c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6.exe
Size 135KB
Sample261014-en3afavy8k
SHA256 c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6
MD5 34125456618d89e73b897a15375e9c29
SHA1 14f60b4403f060457f525329436fdaf6ca807247
SHA512 b1c1d442a495ac680f23c472868fe3e13e60405e9c2c64e004470b3fb54ff4b2644bc822a34f4d179f851815206e3a0765a3500574653c36c5d2f9266ec97413
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0E:nqZ4h4fIqPWQd/4KUNNFx
TLSH
T1DED31849EB8310F1FE6701B010AAEBFF4236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	4892	Eupdate Helper.exe

Executes dropped EXE 9 IoCs

pid	Process
4380	Eupdate Helper.exe
5516	eup_rotate_4380.exe
3344	Eupdate Helper.exe
4328	Eupdate Helper.exe
4692	eup_rotate_3344.exe
4892	Eupdate Helper.exe
5744	Eupdate Helper.exe
2124	eup_rotate_5744.exe
980	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000000433-61.dat	upx
behavioral2/memory/5744-70-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/5744-78-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/files/0x0004000000000433-87.dat	upx
behavioral2/memory/2124-89-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/980-267-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_3344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5756	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{6FE4030A-80E8-4D9F-9734-C2F6F41FB79D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 4380	6092	c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6.exe	89
PID 4380 wrote to memory of 5516	4380	Eupdate Helper.exe	90
PID 5516 wrote to memory of 3344	5516	eup_rotate_4380.exe	91
PID 3344 wrote to memory of 4692	3344	Eupdate Helper.exe	94
PID 4692 wrote to memory of 4892	4692	eup_rotate_3344.exe	95
PID 4892 wrote to memory of 5744	4892	Eupdate Helper.exe	96
PID 5744 wrote to memory of 2124	5744	Eupdate Helper.exe	97
PID 4892 wrote to memory of 1200	4892	Eupdate Helper.exe	98
PID 2124 wrote to memory of 980	2124	eup_rotate_5744.exe	99
PID 1200 wrote to memory of 4440	1200	msedge.exe	100
PID 1200 wrote to memory of 1492	1200	msedge.exe	101
PID 1200 wrote to memory of 5756	1200	msedge.exe	102
PID 1200 wrote to memory of 1492	1200	msedge.exe	101
PID 1200 wrote to memory of 1492	1200	msedge.exe	101
PID 1200 wrote to memory of 5304	1200	msedge.exe	103
PID 1200 wrote to memory of 5304	1200	msedge.exe	103
PID 1200 wrote to memory of 5916	1200	msedge.exe	104
PID 1200 wrote to memory of 5240	1200	msedge.exe	105
PID 1200 wrote to memory of 5916	1200	msedge.exe	104
PID 1200 wrote to memory of 5916	1200	msedge.exe	104
PID 1200 wrote to memory of 5240	1200	msedge.exe	105
PID 1200 wrote to memory of 5240	1200	msedge.exe	105
PID 1200 wrote to memory of 5688	1200	msedge.exe	106
PID 1200 wrote to memory of 5860	1200	msedge.exe	107
PID 1200 wrote to memory of 5688	1200	msedge.exe	106
PID 1200 wrote to memory of 5688	1200	msedge.exe	106
PID 1200 wrote to memory of 5860	1200	msedge.exe	107
PID 1200 wrote to memory of 5860	1200	msedge.exe	107
PID 1200 wrote to memory of 3036	1200	msedge.exe	109
PID 1200 wrote to memory of 3036	1200	msedge.exe	109
PID 1200 wrote to memory of 6124	1200	msedge.exe	112
PID 1200 wrote to memory of 3832	1200	msedge.exe	111
PID 1200 wrote to memory of 6124	1200	msedge.exe	112
PID 1200 wrote to memory of 3832	1200	msedge.exe	111
PID 1200 wrote to memory of 5984	1200	msedge.exe	114
PID 1200 wrote to memory of 1960	1200	msedge.exe	115
PID 1200 wrote to memory of 1960	1200	msedge.exe	115
PID 1200 wrote to memory of 3404	1200	msedge.exe	118
PID 1200 wrote to memory of 3404	1200	msedge.exe	118
PID 1200 wrote to memory of 6128	1200	msedge.exe	120
PID 1200 wrote to memory of 4864	1200	msedge.exe	121
PID 1200 wrote to memory of 5136	1200	msedge.exe	122
PID 1200 wrote to memory of 800	1200	msedge.exe	123
PID 1200 wrote to memory of 800	1200	msedge.exe	123
PID 1200 wrote to memory of 2832	1200	msedge.exe	127
PID 1200 wrote to memory of 2832	1200	msedge.exe	127
PID 1200 wrote to memory of 6128	1200	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6.exe
"C:\Users\Admin\AppData\Local\Temp\c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4380.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4380.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4380
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_3344.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_3344.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 3344
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\eup_rotate_5744.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5744.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5744
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        9⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://info.hb.1yz.me/eupo.html
        7⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffaf0dcc188,0x7ffaf0dcc194,0x7ffaf0dcc1a0
        8⤵
        
