a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b.exe
Size 135KB
Sample260930-e64afsswd1
SHA256 a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b
MD5 a322a2c5cebf9ce786736ce6d5968dce
SHA1 6f765c6a6bb712bfb592d7b153772e85cd14c368
SHA512 20a1bff8d85d77506672d83bae7ffbbc9a1b376bff0fa56d80ef44f420759256640cd87887a65a901f1f9a957ce8189128b424099f9b5e55c2c2fe28c33372aa
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0y:nqZ4h4fIqPWQd/4KUNNFZ
TLSH
T187D32849EB8310F0FE6701B010AAEBFF5236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	2720	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
4844	Eupdate Helper.exe
5380	eup_rotate_4844.exe
5184	Eupdate Helper.exe
4812	Eupdate Helper.exe
5636	eup_rotate_5184.exe
2720	Eupdate Helper.exe
468	Eupdate Helper.exe
2592	eup_rotate_468.exe
5304	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001b883-61.dat	upx
behavioral2/memory/468-67-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/468-75-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/2592-86-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/files/0x000d00000001b883-82.dat	upx
behavioral2/memory/5304-261-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2384_500325739\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2384_778416658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2384_778416658\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2384_259412663\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2384_500325739\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{BB9DE8C4-882A-4A13-94D6-C53EADEC7ACD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4844	4104	a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b.exe	88
PID 4844 wrote to memory of 5380	4844	Eupdate Helper.exe	89
PID 5380 wrote to memory of 5184	5380	eup_rotate_4844.exe	90
PID 5184 wrote to memory of 5636	5184	Eupdate Helper.exe	94
PID 5636 wrote to memory of 2720	5636	eup_rotate_5184.exe	95
PID 2720 wrote to memory of 468	2720	Eupdate Helper.exe	96
PID 468 wrote to memory of 2592	468	Eupdate Helper.exe	97
PID 2592 wrote to memory of 5304	2592	eup_rotate_468.exe	98
PID 2720 wrote to memory of 2384	2720	Eupdate Helper.exe	99
PID 2384 wrote to memory of 3436	2384	msedge.exe	100
PID 2384 wrote to memory of 6124	2384	msedge.exe	101
PID 2384 wrote to memory of 4644	2384	msedge.exe	102
PID 2384 wrote to memory of 1908	2384	msedge.exe	103
PID 2384 wrote to memory of 1908	2384	msedge.exe	103
PID 2384 wrote to memory of 4644	2384	msedge.exe	102
PID 2384 wrote to memory of 4644	2384	msedge.exe	102
PID 2384 wrote to memory of 3068	2384	msedge.exe	106
PID 2384 wrote to memory of 5668	2384	msedge.exe	105
PID 2384 wrote to memory of 3068	2384	msedge.exe	106
PID 2384 wrote to memory of 3068	2384	msedge.exe	106
PID 2384 wrote to memory of 5668	2384	msedge.exe	105
PID 2384 wrote to memory of 5668	2384	msedge.exe	105
PID 2384 wrote to memory of 4908	2384	msedge.exe	107
PID 2384 wrote to memory of 4908	2384	msedge.exe	107
PID 2384 wrote to memory of 4908	2384	msedge.exe	107
PID 2384 wrote to memory of 1612	2384	msedge.exe	108
PID 2384 wrote to memory of 1612	2384	msedge.exe	108
PID 2384 wrote to memory of 1612	2384	msedge.exe	108
PID 2384 wrote to memory of 2864	2384	msedge.exe	109
PID 2384 wrote to memory of 2864	2384	msedge.exe	109
PID 2384 wrote to memory of 2716	2384	msedge.exe	112
PID 2384 wrote to memory of 4128	2384	msedge.exe	111
PID 2384 wrote to memory of 2716	2384	msedge.exe	112
PID 2384 wrote to memory of 4128	2384	msedge.exe	111
PID 2384 wrote to memory of 5448	2384	msedge.exe	114
PID 2384 wrote to memory of 3740	2384	msedge.exe	115
PID 2384 wrote to memory of 3740	2384	msedge.exe	115
PID 2384 wrote to memory of 3344	2384	msedge.exe	118
PID 2384 wrote to memory of 3344	2384	msedge.exe	118
PID 2384 wrote to memory of 3364	2384	msedge.exe	120
PID 2384 wrote to memory of 3920	2384	msedge.exe	121
PID 2384 wrote to memory of 1312	2384	msedge.exe	122
PID 2384 wrote to memory of 3224	2384	msedge.exe	123
PID 2384 wrote to memory of 3224	2384	msedge.exe	123
PID 2384 wrote to memory of 1300	2384	msedge.exe	127
PID 2384 wrote to memory of 1300	2384	msedge.exe	127
PID 2384 wrote to memory of 1028	2384	msedge.exe	128
PID 2384 wrote to memory of 1028	2384	msedge.exe	128
PID 2384 wrote to memory of 1660	2384	msedge.exe	129
PID 2384 wrote to memory of 1660	2384	msedge.exe	129
PID 2384 wrote to memory of 3188	2384	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b.exe
"C:\Users\Admin\AppData\Local\Temp\a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4844.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4844.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4844
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_5184.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5184.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5184
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_468.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_468.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 468
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffbc0a3c188,0x7ffbc0a3c194,0x7ffbc0a3c1a0
        8⤵
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10470190801970738391,5753775647577910649,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:6124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,14953723390289600201,12848658579347071682,262144 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
        8⤵
        
