1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f.exe
Size 228KB
Sample260930-krhyvstdra
SHA256 1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f
MD5 0ee88a39be02f0db4381b2dddf52a64d
SHA1 f938f22d300887a5cc7d9f19ac2884b12a6bafea
SHA512 e800072f8ea967d71b2cbdec3892976c9c09c60f6ba905f2feeadef5ae62a844c190ea7b2d83f7f5d0561d94bfb6e2b389d8b3630f9f330ebe8f99292867985b
SSDEEP 3072:UfDmzPOs8y4d9jKAgiuaDt1KFsvQRtw6OHZqUXkkhuTnwy:6GzDegC51mszqUXfuTnZ
TLSH
T1AB342A19FA0704F1EA33977244EFEA3BC3117C1686379E2FEB4FDA4468725662809395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
38	4204	Eupdate Helper.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
1064	Eupdate Helper.exe
4464	eup_rotate_1064.exe
5356	Eupdate Helper.exe
2508	Eupdate Helper.exe
412	eup_rotate_5356.exe
4204	Eupdate Helper.exe
2648	Eupdate Helper.exe
4092	eup_rotate_2648.exe
4664	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b00000002441f-68.dat	upx
behavioral1/memory/2648-72-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2648-83-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/files/0x000b00000002441f-89.dat	upx
behavioral1/memory/4092-91-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/4664-92-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/4664-253-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_573512581\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_357233682\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_73541235\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_774622880\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_774622880\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_573512581\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_573512581\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_573512581\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_357233682\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_73541235\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_774622880\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_774622880\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_774622880\_platform_specific\win_x64\widevinecdm.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_1064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_2648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{3F363BCE-353F-42DF-BEAE-BCE6555C6453}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1064	3892	1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f.exe	87
PID 1064 wrote to memory of 4464	1064	Eupdate Helper.exe	88
PID 4464 wrote to memory of 5356	4464	eup_rotate_1064.exe	89
PID 5356 wrote to memory of 412	5356	Eupdate Helper.exe	95
PID 412 wrote to memory of 4204	412	eup_rotate_5356.exe	96
PID 4204 wrote to memory of 2648	4204	Eupdate Helper.exe	106
PID 2648 wrote to memory of 4092	2648	Eupdate Helper.exe	107
PID 4092 wrote to memory of 4664	4092	eup_rotate_2648.exe	108
PID 4204 wrote to memory of 1204	4204	Eupdate Helper.exe	110
PID 1204 wrote to memory of 2484	1204	msedge.exe	111
PID 1204 wrote to memory of 4856	1204	msedge.exe	112
PID 1204 wrote to memory of 5452	1204	msedge.exe	113
PID 1204 wrote to memory of 5452	1204	msedge.exe	113
PID 1204 wrote to memory of 5452	1204	msedge.exe	113
PID 1204 wrote to memory of 1844	1204	msedge.exe	114
PID 1204 wrote to memory of 1844	1204	msedge.exe	114
PID 1204 wrote to memory of 6040	1204	msedge.exe	115
PID 1204 wrote to memory of 6040	1204	msedge.exe	115
PID 1204 wrote to memory of 6040	1204	msedge.exe	115
PID 1204 wrote to memory of 5192	1204	msedge.exe	116
PID 1204 wrote to memory of 5192	1204	msedge.exe	116
PID 1204 wrote to memory of 5192	1204	msedge.exe	116
PID 1204 wrote to memory of 5984	1204	msedge.exe	122
PID 1204 wrote to memory of 5984	1204	msedge.exe	122
PID 1204 wrote to memory of 5548	1204	msedge.exe	123
PID 1204 wrote to memory of 5548	1204	msedge.exe	123
PID 1204 wrote to memory of 5152	1204	msedge.exe	125
PID 1204 wrote to memory of 5736	1204	msedge.exe	133
PID 1204 wrote to memory of 2716	1204	msedge.exe	134
PID 1204 wrote to memory of 616	1204	msedge.exe	135
PID 1204 wrote to memory of 4076	1204	msedge.exe	136
PID 1204 wrote to memory of 4076	1204	msedge.exe	136
PID 1204 wrote to memory of 2944	1204	msedge.exe	138
PID 1204 wrote to memory of 2944	1204	msedge.exe	138
PID 1204 wrote to memory of 5728	1204	msedge.exe	139
PID 1204 wrote to memory of 5728	1204	msedge.exe	139
PID 1204 wrote to memory of 1552	1204	msedge.exe	140
PID 1204 wrote to memory of 1552	1204	msedge.exe	140
PID 1204 wrote to memory of 5732	1204	msedge.exe	141
PID 1204 wrote to memory of 5732	1204	msedge.exe	141
PID 1204 wrote to memory of 1428	1204	msedge.exe	142
PID 1204 wrote to memory of 1428	1204	msedge.exe	142
PID 1204 wrote to memory of 4048	1204	msedge.exe	147