        PID:4440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,12226930269812542734,14743527705510178225,262144 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        8⤵
        
        PID:1492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13101231991844203639,8719106567280574886,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:5756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,2576214120600081836,12818026690152671791,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
        8⤵
        
        PID:5304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,1711610520864477440,4969164495337162301,2097152 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
        8⤵
        
        PID:5916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,9939103968410802583,1115954776425101955,2097152 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
        8⤵
        
        PID:5240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,2069988031420534117,3539999915738337374,2097152 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
        8⤵
        
        PID:5688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11627489241128394336,2959081234348776408,2097152 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
        8⤵
        
        PID:5860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,15007794620194767766,15957653521308717695,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
        8⤵
        
        PID:3036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,1800766075415085939,14599298477786388503,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
        8⤵
        
        PID:3832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,11102971548651991309,3417903479407858700,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
        8⤵
        
        PID:6124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,14192833477007547440,967015965677441917,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        8⤵
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,14192833477007547440,967015965677441917,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        8⤵
        
        PID:5984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10593679541622557047,11509298919331611950,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
        8⤵
        
        PID:1960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,75255052021576032,8907689976434920096,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
        8⤵
        
        PID:3404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16309181265259924811,8995022797954396227,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
        8⤵
        
        PID:6128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3314776594144017478,1288715921220912961,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
        8⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,8327172323110156424,6222913927674828485,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
        8⤵
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,8894559634070441106,13106855038592119690,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:14
        8⤵
        
        PID:800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,16013060332885592959,2233410133958511159,524288 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
        8⤵
        
        PID:2832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6716,i,15205012272132222123,1454367855439457747,262144 --field-trial-handle=2316,i,15350936370748833171,1037221478933423054,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:10
        8⤵
        
