d036d2da6456eebf5fc8e670acb4d30375858826c95d7db23e40122fde688
MD5 f856dced91871dae47a2c51966abed72
SHA1 4a4c0982582474836179ef5c221f4361e999f271
SHA512 11d8320e20fa1094c654372ca2522442c9bf35debbcdf8b9ca1a44f5558aa7528cb17ab49be678b325e61598e34feed5f7636516d7e822d145aa8cc4b65af17a
SSDEEP 768:1L3bYs9TOf7fTfqtWyJYe1ELsAvC8/YEP2sPOX:1L3of7fTfCYe1EQujYi2sGX
TLSH
T13DF29EB1EC74CD771CF9A789B34A2B43AEB8412394C84B54D5DA270D44C36EE274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 ff59c5dd5fbe271f5651c65be28f7d874194e759d12926f22216a699099f3a51
MD5 a251cb4bff8ed4552715aafbd38e0ecb
SHA1 a5121db00964d56b27227a4201a4c155e46eb342
SHA512 a6c415fb03a30b24e7f705711798a6224f8f66130444aea1ea1717b425793699dd795ae2d7f465007564dc0b192248d6322dbfd7c3b46471390d72589701082f
SSDEEP 768:HFQ+3BwgBx0ROf7fTfqt/0GJYe1ELsAvC8/YEP2sPOX:a+3Jf7fTf+tYe1EQujYi2sGX
TLSH
T1831317F598E78976E8AD5787A37D2E029DBCC113B4889994F7C91E0DCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

de3a9d2c-62ed-4373-9708-15a77762a14b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\de3a9d2c-62ed-4373-9708-15a77762a14b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 879196a5cd66c7d037ad77e2185d43c202e0027ea7c91e0f420a2acfb7685bd4
MD5 abf8d9ca60de4a02482d4e723c55cc9a
SHA1 031e993a11c08d30378daf0da2077ec97afb969d
SHA512 9f649a36a3f0451ac684a05e0ae9905a51bc712bd02f34715a59feb1f3f3d7b462623690483bae95101e13b0264628ea3369cae0720c36fdf49d4c420fd1af59
SSDEEP 3072:HNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0n:OqZ4h4fIqPWQd/4KUNNFa
TLSH
T163D32849EB8310F1FE6301B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 4fa3f71ee117a86f6e1f48b321586a36ac77581596e8f6737b56e6b67bb74d9b
MD5 0b80f8bb474454e3d5f8f2891acfc129
SHA1 e538db550de036fa0a93bbe1f2738d8e5c787579
SHA512 c0e8c698fbdadbc22bd362377d026e65bdd333bcfa0fd7a0c0c6991b8d9a2d4f9f902f4c89f34211ad1a218ac799594a0d1d8e6279dde1f1a5ff92974557dca3
SSDEEP 3072:HNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0P:OqZ4h4fIqPWQd/4KUNNF2
TLSH
T138D32849EB8310F1FE6301B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 5edce180b433d53315ffe2947f4e58269acff687c20eed29d5710bf989f1ff09
MD5 423fd309dcf45e4c1d2ff3aead70228c
SHA1 86d697badae782c2b920b1da0f40fbcc83b9eb67
SHA512 212def7a60b1e8576a2ba918f681bb4b38e01e85e3e8d709ba70d154f482d9889b1260984412707e9489daf95606709bb13cffed49cdc726674bc83ae7d7ca17
SSDEEP 3072:HNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0C:OqZ4h4fIqPWQd/4KUNNFx
TLSH
T1DDD32849EB8310F1FE6301B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 d06ed6629e7b3999e4ddc7c264c3092ce67518d345bc49c2003f3e91cbbde976
MD5 a7f6ee563b9a6c21a09601c95a01a533
SHA1 d187fd256d027b70392b5bf5fc730b640f601047
SHA512 a5a8cf775f2ced04ebfe725999fd5a61029a210773495c588e8d67770d76ed49f0781dac9e2bd5236d086f00191813808dbb0589f9ceab8b68c86837812301cd
SSDEEP 1536:mE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:hEuSllYhhjm+kLZ
TLSH
T1707302516690F933E92E9F721B76C12CDFF8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 9879cedc45f40fa7103a467f85abf88d4f488a7cedc69b0487a0f98042b3846d
MD5 2fa72ffe1a4a35d73d6b3f9663acc8a1