C:\Users\Admin\AppData\Local\Temp\1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f.exe
"C:\Users\Admin\AppData\Local\Temp\1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_1064.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_1064.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 1064
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_5356.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5356.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5356
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_2648.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_2648.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 2648
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e8,0x7ffebf2ec188,0x7ffebf2ec194,0x7ffebf2ec1a0
        8⤵
        
        PID:2484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,10485172386917752439,10519294993599228383,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:4856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1792,i,4651374453628589858,13162878392609372992,262144 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
        8⤵
        
        PID:5452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,4220644712384387781,1115911937656427300,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:8
        8⤵
        
        PID:1844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10935968403832470500,10506600669478279639,2097152 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        8⤵
        
        PID:6040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13211708860246477741,1267986823842721409,2097152 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        8⤵
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,9413504470312826692,8178054621159683614,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
        8⤵
        
        PID:5984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,2495821840584604822,6085268028043526526,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
        8⤵
        
        PID:5548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,16132109088796444371,6853492773646944347,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
        8⤵
        
        PID:5108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,16132109088796444371,6853492773646944347,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
        8⤵
        
        PID:5152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,8926152493266418982,14940003542578209209,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
        8⤵
        
        PID:5736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,12687489562107722501,10539386499451785604,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
        8⤵
        
        PID:2716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,179684876971180444,11381615359792476744,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
        8⤵
        
        PID:616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,17220544478967100411,13478865615699145292,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
        8⤵
        
        PID:4076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,551816445884722741,17911196907418171204,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
        8⤵
        
        PID:2944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3596825949877547345,2937736278229045589,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
        8⤵
        
        PID:5728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,7605245842653721349,15137287775158678079,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
        8⤵
        
        PID:1552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,3308142141839261521,13598073221917018188,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
        8⤵
        
        PID:5732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,17552469726575127588,8248817171962274177,524288 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
        8⤵
        
        PID:1428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,11342450185512995438,7688030028058594346,262144 --field-trial-handle=2228,i,14708266357117309329,2070605402815326244,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4048