        PID:6128

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3570409d-50e2-45fc-b085-0eefe1399b8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3570409d-50e2-45fc-b085-0eefe1399b8a.tmp
Size 37KB
SHA256 c9888dd3b4f50cf056707706ff0b618c365e3ff02aee0c00ade501b6b9c219f3
MD5 ba166181555ed25e15281738400cdb80
SHA1 fb3c0bc6df7eedf3c71a3ba268d4dc41ea7481fa
SHA512 45fe543016b40de716dfc61d13944f08729cab3c3961672ecebed0e605596255a3f3a65fca1a71b9206f52762fd4bdf12a8dadcdf06dc9236159e91a7cf495a3
SSDEEP 768:vw/UxvxjgC+5j3wVz68lieOT9TjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5RAgZbCMc:vdZj3+5j3wx6yCTjFwQpYoimeoR4ccFQ
TLSH
T18403BE75E8A8AE37DCF39784365D6342FFF1416395C22AA4CAED1E0D42872AD430BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57848d2b-75a7-4421-a39b-c9a7a3aec012.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57848d2b-75a7-4421-a39b-c9a7a3aec012.tmp
Size 40KB
SHA256 1d981c208af3fc990b8068e0af9b43b5dbfa18a1c4fbf763fc2c11fe355c0f76
MD5 24b5855ecb4a21b4354e8bb938c2040c
SHA1 049d82e80f8c33c3da28bc0391308bb227df0784
SHA512 49125b1fcfb5469dd6da4deda21b2b893881806ed0aa81ac7498df8d84db8f923af6585f4805f4ca6ec3073f543583cc07c4d581e11b880de647b3d264241c61
SSDEEP 768:3I/UxvxjgC+y3VmVnOieOT93xTRnUPO4Qp7cPAiSm2eo4w4cciGrTFl5ykJVCiMC:3VZj3+y3KOCZRwQpYoimeoR4ccFFzyQt
TLSH
T13813BF75E9A8BE23A8F2A241765D2382EFF51573A4C21E58CAD91F0D06837DE031BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dc1451f-7957-4796-acbb-3072122a4428.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5dc1451f-7957-4796-acbb-3072122a4428.tmp
Size 34KB
SHA256 1ad216005171d1c8df79a43ece22eecf097e6d54b4e6efb58d0520330dfa1319
MD5 0c56ff636050430ea60ee71a5f7d4f26
SHA1 43eb0c256dad65ca17ed65fcaec01233eda6357d
SHA512 1a15d5330aab678cfc7688181917c222b90db3722600b71c089a5e26f1e8c47ccd911d06a50be55685340e2738780425d03e48c8a99ac8a3937d395ff211e57a
SSDEEP 768:Hb3q6VnOieOT93xTSnUPO4Qp7cPAiSm2eo4w4cciGrTFl5ykJVC6:Hb3fOCZSwQpYoimeoR4ccFFzyQh
TLSH
T1BFF2BEB0E9A8EF33ACE69241BA593702AFF55133B8C51F48D6D95B0D41437AE071BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a76380b-78d5-42da-9672-d5427509320f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6a76380b-78d5-42da-9672-d5427509320f.tmp
Size 38KB
SHA256 ea5fcd6fa0f823634b26e449972011e647f5460dc0b841193607ce8dd81ff0be
MD5 833b1ac29a87ac9450eefbd9fe699928
SHA1 687f1d83f0a02362b638735060849bd5891f3b94
SHA512 c402453a3fdbb3f42eee5eae14469ccfcecc25a32fbbd3a555b055b922a067bd5e08110aa0232d3913a9c501c8d1a6d4fc2b3394bedf96151479f5dce6031029
SSDEEP 768:v5/UxvxjgC+5j3NVRVF8IieOT93xTjFnUPO4Qp7cPAiSm2eo4w4cciGrTFI5AgZw:vsZj3+5j3N1FvCZjFwQpYoimeoR4ccFR
TLSH
T13603BF74E8A8FE639CF3A744365D6382EFF1116398C25E94CAE91F0D46473AE170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80f68a91-618f-4130-a5fe-98cd45784d9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80f68a91-618f-4130-a5fe-98cd45784d9b.tmp
Size 42KB
SHA256 57789a06bad27235fc80f9113b547ff86eea3530768440abfd9fee66e232424d
MD5 508ce9f4c561d60ee7dd7a491004f83d
SHA1 d96ed2cf5ee65b7b8fc3639f435ecb934dc61612
SHA512 79f761ae78531debe01b2c1266c1b4c0d7fbeb2925c5f0a490fbdb929871af6b93945764762b06074fa5c3ebb1861547ff1ed05792d108cf967423308e8264ea
SSDEEP 768:77FQx33wgy6Cn0uOT93xS7nUPO4Qp7cPAiSm2eo4w4cciGrTFl5ykJVC6:7Ox3WW07wQpYoimeoR4ccFFzyQh
TLSH
T14A1306F198D79A36E8AE4783677C2E019EBCD163B5895984F7D91D0CCC822BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

