a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611.exe
Size 59KB
Sample260925-ymvnrawv3q
SHA256 a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611
MD5 8d2be39044b518ff78990e12ec6f0f25
SHA1 3c586ad49e28bcc8df060216a0ebdbea184c2102
SHA512 811c131b1f35e533a4fee0e4c784e9b4fbba0cdda7bc1c2839d367869a20094a3262b1ff6d0bcbe204fc83aaae5b9740c7863a996b6f17b8701d03154afbf9da
SSDEEP 1536:LJsXcv+bxpkmitg1IxdsHfRhx83US4HRib:LL+bxmc+kHfrx83SAb
TLSH
T19153F1A5A4948F3EE8D7FAB2DFB542749C3539FA4F9A42250F0D743E9779A800673101
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	2448	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
1800	Eupdate Helper.exe
704	eup_rotate_1800.exe
4548	Eupdate Helper.exe
2420	Eupdate Helper.exe
1040	eup_rotate_4548.exe
2448	Eupdate Helper.exe
1628	Eupdate Helper.exe
3812	eup_rotate_1628.exe
1552	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3396-0-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000a00000001b2e2-1.dat	upx
behavioral2/memory/3396-4-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/1800-10-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000a00000001b2e2-17.dat	upx
behavioral2/memory/704-19-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/2420-26-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4548-36-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000a00000001b2e2-41.dat	upx
behavioral2/memory/1040-44-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000e00000001c588-59.dat	upx
behavioral2/memory/1628-65-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/1628-74-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/2448-75-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/2448-79-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000e00000001c588-86.dat	upx
behavioral2/memory/3812-95-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/1552-261-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/1552-335-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_723757824\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1035073440\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1035073440\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1652144396\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1652144396\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1652144396\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_359676296\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_359676296\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1652144396\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_1800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_1628.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4376	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{FB167957-070E-4975-9B66-A9713CD0F140}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
124	msedge.exe
124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3284	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 1800	3396	a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611.exe	89
PID 1800 wrote to memory of 704	1800	Eupdate Helper.exe	90
PID 704 wrote to memory of 4548	704	eup_rotate_1800.exe	91
PID 4548 wrote to memory of 1040	4548	Eupdate Helper.exe	94
PID 1040 wrote to memory of 2448	1040	eup_rotate_4548.exe	95
PID 2448 wrote to memory of 1628	2448	Eupdate Helper.exe	96
PID 1628 wrote to memory of 3812	1628	Eupdate Helper.exe	97
PID 2448 wrote to memory of 3284	2448	Eupdate Helper.exe	98
PID 3284 wrote to memory of 1112	3284	msedge.exe	99
PID 3812 wrote to memory of 1552	3812	eup_rotate_1628.exe	100
PID 3284 wrote to memory of 4336	3284	msedge.exe	101
PID 3284 wrote to memory of 4376	3284	msedge.exe	103
PID 3284 wrote to memory of 4336	3284	msedge.exe	101
PID 3284 wrote to memory of 4336	3284	msedge.exe	101
PID 3284 wrote to memory of 3080	3284	msedge.exe	104
PID 3284 wrote to memory of 3080	3284	msedge.exe	104
PID 3284 wrote to memory of 2852	3284	msedge.exe	105
PID 3284 wrote to memory of 2712	3284	msedge.exe	106
PID 3284 wrote to memory of 2852	3284	msedge.exe	105
PID 3284 wrote to memory of 2852	3284	msedge.exe	105
PID 3284 wrote to memory of 2712	3284	msedge.exe	106
PID 3284 wrote to memory of 2712	3284	msedge.exe	106
PID 3284 wrote to memory of 4380	3284	msedge.exe	107
PID 3284 wrote to memory of 4380	3284	msedge.exe	107
PID 3284 wrote to memory of 4380	3284	msedge.exe	107
PID 3284 wrote to memory of 2116	3284	msedge.exe	108
PID 3284 wrote to memory of 2116	3284	msedge.exe	108
PID 3284 wrote to memory of 2116	3284	msedge.exe	108
PID 3284 wrote to memory of 4904	3284	msedge.exe	110
PID 3284 wrote to memory of 4904	3284	msedge.exe	110
PID 3284 wrote to memory of 4340	3284	msedge.exe	112
PID 3284 wrote to memory of 2076	3284	msedge.exe	111
PID 3284 wrote to memory of 4340	3284	msedge.exe	112
PID 3284 wrote to memory of 2076	3284	msedge.exe	111
PID 3284 wrote to memory of 4528	3284	msedge.exe	114
PID 3284 wrote to memory of 4936	3284	msedge.exe	115
PID 3284 wrote to memory of 4936	3284	msedge.exe	115
PID 3284 wrote to memory of 2792	3284	msedge.exe	118
PID 3284 wrote to memory of 2792	3284	msedge.exe	118
PID 3284 wrote to memory of 5912	3284	msedge.exe	120
PID 3284 wrote to memory of 5704	3284	msedge.exe	121
PID 3284 wrote to memory of 4896	3284	msedge.exe	122
PID 3284 wrote to memory of 2704	3284	msedge.exe	123
PID 3284 wrote to memory of 2704	3284	msedge.exe	123
PID 3284 wrote to memory of 1632	3284	msedge.exe	127
PID 3284 wrote to memory of 1632	3284	msedge.exe	127
PID 3284 wrote to memory of 5088	3284	msedge.exe	128
PID 3284 wrote to memory of 5088	3284	msedge.exe	128
PID 3284 wrote to memory of 628	3284	msedge.exe	129
PID 3284 wrote to memory of 628	3284	msedge.exe	129
PID 3284 wrote to memory of 124	3284	msedge.exe	130
PID 3284 wrote to memory of 4308	3284	msedge.exe	131
PID 3284 wrote to memory of 4308	3284	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611.exe
"C:\Users\Admin\AppData\Local\Temp\a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_1800.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_1800.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 1800
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4548.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4548.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4548
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_1628.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_1628.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 1628
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffdea79c188,0x7ffdea79c194,0x7ffdea79c1a0
        8⤵
        