SHA1 6022085877e08c798e3371deec54e7f048c52144
SHA512 7fcc96ead9c3de935c19bf6f7ba4e1db2c7b4807d0b2c42c60ace853dc9e38a6a1dcefc7bd34e124538e1dac0976dc72108f7cf40f7bb2f98ccdd2a0019ee021
SSDEEP 1536:mE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3BeY:hEuSllYhhjm+kLZY
TLSH
T13C7302516690F933E92E9F721B76C12CDFF8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 710B
SHA256 b7dde8ec89669ad6914b980dddf9dd4a8368364eb7ef749e70fbab29b9577b22
MD5 bc48b824b9cf8d0648eb8eb815a8af3e
SHA1 d21c5f35c4c7cf59b4c4ea2263898ec5be1c324a
SHA512 a90249069245dd741b81529e965b456a1fa3bd03638a5456869aba833c06a408dc0dcca3cc5924311d6aa62bee7d86ee2fd5248a7befd2ab5d24f648604f82b2
TLSH
T1DF01313E5EE90157E6B7EA176CF240179AB67EB16935D80C13C18B8C0CB2705F820BA7
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 8b183f03af51adfbdeed39f942745dd5b6f62722c7e7e98273656fbd1d03642d
MD5 8562891e08806b98f3ce90a8c5866b1a
SHA1 78eb3acea9178211746e424fba9a2f413823691c
SHA512 a9ecb06bd1d66bb3e023b7f8c4c3a8329e13d68bc5c7e868cfa950d14e8230be6239ff38f05ee7775e943fb14c42d93c109915566f6a03c4aca7dbdcc6d675b7
TLSH
T1ED81522E1EF80567E6B7EA035CF34417ABB67EA15875D94C12C28B8D0872709F910F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 1e3d71341e86e8c0a0769746e10ceb6d2bfdb3917ba46143841045e195aa79c4
MD5 b942585aa0af18584718ea77959bd026
SHA1 8696c548bf2233f107536426f904adaf69656790
SHA512 8b9f5a9c0081888e21011dcf067525fc8a8e4310196c50d57d84dbea27439ea7ecd8c2d9c9747b8b44fec1dca34ea438675ec9e0c8daf354039f88d551703902
TLSH
T1C811523E5DE90157E7BBEA026CF240139AB67D716935D80C12C18B8C0C72705F920F63
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 874405850492d15927b5990f89813a54ff19f0dc367012c8f4c85db1998f0519
MD5 4702e52d66fd20f19d3e003d071a0821
SHA1 05b134e0018808b87be365b97e8882b1d645a730
SHA512 f0c66bbf950cdc834dde551a25832061db5321e13e2bbda4cd217caeed36ff5bc2af47064abf66f92f428e60a26fbd6dcb797caee9667e7249105cdfb7112ebd
TLSH
T1D621213E5EE90567F6B7EB466CF24017AAB6BDA16935D80C12C18B8D0C72705F820F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 a9fa427acdd37a6950a78bdfa09a1618b8f9debf8e4f02b45d12617cc54980f7
MD5 bc306fbb32c8c25b0559d1778eb03149
SHA1 6449c3d6858ad9e79d9310e75903b42f886ff0f3
SHA512 cce2bb54bf30b59609dc420db1777143606d6bc14ee284afa5d02626e6f05d64dc803fb2b2f5852c50af9c98a35910549100395b6734c61f4bab473d484ccff9
TLSH
T12C21322E5EE80567F6B7EB466CF24017AEB5BDA16835D90C12C18B8D0871705F820F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 09fd56e2c822e71b921848f51f5b6bb4e7e499b771c3f35f4697ea23ba835f35
MD5 8aa7d624b4ebb32e7824438504085652
SHA1 731a6a8c17be1d6ea438ac716cf8f6bcfb24a813
SHA512 7460cc9ddfa6807d3793984ac8ea31ff47adfe3dd406d7e9b76c54e788cf4e1b794a286ab9e3dc761b3b87621ffabe579ed38a0fde78182462188d224acf3429
TLSH
T1C541562E4EF90567F6B7EB065CF34017AAB5BDA16935D80C12C18B8D0871705F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 36a7c186260c98eebca9111e587768005fb3644ff39657bc70ba8b1bd65b0721
MD5 b2748b4204a2d3e641580ce3421ebe61
SHA1 771c06a73c3eca19e7d58454e16ca331c1fda1a7
SHA512 9f2ceb83b634444bcf6b9bcbefe747b61784836fd17bc86c42c85f160c11d6f9df9ddc534ef51c4b3941cd3246036a5fa15e482d7cdfd3d736116ec17593062b