1bb0f36c-d60d-424f-9592-18ce69799c29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1bb0f36c-d60d-424f-9592-18ce69799c29.tmp
Size 11KB
SHA256 f2273e6110eae9ab41f45460bba6faf7c1438f083b6c5f8bd5e7bf2e8c3b3569
MD5 be2f9aaf8b91ffc2196a9e2a71743e89
SHA1 c4f182a1e495a9e5a301245362ec4076b547e48d
SHA512 b6ebae4a671d9edd9a482bb8875b410a97f5e576b36ea9463a16d26d539556f699d7006af72df8b15834232fc18faaf1dace8fd952baa236c57b757d453ba4b2
SSDEEP 192:sxR4aRqC//feqksIVZgA7VzoA8pU9S/g6+WNQ9o6/Yc0IAXtiTuGoIgDtVuQJ:sxR4aj//feqksIbQAS/50h/Uz9iT+Hu0
TLSH
T1F742B616AD28A93B8CDBD209FB55BF53D6FD5132A0D11E08A6FC8A1C04E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35091439-2590-47d3-89c0-5f9523ad4c57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35091439-2590-47d3-89c0-5f9523ad4c57.tmp
Size 29KB
SHA256 b7f4408b63bbca62772f58f6f7575c23a739928c969c03c590027090e031da10
MD5 f030017848c2eb0ecce60c48c646a54b
SHA1 7f73beae2a150d6897c8101a908407f42c6d08f5
SHA512 d1f42461fad8904f7e8f9a9a1c0f961135bce386659045ee3980257ae937a837c3fcc4e89e0c02d46d234f1564260a8ea0931011d91d035d40d9636a2e3dbf12
SSDEEP 768:DFak94yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbGJ97gProMzp:DFak94ymEbs5Wg1Bf9tu1jacGJxgcMzp
TLSH
T1BAD2EA3B744CCB7F4F804A9DEC197E9B6DA802CB9598C94047FE941D03C6BEA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80ba66ac-b3da-449c-9026-d3e7d06df8d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80ba66ac-b3da-449c-9026-d3e7d06df8d7.tmp
Size 11KB
SHA256 f4abaea8fd1a9c7cf1ed74ae63aac1ef7186c5e205c988c843e758729ec2a7ab
MD5 87447dc6737204e37e94e2c91342105f
SHA1 eae9d7d814e46fdb6e8a61ebbbcb0de739486b43
SHA512 8360cf8100d601dca300213845520f2b4e1fe418e04e7c8ba2e2262ed2770d003cf9b58570a53d95d632379ab38ef202748ca50a9476143a966bd383ec98982a
SSDEEP 192:sxRpaRqC//feqksZVZgA7VzoA8pU9S/g6+WNQ9o6/Yc0IAXtiTuGoIgVVuQJ:sxRpaj//feqksZbQAS/50h/Uz9iT+bu0
TLSH
T11342B616AD28A93B8CCBD209FB55BF53D6FD1132A0D11E08A6FC8A1C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 86c13799963f3aee1c5f43f5e219e2094cfa21bae657f1dfedab33d52d230d51
MD5 801915896f63745e954efdb1d418cc43
SHA1 23069c9cf6e558013c07412832e061fe42989b76
SHA512 5688fdfcea80fa0ad8fcf709f4f8f2ed1a7bd3007d8e4b085b66fe82a2f2fc7d359bbcc3f0812ff86f9ddd67c3456c50a73652f43059e970dae707bb1134b54c
TLSH
T1D361607848808241FF7E407DD7D09CC336B34AAB52832E612A58FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7d8ff154b9bdcb3cf5342cc74311234c809d5c8bc093e669b782713e8823d969
MD5 60751ae1e3ad016042f85a13ad2b0541
SHA1 5d17a25a54a292225e60c7b4c7bc626abb8fe33d
SHA512 2477d441ea3cb75c2d3fc18d754d26cb628b5c2cee6bab971a75d9e47bc120d11bab560a1ef1c5b47f6931ee530cfdff14f2d8442c81466fd208e123ae369e4b
TLSH
T196615E7859808245FFBE407DD7D09CC336B34AAB52832E612A58FF7CA4463D1B29781E
MD5 SHA1 SHA512 TLSH

