a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29.exe
Size 59KB
Sample260925-ynqfesyth1
SHA256 a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29
MD5 8b82aea7cdb7ee2b764cbe9e2b163b4d
SHA1 0cd56e498227bf348150912280a0029aa8d77e60
SHA512 827caa1c9a732d3a49954bc4fe5f3c33d43c1f2120488bd7ddd7fdc40bad3c876905787f31144e4ee13dfcd7d19ab1e879c39d9f114ac4960e63a43f25b864d7
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRit:RL+bxmc+kHfrx83SAt
TLSH
T16853F1A5A4948B3EE8D7FAB2DFB542709C3539FA4F9A42190F0D743E9779A800A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	792	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
4048	Eupdate Helper.exe
2400	eup_rotate_4048.exe
2420	Eupdate Helper.exe
4628	Eupdate Helper.exe
3332	eup_rotate_2420.exe
792	Eupdate Helper.exe
2980	Eupdate Helper.exe
900	eup_rotate_2980.exe
4196	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4940-4-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x00160000000115bb-2.dat	upx
behavioral2/memory/4048-10-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x00160000000115bb-17.dat	upx
behavioral2/memory/2400-19-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4628-26-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/2420-37-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x00160000000115bb-42.dat	upx
behavioral2/memory/3332-46-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x000800000001b7fc-61.dat	upx
behavioral2/memory/2980-69-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/2980-77-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/files/0x000800000001b7fc-88.dat	upx
behavioral2/memory/900-90-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/792-86-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4196-263-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_454690269\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_267091796\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_1788017774\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_199092960\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_199092960\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_267091796\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_1788017774\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_199092960\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_199092960\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_2420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_2980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{4082EAE4-77D6-4FE7-A688-7AF92D5BE629}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
828	msedge.exe
828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4048	4940	a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29.exe	89
PID 4048 wrote to memory of 2400	4048	Eupdate Helper.exe	90
PID 2400 wrote to memory of 2420	2400	eup_rotate_4048.exe	91
PID 2420 wrote to memory of 3332	2420	Eupdate Helper.exe	94
PID 3332 wrote to memory of 792	3332	eup_rotate_2420.exe	95
PID 792 wrote to memory of 2980	792	Eupdate Helper.exe	96
PID 2980 wrote to memory of 900	2980	Eupdate Helper.exe	97
PID 792 wrote to memory of 3000	792	Eupdate Helper.exe	98
PID 900 wrote to memory of 4196	900	eup_rotate_2980.exe	99
PID 3000 wrote to memory of 4404	3000	msedge.exe	100
PID 3000 wrote to memory of 1480	3000	msedge.exe	101
PID 3000 wrote to memory of 4732	3000	msedge.exe	102
PID 3000 wrote to memory of 1480	3000	msedge.exe	101
PID 3000 wrote to memory of 1480	3000	msedge.exe	101
PID 3000 wrote to memory of 5112	3000	msedge.exe	103
PID 3000 wrote to memory of 5112	3000	msedge.exe	103
PID 3000 wrote to memory of 3556	3000	msedge.exe	105
PID 3000 wrote to memory of 5592	3000	msedge.exe	118
PID 3000 wrote to memory of 3556	3000	msedge.exe	105
PID 3000 wrote to memory of 3556	3000	msedge.exe	105
PID 3000 wrote to memory of 5592	3000	msedge.exe	118
PID 3000 wrote to memory of 5592	3000	msedge.exe	118
PID 3000 wrote to memory of 2136	3000	msedge.exe	107
PID 3000 wrote to memory of 2136	3000	msedge.exe	107
PID 3000 wrote to memory of 2136	3000	msedge.exe	107
PID 3000 wrote to memory of 5400	3000	msedge.exe	108
PID 3000 wrote to memory of 5400	3000	msedge.exe	108
PID 3000 wrote to memory of 5400	3000	msedge.exe	108
PID 3000 wrote to memory of 3200	3000	msedge.exe	109
PID 3000 wrote to memory of 3200	3000	msedge.exe	109
PID 3000 wrote to memory of 5824	3000	msedge.exe	111
PID 3000 wrote to memory of 5824	3000	msedge.exe	111
PID 3000 wrote to memory of 3692	3000	msedge.exe	112
PID 3000 wrote to memory of 3692	3000	msedge.exe	112
PID 3000 wrote to memory of 3204	3000	msedge.exe	114
PID 3000 wrote to memory of 248	3000	msedge.exe	115
PID 3000 wrote to memory of 248	3000	msedge.exe	115
PID 3000 wrote to memory of 2064	3000	msedge.exe	116
PID 3000 wrote to memory of 2064	3000	msedge.exe	116
PID 3000 wrote to memory of 5312	3000	msedge.exe	120
PID 3000 wrote to memory of 5016	3000	msedge.exe	121
PID 3000 wrote to memory of 3720	3000	msedge.exe	122
PID 3000 wrote to memory of 5516	3000	msedge.exe	123
PID 3000 wrote to memory of 5516	3000	msedge.exe	123
PID 3000 wrote to memory of 720	3000	msedge.exe	127
PID 3000 wrote to memory of 720	3000	msedge.exe	127
PID 3000 wrote to memory of 124	3000	msedge.exe	128
PID 3000 wrote to memory of 124	3000	msedge.exe	128
PID 3000 wrote to memory of 3256	3000	msedge.exe	129
PID 3000 wrote to memory of 3256	3000	msedge.exe	129
PID 3000 wrote to memory of 1336	3000	msedge.exe	130
PID 3000 wrote to memory of 1336	3000	msedge.exe	130
PID 3000 wrote to memory of 828	3000	msedge.exe	131
PID 3000 wrote to memory of 3388	3000	msedge.exe	132
PID 3000 wrote to memory of 3388	3000	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29.exe
"C:\Users\Admin\AppData\Local\Temp\a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4048.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4048.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4048
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_2420.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_2420.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 2420
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_2980.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_2980.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 2980
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff87e90c188,0x7ff87e90c194,0x7ff87e90c1a0
        8⤵
        