        PID:1112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,4290646799093669342,14925988486215604902,262144 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
        8⤵
        
        PID:4336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,11234723932071809800,9745517985809371062,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:4376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,5784107125416560716,7093289681620116774,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
        8⤵
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,658066037481845500,11791517844024807562,2097152 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
        8⤵
        
        PID:2852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,16249699333655970339,7495713687159864831,2097152 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
        8⤵
        
        PID:2712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,10673146681830729784,2061612438701791309,2097152 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
        8⤵
        
        PID:4380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,3593626609694904529,8430884738068809967,2097152 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
        8⤵
        
        PID:2116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,15276748869400361921,2108371340808920497,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
        8⤵
        
        PID:4904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,3868567665020378956,5488379661730448456,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
        8⤵
        
        PID:2076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,2676819354766411494,18360305285106602966,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
        8⤵
        
        PID:4340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,6414258324329127457,14932031732225591404,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
        8⤵
        
        PID:2264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,6414258324329127457,14932031732225591404,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
        8⤵
        
        PID:4528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,35749690780764162,2913232989210467658,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
        8⤵
        
        PID:4936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,12293128434818899009,4190003137567559862,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
        8⤵
        
        PID:2792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,3872292887655049995,8732865337015937671,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
        8⤵
        
        PID:5912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,41270715138472387,6144771639960612348,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
        8⤵
        
        PID:5704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,13059382769321928643,5271287375284462147,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
        8⤵
        
        PID:4896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,7862926635951187846,8578835964955572973,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
        8⤵
        
        PID:2704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,2504108985226195256,3009605813140873099,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        8⤵
        
        PID:1632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,13279370225840343784,14996782644952206620,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
        8⤵
        