        PID:4644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,16185242786226452398,16562192235533129228,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
        8⤵
        
        PID:1908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,8307420763753932614,1820659068197587223,2097152 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
        8⤵
        
        PID:5668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,2874295512845636016,13283108836379191896,2097152 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        8⤵
        
        PID:3068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,5876056187850229263,6782890769155535919,2097152 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
        8⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,11287672965380688236,11297723285375098294,2097152 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
        8⤵
        
        PID:1612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,475281485301946134,9160952188493555386,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
        8⤵
        
        PID:2864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,12542143982217267751,4457847877860148666,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
        8⤵
        
        PID:4128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15017707956434685336,14465097588615874102,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
        8⤵
        
        PID:2716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9345008913772388661,5699145830345067171,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
        8⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9345008913772388661,5699145830345067171,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
        8⤵
        
        PID:5448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,14473482569248851632,1172639249536887088,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
        8⤵
        
        PID:3740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,18081385241157233225,2431994376807308573,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
        8⤵
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,15555907341517171884,13987234703194994656,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
        8⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,9946436405215082442,3114612912899379210,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
        8⤵
        
        PID:3920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,15630140041798492426,16442521731322999929,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
        8⤵
        
        PID:1312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,14091626788403332171,1689846902487997932,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
        8⤵
        
        PID:3224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,10159999748296570153,17769550023699060574,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
        8⤵
        
        PID:1300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,16041780220661376302,1694241996774864882,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
        8⤵
        
        PID:1028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10546899072828572729,9510676548648429738,524288 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
        8⤵
        
        PID:1660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6752,i,2042143297778694307,3228434591434303993,262144 --field-trial-handle=2400,i,15853397992779177679,15064292741733173409,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3188

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

604eab03-8e10-4888-8393-33df1c1e410a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\604eab03-8e10-4888-8393-33df1c1e410a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 46b92796f487ffd8ab15fbfa2a96a3d4354f1fc76e5c3617884437b79c3fa044
MD5 27babd57e5c3a878be2e0cb1ea56bc82
SHA1 0f05090ca86c42b46c9e92e0190c70f6896784fc
SHA512 668d2846260bfed881d8fba6029f52eee571a239f4353996e76a678138090e8e17b5a6544815da68705bfb46f9f4674f23f3ba1d26f5b3176ffbe6520d41768b
TLSH
T105514D843F603CE8EB994930F1F591A33AF44AF4478B9E0265A4FFB9B727B0151E4066
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