Submit Download

b44741ba-4664-409a-8865-0880cc75bdb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b44741ba-4664-409a-8865-0880cc75bdb5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0dc790ac-50d5-449d-9fd5-78d5d8217d62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0dc790ac-50d5-449d-9fd5-78d5d8217d62.tmp
Size 2KB
SHA256 5a808544e71615878cd76d214b767457e55c9ebf3e13980a710f7fe001c8adfa
MD5 a86b05659861500276b2acbba31ebbdf
SHA1 a1b8749601fc3279acfcb55b4e5ebeb404b521cf
SHA512 df01c5e06aa026cd4fe517cb1b986e4665b5a4a9fb922ce0aa3a52ed08016427d0ccf5f5ad7f93355923791b40974631b166b171b4aecc6530a8a58c4e6d8b07
TLSH
T10551D0F783F4866ECA0196F0AA186E2FDF1D0515432C7D5A85E0AE2B93F3471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

771b5ea0-e9a1-42fa-b6e5-aa138618f206.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\771b5ea0-e9a1-42fa-b6e5-aa138618f206.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c20ec145-637e-4119-96a6-4599735f16b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c20ec145-637e-4119-96a6-4599735f16b2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 161c082800136ec1b1347f9f2b290031a5e401f4ced8acc449980f81071c7d15
MD5 d15ed1b36349cd4ca9f9da1bd1e0dc4b
SHA1 2fc93e1d0bcf3d1d9edf531f19118f519e2c3abe
SHA512 435e64495d10e7ac657d121b2626daf691090bf168b9a7df7b17440d88d9fb788760b7295732fd9279153d00962a407b81c641abcb0716c125e2c0e334c12b33
SSDEEP 48:KMLGnrFNdWTNYdIarWKVz9BWRjGoQRLHyDC9ocC4IpTM7kIakpKVg9ypRa5oj0so:KsYoKRqmuZ+KqcZnWKoIeN
TLSH
T1B791402275EA0250387D3D1C56D59BAB434176A37028F93F7BE944A18E2BE050EFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae1987a5-eb4a-4d4a-8b89-f09845469481.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae1987a5-eb4a-4d4a-8b89-f09845469481.tmp
Size 12KB
SHA256 5f893d3a0f90c4b7965696da78d20210f865fa41e0e72e6f150b6b815c870544
MD5 6a4e5b9f392de65ed2e0b7e2c5596486
SHA1 1ac9e467b6f0abf61bb92d119447b1b6d93a1770
SHA512 b881a58241e7516acc9e00887bf4154ef2e5bfec281e68d74dac7ec0bf43e0171c6c04f06bc2009c24e9bf8bd0c4d7b3d1f3a738ebc1f47adcd9e9c5bc13ee50
SSDEEP 192:sxR4aRqC//feqkssVZgA7VzoA8pU9S/g6+WNQ9o6/Yc0bCXtiTuGoIgDXVuQJ:sxR4aj//feqkssbQAS/50h/UW9iT+5u0
TLSH
T18842B715AD28A93B8CDBD209FB55BF13E6FD5132A0D11E08A6FC8A1C14E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c41df5af-903e-4866-bf83-ec42566e0395.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c41df5af-903e-4866-bf83-ec42566e0395.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78142654-261d-4a59-8942-76b4a0654f00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\78142654-261d-4a59-8942-76b4a0654f00.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5844836-285a-401a-9201-2e48cf9beff3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5844836-285a-401a-9201-2e48cf9beff3.tmp
Size 34KB
SHA256 b754414cdff239ac6eb6c79c52e37771b5d7fa6a82b7d9ff5abadaac8aae34fb
MD5 24e82faaa595834a680a02a925437b26
SHA1 a18200416221d7cc962b225f728bfa851e468dca
SHA512 33d5354d35724f57a1d7a7fb4d449579deef117135e8e9aab29faa09b46ef1bba3bca98dbe0f3de58a2ec5ea6aaae8cf05174a8874b9858c8b3fdf922ab1672f
SSDEEP 768:34b3V6VnOieOT93xTSnUPO4Qp7cPAiSm2eo4w4cciGrTFl5ykJVC6:34b36OCZSwQpYoimeoR4ccFFzyQh
TLSH
T157F2BEB0E9A8EF33ACE69241BA593702AFF55133B8C51F48D6D95B0D41436EE031BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