        PID:5088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8470970336644734315,16178723591866463246,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
        8⤵
        
        PID:628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4180,i,3505915391509257977,1802777408311321939,262144 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,5207851098150478640,11586829872000772177,524288 --field-trial-handle=2352,i,16464718444108492629,6759136047350040247,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
        8⤵
        
        PID:4308

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2c033c4a6b75fe8ce730ff276e2a5b6dcd04a2ae5033df28197e72a05d5c103
MD5 891b29fc6e1d4d96e23dbc90e496f599
SHA1 501c1c71d62528310cf44a62b2ad877df381b81f
SHA512 b7a3163fdd4def28bc1b37762827910afd4d2e379cd2d0d9a5d57ee0d5ced66b936fb0b150eb3d275b87588ffe60db50ecbd0b1a5d0c34ef38e104f1bd636ae0
TLSH
T1F461618067943592D7ED52F4D3DB118F3A3869B729973F1007D8EB78A98532EC06E388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c6ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c6ff.TMP
Size 3KB
SHA256 f74b14a24215ff0cf00ba26e455e2f48137605d4d2414e09ac25b2e76af162ff
MD5 665b4b27b063ae9d29ee4ecc81cb3c65
SHA1 4fa779218bc679bf44245471ad3cbca499e92d6c
SHA512 fb515ab65d03019f01d70afe1748631f1da2dc6a15dcb05f0ca03a2922c34923584b70b906032ade0a777ba377712777e17994e10f19575f5366185b8df4f9e7
TLSH
T1B161618067943591D7ED52F4D3DB118F3A3869B728973F1007D8EB78A98532DC05E388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4d940d7cc97b2d23296e6cdc2c4fd388e24d30ebf845173925988e6c3ff1def5
MD5 32a2861bf9be087bf5351a39b7f05dbf
SHA1 b58e8f8f3a3cf4efbc198620a66a906aeca6d36a
SHA512 a014a4f5171b66d220bf7259729921e48cc5d065a28e0f6577f988caf2ff95bc9bfa2fd34451b9b33c9398296aeb0d154c3bcba2102b7f0a389325ea9903a4e5
TLSH
T1FB51C0F7C3E8866ECA1196F0AA186E2BCE1D0954832C3D5AC9E4DF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ae67a2b381aa437443eeaa02732abb41b738ef5794f08fdd89360667c46ae4ba
MD5 6cb2358c044bc2f1349089146670b4e6
SHA1 81a9a471ab1456e0eb5e038293e1bf762e5f7c68
SHA512 327273de388f12d56b232a1beb79de9fce0e092ca220423552df47d14d3e646af3d037c5c570fa04628d81483565fa7b9fe9228985575c86de7a382d1af5928a
SSDEEP 192:sxRwRnCh/fUs+CjZmzoA8pUs/g6+WNQa4/YRfx3j/+G5IgDerJ:sxRwMh/fUsRNbp/5m/O/7C
TLSH
T12442961DAD28A97B8CCBD21DBB55BF53D6F95032A0911F48AAFC861C04E76DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 98e50d7dba48cf1404c7d10aeac075d6fda494b82fbf857e7987140fe894c147
MD5 f2bf13ae42885628826b7b47d4077bd8
SHA1 76bf59d04aee695e9ea0bd3a5ec61a75b72cb79d
SHA512 c00ca00da1d3103f4c04d22a08711885847a02036d787da92d33aed8257c51cb0e0e50e109e0cc5849c39fe443b26092b116f296ec99bb559fd9e1c03539b959
SSDEEP 192:sxRwRnCh/fUs+YjZmzoA8pUs/g6+WNQa4/YRff3j/+G5IgDsrJ:sxRwMh/fUsHNbp/5m/W/78
TLSH
T1D142B71DAD28A97B4CCBD21DBB59BF53D6F91032A0951F48AAFC861C04E76DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cd3f730c57ebcb6a224cb73469446fdfd021389f387bdbfd0013e87c9610afc1
MD5 4e0ff796cbe658675a38b624f4ec6efe
SHA1 3061797a8297028e66add7fb5d4d321d8ca6bd9d
SHA512 406051fdb673f5dcf9ce9b34f21f310bfe5245c46f8b57a4d7c6bf1f20b35bc3a08075e933bba8db606756a56b11c9838d51f5757be277434ffcfbd4ef2a7586
SSDEEP 192:sxR/RnCh/fUsHYjZmzoA8pUs/g6+WNQa4/YRff3j/+G5IgVrJ:sxR/Mh/fUs4Nbp/5m/W/7f