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_357233682\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_573512581\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_573512581\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_73541235\manifest.json
Size 118B
SHA256 3f89d5f63524c77efb5facb385319a03aee54129aa22bca5f6061b8654f7bc5b
MD5 064a722d540bb9c42e4db8268426a4e1
SHA1 dbf4fe6aba40365a0646508d6f1f558d767e234a
SHA512 ce6a19905edea82b03cc4b70907393c2fd31e308c9d6e6dac649bdfbf44b04bf0ca2ffc8f0e354784258ef3d0b25bc72655302dca37897c36f0848bc9debe394
TLSH
T196B092B00C1AA03B22849320ECA066C283F80A19E8021B1E088036481F8817881366B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_774622880\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ffec4d58c3a6e4ab1d237b220079f08164ff44d8b32fbf1fdddb76f0d017be5f
MD5 20c1ae9894e87d6fa8e7306b1e309eaf
SHA1 0ed6d98fba5dd9717e4c013c1ebf95e209484468
SHA512 aaa5e403b0f64b577fea503d6c3ebfe77703459bebc9ffe38ec62bbd52cc4a10a3ba4a29514e4f8bc713d7bbe8e3edc38fa0b5a2a0e834fcf639cc645c760138
TLSH
T16DF028BAC961EC3B18FD0B7D20940746F750232B2A41988F7B3D821C8FB173B469586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 819ae0cd4209f2bfdebd764283477f4104065dab4babc0263b5574f7c526dcdf
MD5 7b40ea8d53b8f19df17dca59f813280d
SHA1 dc2f69ccdd96211fd08a54a1b8083438a0473525
SHA512 7b416e9cafbefd5b360df36fc1066ccf48d921871d0550e623b4d60222535e49690070c32a6e4994789f0215cb24d2ab6e444c5b68ce1c189c2a7125593602ef
TLSH
T1DE41B1F3C3E8856E890156F0AA14BE1FCE2D0554432C7D5AC9E4AF6B93E3471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2fd03c8d9d3e9c581582cb15452b90592f9dfb523acfb26bf912fa84c4daab71
MD5 75e95bf16ca38c4643ee8d4bd2018424
SHA1 a0e564c5c18f8344b4b8bcef2a3816049284d8ed
SHA512 376a2de7cbc3f2280208c66ac2437676bac3371612c169d4340f672384759e01a932736a1786c383e2d59d0ce9ec105b4e243e3d5fc1ecd44b588b022d74b149
SSDEEP 192:sxZ0RUoin/f2s5aQZLjU8pzodph8HW6+WNSlj/YopJSZFIg5htMJ:sxZ0Mn/f2ssOPrCmHbM/5Szvtw
TLSH
T19B42E915AD28A97B9CC7D219FB597F53E3F9103390910E48AAFC8A1C14E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d9ead5f8608464076db6293f30d3eaac1e2e1c61b5ff6ae40b3b312b59cf3ef7
MD5 27eada4e42c29d85e55a34d06f88ab22
SHA1 b551f85a3277c7549c0f5b4fae1247f8014b20e3
SHA512 0fe018886c81b5f8edd19610fac02e8ed5b2f2ab8315348e3b5547af1f8425301b6555d1eb38722292bf8e040cad25f638726c1c9b9198cb7ddc45ab1caba567
SSDEEP 192:sxZ0RUoin/f2sTaQZLjU8pzodph8HW6+WNSlj/YopJSZFIgjtMJ:sxZ0Mn/f2sWOPrCmHbM/5Szjtw
TLSH
T19B42E815AD28A97B9CC7D219FB597F53E3F9103394910E48AAFC8A1C14E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cb310956408f9c1099212e47d803b58f1861432b7229510cfe552ae70ba1bebe
MD5 e0d453ee23a937d2a3c537ff1a638317
SHA1 f4d9dae83cdc27b69af34d2806ff678c701174a6
SHA512 b57b88c293bd0234fc888b8ec82975a89c17dd5d459b4012b46b9f538d324c8c6e9bf2138697caa94cece06ae405f81eb2d2f401346820c4cc5955ceb2a73049
SSDEEP 192:sxZ0RUoin/f2s8QZLjU8pzodph8HW6+WNSlj/YoXJSZFIg5T1tSJ:sxZ0Mn/f2s8OPrCmHbM//Szrtu
TLSH
T1DD42E915AD28A97B9CC7D61DBB597F53E3F9503390910E48AAFC8A1C14E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 57d6cc4f5a095ffd51681ea7fd0414ef2ded26dc0454177e46ce85b1b4ed553b
MD5 d1fb7c16c6c19a0fd7cf36ad30939ef7
SHA1 86f40845f7b823b21c09862bac07c95dd3d993c6