49740f54-c3be-40f2-9487-3ddfc4f7cdfb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\49740f54-c3be-40f2-9487-3ddfc4f7cdfb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

9426c773-fb5a-4414-a1ed-4fa217eff116.tmp

Path C:\Users\Admin\AppData\Local\Temp\9426c773-fb5a-4414-a1ed-4fa217eff116.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 c362065f9aed637f65407fd35a2799cb619695cae05464d867d0fe04b4e63df8
MD5 c4614ca770acd67e68fe7983c6bd0c11
SHA1 b1961e48edc0c4cc5b0c5314aadfa89e8ab64e35
SHA512 6a67e4ed9b8a2f43ce6a86460fd454bef41f05e72cde69a8140451bc45be78531baf296ddcef99a20db209da87f8be673873c14d528478b33789fb012c8613b2
SSDEEP 1536:IE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Be:nEuSllYhhjm+kLZ
TLSH
T15B7302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 76KB
SHA256 f8c95b15c029889ff480b0bcd47e8590182f8ed991e8be87e692e48793ea49b3
MD5 ac53e277ae30b74807fdfa2c72c7fcee
SHA1 e7feaa746464616be2ee356f505495677783106c
SHA512 af222aee17d6aa49073a026b88561fe019ddb3f0b789921cabb9b4bcc21450ccf48c895d44b87b883a0087a69d179751e1053c611b5c2a9acd17a195553f527e
SSDEEP 1536:IE3rwNdcSSKhLihzFhhho92y5IRQ8mzpNUZuE/4nC3Bed:nEuSllYhhjm+kLZd
TLSH
T1787302516690F933E92E9F721B76C12CDFE8E712C62EEF161A0ECC1D7CA2255060C56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 d9a270145327cd1633f6b6725adcada3bb03fd0d0d22d9875b5b3eb9b82033b5
MD5 0ea2d1e506e28f41b2589e7f4480251c
SHA1 6fb58bd3bfae3969751bc1034aee73a83843bb33
SHA512 dc3a4d39960bdce548f563ee55acd7e432676738f313c4fb3667d2974886dca23e13a315dc16e31073b0609057636359abd9fee443a6f01fffd9e7bced8aaa39
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0W:nqZ4h4fIqPWQd/4KUNNFD
TLSH
T16DD31849EB8310F1FE6701B010AAEBFF4236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 c82a1fb133ec52716b99bb861b868d1423ac6b0473c46ef186cfeea2884306e6
MD5 34125456618d89e73b897a15375e9c29
SHA1 14f60b4403f060457f525329436fdaf6ca807247
SHA512 b1c1d442a495ac680f23c472868fe3e13e60405e9c2c64e004470b3fb54ff4b2644bc822a34f4d179f851815206e3a0765a3500574653c36c5d2f9266ec97413
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0E:nqZ4h4fIqPWQd/4KUNNFx
TLSH
T1DED31849EB8310F1FE6701B010AAEBFF4236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 135KB
SHA256 7b5a9e55eac38186ac216102b91798b6fd47c39726d57951f38a5484f2d5fb40
MD5 867a906da620d9fd37dde9c1e67c5529
SHA1 5992527985f6253ea8035d12a8879478b4e6ba31
SHA512 27df58b7153e0e3a8881a28fe54d97a85c6efc2be53feba7ea8dccbff9c94f73ee63363a3d349541eb4d1c739b8e86ed9a4e2148ab593c2feb2d810d98f19c65
SSDEEP 3072:KNRrWgsD+ZKHhfWrfI10PKucQd9Z7zH/4KUNk0F0s:nqZ4h4fIqPWQd/4KUNNF5
TLSH
T190D31849EB8310F1FE6701B010AAEBFF4236B511D93A8D66D786CD86ADB29770C1531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 710B
SHA256 c1c9d37412053b8fb3751c9ee26fe0313726afb2729908aa0c569de0ea2509f6
MD5 7dbb5c4a47b97ab498425ae582e8302f
SHA1 40a578b92cbf0ee15c8c24cb68241f89d2810b39
SHA512 48c00dc72ddff25262f7472025629ab933f6ac5e0b3b0e5ef08931791faa9d7bc0f3d884743ca4e71c4939fa483f97b0608f0fa41f8e4bd7239e71c7c0f879de