TLSH
T1BE42A81DAD28A97B4CCBD21DBB59BF53D6F95032A0951F48AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 165267fd542121a67616b3ee226c85ce027a8754c0bb2c4c46eb0f04d454517d
MD5 7a51098ce4090c95424d3f64bf6a2180
SHA1 e9c7ede4df984e2674c515f7c7a1c73a08d43fe4
SHA512 08c218976b5b50668a5cbe04b7dc1168ec930ed2e4dc9d3af81aa7023ab7a726b05b72f736a269de0840fe2e6fcc873d74356ba7dcadcd53652dc8f01953103d
SSDEEP 768:UEg+6C7pLuLb7uWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV80+6ty6roqqQ23:UEg+6aEb7uWgf/fXHu1ja30+4yxZ
TLSH
T13FD2EA7F744CCB7E4FC00A9D9C1A7E9B6DA802CB9698CD4047FE891D02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b11b8a54-2784-4bdd-b726-a7f5d83fb272.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b11b8a54-2784-4bdd-b726-a7f5d83fb272.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 68331202622732c19ae4628dc9db0a5bb997d1d0f2ef26d7edf91118aa70e0c2
MD5 78154c8435b2608a2152e8bcf8b8f282
SHA1 ec6cf087c7bf29c4857818d9499521bbce512c2a
SHA512 63e9b097d96f3c7e2d994e3eb9822c51641d9c8422fd93e799c4e00dc55db07608962023550bba648b60dc1a54052ad46467c39fd9234b31b072449713d10aff
SSDEEP 768:GI3jvQwOtNCQle5fgGM1TnXMqOaK2sXie:GI3j92sfgt1TnxOl2sye
TLSH
T17CF2BE35A96A8CB35CF6D385F206E6822EF150B7C5851E98D8ED6E0E049329F171FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 31dc6e8f671f9887552a715b9864a2a5a28922e481e0986a9e8bfbab16d8f7a3
MD5 c0aa7489797ae0ebe50967a977ef0e94
SHA1 5da43cb35f91adb5e9abea21d6b8bb9492c71a97
SHA512 6bfba77f83cea6b07c5eeb65b06ff6101ff5a3878e9d18fbb9bfe2bac15adcdd011ca11d2d0919363ff25aaf40d1ab33df13cc313bfdd98ef491195a0b1c51c7
SSDEEP 768:DI3cvQwOtNCQle5fgGM1TnXMqOaK2sXie:DI3c92sfgt1TnxOl2sye
TLSH
T186F2BE35A96A8C735CF6D385F206E6822EF050BBC5851E98D8ED6E0E049365F171FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c9e4aa042199fa537f1a17192acd74f50fb5db2e737ca10d08e8b3cfdf8b59df
MD5 a811b91bded1e39441acc08804533aca
SHA1 0b1a5059529351b185bcdf9a39daa7f8deca7d24
SHA512 170b8b47657926936dc0aca8f83cece2ba4049f1254acb4a53b9f92e5bb8f3fa91a27331d914cfa0cb5103ad3d3f803d471bac3b1c7233e6b536788c129817dc
SSDEEP 768:u/UxvxjgC+N3jcQwOtNCQlU5fgGM1TnXMqOaK2sX09:jZj3+N3jO2afgt1TnxOl2sk9
TLSH
T11B13BF39A9699C635CF79244B30AE3D3AEF114B7C4821EAC99ED6E0E058725E170BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 652f5a83a5a09653c0fdb2ca7b26ef5402c82ced2cc33c8745862087c8aa472c
MD5 afcc4b7f250db0e8eab000b3ef1a6809
SHA1 15e6983f973392cd06b4ebda5c00d24196272ece
SHA512 4186afa624a8df7bc06b7c9d4e5abb6e67318529925797a8ad1ff764b4057406a2ad02ff6873640088f7c529cac79ed111abaca5a6a03b049c1d73d598b04264
SSDEEP 768:5/UxvxjgC+93ABwOtwu5fgGM1TnXMqOejAaP8:sZj3+93Zcfgt1TnxO8AG8
TLSH
T10303BF36AC5568739CF2D384730AA397AEF144A3C5C51EA889EC3D1E069B35D530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 7f0f87b275ed25a94a78c691f5e7dffd89c0e74fc6f65f23bd38283250a69bcd
MD5 e7c56551582a2db8397ed163ebac526e
SHA1 f0b08c28c9c4d5eaf3dbf43d5712b610ccb343d8
SHA512 1b61f7f2d5615c8c2ecde7d193350b10b32fe294e7c0c722dff4939109dd75767ef807f24d4dff89a122ae9d9d0c516c50d364558e463acd7a98602017d4774c
SSDEEP 768:yFQv3xwgycDIOtNCQv5fgGM1TnXMqOaK2sXie:Jv3CHQfgt1TnxOl2sye
TLSH
T1891317F599D78976E8EE4783A33DAE425DBCC067B4895994B7D81D0DCC821BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