59487c09-3f04-4ef8-b363-fa1b75ec701d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\59487c09-3f04-4ef8-b363-fa1b75ec701d.tmp
Size 2KB
SHA256 6eec16db9c0aa425f5695723577dbedbd7a4748bbe93bb29ce59f4c1a4e33c91
MD5 0ed8173b7105b476a4ee5bf208dbc239
SHA1 d81912567fd31a809e08d2b79ac4e203b5ed06d6
SHA512 a2bf8d29592058da24c67b067d984fa9b6587fbaa20daa9069d3d7147e78d45f20ed701b7c09f30e6cc60922069b4a523d914452cbd4c4918bcf8ebafd3263f6
TLSH
T1F1518FF3C3E8866E890196F0AA186E2BDE2D0915432C7D5AC5E49F1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 29e2ac1778b7b6d03a68fb28294295ace3cc924f8ed0a5547ea7903b3f658933
MD5 b250ed1e4c3214cc509225236375d2dc
SHA1 3513c0b5d967a49fb66faa1f3a5629a7daa4bb42
SHA512 9f9c366c976167d29144fedde66206f26c88d015a393a7f749be7627ec23defe293b8c5c57c86fd7978088712884bdce6b1dcf770fa9974d1d05d9bb7c0fa5fd
SSDEEP 192:sxR8RJCW/fgsFMZdy8zoA8pUr/g6+WNQW+/Ylac26aG8IgDhKJ:sxR8mW/fgsFydyti/5Q/FU
TLSH
T1F642DA15AD68A97B4CDBE21DBB557F63E2F9103260C01E48A7FD9A1C04E76DE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 66fb8f106457e6fe23d06e5a5d72a22a80a2ac802ff4a09b7bab009fda947d4a
MD5 c6a9d8489aeac360fe1f7a32e15b9788
SHA1 009c12ef9afb2fbead29fedb09d057b94c63fa6f
SHA512 003935dbcd875810a86e633fd1636c313a441b1e39cf69fc6e5f14f4d414393b83c1abc5014f199669e961fe678ac1dcf2f636a5f5432dffc04b3f12d6e2fe13
SSDEEP 192:sxR8RJCW/fgspMZdy8zoA8pUr/g6+WNQW+/Ylac86aG8IgDDKJ:sxR8mW/fgspydyti/5Q/xW
TLSH
T19142EA15AD78A97B4CDBE21DBB157F63D2F9103260D01E48A6FD991C04E76DE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9ed67ded210e332770d10da34943c6a2f89b8d81c893abfbe870fc642bb7f389
MD5 0dc501c3f63f5a38e80ce39238dfa8f5
SHA1 029447b00125bc4d788a52b23fd36a633228c864
SHA512 addd002a6c5bad09682a3ebfd94ef8e9001eac03f0ca479dd36cc8fb4fa39bc2e91238bf51156ef97dbfcda2899b94c74b0d540b9ab4629d1d8e868dcd75dd4a
SSDEEP 192:sxRPRJCW/fgsTMZdy8zoA8pUr/g6+WNQW+/Ylac86aG8IgVKJ:sxRPmW/fgsTydyti/5Q/x0
TLSH
T11042DA15AD68A97B4CD7E21DBA157F63D2F9103260C01E48A6FD991C04E76DE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 cefec46b131a2a4b6b4055ff4e65415a971b229fc4bcf379449647f6e496df96
MD5 037db002a4948c5a7da27def086a7d63
SHA1 88860561b5366dec13e0c79c36b77cba0e661d86
SHA512 893d919283664f485d8e221571276b3856131857732d55b05195308d5df51d359aa3f3edac4091307a1dd0e9f05f723fe1c42c1413874e06d8b7a782c519d4de
SSDEEP 768:ksRdnG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+y+2+geroe2qiC:ksRdnmEb0JWgSwffTu1jaZy+rg1e2NHi
TLSH
T1C0D2D97B680CCB7F4F804ADDD8197A9B6DAC02CB9698CD8047FE941D02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e55f4ecd5aa7344f70c628455896a647134f6c3b0d3cec59786ac7c916fba2b3
MD5 e5b2e785e7e0ab333720068ce636d3e0
SHA1 b58f52714a7f5baf248981d61ea459ea6d47abba
SHA512 65bf8c89be2045a6e5aa2ecf534796bf1a6f0b6f913d9a5a972edd92dffff120edc6ae0bd60786376722f6b2bb72fa6ee9ef28d11693733193a3e5e71d5f82f4
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyLtMBdvbfAbzGTISVAK9V13AxFQYWXTA:KAhCKigCKqEKzikgAKxyWB
TLSH
T18E914450357B4204787D394882A8972F465136B7701AEA3B7FBC44B58E2FE099EFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60256190-7e83-4c2b-af0b-ba74aad301e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\60256190-7e83-4c2b-af0b-ba74aad301e0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ce511c75d05598da643c05a05005f3559730987b3c9d12adfef83442faf7c524
