881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0.exe
Size 135KB
Sample260930-e81x4stt2n
SHA256 881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0
MD5 ad033bed915f517ed7980929a8bb10af
SHA1 5f16c13104b943974a7d066a38f7f513b45635c0
SHA512 ef592ae57a4295e72f65d50d477aa6982496537035b81b51ec9e4b4a05f51e2c8b02b11e0368cef469290f84e9dec9183129e0e9f9186a5743847d25d4f43da4
SSDEEP 3072:dNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0A:4qZ4h4fIqPWQd/4KUNNFn
TLSH
T115D32849EB8310F1FE6701B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	3712	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
4548	Eupdate Helper.exe
4440	eup_rotate_4548.exe
1372	Eupdate Helper.exe
3012	Eupdate Helper.exe
3956	eup_rotate_1372.exe
3712	Eupdate Helper.exe
1384	Eupdate Helper.exe
5752	eup_rotate_1384.exe
4176	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c58e-62.dat	upx
behavioral2/memory/1384-68-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/1384-77-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/files/0x000c00000001c58e-84.dat	upx
behavioral2/memory/5752-86-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/4176-267-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_648894988\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1139369089\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1059495583\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1059495583\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_803321598\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_803321598\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_803321598\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1139369089\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_803321598\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_1372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_1384.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4496	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{FBC6FF89-F8AD-45D8-AEDA-F013745701B4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3128	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4548	3392	881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0.exe	88
PID 4548 wrote to memory of 4440	4548	Eupdate Helper.exe	89
PID 4440 wrote to memory of 1372	4440	eup_rotate_4548.exe	90
PID 1372 wrote to memory of 3956	1372	Eupdate Helper.exe	93
PID 3956 wrote to memory of 3712	3956	eup_rotate_1372.exe	94
PID 3712 wrote to memory of 1384	3712	Eupdate Helper.exe	95
PID 1384 wrote to memory of 5752	1384	Eupdate Helper.exe	96
PID 5752 wrote to memory of 4176	5752	eup_rotate_1384.exe	97
PID 3712 wrote to memory of 3128	3712	Eupdate Helper.exe	98
PID 3128 wrote to memory of 5768	3128	msedge.exe	99
PID 3128 wrote to memory of 4496	3128	msedge.exe	101
PID 3128 wrote to memory of 5708	3128	msedge.exe	102
PID 3128 wrote to memory of 5708	3128	msedge.exe	102
PID 3128 wrote to memory of 4012	3128	msedge.exe	103
PID 3128 wrote to memory of 4012	3128	msedge.exe	103
PID 3128 wrote to memory of 4012	3128	msedge.exe	103
PID 3128 wrote to memory of 2240	3128	msedge.exe	105
PID 3128 wrote to memory of 2240	3128	msedge.exe	105
PID 3128 wrote to memory of 5644	3128	msedge.exe	104
PID 3128 wrote to memory of 2240	3128	msedge.exe	105
PID 3128 wrote to memory of 5644	3128	msedge.exe	104
PID 3128 wrote to memory of 5644	3128	msedge.exe	104
PID 3128 wrote to memory of 5836	3128	msedge.exe	106
PID 3128 wrote to memory of 2392	3128	msedge.exe	107
PID 3128 wrote to memory of 5836	3128	msedge.exe	106
PID 3128 wrote to memory of 5836	3128	msedge.exe	106
PID 3128 wrote to memory of 2392	3128	msedge.exe	107
PID 3128 wrote to memory of 2392	3128	msedge.exe	107
PID 3128 wrote to memory of 4512	3128	msedge.exe	108
PID 3128 wrote to memory of 4512	3128	msedge.exe	108
PID 3128 wrote to memory of 3744	3128	msedge.exe	110
PID 3128 wrote to memory of 5312	3128	msedge.exe	111
PID 3128 wrote to memory of 3744	3128	msedge.exe	110
PID 3128 wrote to memory of 5312	3128	msedge.exe	111
PID 3128 wrote to memory of 4652	3128	msedge.exe	113
PID 3128 wrote to memory of 1344	3128	msedge.exe	115
PID 3128 wrote to memory of 1344	3128	msedge.exe	115
PID 3128 wrote to memory of 4828	3128	msedge.exe	117
PID 3128 wrote to memory of 4828	3128	msedge.exe	117
PID 3128 wrote to memory of 5148	3128	msedge.exe	120
PID 3128 wrote to memory of 1508	3128	msedge.exe	121
PID 3128 wrote to memory of 5612	3128	msedge.exe	122
PID 3128 wrote to memory of 4184	3128	msedge.exe	123
PID 3128 wrote to memory of 4184	3128	msedge.exe	123
PID 3128 wrote to memory of 4016	3128	msedge.exe	127
PID 3128 wrote to memory of 4016	3128	msedge.exe	127
PID 3128 wrote to memory of 1816	3128	msedge.exe	128
PID 3128 wrote to memory of 1816	3128	msedge.exe	128
PID 3128 wrote to memory of 5380	3128	msedge.exe	129
PID 3128 wrote to memory of 5380	3128	msedge.exe	129
PID 3128 wrote to memory of 3320	3128	msedge.exe	130
PID 3128 wrote to memory of 5024	3128	msedge.exe	131
PID 3128 wrote to memory of 5024	3128	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0.exe
"C:\Users\Admin\AppData\Local\Temp\881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4548.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4548.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4548
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_1372.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_1372.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 1372
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_1384.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_1384.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 1384
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbc023c188,0x7ffbc023c194,0x7ffbc023c1a0
        8⤵
        