824bfc46-4be3-461e-8c4c-386b97612576.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\824bfc46-4be3-461e-8c4c-386b97612576.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 a72a102b8df82bc301f785654952ab48cdebe8eccd8d3fcb42e570d85ffa4611
MD5 8d2be39044b518ff78990e12ec6f0f25
SHA1 3c586ad49e28bcc8df060216a0ebdbea184c2102
SHA512 811c131b1f35e533a4fee0e4c784e9b4fbba0cdda7bc1c2839d367869a20094a3262b1ff6d0bcbe204fc83aaae5b9740c7863a996b6f17b8701d03154afbf9da
SSDEEP 1536:LJsXcv+bxpkmitg1IxdsHfRhx83US4HRib:LL+bxmc+kHfrx83SAb
TLSH
T19153F1A5A4948F3EE8D7FAB2DFB542749C3539FA4F9A42250F0D743E9779A800673101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 0b6721ee491404c3d4a415ff804309a9884597ed68aab58d41b5366f21ea7580
MD5 ff637e28752e0d561e61b38e0434ab0e
SHA1 1d22e8e1d8c0a91a1075fc121ec763f3a3ad991b
SHA512 dae198e1e05631fd9fc0386e8b22425346a60f0d66134b09a26bf7741be8a45f2ce031e5b2d66a93263ae6c2f5d65fcbe34accc4a136a86a728b7e36ca8858df
SSDEEP 1536:LJsXcv+bxpkmitg1IxdsHfRhx83US4HRiI:LL+bxmc+kHfrx83SAI
TLSH
T14753F1A5A4948F3EE8D7FAB2DFB542709C3539FA4F9A42250F0D743E9779A800A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 56026fa4221bfca630b10c798d595be7a28efc58230511ed58501611832097c3
MD5 9fda5812f81a260abc00c352225671df
SHA1 92d8a2e707bc0be33481e73a5d5a443401892a6f
SHA512 8cc14c0dbc5b7a2e6879504f12eefa8942c5cb97c77ff6a25aea2d52804852e812ad6235c74c122c3678aecce0aed9e73add8c6db12cb0732bc228e324d9fc1e
SSDEEP 1536:LJsXcv+bxpkmitg1IxdsHfRhx83US4HRiL:LL+bxmc+kHfrx83SAL
TLSH
T15553F1A5A4948F3EE8D7FAB2DFB542709C3539FA4F9A42250F0D743E9779A800A73101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 d06ed6629e7b3999e4ddc7c264c3092ce67518d345bc49c2003f3e91cbbde976
MD5 a7f6ee563b9a6c21a09601c95a01a533
SHA1 d187fd256d027b70392b5bf5fc730b640f601047
SHA512 a5a8cf775f2ced04ebfe725999fd5a61029a210773495c588e8d67770d76ed49f0781dac9e2bd5236d086f00191813808dbb0589f9ceab8b68c86837812301cd
SSDEEP 1536:mE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:hEuSllYhhjm+kLZ
TLSH
T1707302516690F933E92E9F721B76C12CDFF8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 f94ce3b98319552145d5bb8cc6706b0048c939c84ce22da07bcd687747cd9d01
MD5 4cb9d9d56fafc1b8eb9ec9ba7c488563
SHA1 ce9a48ca86e186cd1c2e47f05a8e5bb01a3d8420
SHA512 58697c900e87b9cb429551a2efed359f9d3403e5669a516fd410097ac54d38902ff5f81a6dfaac86e3c70db77a976ec36f89ceddf994e8ce3dcfc257ef6ac372
SSDEEP 1536:mE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3BeR:hEuSllYhhjm+kLZR
TLSH
T1A97302516690F933E92E9F721B76C12CDFF8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 710B