MD5 be715d09a2d8c201096921ce8d4920e8
SHA1 5072821f40d5f1e3c9539d2efe0309ef2f2d8548
SHA512 1f513ff87aa5281469e5199b7a31d3c99c42682bae775ced2a12fc46ea72813ab83aa0496f45f33a2225fe0369d597f785ff51eccf50b779b90c341bc0027c59
SSDEEP 768:TV3z7VSFajUU6OnqMwQi5BgK5/CwYcZY2s4l5:TV3zr5VmBg8/dG2sk5
TLSH
T1FBF2AD31ECB58EB75CFE9244B2867786AFF812A3D8944958C4DA5F0D05939EE130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 41c473ef6d28270fc6a0c83e8dfe4d895335521ce42b6add9c2f03dfb2fbd1f6
MD5 4d0aa65660eab908f79b2e0c5c022de6
SHA1 a4b6c02ebd7bcd53867cadeb7e891f7e51132228
SHA512 eaf6fc037d2d4d12869052d2159694b97ca2c0b6ac00f3338c650a9f34f85ab9e562bf23dab268247d5e7a9c349e69e6f7055b7b6327e811ac9c37331a8678d2
SSDEEP 768:O/UxvxjgC+Ft3ozjSFajUpnqMwQi5BgK5/CwYclPA8Dea:DZj3+Ft3oNCVmBg8/ddA8Sa
TLSH
T1CD03C036ECB49D778CFA9254774A638BEFF451A3C484089889ED2E0E06C7A9C530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 eb1c4135b1440563876ca83a6b49213bfcc13eabb3b2fe54c3b94b3acd775dbd
MD5 b6e53bbd61797f974d580f9d88520867
SHA1 6afbe4148ac5f1cf44d8fbdaac3179c650da68f6
SHA512 6173c1aa4e21b9ac6760ba1a7512cb7d9efcf7f494e72efe0fdd9ae3338957b0cb1449cbfb5f3d399a107fc7367596bf2119fd072cb8a54a820e5a58c53883d1
SSDEEP 768:4V3s7VSFajUU6OnqMwQi5BgK5/CwYcZY2s4l5:4V3sr5VmBg8/dG2sk5
TLSH
T181F2AE31DCB58EB75CFE9244B2867786AFF812A3D8944958C4DA5F0D05939EE130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 dabc87247f44a661585aa82c2bdf84906545c5942604dc1040d2d8910b8866dc
MD5 6a5cf4c4b77b28b7439bfa07bab3c4fe
SHA1 1261403548b5929fce3ad008f9789703595747fd
SHA512 6675ada86ac64ea60b4695bec8358658e5b0d3da576685c1e7e6565e366cc378263f834d69b8bc4200f049b1f3ef482cd8d68470a773d9a819e3e5a66e91784a
SSDEEP 768:RV3f7VSFajUU6OnqMwQi5BgK5/CwYcZY2s4l5:RV3fr5VmBg8/dG2sk5
TLSH
T1ADF2AE31DCB58EB75CFE9244B2867786AFF812A3D8944958C4DA5F0D05939EE130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1677f66b460e665e04bf6b69bfed977f5965e325ea186b78fb0331b8cf4aae45
MD5 073e5131af01b8956ccbf51986ccf771
SHA1 4734f2e32d78271c9ac66f7bf98822cd043a9a28
SHA512 570fec7d63e2d7879a1eac3faed45a4afeb7c49c367318862068b5deeb021cf288b5dca143be7e7890b61404001482ef1a9fc2110fa0f0c7feac7fadb950fd1a
SSDEEP 768:8FoT3RwgaWVglajUU6FRnqMwQi5BgK5/CwYcZY2s4l5:BT3q68RVmBg8/dG2sk5
TLSH
T1861307F198E38A77D8AE4783A77D6E469EBCC163B4984884B7C55D0CCC825BFC30A845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 b05ea19c128beead6119b0186474a1cb9b016a808e096ee6e92216de01fbb4f4
MD5 e3db1f0ec2fed7e0de83fceba555d35a
SHA1 7ed69600412f8fc7c082c68183b79298d9463be6
SHA512 10dc179fb354f6123eded919dd3f04df60ee0917fe75622e0770cc5abd975f02c222ad22cc4b3283e159d516034e8b9afa4866a354d16661a73a6be1a5b78ad8
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0B:nqZ4h4fIqPWQd/4KUNNFu
TLSH
T17FD32849EB8310F0FE6701B010AAEBFF5236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 a33fe3361a00f6ee3bc9eaee762788d33f063c8b859f1189c4bfc10a1e79078b
MD5 a322a2c5cebf9ce786736ce6d5968dce
SHA1 6f765c6a6bb712bfb592d7b153772e85cd14c368
SHA512 20a1bff8d85d77506672d83bae7ffbbc9a1b376bff0fa56d80ef44f420759256640cd87887a65a901f1f9a957ce8189128b424099f9b5e55c2c2fe28c33372aa
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0y:nqZ4h4fIqPWQd/4KUNNFZ
TLSH