        PID:5768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,11919816891454372328,14380844432413486375,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:4496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,1195054623757700286,15998339931373004721,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
        8⤵
        
        PID:5708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,7279429851814562549,12659021700117432560,262144 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
        8⤵
        
        PID:4012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,11874029378216753209,9158715350305207211,2097152 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        8⤵
        
        PID:5644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,3764593111065948131,3056451646472253626,2097152 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        8⤵
        
        PID:2240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17352141612405999396,1458984391378575752,2097152 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
        8⤵
        
        PID:5836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5741809653583165009,16512094679395683506,2097152 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
        8⤵
        
        PID:2392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,1604595571798850844,17964109403345152873,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
        8⤵
        
        PID:4512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7714823010974508419,7296664705469607028,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
        8⤵
        
        PID:3744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,15976265101359936855,1961753197200787778,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        8⤵
        
        PID:5312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,5393648334324712431,12118935123329858704,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
        8⤵
        
        PID:5940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,5393648334324712431,12118935123329858704,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
        8⤵
        
        PID:4652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,16635041027654028413,1941715954887793925,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
        8⤵
        
        PID:1344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,15797402841315746998,18288123580697225578,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
        8⤵
        
        PID:4828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,12606731346659341323,17307389096414791636,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
        8⤵
        
        PID:5148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8920221441334705063,16319010823871450806,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:14
        8⤵
        
        PID:1508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,14024201291339954568,12534523718288998071,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
        8⤵
        
        PID:5612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,2814097372823205816,12084681308693664207,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
        8⤵
        
        PID:4184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,8045770953936175413,6121542026153281199,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
        8⤵
        
        PID:4016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,2683787712624610346,10792818355724517117,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
        8⤵
        
        PID:1816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,1825179241544279511,14875105723887268275,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
        8⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6464,i,2298964356524175584,4958960868561821106,262144 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,1805767046728370390,13582525581291429187,524288 --field-trial-handle=2512,i,3144032057111044842,4127493866338771374,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:14
        8⤵
        