SHA256 edb7ebbfc41c2076397e3d0ba34c23fa6c3d6563f9dc816d652be44537593bd5
MD5 9e530d6b529c2f9388e3645c63aadecc
SHA1 c24edd4a732f3a1e33fe42db3c9ff62189da7464
SHA512 abd065924bc42d1490890c794f1ffd5b8240f1c0b88f952dee94bc49b1d3d59feabae44d4fe73f325ff65d1ea4ca581ad5209107e1642e5ae43d056333c7191d
TLSH
T19901122E5EEA0197DABBEA126CF34016DAB27E716836D40C12C24B8D0871704FC20B6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 051d9d6eca2205cfc3dbe2f80b70cd20609368845e2244956f29b2d374ea2938
MD5 8d2d2ea9d3097ccb5f8ef89afbd933ae
SHA1 7b4902bf0880d411e06a8ee933a7a32b62652c5c
SHA512 373efc88698f175355ff822a7aa383f6ed60e7339105cc5a2d54a10f2c9e1e6029b81e10092c86a46820c713df51aea24f3acf7c073d3863f69c3055169bf50f
TLSH
T18211002E6EE91197DBBFEA126CF34016DAB67D716836D40D12C28B8D0871704BD20B6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 e355ca191226d5827125ec410cea561ba027020bbe94a66dd07899aef6ebfb6e
MD5 253d73933dcc753a0631b6340e47269d
SHA1 1207e23d7c0e0bc78747eac7abf649923c5a934a
SHA512 218aadfb827ca32dcbc9dae7159c9e24ad5a1bceccee3d027d72c865e8bd0faa554cfbf4b1deb0eaecb321bb1dedd06e450ba23bb94e15cf0abda8feb93440a4
TLSH
T15D21272E5EE51157EABBEB425CF34016EAB5BDA16836D84C12C24B8D0C71705BD20F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 c81972a607a710815877a9e4ca4e4f781e4c12945e68edc0a847de1601884aae
MD5 e9059b833b007338256122358f57606a
SHA1 db87dba97b320b48df6aea5db6821a61d00acd69
SHA512 414da78c34bce6296c4c9e6bdd9b878b3c8da8ce655edbfc52608b46aa2ac43edaa5afba78e8cad8381a58e353bd291dbc545ffc30d5bdddb12fa027cf6eda23
TLSH
T119413A2E5EE50597EABBEB029CF34016EAB1BDA15835D94C12C24B8D0871705BD20F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 868dd31241f1d231186ca69ca44f5d16b74148303c18fbbc187964bd36c124e8
MD5 9e776516657cddb474ee4124167a82d5
SHA1 594538d541afd2f591565a0f3d3ad83cdbbf7857
SHA512 a1482f62f6f57bdfdbed15c30238e7b05fc382e7370fb24458b44ef8cdb14e044f1ec692792b9ac9dcfad26bcc6e27708fbd5764b6a2928cef8f4c3404569e42
TLSH
T1AA414B2E5EE50697EABBEB029CF34017EAB17DA15835D94C12C24B8D0871705BD10F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 ed356e65ab72246e8eaef8df949a88fb7371c4594c3022fa72fd9232e15ecd0c
MD5 3fb257b49956fcc069b684fcaa50ec56
SHA1 008ebb73b6ae8b6bbab3c09148cb637deabb3983
SHA512 72bdad546a2c8b0e5dfaa17c32aa02bacd393b17756b266ab400a007ce209050f5990094981917ad57ad1c94cbf15e8ec613317664fb96418cfedf4a84fe0639
TLSH
T163F0122E6DF60157D6BBEF526CF34012DAB6BD612835D40D02C28B8D0871704FD20B67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 dce61d6a5c3fa368128093d4f88ebdbb889f38b1a47c600fbcba0c86c6d6de51