T187D32849EB8310F0FE6701B010AAEBFF5236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 0d477de90eaa767cdf62555d23530866d8bfe9eba81c611aa10a9c06db48529b
MD5 50af8a2d6f9e3c58442ca09a76a7c286
SHA1 768c07e18f105ec96a27c84c3d1e8dbb0ff6fb8a
SHA512 dd3c1456a4adfb59d1ac7f9acba3a16cc2deac22beeeaeea1f75d8fee9d28d42e3245e15ce4e9b20fd0d205e10d1c07f1cccf68ba6c963b06adf6921989ae942
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0d:nqZ4h4fIqPWQd/4KUNNF8
TLSH
T1B1D32849EB8310F0FE6701B010AAEBFF5236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 5461304be79617fb21b2f99ed782f1fc561ec10563fe1bf819d687e9345e7dfe
MD5 fb16c0ec9d37d1b5b58cafd01989b155
SHA1 bffda7d7f10ac9a982272ecb4bbb6df6cea43b94
SHA512 8dbee72b2aa49fdbd85226e4832b031d57e68e1f1654797275141f7ef3a34d0294865b0be723bd7c50fa1d69a29db9d38a2abc624c3b32bb43265b1aa12b9d26
SSDEEP 1536:PE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:2EuSllYhhjm+kLZ
TLSH
T1E77302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 ed968b06ec7ea8ff3ca906eb48b8c69ef69d109e169ff003a47e9493cbc2b696
MD5 38def97cba42037ff813efd812ff39df
SHA1 9f73a8488baf6cb7a5eca436c349ea7205ee98f5
SHA512 7e7da068edc006cbc9fd569523ea9909ed04c62c4134d01517eb64ca2439d2c2ad571685ba9d6b1e6806cc5fc40f829bd1a5e84dd0fd0b3e1ba2b40be10905fc
SSDEEP 1536:PE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3BeA:2EuSllYhhjm+kLZA
TLSH
T1477302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2215060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 712B
SHA256 7292a156b98d1d6585824fc7548bdbd16c4e076bd8ae6bec4a7741d9f662c7f9
MD5 f52e2601ed36a61d698c1addecf0786c
SHA1 639f0aff9e48f9cf2465166e1afa0e26a8ba5b0d
SHA512 3d788565bec303f822e9a1e7c172d66f9f7aa2f7fab6200e54418ac8ae9b7aaac2ec3d174bdd180bd8adb2ea2abcde9cf39a1dd081ba52f026ae0aa7dabc2f50
TLSH
T14701811A5EEA0566E6F7DA0258F360135A767EA26835DC0D13C08B8C1CB2B14F820F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 922B
SHA256 08bdcb3ad8b4fbc9664ca76b4be14430b72e9c0e66a998bba820648d1f395b36
MD5 7ee280241615c91b089ce0f52eb1411e
SHA1 1918b1a28e90ea443d538db54d8f291116804476
SHA512 f7dd3abf229a4eb79d1774cf2f8add6a0301fbec6e5c8520f083ee8633987d7234e8728f68ef71909d823ae373458e25f9c204fe2e21b3cb3d4f9c44f76a950c
TLSH
T1DB1184265EEA0566E7FBEA0258F3A0135B7A7DA26C35DC0D12808B8C1C71B14F920F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 2c70737b61e1cd412dcb70d7e5f24a2c7e79a8b0500ce8cdb1376ac712220979
MD5 8fea9264951328c15a58e40ec7007e54
SHA1 4612e27c44bc59b7cd83ffd2b92f361f2889bbe4
SHA512 5c725f085abbe9f6428ded0c1531d892c2464cfa243d2e559d1f9cd6ef9cc068769584c027a5069b1ac469b66d71bead107696f55ccf943e2ed627c8ba52161c
TLSH
T15C21A2265EE9056AF7F7EB0658F360176E76BDA26839DC0D1280878D1C71B14E860F37
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 745c6e0a992ad1e74333e30a8a3334fe45b6c973ccfa1c073dcd7b71e5c88bf4
MD5 0f78afc7e3c1ecf777be55ab39827191
SHA1 ffea447aa234ab9abed157dbb17a33144685aecf
SHA512 5bb5c08dbf80120371b8cb7f0e29fad298c58e381f8e1a9b45e51cb8c5f8a2282ef8624aa3d6a23044cb01158f8a455dabdff5223e7c874d02e1f053db8351ae
TLSH
T14C41771A0EFA0566F6F7DB0258F364176A75BD926835DC0D12C0878C1C71B14E960F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 49f5fcd7bdfc2c12488b77e697e86bc628551ad23e470e8e53c401f23d1837a6
MD5 dd054ae1e2dbbc67d4f42537edbaa087
SHA1 950e48ef3ab43acec761dd0eb5f84576310f8f6d