TLSH
T1D901812A9AE50146F5F3DA1714F3A013AEB67E607839D40E07C14B8D2CB1604E820F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 7d4885eb5796d39d07c5385dc0016196a25eced8295202d6ac0b4793a0978591
MD5 756672e7b9e47f7b74a120bd8e7634ab
SHA1 c9074ca6fc8c9c9ac6fb200ea5f8bea4bd081163
SHA512 126a709d44efc62ee3118f88ce33ab73e939c72308df9eb27492b9acfe43b40fb7746a0254c1ec27cb99fc64343e70dd30bd37ab2fdce9115da3cd1f9f1aab44
TLSH
T11311C4365AE50146F6F7EA1718F7A013AEBA7D603839D40E06818B5D2C71604E920F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 f861550f0cf031ab0abdabfa9b7b6f2e5c15f27a39220ba14e9a7e2d68e4f4e7
MD5 b7ea6130e5ef5fd8938323df17c8c750
SHA1 beba35d0c62fc15b7815ce05384431d84e49d178
SHA512 1a8a738f69c24fb4940240fe080661183ab61004a1b0f3a7af6246bcc7fd786d36b9fcc10c23ccad2649037c76bc9e95bae6292970cb57363c15c62e43ddd366
TLSH
T19D218E269AD4015AF6F3EB1B58F790177EBABD60783DD80E06814B5D2C71604AC60F3B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 8682bfdb52f3316807bd5fcfdc86953a00e09d739b386ce456598a60ad48c198
MD5 6f4d8c2d5c68e5d80148217406dbb3d7
SHA1 f71821a0834f213f2385e2897702839db556cf62
SHA512 3ea9869d5136da0fc541ece7848373d739bfe87b5938adc72ee9a9e10cbd315a684301f9b2899a12064125af92f1bbc8a6aac36b3a973ffdcbc9ca2fc8fe28c5
TLSH
T15C21AF2A96E40256F6F3DB1B58F790177EBABD607839D90D06814B5D2C71604AC60F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 9a45eee177d22a21e31b8eb79b200a0600ce92ef297e1064495d09ccf4ec2b83
MD5 612e83bb8dc557271a2ac54b8774186e
SHA1 99fd5f6207e8e846d7ab9b178f7e1ee307ecfd8b
SHA512 4a864807c98e8db15a80a8f1a56d4612403b8162dc7d10ae13cc7e42fcdcfc1a7170c37837bda1dbae06287412c238a7411655c8a8de46a61b23c30093572b30
TLSH
T1A5416B2A9AE5025AF5F3DB1B44F790177EB6BE607439D80D06C14B5D2CB1604A860F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 17cda01c1d2ce57f67f29a8bbc810b8d16cb6343ce2ca872034c5dd491bbf9ea
MD5 f91e25d5079179ba02acb4e5dcc40e42
SHA1 196a29f359cea439cdaeed3fb5e34cacab8e46cb
SHA512 a2b2ff0808a7a2004f27baff40dbc3730d3fa6a265ebbeff92ed87c77555d8b6b98c986da6ad5f8d556c5ef9529454e8bc0fff6c23b2216a7e2bb3b4e68703de
TLSH
T159419E3A9AE5025AF5F3DB1B44F790177EBABE607839D90D06C14B5D2CB1604A860F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 24ac6c7ecbd0b263e0b1cb51dd08051681b0c1129734e39ee6701567af38a6db
MD5 f2ba414b167dbe2772bf9e3ba01d0cb9
SHA1 60d704b3b1d6ad6f5fa225ffdf14f55c8aba0505
SHA512 a22b96fe8e54bd611d03c603d000cc2adcd954cabcc06945723240f460b729a7befec50c1adfc2979c9158c7dfcd6299c11c2b522811cfb27c5d7ff801ae85cc
TLSH
T157F0372699E50156F5F3EF5718F790136DB6BD603839D40E06418B8D2C71614DD20F7B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 f3889085df522fd703c7898888102f95db0457721f68bfce07abac2f1b1f5d46
MD5 8a734bafdc1b88b96da012cf52c3e498
SHA1 f572072d288886f594a1686289dce35ecf2d3a12
SHA512 e0595529539724fbc64334d898e2927a2bbd7012bcf75551919499edccb4056121be224ecfdde566569ebaa9ffe66106c08cbc9bc03802c05eee2717f38d7893
TLSH