        PID:5024

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 286fbb7e39b67dfc6bdbd83e686b19f2b80d22ee14369e67939caebe04c616e0
MD5 53f592c63cae4e5ca6105797314df6fd
SHA1 f4833b4ec83b6c4a57e0681f590030c5d2aa6e3c
SHA512 65b5b7580280b5f785269f2ea7b0d2f72dcabf5766cde08020f8d91c6eb805f6ee06413222820e5bc1c9a714f4710ee7a11b87d6c49e34785c0cff57377ab009
TLSH
T16251A76353939960FF6C48B6E1C82B8F3733C5B2544F1D920466D4BD7B4E3685436C68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a81b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a81b4.TMP
Size 2KB
SHA256 fabfa71bc2f0af829489e437e5bd739681bec51fe5e73b8a5ceaa0b1b4f0ace9
MD5 0cc8d03cec20130887bff536ecbf5e66
SHA1 b512b9e551a745b0882034a02255a0f4e4e70a83
SHA512 422523ed9b32a7f0c11b7624397a4323fb615a854977580e6c89f1eec082a11e39298bc648436d98ce442eadc2579247d81cf3a3e2cc3bc38bc67a1b9d97cf8b
TLSH
T10E51956357939960FF6C48B6E1C82B8F3B33C5B2544F2D920466C4BD7B4E3286836C68
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e89e0d958fb27114e7bfe1c8e854f4597bf2737fbd817589af84bb92bf49c6b6
MD5 384a6406a27b16c78383f53657db9464
SHA1 e000d58f79979b2cb5ac3786e432bd9672e8aca5
SHA512 ceba67025676771fb3f11217d1af0121e5ed1d98da5d2af915e50fe58d6352e7063adb196c676e51616f4a88b4fdab8ad39233dccf17e1ea9a707d30e310ae32
TLSH
T16551BFF7C3E8866DC90156F0AA186E2BDE5D0924432C3D5AC4E4AE2BA3E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 23ef59e597f9b9dbd9af48dadf917fe3971635939438deed4d855268df15120b
MD5 af0181763cabfffa39a19301c3fbced7
SHA1 1847973454daa545f248e98bace580c633db4b29
SHA512 9edd916411206d1241221d99472c3643b15183e6fee7113440c347a457c71979963cd3fbb18966dba927090506489c8221e24f432b7f23c7c8c57a0e4a75479e
SSDEEP 192:sxREBRiCC/fNrsYOZYqAPumzoA8pUX/g6+WNQGj4/YDrfG0IgVOJ:sxReXC/fxsYor6/5Z4/cI
TLSH
T1D042D8156E28A97B4CC7E21DBB55BB53D2F91032A1D01E48E6FD8A1C04E76DE620784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1a5f9cd31838b584f04ba415be99947b80d44b79198b64b7c6ed6c3b2c0e41a9
MD5 21e5cf25787f6dc32b286d3cc2c0d6db
SHA1 01ad90377eac492e095b756f4ed04df6dbfd8eb0
SHA512 516792503d5d4a7bd02043691e7a79682f1581ba5df893fdbb063d79f97b7a90622b731e4fde51d525d7c762743a00f1d20c79a16c5b2182c00b402cbb6fecaf
SSDEEP 192:sxRLBRiCC/fNrsxOZYqAPumzoA8pUX/g6+WNQGj4/YDUfG0IgD0OJ:sxR1XC/fxsxor6/5Z4/vf
TLSH
T17242E915AD68A97B4CCBE21CBB55BF53D2F95032A0D01E58A6FD8A1C04E76CE620784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3bb5594428d5100cd4360c127feee014b92cac6888124c7005ff35c0ae350adf
MD5 6ada5faedf4f29c9821846df5933804c
SHA1 43cffd979a04498691bc626f7db8e1dbe63188bf
SHA512 6e835b6c7e2d8ea0947ad3b5cdf73bd56dac23c9e28ad86e27fb91e4db3ecf98a2cc7bad85355a8fa81be40d33d22131f8c20e6933fad5c67b56136e88745ec5
SSDEEP 192:sxRLBRiCC/fNrstOZYqAPumzoA8pUX/g6+WNQGj4/YDrfG0IgDOOJ:sxR1XC/fxstor6/5Z4/cp
TLSH
T19C42E915AE68A97B4CC7E21DBB55BF53D2F91032A1D01E48A6FD8A1C04E76CE620384F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9a09fd098236336023fec5ffafd7be63f98cd1e9118048d9f3bb12c2f3a2c92e