        PID:4404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,15568740973928970830,9098200611450824783,262144 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
        8⤵
        
        PID:1480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,3158200825334331854,6200275106662001910,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:4732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,6832060457369387308,15204797872431514812,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
        8⤵
        
        PID:5112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,17065357372372230932,11640893211253325831,2097152 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
        8⤵
        
        PID:3556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13692101459971323096,15173020412188891598,2097152 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        8⤵
        
        PID:5592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,15980840532583720430,12560498153107651917,2097152 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        8⤵
        
        PID:2136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,7003290865681310003,9151648034685542375,2097152 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
        8⤵
        
        PID:5400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,11592423252510683301,7421824388531046142,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
        8⤵
        
        PID:3200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,10460580537377774401,2058365720535193412,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
        8⤵
        
        PID:5824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,13905054798420068250,4860244665874585514,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
        8⤵
        
        PID:3692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,6726535689686395842,9500156181712140964,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
        8⤵
        
        PID:3144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,6726535689686395842,9500156181712140964,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
        8⤵
        
        PID:3204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,12671806478903748285,18410806296112544519,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
        8⤵
        
        PID:248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,16539060564142527708,2921644453996556081,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
        8⤵
        
        PID:2064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,17504162282220049311,2521331536432505736,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
        8⤵
        
        PID:5312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,3865277407192990771,9767062123721554933,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
        8⤵
        
        PID:5016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,6629113557172947613,8786496590105514141,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
        8⤵
        
        PID:3720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12389592911134105182,14909425473229416370,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        8⤵
        
        PID:5516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,2425059568815740771,1398828039490098162,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
        8⤵
        