SHA512 7ef896cf54ca753cf683edde9e157083c89137c4f052d6cf3b6bb83e590c2904d6d70f64b75f25b7ea93d1be053f2c6fdafa4e4eda8f2e49e5cd9cc4333029db
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVr1qpLlvVajYroS:Px6r8s2EbG+WviyUKu1jai1qpLd4jjo/
TLSH
T132E2E97B780CCE7E4FC05E9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1fbc7d4b2c90984b5948acb1d3ec70719cc534e7f995fedbfcac08c7b2b6a990
MD5 98757b39327c9c835d1bd1aec52fbec1
SHA1 ad4f9b26c0ce4e2897471552e5bc50c10b1ae2cb
SHA512 908636095946b69bd70bf7cbeafe41df6b6b82301ff3458513a1c9771dd022dad805542ee0578b1a6f6f0a75ea71fb096da8ee26f2496d70f6be01b1248c9734
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgD:ST/2dXOJhJlpfnpp3tNXVrN3aJhQ
TLSH
T1E8B2125571BB021039FE291C92B59B2E168231733119E66B7FBD40B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 814495ef5d934be071b038ef450531740ecc6865a333a077f3fdd145328451b7
MD5 7beb847583fe72f8a4e24538a9bd2b3a
SHA1 52e86006b540e27e538dc098b8bad459bb1533e8
SHA512 207f5d3b5ec3db3c22ca9f827ced1b1de947d8d3c3686d6590e416a8086e9aaf57427e929cafa0a9b7304a4931d417337c88ed9268b494e18f38fa5cedb085ae
SSDEEP 384:nfiFiZcIO43sNi8TUNTUlI48JaKMxbMgwzWfcBCh7SUZ4mY5uImm0VZh6DKhHbgL:qFQr3TwgQ8fjBChf+mY5dmm0fYGHsh
TLSH
T18CE292F298D789B7E89E4B87A77D2E4299FCC163B4488984B7D41D1CCC821BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7ec144379d71dab165a82a996e85d877fcc9f3af03717d44a0f96bd10b1cec29
MD5 8929ffdae89074f4bd39eb90fb99f02c
SHA1 5dc7f07f76e188cc71bb5ba56c47702e7ba4e9a4
SHA512 9c4e20d5b6ce01735adbde19bdd9f5543b4f8b4564e9052b93f902920d4178e64edc1fbe36450e2a3913fcc02a921ed27bf7b29da5a03ad53d2bf4c619f89362
SSDEEP 384:noiFiZcI63sNi8TUNTUlI48JaKMxbUgwzWfLBCh7SUZ4mY5uZim0VZh6DKhHbgLX:zFQ63TwgQEfEBChf+mY52im0fYGHsh
TLSH
T1FEC25B33D898CDA7ECEB5AD9B75A3A43DEE001A3988C8AD8D5D91D1C009359D170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 edb807ae888360a3a6f5d6c8bd12896954130fb3a61f1714af6577ca0b23f95d
MD5 6457bfb1ca4040eb70d0576c0d858e23
SHA1 996bbd0fed37275a33c936de777b3415f2648641
SHA512 58067629cb2aa883a4e91a14ef238d53a753acce2fb6b775acf64c559975a55f90d32f276a2eb928ecd44decd7b1bd523a62fc176a3ab0db3c8324b98f9ff63d
SSDEEP 384:nUiFiZcI63sNU8TUNTUlIm2aKMi04wzWfLBCh7SUZ4mYpFJsa+VY5agL/7Iz6o5:vFQ63BwgcZHEBChf+mYpFJhggq
TLSH
T131C24A36EC98D9ABE8FB4FD5AB4A7603DEF001A3959C9AD4DAD91D1C008759D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bca91ca4d11704602605abccd31fc21278a7fc16e3ea828689ba437959333c0a
MD5 0ec9cc7c1dab286859632a29a7804a0d
SHA1 5bde550e6634ff3e53ba59d6b63163d39f10c71e
SHA512 5e648fc185469233b3f72928d0bfe7b11c4169e278b4c69159c476e74d2579c6d2aa1b707cd172143bcefd0f266a760bf508c63eddb391df147245b35ec6a357
SSDEEP 384:nCiFiZcI63sNi8TUNTUlI48JaKMxbUgwzWfLBCh7SUZ4mY5uZim0VZh6DKhHbgLX:JFQ63TwgQEfEBChf+mY52im0fYGHsh
TLSH
T1C3C25B33D898CDA7ECEB5ED9B75A3A43DEE001A3988C9AD8D5D91D1C009359D170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.30.1\typosquatting_list.pb
Size 1.4MB
SHA256 5435d91bee48abb353a7d203b4b7eecac6d2901a96fd0c934fcc8ecf173e5563
MD5 5bff34d92fc5a86bef266b458a6efc08
SHA1 95e2c2b9d976cb7855d6f7092ecb0cb241617182
SHA512 02625a49261c12154ebe377df81d4457ba449801273dcb27d742dfea86329b1da7088484467ff9ab6dae4e649783201a58efb9fbad630c0e29d1191b2ccec20d
SSDEEP 6144:NwUhpkDDI4SQRKjrKu5ujaJ+jb+1zIs4nKvL0+7rbKQPCL/LsBjeLXgJ1NCry25u:NtpiDI4daZHlIXKNYYZfdhvn8RZJcv+Y
TLSH
T1B365B5B9DFC00194DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 367812bac898995acb3dc69eb5a0a119687a6edb00880bb4a878ea660d2e9264
MD5 a184c36032fb93553b4ee284a4e5c8d5
SHA1 068c1df6b4c92e849951223dd16e32a222d823e8
SHA512 e458eca7a8d9445c116addecea71153d0e7e16bb26ada79f27e19bc09686275f4fa6686e61f53d007c028546526bd3432026188175d606d51950b0018118f9e3
TLSH
T1145130E05C785AD1D1FD0E7EB09B38EC85ECD721F8A4747D2858E9984A7A62D708083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 38ccc0c55e67965df4aa9048d980afe4611364e9aff2893696b31106b644bd79
MD5 e9ab6482de55cc61833724ad96063c5b
SHA1 b0a1b6275008411f027c641e9a3720c39010a8c3
SHA512 3400a05a3a5eb5afd6a98060832ba8b582e1cf1a4fe01047566f0786834c93dd3eff931d70fd4e0c35d40272a30e227a6b6161b7cd37fdb9d70a4b6e3948c33c
TLSH
T159512EE05C7C5AD1D4BD0E7EB09738EC85E8D621B8A4347D6858E9988A7A61D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4ea78d06a3b60bb4b6344c65ec12b048dbb555f439b4f1629e5ef54a95512711
MD5 d7e4e113ccf3766038317948547a6cb9
SHA1 6251ed9e40f35679c78607daeb0faa3c417cc36d
SHA512 d95f92610fc1e13dda75e17472585382ec6e550713944967ce054941615e0a87362a51f7cad670fc7016934fdc04f342a1903eb5cc45820f8f9f7d2dff5aa94c
TLSH
T185513FD09C785AD1D1FD0E7EB09B38EC81ECD721B8A4747D2858E9984A7A61D708083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f9280bef8a374c38eb09151c29b0be7a8d6fb2170a9806195a8dc78588c2b6f
MD5 a5ff405fd84f36e4fc04379a5ba1353f
SHA1 b0d6eb0389f02ff55b2ccbf2385b74f816f0d380
SHA512 e7cb432a318d54de859f6746eb7e84b04eadc369be343b8ab0f8a9767a77266771ebe597289c502c81aef5a03767fc163e4527ea66fe09be4b60ad22d07d6646
TLSH
T14541285CB6F91108B3B37F5AAFF7A8AD44BBB9372E06D45D10010D4E0A62B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 57a4777e3b01413e800b08ec60f0a926147358ba60db1654dd2f0e48947353bd
MD5 8847dbc491cd490ac082bf273dd0259f
SHA1 e7a480ec3c3352d7eaf51eeda47f91edb921aded
SHA512 e72200fd621affab11a2524bdbc407e92dd3ce92bc0c80794ff32acdb0befc39de38cc3a6b6c60582522281208ae23ae995fd74216c3f526666485f8ad95ca42
SSDEEP 1536:UE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:DEuSllYhhjm+kLZ
TLSH
T1597302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C57A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 cddff2110d4c4103b1c5d6fc645f1138767588a52995c57a1234fc37bb15d86d
MD5 034d2a1add56f5d2e2f5f883d51e49ee
SHA1 dfa538edcc76d90a7f7acbd0eac217cbf8323ef8
SHA512 d01d7729889ac30249711c66655fe5eb2c35c0e52a195dab5ff1c7b935f2dc104f31cff19794e92b34d3afc5172c5e71a5b358677d907531a8da922f24e4a2b4
SSDEEP 1536:UE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Bei:DEuSllYhhjm+kLZi
TLSH
T1717302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C57A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 228KB
SHA256 d92491a77f47d818e68cb3553477546961d0c4e02257f4e28181a1fdae41bc1a
MD5 2cee9eec6092064f9355beaf29766f17
SHA1 9ae0e133f83a497e0716297ce36b0aa74c5533e7
SHA512 460966c7cf627521221afdac24363e1e896dfff5763a5987703ed022f41ddbeb36f593a87691d37b3c4d71337d4cbc6617fb25ab9e57246a431dcd18c58b0baa
SSDEEP 3072:UfDmzPOs8y4d9jKAgiuaDt1KFsvQRtw6OHZqUXkkhuTnwm:6GzDegC51mszqUXfuTn5
TLSH
T18E342A19FA0704F1EA33977244EFEA3BC3117C1686379E2FEB4FDA4468725662809395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 228KB
SHA256 1f0f0eac67621024a9b5ea17567919a693b1aa87ad518b4981acf65a11e2211f
MD5 0ee88a39be02f0db4381b2dddf52a64d
SHA1 f938f22d300887a5cc7d9f19ac2884b12a6bafea
SHA512 e800072f8ea967d71b2cbdec3892976c9c09c60f6ba905f2feeadef5ae62a844c190ea7b2d83f7f5d0561d94bfb6e2b389d8b3630f9f330ebe8f99292867985b
SSDEEP 3072:UfDmzPOs8y4d9jKAgiuaDt1KFsvQRtw6OHZqUXkkhuTnwy:6GzDegC51mszqUXfuTnZ
TLSH
T1AB342A19FA0704F1EA33977244EFEA3BC3117C1686379E2FEB4FDA4468725662809395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 228KB
SHA256 04ab7a6759aa81bbf8988971973becea7432d19dcefe9fb5ad98954ccacb5594
MD5 975358b8a0364315cee2feba35d1ea47
SHA1 b00576d2d52a0db1060bc00d1e75f58227c2adf8
SHA512 f3871fd096b49487895a030dc9d0a54a068a8577ede002ea0da17aa953067e346c3098e3e856d84ac8b26c6fa5a149c395d7b5ca4468f7575106373a9e00788a
SSDEEP 3072:UfDmzPOs8y4d9jKAgiuaDt1KFsvQRtw6OHZqUXkkhuTnwd:6GzDegC51mszqUXfuTnw
TLSH
T1CE342A19FA0704F1EA33977244EFEA3BC3117C1686379E2FEB4FDA4468725662809395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 8e7bbe56410c62f8d4cc8a01d3db19b858d3c6a5fa85b14bf7616ece9fdb9e28
MD5 020ffb59cb0900f75c0018e259ae15ae
SHA1 0c3851d50da049a2f2e57f9d49d5cc580a5ec7da
SHA512 9f0ae58275f6980c63fd2a7f58384f2db86d76c65581781e12cd3ca55be33433998d023432a2e78963d69b43647665ea04e5d9d685f8dcc438d7269492313a89
TLSH
T14EF0A7165DF611A5E6B7AF1658F350175A73FD612835D40D0240878C0CB1B04DD20F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 f1a5f9b48fdb57891c423a38cd8229ce504114b195a61edf91df9e928e3a2ae6
MD5 1beb87e826364622cd9d72d173453333
SHA1 3495a6fb09e47f87fb3070417013249e511d9b55
SHA512 b1ed96506bd616c3e4d75f001849eb366a8c46809869fa08cc1e9c2077b165d738c6299f14f6b8b982842b479c057acdeee2017f14c64021c21f040fc6564251
TLSH
T1BB81922A1EF912E5B6BBDB0B84F360176A77BEA16875D90D12C1474C08B1B14A920F37
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 710B
SHA256 5da71b0b3c5658924fed68a18d80a3a17fa5329acc90e4d1e75c19eba963b26a
MD5 dbb2de92d7bf5807dbe6c41bf766a141
SHA1 20e603183b7c116e485a32142c3e6a6e117a91d2
SHA512 20fc0954422b7ea9a3faa3fe24f7b22fbcf729f93f3e08c862dcb94e79476d59cc2bf3fa31344940a429f3f4baee88421fb2ad2f5a72ca3f9c0391a46fbc046e
TLSH
T16B01A41A5EFA11E5E6BB9B1754F360179A73BEA16836D80D03C0478C0DB2B04E820F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 d9a12aa499517bff13ee6fda2699d9a0d9f6e79df7dacf168d39196e4429ea2e
MD5 5809b410a59535c6d2d7db52f07ce52e
SHA1 b98347238d9c8f545354eb6c6d42b1635bc94e89
SHA512 24e3a030e0a782896ba3a49d81869d6eb9c5c048fddb31ed55f9ac6beb5b8f7979beabf04d25d757957e064c4475c5e51e6ed88c33aa469beea27f8e050aa8ff
TLSH
T14A1188265DF911A5E7BB9B1758F360179B77BD616C36D80D0280874C0CB1B14E920F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 6edb0c31d6725f124bfcb71bcbb360440e8395bc912293e608e905a7cf60cd96
MD5 f978d6c58d1a692e7763dc197f03923a
SHA1 5205f027e9cec4ab3fc7734051c074fc49f73ce5
SHA512 d687b20aa4062740feb69692c4c32048f93d7c85e8024c74de5dcf7d99f162e31e28fdb95b3c5846feb9048aabf892a590b06c62f361cf462f07bb80be8b4796
TLSH
T1EB21752A5EF911A5F7BB9B0A98F36017AE72FDA16836DC0D0280474C0CB1B14E920F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 94f9d59eeb68aaf16c21696b05bde0ec62a89d3ab512166bad7c609e863921c9
MD5 1143935295009078f86e1a14c6540bf0
SHA1 9931e8a485e746d7dafc8180d7febd7184fdb587
SHA512 651bae8b23dd380df5957128a02b15936167ad051abb22df879327443e20696602e15575b7e88eba0405b6632bed61f5dbe6fb0d5af19c2016be94dfe24ceddd
TLSH
T1EB41501A4EF912E5F6BB9B0A94F360176A72FEA26836DD0D02C1474C08B1B14A820F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 662e6c52c09f22f5e3d56e0395db2264271b6cd4a6179d40823126a27d1d3757
MD5 bb83c628c74517aa8d7929ae5cdec523
SHA1 12a84dfe5ca0b6d4e90399c31280b1f77bd567cc
SHA512 722e6e3f37b19589bf2e10809a43054f2c7f5a60d12c406c6da4d04ca6666d70340abaa005014d77ba735df81fd0c0b90f32ac29394b45145c90b09073fc7d6c
TLSH
T14341441A5EF916E5F6BBDB1A94F360176A72BEA26836DD0D02C1474C08B1B14A820F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 d9b6b22835f72ec904886a58de0a04cd952531b93eff8dab95ad7650fdf48738
MD5 3573006d91a588a7ced7334fbfbd2403
SHA1 efa7ffc9aceaf3418f9c289f17d35deb80097acb
SHA512 13b0da7d2d6da327693cc35a817458d2297e19e097f00ecf0f027475684acff2abf05afb316c7875ba3c2b6ab1b9e7c9fe6cde36b1b9c42ea581e0655b5e576f
TLSH
T13261832A1EF912F6B6BBDB0B84F360176A77BEA16835DD0D12C1474C08B1B14A960F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 8a36500189b243f5b31bb0d9da95499a8676e0471678b5c5d48a572b17bf9fe2
MD5 a4572dfa325b6a4a91245c326cb1129e
SHA1 e629a98a546818639de3e0dffb25a6051702426f
SHA512 bed882d199d806f5d447ce9436e1d9b3fb61ee4e37283c8352fa5312581b451939cfad76e51f4d2df4551b96c16e8d2f1170bb08a60449d993c46f5b6125ffa2
TLSH
T14D71942A1EF912F6B6BBDB0B84F360176A77BEA16835DD0D12C1474C08B1B14A960F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 cef5702bfe308bf58691a4018be5500935c45466dd133752a1eb4a0f680f286c
MD5 fc555009ab4d7b6e7601e11cbc6356c7
SHA1 3142153ed376b52e1fdb215d38ccdda3cf4426ba
SHA512 66a7cbae7f72817f26adec5d237a7f10cec16210000367080ac9f8bc3dc16484a50a8687084f4e9b2593ba0f767a28c2011e9f863e3f9d4e2875dd8eb6e7487e
TLSH
T13471822A1EF912F6B6BBDB0B84F360176A77BEA16835DD0D12C1474C08B1B14A960F77
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 8ca4b1c69bf3a36fd412837a2b03c66f84cb5de9618a469ef9e46954ae58177f
MD5 8e17414f396484e2b10322c7e5470385
SHA1 ab137947220fad785b6ad0f3c17e06d5227c23af
SHA512 96f773e5dc38a066f3dd375fc3d43a70325ef165764bfe89dae0359184536a70dfa9288d1cd338678cb37d4130320570a243768526da24fead41d7bbb97b6145
TLSH
T16F81912A1EF912E6B6BBDB0B84F360176A77BEA16835D90D12C1474C0CB1B14A960F37
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/412-51-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1064-7-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1064-16-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2508-31-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2648-83-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2648-72-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3892-1-0x000000000043A000-0x000000000043B000-memory.dmp

Download

memory/3892-6-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4092-91-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4204-97-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4464-24-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4464-17-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4664-92-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4664-253-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5356-44-0x0000000000400000-0x000000000043F000-memory.dmp

Download