MD5 2b8c39f868f9e186fe47d6964bbf5ff0
SHA1 85cbcc7a8c11f9b56bdb6e8d2b5869897d5f06c2
SHA512 620e002ff8596b6607365c15c228348ea0b4677ccc84812ab114003d82f1bb6a209097cc289ea12ad250881d71d654d97f21df4f1e2786eb6a6aeb7412b5e9f2
SSDEEP 768:SzYb5R7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OV/Rw8WSproGXGk:SzYb5HEbxUWgasfA6u1jawRwtSCqGk
TLSH
T14ED2D97B640CCB7F4F804ADDE81A7A9A6D6802CB96D8C98447FE941C02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b57a275d-e8cb-4014-944e-f5ed17a11a45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b57a275d-e8cb-4014-944e-f5ed17a11a45.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f572a40561ec1faf62fa659a6a11bfcb69720583eb5f981c494ad579bb47d01c
MD5 854e622a9e5ca5c776b2ab2a2f6af95c
SHA1 b8741e7d1a561ee4efa7cb4f711743ec351c33e4
SHA512 0b5d436b32756254b26cdf72499e5249c0982f605184bac0006b40d22d2e7c891440d660ae1e0a08054d18b19ba3de0f5668e991dc6ccdf25e4749edf9c72a74
SSDEEP 768:vj3WL9ybNb9sHztBOeRFZD1fTos7RjaL2si17:vj3WReY1fT/Ra2su7
TLSH
T102F2AF35B8E49D734CFAE284B2457A877FF450B38989499894D95F0E0487FEE134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b6a36f8273cfb4787882daf339fa047914136c606d59195a56b0a25bae034f7d
MD5 d2b8ac280d17b03aad8d9937016f3c7d
SHA1 d518ddc994d82e2ce4c703c6a30e406cb2631cda
SHA512 c537947aa541677109262f3254b76994b56f2c135812de91cabf9bd0211b2991bb5207e0e4960da9bfe322abf91ae1216475524194b1d49a9aa2164aae01a084
SSDEEP 768:Aj3zL9ybNb9sHztBOeRFZD1fTos7RjaL2si17:Aj3zReY1fT/Ra2su7
TLSH
T111F2AE35B8E49D734CFAE284B2457A877FF410B38989498894D95F0E0487FEA134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 420d5c068271b1805fdf23a7a2cda98b157cf1835df3620f983d12400fded587
MD5 d49a42b3ffbb9bff24f5f530bae3751f
SHA1 cb4d05fab97792adcdfc565c2648c5365a7b2811
SHA512 95b95373ab23c9e95d3508affd94554b2089c3673d5d957b16a6833f56bf2321fbf0887d0bfcb4c60154d6716e2cdb17859f6c303d25d4378af075d319bacdfb
SSDEEP 768:z/UxvxjgC+k3qjgybNb9bOeRFZD1fTos7Rz6/+Pu:GZj3+k3qUnY1fT/RmKu
TLSH
T1B903CF3AF8D46D338CF6E240720A764BBFF015B389C91A9809ED6F0E158B79D130785A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 11793d41d2d1fbce491064d406846e081b4150f399d939d4bb4e999c6494c369
MD5 e64011a413059112b55180dfd53cfe4d
SHA1 fa30693fdd600a9054cafdf57da21f5d70d4411d
SHA512 bb01b66a7281a0210bc77b98afca28a4997bd2d087e3207e93f7d183a9a7422eba7e52eb86942717dc7380611214074f9352d33ae26a0a21e66f90d04c9bb15d
SSDEEP 768:Q/UxvxjgC+K3zL9ybNb9sHztAOeRFZD1fTos7RjaLogXJ:9Zj3+K3zRFY1fT/RaoUJ
TLSH
T16203BF39B8A4AC334CF6E244B24976C7BFF414B388C91D9C49D95E0E0987B9D134B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 59c3aeb560630e1210ca6507e8b1d309675049f0f266883df6bd3a9ea30152ea
MD5 3da640fcb79457754f90a311ed226687
SHA1 f30f6ccb32c828180a961d72913d36e2e4761c48
SHA512 dcd35191f1d0f2c96a26b0873b8573ad48d7ded520f9cd607e4b40d12cb5eed78f478a9426ec9a1644c7f69cf94c33717bb41b2b1f8865b1da041b07086fec99