TLSH
T10F41322E0EF90567F6B6EB065CF34017AAB6BDA16975D90C12C18B8D0872705F920FA7
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 67d0f4e5e7fc40e365d3cbf36da23c882af3ca437f9c5214c1733543e0ccff31
MD5 d65bcc5870c9528f6501e46e6d4d2549
SHA1 957f4615c408a10c3e550d5ea3c325bd93c2ed5c
SHA512 eb39ef6fa486227ae33f1a8d3186ef4be0bcd3ff2c0454ad9e3491785d6c54d3869796e1fefdea87a75838c205c8167ee09b214dc2153712007a17b62e9df2bc
TLSH
T1C7F0122E5DF50157E6B7EF426CF240125AB6BD612935D40D12C18B8D0872705F920B63
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 7cc55aab653c83e2a03a1539633db2723384e016714929e598ed5e8181763a7f
MD5 b15a13d70f6c4faedd224fde422e62c4
SHA1 fa46a612dc698eea9d989273abcda0b6b4aa0217
SHA512 0e3b836b42a39ed04df364e6922a19a1ca8362c6943e62ba2e84fe5d0c306e9f2c54d18d2c6f73d433e9f445ab018c3534e40749ee1dbf012ae308980dab6e97
TLSH
T1CE51733E1EF80667F677EA065CF34017AA767EA16835D94C12C28B8D0871705F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 aab6c4b6024f5bfaf3395040d8f938bed0cd6f1ab0513e8f5d2082daf1ce5180
MD5 7419dcc59141c31dedac9e05fd251231
SHA1 17721eb10986a09ecb47b2617b0473be397f0a8f
SHA512 f316261552be1262ed5d39ff997cabe8eacfd0699b6494dc23def2296e1b4ce10320c284edf9ee41ab7d9b40ea7da9d34348fb86b6c260341ecd5d91574adb50
TLSH
T1F171662E1EF80667E677EA035CF34417AB767EA16835D94C12C28B8D0872709F910F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 df50b1bb89533035e7e24e104c7bb2e20b39296291659737e68b3253fd676ab9
MD5 f5410d20d2b4ba0764aae64f4c0c5c5d
SHA1 5b7936334d2a04f79aedecd1b1ee114f8b017859
SHA512 a01f190a1d1da807a1b11372616f3242c30d4bcb6bedf86b2f227418954a56ebfc6b264b6275a2e071f1abe7773dcb9e0b7d6c5d2e978b030657f97a1fc044ee
TLSH
T1B571542E1EF80667F677EA025CF34417ABB67EA16875D94C12C28B8D0872709F910F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 23a5cb425ffe683d1f870162ad11423677baaf0dcdbed1f4108271f12065c94a
MD5 2a4a46699850f9ef7b1a74980ff9e713
SHA1 081de44d80421b19a3b26953132cf74435ff74b5
SHA512 be818149e8758a8b3c45bd9803ef542ce9b4f724af475ecb952491bf6161c7a7cec4b5bd411f5494686227dde4bbeb45fd10d4090c464cc81f2c5336090d16a3
TLSH
T13281542E1EF80567F6B7EA025CF34417ABB67EA15835D94C12C28B8D0872709F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_593346373\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-266-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2884-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3324-68-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3324-76-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3436-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3860-45-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4612-0-0x0000000000424000-0x0000000000425000-memory.dmp

Download

memory/4612-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4708-90-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5144-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5144-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5848-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5856-85-0x0000000000400000-0x0000000000442000-memory.dmp

Download