MD5 383e6fec3e3426350df52531ac878b2c
SHA1 5c779eddbba9a3d793876e75e19eea30aaae92a7
SHA512 062eee38fcb348942f9cd114d4246641ffe7f6893ba7b75df53af03dafb336fde73f403df196bb4b0be6b1a33fbf1d8501b49b9e6f391f60f67791e76a3f0586
TLSH
T15C51582E2EF502A7EA7BEB029CF34016EA767EA15835D54C12C24B8D0C71705BD50F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 113afe54c8b208fafb4a2387e830707ae416de8436ae6a7d1b75265aa35d85fd
MD5 e5a61dfec1147be007d50456492614e0
SHA1 ec21ef4d3a06d3f935c1b62d4aa12f1b625b6598
SHA512 1710002446d8786e0d3f2b72ac5f8a5f69033497f974b900ad35cce17be2f6a55bcca550fca5b002b34a289b251d09211d740b08b4da75ebbe43c81ac4bf1afe
TLSH
T1C171682E2EF50197EA7BEB0298F34016EA76BEA15835D54C12C34B8D0C71705BD50F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 4edf2b90b5c582fb172a03a9fe6b95eea8c30401c1f731020892f4a52eb24822
MD5 ba306736d54ad444e69face06a258247
SHA1 2a9a090bae8ca1b3113c7719b3bb7e5b6b953973
SHA512 cadc7194d560f722b25659034ab726255d705bebd8111ba1f5ffd9d14fb64731d1356197c4964dc06d4ba8ade1461464034fa9276d216a9bced0fc9584a06fc5
TLSH
T14071572E2EF90197EA7FEB0298F34016EA76BEA15835D54C12C34B8D1871705BD50F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 b6d81f9f64d1cef96d63a09f19ee6881ee8d9d21269ff4102cca890a8a879c84
MD5 5dd791badd4fa04faef92d3c80e7d579
SHA1 efff017e5af965a7bef9daf53c4b43a02bb8cfe0
SHA512 08a1153ceb90fb32997ad15abec94820abbb3e7779ac744a9ec7dbcaaadef5846b7de1a02ebfd9e01b281b147a38d9770da06749038e81882f42ab8f83908273
TLSH
T15B81472E2EF90297EA7FEB0298F34016EA76BEA15835D54C12C34B8D0871705BD50F6B
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3284_291130405\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-19-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1040-44-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1552-261-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1552-335-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1628-74-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1628-65-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1800-10-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2420-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2448-75-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2448-79-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3396-4-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3396-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3812-95-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4548-36-0x0000000000400000-0x000000000042C000-memory.dmp

Download