SSDEEP 768:+FQZ3lwgU5BS9sHztROeRFZD1fTos7RjaL2si17:VZ3QkY1fT/Ra2su7
TLSH
T1CA1329F598D38977D8AE9383A33D6D46AEBCD063B5894884B7C54D0DCC826BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ab1d5a48-060a-4d4e-8790-7c16c1d0b7ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab1d5a48-060a-4d4e-8790-7c16c1d0b7ed.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 b89e9a90cffc00960ef259988f200a2ce4c2cdd8ceabc53be838d0bf70d0c43b
MD5 3e24fbf9d723f3e0d2f9857457b3fdc7
SHA1 f3579e7d6799839436b0186de11b6a1bcb38d64a
SHA512 c19a42a8843c19e32030618ef327b207a6cdbfcce93b733b5317b6f342a36d51c499e3b01032b08a9d63715548e2b8b0cb718726459ffe4c9e04f49251298ba7
SSDEEP 3072:dNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0S:4qZ4h4fIqPWQd/4KUNNF5
TLSH
T1ACD32849EB8310F1FE6701B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 881318b78233fceff9338d401b1074616b209318b1b0cc272f0d9b123a6d92c0
MD5 ad033bed915f517ed7980929a8bb10af
SHA1 5f16c13104b943974a7d066a38f7f513b45635c0
SHA512 ef592ae57a4295e72f65d50d477aa6982496537035b81b51ec9e4b4a05f51e2c8b02b11e0368cef469290f84e9dec9183129e0e9f9186a5743847d25d4f43da4
SSDEEP 3072:dNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0A:4qZ4h4fIqPWQd/4KUNNFn
TLSH
T115D32849EB8310F1FE6701B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 5470cac7ff842bd3a1938641f12c4831bdf66446eacf976140f77c594d22e29e
MD5 f0c672a9140a2684dad8516d883dca3d
SHA1 777e7049e0713951a57bc555f09d1ba6460868c2
SHA512 78422ebc3c983e76f69318611bd1945bb6bdd1f58e3251177cad07dda2d7f2c4722f1253e37df343758d9045ba8dc53a08871afca37acd3715f6060beb88af4b
SSDEEP 3072:dNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0q:4qZ4h4fIqPWQd/4KUNNFJ
TLSH
T164D32849EB8310F1FE6701B010AAEBFF5236B501D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 5461304be79617fb21b2f99ed782f1fc561ec10563fe1bf819d687e9345e7dfe
MD5 fb16c0ec9d37d1b5b58cafd01989b155
SHA1 bffda7d7f10ac9a982272ecb4bbb6df6cea43b94
SHA512 8dbee72b2aa49fdbd85226e4832b031d57e68e1f1654797275141f7ef3a34d0294865b0be723bd7c50fa1d69a29db9d38a2abc624c3b32bb43265b1aa12b9d26
SSDEEP 1536:PE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:2EuSllYhhjm+kLZ
TLSH
T1E77302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 7d7e031ad3e4c0a80ca2657a4f83812e9295fee5dd59fad952ca26a2836328a2
MD5 b545724b7917abdbcc452fab94eac84d
SHA1 e20540cd20937ac463a4332e2d5fb3b92ff6b7de
SHA512 77cf051f96e8f703f3bae019d15faeef4a369638a2216f8ed7b548c6e172f2953f3a67bf3fac7be7513426a5d7903abdd9643c2bf12ae5169adda0dcc60c0ace
SSDEEP 1536:PE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3BeI:2EuSllYhhjm+kLZI
TLSH
T1C47302516690F933E82E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2215060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 712B
SHA256 9d8bef822ea98917b370761daf99c27e361353bd410fd99a497d9e4d8757b77f
MD5 6b8403094972730b54138d32ab6fa889
SHA1 ae096bb7f1bff54a7f4067d21117ef28f048c476
SHA512 7e8eac33cab58d46db924eeaa10165d1c9f89b93cbd82a4a02ba359ce9da083eca8d9e5e92f3f15dfdefa30339eb46b96f2c34154615f2678856afe7cdeed2b9
TLSH
T1E8016D2B5EEA0579D6FBDA0215F360235A727EA6A835DC0E02C04B8C58B1B04F860F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 4KB
SHA256 87d41f01f63029f91418d41bc02cce2d4914dd368cc0bed26a6f98f185230b6c
MD5 3708e29f8a0d9864aafe0ef0b660c4c0
SHA1 fed933eddc8505282c8c0e2d7ca311a38ded48e2
SHA512 f48f06f3e435f322ebd9d273083843e46225535f06ca7f061b8c4f59c3e3fe9a930ae371ea4757c64a74a55f0bf4af3adf224bde7e93ca681540439c0da3d298
SSDEEP 48:nmgiASC+nzNx4mKHNvf5APYSLuFS7hcdt+noNx5mZHEvfyNXlcwjdzo71oxhWd3l:AAn+zLwAgLWM+oABXxaRESmc+i6SssR9
TLSH
T1B181B52A1AF9026AF6BBDA0345F370276B767EA75835DD0E02C1478D1C71B14A9A0F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 922B
SHA256 fb8395d136cb6be0548015cb1541f9bdf3cabacaf53123d80438155bd89cddc1
MD5 011f7d21c7668db6e41b5a3bebbc0342
SHA1 bffcacabd188869badfd5777bfdd1a9a9bb58578
SHA512 f52720a6b642713e4291834e68f946963f684161aabff046f316d35c75b866c54e5f16325eed5e79a0418d64f1dd526206768f4936a7acf58f17d4d619018eee
TLSH
T1A311822B1DE90475D7BBDA0219F360235A767DA26835DC0E02C08B8C5C71B04F870F22
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 4dba57d90ccc36a743b01c6e88dbb17e9fcbe86ac03fb52ab84178059dedbbfc
MD5 3afbf8167609cf63362155b5a711cc55
SHA1 7784630f5f1349a24e2e1197a011c4db453b7a4b
SHA512 fea0ddeb863ae746752e8b7d087f4bcc98b2813174f919eabed3b0c8ce8866b29e1a125e313b3f4f674a7dec015967e6f4e23f2a932185908a289ba0437ef0e4
TLSH
T1A721812A5EE90579E6FBDB0259F260276A72BDA66835DC0E02C0478C5C71B04B8B0F23
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 a771f410467e162c029800c77e3a0f31a133f276622efa60e334683d46db50af
MD5 f92414929df293e1924868526b05fce3
SHA1 a1658b936db86578039d2808058f344147f23cf6
SHA512 cbd899c7c97037e5a71e62cf3f434ec0beb1c19dd43c51afb73b1981415eb7f4a433d212a65e804d52ab756275411702accacfbdb314d802957e2117218002a1
TLSH
T1B321862A5EE90579E6FBDB0259F360176E75BDA6A835DD0E02C0478C5C71B04B8B0F27
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 f4250e01ad8e9649808ea08c7ed68e4b7676cd00da41887c53db105b1e4f6bb7
MD5 5268f2be6f6bdd3e15c23aa21d4d8ee8
SHA1 f710b97262d478ce301ea15e53693f3c1eb835f7
SHA512 44afaee0b437755ad1df32d3ec7409e71db7130c8c5d747f7e5853e6da17604c49eaf6fec3b3dfaf64d671b85c78f9a40d9ac43e276d586c1b721954272fe971
TLSH
T13141562A4EFA056AE6FBDB1255F360276A71BD976836DC0D02C0478C5871B14A8A0F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 f67019da17cbba510e31892d324758c189881f4dbd06bd24ba697041f73a6194
MD5 e34cfd8c6c383cfb7e704b95e5970b69
SHA1 a95c88c4cca4509232c13316208c50183e5211fd
SHA512 b09d28fa4b6f0780c6b614090cabe0288ec6e42e4cefe5309c89daa6214213a51cf99f7fe8a34f54061b6115826189189acf6b9356f5a6f29c0e52b77cd48354
TLSH
T15041652A0EFA056AF6FBDB0355F360276A72BD976835DC0E02C0478C5871B14A8A0F67
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 79e1371a5fa7de856605a44bd46d0ac56f86797f793e6593369c56271b51c926
MD5 370d667a41b069c62e0d007b8f4dacdd
SHA1 2e28b3ffc16e3b3db77d357ba461aa091b3c15c1
SHA512 69b06e0f4ef545b0d424cc987223e42c1427c63c67e1c44f22ade28dd8192cc889799785f34c7d4955b5fce000dd85af1206489d35ea30c83f5128a8d90e78c3
TLSH
T117F0822B5DF60569D6F7EF0219F260225A72BDA66835DC0E0280878C5871B04F970F63
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 3cb1194e3c0d9ce680e98f2bf961d86bc74f93f1e596fd331156763ebbf0f4c1
MD5 a2a6c362e43f63dd0f3e0c37ce5899a7
SHA1 bfaadc0d90be3f39cf51d5cb3415facc07f71a85
SHA512 695bf673506ec81869949133b8edb8aaaf3dca311a0f564861e1e31eb3d7948e4f31cc11df4817335845d920f48be6fc055f31121189dbea8cea26fa7e272aef
TLSH
T19061C73A1AF9066AF6BBDA0355F370272B367E975835DD0E02C1478C1C71B14A9A0F27
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 69b38de785abca3b81fffb0d64756a9e4153efe99fa8e9bc6bc7d93a4a3855ad
MD5 650f26e9ee3f818a6ebeb7ab86477c36
SHA1 26163f87bc0af5ba492f8ba22d6231f359601aad
SHA512 0bcff191b8531002a56a7249ecbfa28ad9c6ec0778ff81a6b5751d0706b4ff21570e59dfe3f1dd48784a8d43a423a2fc8f45724a23b2e07272b0a4ba0a5940a5
TLSH
T12371C93A1AF9066AE6BBDA0355F370176B727E975835DD0E02C1478C1C71B14A9A0F27
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 351d3a479bd3befee71dd303fa7a9082cf54f097d3ff5a891b8f46a587be85ad
MD5 cf6b28565a48410af06d171c96e91f95
SHA1 6f4900e1634772c06896a48c384205d74a681260
SHA512 0508d71aa930a7a60eecd6388067b88ef639b7045ed30044eb28c651c2abdbae2717922d78d681166b9eb90458004af604759efed57b706850493cdb8f81fb39
TLSH
T1BF81B63A1AF9026AE6BBDA0355F370276B767EE75835DD0E02C1478C1871B14A9A0F27
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 5c1b10ae6f85730f9f9bf06a53e70d223e0bf81b52f114f2d2528be24f86136d
MD5 1eae0b6d112758147fae868e9fb1b54b
SHA1 2bc276ade0c1d9a9b4345199039a4c893391a4f7
SHA512 44589f5df043d7eb6d0acaec3b3cec778cfc01ab612f03c1603ad22b606ee7a0d27321d4ddd3804ea29f4ca2fbdfbe8aeb3b7c3cdff00601f5f49dbee7f20e1d
TLSH
T18B81C52A1AF9026AE6BBDA0345F360272B767EA75835DD0E02C1478C1C71B14A9A0F27
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3128_866476791\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1384-77-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1384-68-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3012-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-0-0x0000000000424000-0x0000000000425000-memory.dmp

Download

memory/3712-91-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3956-45-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4176-267-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4440-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4440-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4548-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4548-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5752-86-0x0000000000400000-0x0000000000442000-memory.dmp

Download