SHA512 4206023d7fd223d098764ec860b5827329ded20278c0ae54255d6605595e120b6947929d663cabc0a7deace55681c979a03b8ac9ee0b0ec9055af9dc4bd9136d
TLSH
T12941971A0EFA0666F6F7DB0258F374176E75BDA26835DD0D12C0878C1C71B14A860F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 44036cc18c52724d8e2a9d448beb0d564b5da77b7f2bf860fee7d870e5ab124c
MD5 26e4227fdecd7040edb9a36b035d4441
SHA1 2d12212b81a8f491edc2836bc47997202fada9d9
SHA512 8cdb500409a01995c3c9332f7f0834bf82cf7d574b8269ef172e10e292e250d0238945ffb8e147eb0c6a1c315d3b79f599a1164565bb84c17f4df61a96a99e64
TLSH
T162F037165DF60566E6F7EF4218F260135A76BD622835DC0D1240878D1C71B14ED20F73
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 7948bee486e4e26eb6ca870922be4ffe30bf48f1ff7873ab25cc45d03d4dfc52
MD5 7ba081b8c144fd91a1d802097050bb93
SHA1 05fcaedf93bfdf92fcfaa888468c1e5cb671121c
SHA512 6c12aea010616f8a0f7c96b8c6580f553d5b1c2b4bd964954059a927226043fdea5b9eddbc78095dc04abd271a4b9fd5c4c67c517736766f8106d38fc6e90d39
TLSH
T14051C72A1AF90666F6B7DB0348F374176B367E926835DD4D12C1878C1C71B18A950F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 16cfd26225fca02306e67d19d9d6d62a6a26c384c19b02f5c71b2f5e8b00d864
MD5 b5f42718220f8d146728f504dff0cd6c
SHA1 19a216105163d93065351552ffde3862ed750486
SHA512 c32397692e0de77487893506e1de4cc4a351c46d481fa048f7deb132e7eae7f41c3f21e2cb7cbc61ecb4f978d86a31e4282981612ab8ac99668f9c49a2a02619
TLSH
T1B071C72A1EF90666F6F7DA0348F374176B367E926835DD4D12C1878C1C72B18A850F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 c542c91739597623f36f1fa875718f6d32b8fcfe9c48478efda00d5b59a2279a
MD5 72240684a9b9e0ceb78df16d64ea9a7c
SHA1 9cdff631f913caca98ae649c10848b55d4d375bc
SHA512 6d9c5c774e98ef9202d65de89cba05b088503d203eaa3a8a18d767b3e05cc70bf8211acab08fdc6985e480b08735fc912534c7ce8573299feebe597c01717897
TLSH
T15671C82A1EF90666F6F7DA0348F374176B767E926835DD4D12C1878C2C71B18A860F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 9e629921fbe09c729c246e7983f17e9226b903368dd3bb19631e0a838dc634da
MD5 9a674d9489bc283371ccbd662cd4f5ed
SHA1 efe5bd1a01c9b905f69dc2f4e6a287a32d58468c
SHA512 bbff4f9c8d668e076bc4f780245ccc51510c82594221745ddb393b3acf64c147389e56e2e87cdd58b9f9fb61ea10ce05a767d45ee3c868af52a50cb79f0045c1
TLSH
T1C181D92A1EF90666F6F7DA0348F374176B767E926835DD0C12C1878C1C72B18A950F2B
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2384_804785575\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-67-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/468-75-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2592-86-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2720-87-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4104-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4104-0-0x0000000000424000-0x0000000000425000-memory.dmp

Download

memory/4812-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4844-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4844-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5184-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5304-261-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5380-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5380-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5636-44-0x0000000000400000-0x0000000000429000-memory.dmp

Download