        PID:720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,7987619441088959822,4476153824772706227,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
        8⤵
        
        PID:124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,4318970107973750712,7862960043807647292,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
        8⤵
        
        PID:3256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,13100815236817907211,6149017741865462512,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
        8⤵
        
        PID:1336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6112,i,11001898750346433186,704362782955711192,262144 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5351675528895134126,8675244772896915249,524288 --field-trial-handle=1944,i,8462162809941590357,1101749275781760544,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
        8⤵
        
        PID:3388

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82c99b0376d19a953e94e4cfc4ac8d7830076a42a2b225651a42f9992bb1f21e
MD5 a6a3e7c26dd3b20aa958f199269d9e98
SHA1 c547a10747d91439d4011c056d45aa284535786d
SHA512 b25c43638f351cb94839a03690e482137726f72f42b1993b0fff9ba206a015171ec8383d2f9affb41a63c7b8cfaf19da760609be4a2fdc5e79693b0d439d5b15
TLSH
T11F6182C231E18066F7980435B0C25C8736FC968A61CB9D8209ADF67D5F6672D819F07B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 996a4dc3bc71c65da629ca4695a9c98f32ea97509d794d4f11c65a9379b50405
MD5 6090e96704d4817d1602097026a2e785
SHA1 50ff5861d106bcfda7a92d454d57ba6aeb144613
SHA512 b1c429174dc23cc2d1a8946e66e2a8e8972a40d326b0182dc60c384b1f7664471bb50f9e7d5a7fe95e70016d303aa1e92c6433c72f241186ec0a23cf136c6e1d
TLSH
T15551ABF3C7E8866D890155F4AA146E2BDE2D0924832C7D5AC8E4DF2B93E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c4005572d167dde51c2a3181c56ea24d1f4bc450cac4b38aedc0807cd3230ca8
MD5 e88ca72d6aceeb7f7808a6b281c5bcfe
SHA1 7309911ad92242408938c91a228fe8a498050d37
SHA512 9bf44a1c94acc59b575e5af876e42f785a9499616d7f1ca42e5533399b31002a6b8798b60567f0f000a5ae1a094c71847fb2b1c154249f642b6b5cc0a84e521f
SSDEEP 192:sxRpRrCw/feBs+sZvxD+zoA8pUW/g6+WNQ9y/Yc/XtiTX+GnIgDRxJ:sxRpEw/feBs+SvxXv/5b/f9iTXpF
TLSH
T1A242B81DAD68A93B4CDBD219FB56BF53D6FD5032A0941F48A6FC8A1C04E76CD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e80af2f3cb522c12abf943eda0a66e99c071eafd841c60c5c6d5f9d5446772a7
MD5 064e0a4f5ef27cc346925c358e7718ef
SHA1 ae646aa6128adacfbffb0c2918f3fff035209ea6
SHA512 ad17579cde84942c4b89608fb2ddedc986ac095063ed198dd97d820b313b096c05f51fab4c38abc9335ca1acc6e09076a1f9903ae82e654d3802f096ef2f12dc
SSDEEP 192:sxRpRrCw/feBsisZvxD+zoA8pUW/g6+WNQ9y/YczXtiTX+GnIgD7xJ:sxRpEw/feBsiSvxXv/5b/T9iTXpL
TLSH
T1FE42A71DAD28A93B4CDBD219FB56BF53D6F9503290942F48A6FC8A1C14E76CD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 29876a17bb479385ca80305b8d797e43a26b70bdec746e61ca70b7e315f97607
MD5 fcf365bd0c593b4dce17dfcc19c2f5ec
SHA1 57a3d4a58943b61c3bb05766365e8e4e96725c32
SHA512 4572d847c57087a17bfe5ab82f2c7410313acafe22e6467dc9787159e98bd5895d52c6ed8587d1b6c095a467587c71e9ca8cb691bf6a3bcf5fb4aa8569a21331
SSDEEP 192:sxR+RrCw/feBsBsZvxD+zoA8pUW/g6+WNQ9y/Yc/XtiTX+GnIgVxJ:sxR+Ew/feBsBSvxXv/5b/f9iTXpt
TLSH
T1EA42B81DAD68A93B4CDBD219FB56BF53D6F95032A0D42E48A6FC8A1C04E76DD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c669b05537567f9a5fb5c552cf6942df760b6d97db06eac7d8331c75e1b694b8
MD5 998d38d1c7ff55bc9fe5f50d2d67c836
SHA1 dc4c20507f452344c415332f3d094460d9dd13ba
SHA512 5a85b3418ce647945f3497853fd2681273a7994d825ac2829190527ff591c81684f36e715432c9971c0b08d96127305c826b4e4bb4f61b92bda53900d7cb01c2
SSDEEP 768:DFakF4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2OJ97gMroMDi:DFakF4ymEbs5Wg1Bf9tu1ja1OJxgXMDi
TLSH
T1F4D2EB3F744CCB7F4F804A9DEC197E9A6DA802CB9598C94047FE941D03C6BEA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2038be2751220deb11099acdeea63388e2db3ebe2f8201c32e6a04a7f87d3a73
MD5 3610406ee36d49c8c1b5cc40d03451bb
SHA1 994483d3b67b5c215f91443d07fa42bedb88731a
SHA512 14c223473a697be609eb29d2a1443c9dbcdc3fb377fafb25fd0e4053e4bbb50e592407c9227c5703a9d9b755fbb8c1fda3f10b473e7cced5ad1cea1e595e9ae8
SSDEEP 24:KUCF6gAIFK+hE12SPE9yXVO5ek8IFKChc1WSL05ButEFIvKph61+SMb3yXl6dh:KYfIFKoEozytHIFKUcwQmIvKv6wXyi
TLSH
T143912031737A1200397D690C92D0AB5F464272A23169EA3F37ED10A78E7AE154DFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70461405-0d7b-4d6b-822f-1fa74c3f5907.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\70461405-0d7b-4d6b-822f-1fa74c3f5907.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b5a114816c64917b8d4215066ab8ffc851ac950901ce386af5027e04a563c059
MD5 3b92f3aa062c3f6e1aa9676dde35a1e8
SHA1 a95308fb61de912fc9460f7a93ac019b19d57eb7
SHA512 8d82ec451f0c6eac8721b414bdc6bcf23f90281c82b00799edb42c4edf0b804dd1ee3a4cef4d3f32058d1fc3b3d8c5547e6ac9eea34295c720c63def39e6c7d6
SSDEEP 768:vw/UxvxjgC+5j3pVrG85ieO4ojFnUPO4Qp7cPAiSm2eo4w4cciGrTF5EAgZbCM3s:vdZj3+5j3p5G2yjFwQpYoimeoR4ccFFp
TLSH
T16403CFB598A4AE37CCF397843A5D6346EFF141A395C12A94CAE92F0D42873AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 81101f5d040b820af989612df125c77f1f90edcf7784e220929260454b622032
MD5 2c334a867db0cd4f02a97c62dee07488
SHA1 cb629280ab254739b13f82302e68d95a8c189bd3
SHA512 b82ee49cb63cb520b7e3569f77855b3b446f16c4f435c084c5b6fce3b8cbe5a9954aa3325dbe284500d1e66b14371984d3d2a6a6b72bdf8ae852e51c788f814a
SSDEEP 768:qg36O+QalieO4hbtZjinUPO4Qp7cPAiSm2eo4w4cciGrTFl52syxs:qg36OnAntZjiwQpYoimeoR4ccFFj2s8s
TLSH
T1C8F2BEB598B8DE736CFB9280B6496742BFF01163D8C65F84D9DA6B0D41436AA071BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 54560556ab16398016d6e40010166813ff19729029dcafbdc66014be3775c14b
MD5 526457fd89701159e32fbde83fb7464a
SHA1 844e5fa793cf9f79bd49a2fa48deee8f2a92a803
SHA512 a159cd7165f203c153ad5b8a90d6e34c67464efc49d8c53f1d25a21f11ca5314e5167e3393df78ee00f040353bfe88f09f48de266292d90a23e62ab5d1eac144
SSDEEP 768:34g3DO+zalieO4hbtZjinUPO4Qp7cPAiSm2eo4w4cciGrTFl52syxs:34g3DOYAntZjiwQpYoimeoR4ccFFj2sp
TLSH
T1ADF2BEB598B8DE736CFB9280B649A742BFF01163D8C65F84D9DA6B0D41436AA071BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 cde22174fb6e8e53f89f7edad0c397f340bcc7b8949149e959c9fbc852ba0500
MD5 8b0b385e78b79fc4715e8e57b3169a8e
SHA1 9c6ae12f48411619813cd718f5239efe05c06ab3
SHA512 fa81ac7a435e090c07a94d83d244ffa103746a8d37cd104c2d81c8971b8a704353d287fe2b1ba6af29b806e8440bab8d05ef62b472956dd0b1f1eb9a77ae4099
SSDEEP 768:QFQ/3Lwg2O+GaPuO4hbt0lKnUPO4Qp7cPAiSm2eo4w4cciGrTFl52syxs:D/3gOlBt0lKwQpYoimeoR4ccFFj2s8s
TLSH
T19F1329F598E79A36E8AE4783673D6E429EBCC153B4855984F7C51E4DCC421BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

a7fdf606-6d8b-4f06-b397-5ea52162471c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7fdf606-6d8b-4f06-b397-5ea52162471c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 d06ed6629e7b3999e4ddc7c264c3092ce67518d345bc49c2003f3e91cbbde976
MD5 a7f6ee563b9a6c21a09601c95a01a533
SHA1 d187fd256d027b70392b5bf5fc730b640f601047
SHA512 a5a8cf775f2ced04ebfe725999fd5a61029a210773495c588e8d67770d76ed49f0781dac9e2bd5236d086f00191813808dbb0589f9ceab8b68c86837812301cd
SSDEEP 1536:mE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:hEuSllYhhjm+kLZ
TLSH
T1707302516690F933E92E9F721B76C12CDFF8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 dcbe805b30a10d5c9a3d6b218dcd7c577b6d76b24094fb46057d103f30dbabe9
MD5 e576af7f274f64ecc758e7d11968ac80
SHA1 5748f2b4f7e39ec7e4e4f395bfc5689e9ef890e3
SHA512 14edee076161bc40471aff6c9db50bdeaa0927a0cdd8d94bce685cad88fb26e11998537bc182c147d5d9cd026be81bc11812316bf82983048c34ede87a4911ad
SSDEEP 1536:mE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Beh:hEuSllYhhjm+kLZh
TLSH
T1CB7302516690F933E52E9F721B76C12CDFF8E711C62EEF161A0ECC1D7C62255060C66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 713f2c6dfabeffb86ea0045d5f4a21df9c5ed791ed7d495a4546dccb258c9694
MD5 8226f4f784436f1b5db504626daf09fb
SHA1 fdeb7c95899603fb7a68520f15e3ac8b65187040
SHA512 0499bc722a2c7e88f96260928959800e93cd5624d2a17f90fe2439d366d2aea08689c63b49c8d9a4262fa9ced573bb64fea2f19e9975131635bbf7280a17faa4
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRiO:RL+bxmc+kHfrx83SAO
TLSH
T1D553F1A5A4948B3EE8D3FAB2DFB542709C3139FA4F9A42190F0D743E9779A800A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 a4fa4a3bce14fb24967149d2fb69744de19e909ae9b4eeb157fc0ffd2b02ba29
MD5 8b82aea7cdb7ee2b764cbe9e2b163b4d
SHA1 0cd56e498227bf348150912280a0029aa8d77e60
SHA512 827caa1c9a732d3a49954bc4fe5f3c33d43c1f2120488bd7ddd7fdc40bad3c876905787f31144e4ee13dfcd7d19ab1e879c39d9f114ac4960e63a43f25b864d7
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRit:RL+bxmc+kHfrx83SAt
TLSH
T16853F1A5A4948B3EE8D7FAB2DFB542709C3539FA4F9A42190F0D743E9779A800A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 871c0e6e5b70f51f43d37264f3a467f7542b6253004f44e6ccd183e5d7facf42
MD5 16d3c8e768997a6abc6c058dee8d7bc8
SHA1 40e250acb10e9f8b3bddae73f6043b4b6667d2e9
SHA512 f6d9a5fb6713913b6894e5c427ef32006931185dc7398ebf1024b7eca847b90482a59e1d15c9b0d54b29e26c9fe186e3eb865840b61f6df5790acc6bf1189333
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRiv:RL+bxmc+kHfrx83SAv
TLSH
T15453F1A5A4948B3EE8D3FAB2DFB542709C3139FA4F9A42190F0D743E9779A800A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 622B
SHA256 921b2e5d396620da902ff0ce9fde2d878bc88f4001582da138257528f28c17b5
MD5 1ee1b843957e65507fef29bba0875c09
SHA1 d6f3ea31740f116095c8c8cf145bdad756d3760b
SHA512 de123809efacba555b3cf2014fe06ec773e6ae2daa49c007048d7f990ae788a306e5cd1e490367ab08032ec598ada180d308fed0d61bd1c319ae4f6fee5fd034
TLSH
T16BF0182E5EE90156D6B7EA0264F68012B9B77D722835E80D02C24B8D1871748F920B6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 c806d43e8473475b9e30fd114fe39a326dca524bfab0cfd0a672de672716ae00
MD5 9828e6189df6ad227cb3bd6ba8e301fb
SHA1 16b766191cd09154a776af32e05c3f24a99a80f2
SHA512 40d5a5c4ede9a2c122cc3cd22440ab5438069564c8d6d2c8a2309be7a13e61b7318d9f260583133b751e1c3a51935bf1b52778d064ed081b9b984a0c4fd60e2f
TLSH
T181116C6E5EE90155D77BEA0264F68012BAB77D727835D80C02C24B8C1C71748F920F5B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 4bc78bf2b679ff104b21c3384f62eafcb04de4e7beeb37d17436675192977744
MD5 5e4bc415ec3c6c1f91980ff6339cf313
SHA1 c587d2ce07f282c13f5aaf3ba061b370ea9e6c5b
SHA512 a552bbcf8b23d13ea58f27b13686d6a1226b2b4256224270730717c3ed9ee075d5ea4dc9b0aa2e68b97f488a130fad81f51ff18b5e27fe3138374f0773f5cf8b
TLSH
T185213C6E5FE90156F6BBEB4254F68016BDB6BDA26835D80C02C24B8D1C71748F820F7B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 a6df4feebfde1fc8cc4986543710f7d3789521d8885184b08faadb5cc4756b51
MD5 ca9059a518f20ec1f38f28e28370304c
SHA1 6c8726540b48bfdcb406fcb94048cc3b31cc343f
SHA512 577b23e2c2d76d7d7c838b84c92bcbdf1a9ff6befcbcc26a4c853955270517268b2cf5138bde664a7d1509bba84dee011cfe09592f7a3cfed9c6f0c8c9fb4384
TLSH
T1C3215E6E5FE80156E6BBEB4294F68016FDB67DA27835D90C02C24B8C1C71744B820F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 c8b77fc918d1e0722e10cd2ec7ade65e6d9fae58e61f41457b474903883df283
MD5 d142f3c14f70a63ba412256204dfd0e5
SHA1 4fc52d13c97ae76ff22872ee711cecc2e3dd8ccc
SHA512 38de23cb73061f368c737ee5a30c1584ecfe53cf8a6cbd045ac8fbd53bd13b77d68fa4e7e20456301188727941601a0bc383d2d319a5a6e6095fbd23bf37b3da
TLSH
T195414A2E5FE90196E6BBEB0394F68016FDB27DA16835D80C02C24B8C1871748B810F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 dd695c68d55d192e89108a83446646424a86b29bf40e33725e5eb74b469beb15
MD5 8ace651aed418c3077f7e4b34d9900f3
SHA1 825ef69b54a222daaee4724d37ce274fd1533bdc
SHA512 10797cb46ef863f7949a458978c9da0b81060189384a5e7248df920511abee669417a6ad5f2851392c977a4bedf02f2481fc5196255d0a2c6e8f2bcf5147ff45
TLSH
T1ACF0122E6EF90156D6B7EF4268F68012A9B7BD622835E40D02C28B8D1871748F920B67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 da1208324eac61035238eb3b682c746d336ba862169b64028b115b58c5ce96af
MD5 ab369d5270741d4ed2020083ba6dd4e8
SHA1 52a81f11f3dec79f0a6f10aaaa869a263aac218d
SHA512 f7988c6fc9c006786b55ad32285daa31716d5fc4844e873b016e4d10982f46257d1e7a24468c51a816939de5087e1f2c65de9e6a814baf1004bd5fadd9f42b24
TLSH
T13441382E5FE90696E6BBEB0394F68016FDB27DA16835D90C02C24B8C1871749B810F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 0ec36094e64a239b3b8140599b048f5974fb8e14068b842abc3ceaf864583b4e
MD5 af6d29d4eb72681d5e9a9dd573c77ae5
SHA1 440fb717955e83360e5877a334376e66804eea93
SHA512 c27c533817141ba770262d399678c17820e199c4eed4dc6487ac1ea8efd61effb10a69b579b65bc0070b8ea981f395803afd85a0f35a0abdb1ef1126fd3c41a2
TLSH
T10551572E2FF806A6E67BEB0394F68417FA767DA16875D90C02C34B8C1871705B914F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 daa8cc8871aded2cb5a725e679f3745f5426ea909933444fc4670a2c2c5b43b7
MD5 661be41ee8aeb30ac79b3e709d5aeb47
SHA1 ec652ddbc92f64cd27e81f99bfa3ba4bb9b70f58
SHA512 23c8fe5fdee4d7d42cc7f3954f6f1d23ff7fed701048782d4fbe8381e594f0717dcf73b47c02c5e7c28c76256cc8926650186aea3dffb53e10c1689d38e82061
TLSH
T10B71682E1EF801A6E67BEB0394F68017F9767EA16835D90C02C34B8C1C71705B914F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 0621926f420297f7e3d6fb38c4bb7709a1c19ce55f57b5f5ae7b578cae3f8b50
MD5 bcf99160bbe91555fb028898f73ca695
SHA1 942e3be868a797e504357677a298ff3fe0d0288e
SHA512 080e59dba4b82c266104514f4f5fa230ba0bd46dd1012c716d13f25723a6cb061480b504c22b6eb363be7923793a00d250c117bad02fa7f0b7c2e67a8a07bff5
TLSH
T1F081582E2FF802A6E67BEB0394F68417F9767EA16875D90C12C24B8C1C71705B914F6B
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3000_48488643\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-86-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/900-90-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2400-19-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2420-37-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2980-77-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2980-69-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3204-291-0x000001D355880000-0x000001D355AC1000-memory.dmp

Download

memory/3332-46-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4048-10-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4196-263-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4628-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4940-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4940-4-0x0000000000400000-0x000000000042C000-memory.dmp

Download