T10851C03A56E50256B5F3DB1B44FB90277EBABE607439D90D06C14B4E3C71614A8A0F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 db0afbe4e0a0363a319f7c0e53c8f2d2f86f289a982315ce6c3b3617847c4f62
MD5 0b71713fe2f75a6073d5471bf019995a
SHA1 f3a2769b7bcf7286ae348288730df2daf5bb374d
SHA512 11a2530e5976f6ac1a53d87d6712e03cf104c04f1d900f84647329f3fd6c30e42909fda884e5708b74aae1b79f4472950474ed1197ed07bec21cec13c61c9cb5
TLSH
T1EF71C13A56E50256B5F3DA1B44FB90277EBABE607439D90D06C14B4D3C71618A8A0F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 5eaea829ca2dee0a5bb14e94ea5c2b465651b741b7b099a07c95df51689fff9f
MD5 e3bb5a49502977d07a602f46d084b333
SHA1 a7c9acd0e466ebd32547b0796530255603c03bf3
SHA512 1a498f36f2fab8844fd2675475891f0ddacf70e6206974da146cad010000f0623c74d5f636db74bee57efee3ba89d1c42eedf0a6f715060258072b109dbb3a7e
TLSH
T15F71D23A56E50256B5F3DA1B44FB90177EBABE607439D90D06C14B4D3C71618A8A0F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 3KB
SHA256 a7c3023d9c531715eae11aa39e0d42b13b2d4c78c6a1c50745a339eacf5d297f
MD5 4fbf950a502727383c08b674bc212906
SHA1 3965f859b16eb5b9b43ade8b3aa25975bee60d4f
SHA512 cc3f866173618f8c385a9bb2e8b900b26fbc75dbcdab98167fa3923c6d0dfc6ead6c29c1e4ab21137c55bd0128117a2e71d9bec063e64c8a69a3496522a51768
TLSH
T13E81C03A57E50256B5F3DA1B44FB90277EBABE607839D90D06C14B4D3C71618A8A0F2F
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelperPro_info.txt

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelperPro_info.txt
Size 70B
SHA256 f20312b7c84be544a3808118eddb960987b3ad92dcbbdda8eff933698f22733a
MD5 c149d0e1695f4347b813298a8df32984
SHA1 3a21113f3a6caa1c53848f0478e0b92951475600
SHA512 bc1a2a59de20d9162b306638912fe5f7846d0c10d64b9115ccb4b1889a1fb0cf364a68b183a87ebd38e03f97598eccd63e3f2ce9df17bded08b29dab87ec1f9a
TLSH
T1B8A0220003B0C3E00303AC0EA2080302C0EB83228E3E0B8AF0CF020EF208080300B30B
MD5 SHA1 SHA512 TLSH

Submit Download

a63498b2-7695-4c35-a0b1-793f04b6ae08.tmp

Path C:\Users\Admin\AppData\Local\Temp\a63498b2-7695-4c35-a0b1-793f04b6ae08.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1200_283074911\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/980-267-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2124-89-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3344-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4328-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4380-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4380-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4692-45-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4892-93-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5516-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5516-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5744-70-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5744-78-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/6092-0-0x0000000000424000-0x0000000000425000-memory.dmp

Download

memory/6092-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads