File name:

EpicSetup.exe

Full analysis: https://app.any.run/tasks/2844c43c-8880-433b-8120-65c450ee7c12
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 06, 2026, 20:40:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
anti-evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

20B4ABE9F1A234C3C5CF3E3653C73201

SHA1:

ACAD58367EF24DB763B12B6C25DDFF951DBBDE7B

SHA256:

78B6A0F85F50DA832C2553284C56C83BD847832D328A311477EBF950596A2431

SSDEEP:

24576:UxWdbqh6PI7HcPpexcuRTe1ceNWZtUVyJvRXMaffNIIW/SFvWBwVztcZrng8knyd:daECKpWIyxppfBmIOBCCZjg83PGbWZz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • EpicUpdate.exe (PID: 7496)
      • EpicUpdate.exe (PID: 7532)
      • EpicUpdate.exe (PID: 7560)
      • EpicUpdate.exe (PID: 7584)
      • EpicCrashHandler.exe (PID: 7608)
      • EpicUpdate.exe (PID: 7632)
      • EpicUpdate.exe (PID: 7708)
      • EpicUpdate.exe (PID: 7756)
      • EpicUpdate.exe (PID: 7808)
      • EpicUpdate.exe (PID: 7868)
      • EpicUpdate.exe (PID: 3192)

    • Actions looks like stealing of personal data

      • EpicUpdate.exe (PID: 7496)
      • csrss.exe (PID: 652)
      • EpicUpdate.exe (PID: 7532)
      • EpicUpdate.exe (PID: 7560)
      • EpicCrashHandler.exe (PID: 7608)
      • EpicUpdate.exe (PID: 7632)
      • EpicUpdate.exe (PID: 7708)
      • EpicUpdate.exe (PID: 7584)
      • EpicUpdate.exe (PID: 7756)
      • EpicUpdate.exe (PID: 7868)
      • EpicUpdate.exe (PID: 7808)
      • csrss.exe (PID: 564)
      • mini_installer.exe (PID: 7668)
      • setup.exe (PID: 2508)
      • setup.exe (PID: 6916)
      • setup.exe (PID: 4968)
      • setup.exe (PID: 4396)
      • epic.exe (PID: 3520)
      • epic.exe (PID: 6408)
      • epic.exe (PID: 1908)
      • epic.exe (PID: 6300)
      • EpicUpdate.exe (PID: 3192)
      • epic.exe (PID: 6404)
      • epic.exe (PID: 2096)
      • epic.exe (PID: 7420)
      • epic.exe (PID: 424)
      • epic.exe (PID: 3548)
      • epic.exe (PID: 8540)
      • epic.exe (PID: 8344)
      • epic.exe (PID: 8364)
      • epic.exe (PID: 8372)
      • epic.exe (PID: 8408)
      • epic.exe (PID: 8524)
      • epic.exe (PID: 8548)
      • epic.exe (PID: 8588)
      • epic.exe (PID: 8556)
      • epic.exe (PID: 8776)
      • epic.exe (PID: 8768)
      • epic.exe (PID: 8752)
      • epic.exe (PID: 8792)
      • epic.exe (PID: 8800)
      • epic.exe (PID: 8784)
      • epic.exe (PID: 8852)
      • epic.exe (PID: 8760)
      • epic.exe (PID: 9000)
      • epic.exe (PID: 8940)
      • epic.exe (PID: 8928)
      • epic.exe (PID: 9008)
      • epic.exe (PID: 9064)
      • epic.exe (PID: 9108)
      • epic.exe (PID: 8312)
      • epic.exe (PID: 7720)
      • epic.exe (PID: 1156)
      • epic.exe (PID: 2228)
      • epic.exe (PID: 8364)
      • epic.exe (PID: 5780)
      • epic.exe (PID: 8572)
      • epic.exe (PID: 8588)
      • epic.exe (PID: 8700)
      • epic.exe (PID: 8904)
      • epic.exe (PID: 8756)
      • epic.exe (PID: 8624)
      • epic.exe (PID: 8688)
      • epic.exe (PID: 8696)
      • epic.exe (PID: 9052)
      • epic.exe (PID: 8276)
      • epic.exe (PID: 8768)
      • epic.exe (PID: 8960)
      • epic.exe (PID: 9020)
      • epic.exe (PID: 9048)

    • Changes the autorun value in the registry

      • EpicUpdate.exe (PID: 7496)

    • Steals credentials from Web Browsers

      • epic.exe (PID: 3520)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)
      • mini_installer.exe (PID: 7668)
      • setup.exe (PID: 2508)

    • Starts itself from another location

      • EpicUpdate.exe (PID: 7496)
      • EpicUpdate.exe (PID: 7560)

    • Creates/Modifies COM task schedule object

      • EpicUpdate.exe (PID: 7532)
      • EpicUpdate.exe (PID: 7496)

    • Application launched itself

      • EpicUpdate.exe (PID: 7560)
      • EpicUpdate.exe (PID: 7632)
      • setup.exe (PID: 2508)
      • setup.exe (PID: 4396)
      • epic.exe (PID: 3520)
      • EpicUpdate.exe (PID: 7868)

    • Reads security settings of Internet Explorer

      • EpicUpdate.exe (PID: 7496)
      • setup.exe (PID: 4396)
      • EpicUpdate.exe (PID: 7868)
      • epic.exe (PID: 3520)

    • There is functionality for taking screenshot (YARA)

      • EpicUpdate.exe (PID: 7496)
      • EpicUpdate.exe (PID: 7560)
      • EpicUpdate.exe (PID: 7808)
      • EpicUpdate.exe (PID: 7868)

    • Searches for installed software

      • setup.exe (PID: 2508)

    • Possible stealing from browsers

      • epic.exe (PID: 3520)

    • The process checks if it is being run in the virtual environment

      • epic.exe (PID: 3520)

    • Connects to unusual port

      • epic.exe (PID: 6408)

  • INFO

    • The sample compiled with english language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)
      • mini_installer.exe (PID: 7668)
      • setup.exe (PID: 2508)

    • Checks supported languages

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)
      • EpicUpdate.exe (PID: 7532)
      • EpicUpdate.exe (PID: 7560)
      • EpicUpdate.exe (PID: 7708)
      • EpicCrashHandler.exe (PID: 7608)
      • EpicUpdate.exe (PID: 7632)
      • EpicUpdate.exe (PID: 7584)
      • EpicUpdate.exe (PID: 7756)
      • EpicUpdate.exe (PID: 7808)
      • EpicUpdate.exe (PID: 7868)
      • SearchApp.exe (PID: 5568)
      • TextInputHost.exe (PID: 8060)
      • mini_installer.exe (PID: 7668)
      • setup.exe (PID: 2508)
      • setup.exe (PID: 6916)
      • setup.exe (PID: 4396)
      • epic.exe (PID: 3520)
      • setup.exe (PID: 4968)
      • EpicUpdate.exe (PID: 3192)
      • epic.exe (PID: 6408)
      • epic.exe (PID: 1908)
      • epic.exe (PID: 3548)
      • epic.exe (PID: 6300)
      • epic.exe (PID: 7420)
      • epic.exe (PID: 2096)
      • epic.exe (PID: 6404)
      • epic.exe (PID: 424)
      • epic.exe (PID: 8364)
      • epic.exe (PID: 8344)
      • epic.exe (PID: 8372)
      • epic.exe (PID: 8408)
      • epic.exe (PID: 8524)
      • epic.exe (PID: 8548)
      • epic.exe (PID: 8540)
      • epic.exe (PID: 8768)
      • epic.exe (PID: 8760)
      • epic.exe (PID: 8588)
      • epic.exe (PID: 8752)
      • epic.exe (PID: 8784)
      • epic.exe (PID: 8800)
      • epic.exe (PID: 8792)
      • epic.exe (PID: 8852)
      • epic.exe (PID: 8556)
      • epic.exe (PID: 8776)
      • epic.exe (PID: 9000)
      • epic.exe (PID: 8928)
      • epic.exe (PID: 8940)
      • epic.exe (PID: 9064)
      • epic.exe (PID: 9108)
      • epic.exe (PID: 9008)
      • epic.exe (PID: 8312)
      • epic.exe (PID: 7720)
      • epic.exe (PID: 1156)
      • epic.exe (PID: 5780)
      • epic.exe (PID: 8572)
      • epic.exe (PID: 8364)
      • epic.exe (PID: 2228)
      • epic.exe (PID: 8904)
      • epic.exe (PID: 8624)
      • epic.exe (PID: 8688)
      • epic.exe (PID: 8588)
      • epic.exe (PID: 8696)
      • epic.exe (PID: 8700)
      • epic.exe (PID: 9048)
      • epic.exe (PID: 9052)
      • epic.exe (PID: 8276)
      • epic.exe (PID: 8960)
      • epic.exe (PID: 8768)
      • epic.exe (PID: 8756)
      • epic.exe (PID: 9020)

    • The sample compiled with czech language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • Create files in a temporary directory

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7868)
      • EpicUpdate.exe (PID: 7584)
      • epic.exe (PID: 3520)

    • The sample compiled with french language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with german language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with Indonesian language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with swedish language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with arabic language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with portuguese language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with polish language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with korean language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with russian language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with japanese language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with bulgarian language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with Italian language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with turkish language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with slovak language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • The sample compiled with chinese language support

      • EpicSetup.exe (PID: 7476)
      • EpicUpdate.exe (PID: 7496)

    • Creates files in the program directory

      • EpicUpdate.exe (PID: 7496)

    • Creates files or folders in the user directory

      • EpicUpdate.exe (PID: 7496)
      • EpicUpdate.exe (PID: 7868)
      • mini_installer.exe (PID: 7668)
      • setup.exe (PID: 2508)
      • setup.exe (PID: 4396)
      • epic.exe (PID: 3520)
      • epic.exe (PID: 6408)

    • Reads the computer name

      • EpicUpdate.exe (PID: 7496)
      • EpicUpdate.exe (PID: 7560)
      • EpicUpdate.exe (PID: 7532)
      • EpicUpdate.exe (PID: 7584)
      • EpicCrashHandler.exe (PID: 7608)
      • EpicUpdate.exe (PID: 7632)
      • EpicUpdate.exe (PID: 7708)
      • EpicUpdate.exe (PID: 7756)
      • EpicUpdate.exe (PID: 7868)
      • EpicUpdate.exe (PID: 7808)
      • TextInputHost.exe (PID: 8060)
      • mini_installer.exe (PID: 7668)
      • setup.exe (PID: 2508)
      • setup.exe (PID: 4396)
      • epic.exe (PID: 3520)
      • EpicUpdate.exe (PID: 3192)
      • epic.exe (PID: 1908)
      • epic.exe (PID: 6408)
      • epic.exe (PID: 8344)

    • Launching a file from a Registry key

      • EpicUpdate.exe (PID: 7496)

    • Process checks computer location settings

      • EpicUpdate.exe (PID: 7496)
      • SearchApp.exe (PID: 5568)
      • EpicUpdate.exe (PID: 7868)
      • epic.exe (PID: 3520)
      • epic.exe (PID: 2096)
      • epic.exe (PID: 424)
      • epic.exe (PID: 6404)
      • epic.exe (PID: 7420)
      • epic.exe (PID: 2228)
      • epic.exe (PID: 8364)
      • epic.exe (PID: 7720)
      • epic.exe (PID: 5780)
      • epic.exe (PID: 8696)
      • epic.exe (PID: 8700)
      • epic.exe (PID: 8756)
      • epic.exe (PID: 9052)
      • epic.exe (PID: 9048)
      • epic.exe (PID: 8276)
      • epic.exe (PID: 9020)

    • Checks proxy server information

      • EpicUpdate.exe (PID: 7756)
      • EpicUpdate.exe (PID: 7584)
      • EpicUpdate.exe (PID: 7868)
      • EpicUpdate.exe (PID: 3192)
      • epic.exe (PID: 3520)
      • slui.exe (PID: 5596)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5568)
      • epic.exe (PID: 3520)

    • Manual execution by a user

      • Taskmgr.exe (PID: 408)
      • Taskmgr.exe (PID: 7648)
      • mspaint.exe (PID: 8792)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 408)

    • Creates a software uninstall entry

      • setup.exe (PID: 2508)

    • Reads CPU info

      • epic.exe (PID: 3520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:10:16 17:32:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 333312
InitializedDataSize: 1490944
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.3.29.13
ProductVersionNumber: 1.3.29.13
FileFlagsMask: 0x003f
FileFlags: Debug, Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Epic Privacy Browser
FileDescription: Epic Privacy Browser Installer Setup
FileVersion: 1.3.29.13
InternalName: Epic Privacy Browser Installer Setup
LegalCopyright: Copyright 2007-2010 Google Inc.
OriginalFileName: EpicUpdateSetup.exe
ProductName: Epic Privacy Browser Installer
ProductVersion: 1.3.29.13
LanguageId: en
Debug: -
PrivateBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
78
Malicious processes
71
Suspicious processes
0

Behavior graph

Click at the process to see the details
start epicsetup.exe epicupdate.exe epicupdate.exe epicupdate.exe epicupdate.exe epiccrashhandler.exe epicupdate.exe epicupdate.exe epicupdate.exe epicupdate.exe epicupdate.exe textinputhost.exe no specs taskmgr.exe no specs taskmgr.exe mini_installer.exe setup.exe setup.exe setup.exe setup.exe epic.exe epic.exe epicupdate.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe slui.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe epic.exe mspaint.exe no specs csrss.exe csrss.exe svchost.exe searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
408"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
424"C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4132,i,7241240777795599345,8197907645310298415,2097152 --field-trial-handle=1820,i,9156143025027501798,16215589405273246558,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:2C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe
epic.exe
User:
admin
Company:
Hidden Reflex Authors
Integrity Level:
LOW
Description:
Epic Privacy Browser
Exit code:
0
Version:
138.0.7204.50
Modules
Images
c:\users\admin\appdata\local\epic privacy browser\application\epic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\users\admin\appdata\local\epic privacy browser\application\138.0.7204.50\chrome_elf.dll
c:\windows\syswow64\version.dll
564%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\csrsrv.dll
c:\windows\system32\basesrv.dll
c:\windows\system32\winsrv.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winsrvext.dll
c:\windows\system32\user32.dll
c:\windows\system32\cfgmgr32.dll
652%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\csrsrv.dll
c:\windows\system32\basesrv.dll
c:\windows\system32\winsrv.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsrvext.dll
c:\windows\system32\combase.dll
c:\windows\system32\cfgmgr32.dll
1156"C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --metrics-shmem-handle=6348,i,13793494938602568528,10571977561328667286,524288 --field-trial-handle=1820,i,9156143025027501798,16215589405273246558,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe
epic.exe
User:
admin
Company:
Hidden Reflex Authors
Integrity Level:
LOW
Description:
Epic Privacy Browser
Exit code:
0
Version:
138.0.7204.50
Modules
Images
c:\users\admin\appdata\local\epic privacy browser\application\epic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\users\admin\appdata\local\epic privacy browser\application\138.0.7204.50\chrome_elf.dll
c:\windows\syswow64\version.dll
1908"C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAADAAAMAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --metrics-shmem-handle=1816,i,5610509363315351552,5710804060344955171,262144 --field-trial-handle=1820,i,9156143025027501798,16215589405273246558,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe
epic.exe
User:
admin
Company:
Hidden Reflex Authors
Integrity Level:
LOW
Description:
Epic Privacy Browser
Exit code:
0
Version:
138.0.7204.50
Modules
Images
c:\users\admin\appdata\local\epic privacy browser\application\epic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\epic privacy browser\application\138.0.7204.50\chrome_elf.dll
2096"C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3384,i,17381819503322244345,13488961894830012396,2097152 --field-trial-handle=1820,i,9156143025027501798,16215589405273246558,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe
epic.exe
User:
admin
Company:
Hidden Reflex Authors
Integrity Level:
LOW
Description:
Epic Privacy Browser
Exit code:
0
Version:
138.0.7204.50
Modules
Images
c:\users\admin\appdata\local\epic privacy browser\application\epic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\users\admin\appdata\local\epic privacy browser\application\138.0.7204.50\chrome_elf.dll
c:\windows\syswow64\version.dll
2228"C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe" --type=renderer --extension-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5912,i,13417949448785159142,9970858822673457566,2097152 --field-trial-handle=1820,i,9156143025027501798,16215589405273246558,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:2C:\Users\admin\AppData\Local\Epic Privacy Browser\Application\epic.exe
epic.exe
User:
admin
Company:
Hidden Reflex Authors
Integrity Level:
LOW
Description:
Epic Privacy Browser
Exit code:
0
Version:
138.0.7204.50
Modules
Images
c:\users\admin\appdata\local\epic privacy browser\application\epic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\users\admin\appdata\local\epic privacy browser\application\138.0.7204.50\chrome_elf.dll
c:\windows\syswow64\version.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2508"C:\Users\admin\AppData\Local\Epic Privacy Browser\Installer\Install\{94B1FB3C-B2A2-4C43-9D9A-9AA009CD51AD}\CR_70675.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Epic Privacy Browser\Installer\Install\{94B1FB3C-B2A2-4C43-9D9A-9AA009CD51AD}\CR_70675.tmp\CHROME.PACKED.7Z" C:\Users\admin\AppData\Local\Epic Privacy Browser\Installer\Install\{94B1FB3C-B2A2-4C43-9D9A-9AA009CD51AD}\CR_70675.tmp\setup.exe
mini_installer.exe
User:
admin
Company:
Hidden Reflex Authors
Integrity Level:
MEDIUM
Description:
Epic Privacy Browser Installer
Exit code:
0
Version:
138.0.7204.50
Modules
Images
c:\users\admin\appdata\local\epic privacy browser\installer\install\{94b1fb3c-b2a2-4c43-9d9a-9aa009cd51ad}\cr_70675.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
19 464
Read events
18 973
Write events
415
Delete events
76

Modification events

(PID) Process:(7496) EpicUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Epic Privacy Browser\Installer
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(7496) EpicUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Epic Privacy Browser\Installer
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe
(PID) Process:(7496) EpicUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Epic Privacy Browser\Installer\Clients\{B852E7B1-908A-48EF-9576-CBE23654D907}
Operation:writeName:pv
Value:
1.3.29.13
(PID) Process:(7496) EpicUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Epic Privacy Browser\Installer\Clients\{B852E7B1-908A-48EF-9576-CBE23654D907}
Operation:writeName:name
Value:
Epic Update
(PID) Process:(7496) EpicUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Epic Privacy Browser\Installer\ClientState\{B852E7B1-908A-48EF-9576-CBE23654D907}
Operation:writeName:pv
Value:
1.3.29.13
(PID) Process:(7496) EpicUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Epic Privacy Browser Installer
Value:
"C:\Users\admin\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe" /c
(PID) Process:(7532) EpicUpdate.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{82610E6D-11CA-45A9-98B1-D03B9AEDBD13}\InprocHandler32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(7532) EpicUpdate.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{84D964EE-0441-4A42-8146-0699AE05DDC3}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(7532) EpicUpdate.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{9BA04732-4369-45EF-9DA1-90561134DE6D}\InProcServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(7532) EpicUpdate.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{82610E6D-11CA-45A9-98B1-D03B9AEDBD13}\InprocHandler32
Operation:delete keyName:(default)
Value:
Executable files
133
Suspicious files
266
Text files
1 320
Unknown types
0

Dropped files

PID
Process
Filename
Type
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\EpicUpdateHelper.msiexecutable
MD5:C8F6A0A4A113C0B698A6BA6A4D82D7BC
SHA256:E908D7D23AA40F74068F97C90B9ACC1E103706425A7FFC2046FCBA5E45B1D910
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\goopdate.dllexecutable
MD5:BE1251E33E310931312839E7E92D5428
SHA256:DF801078E2512A40B32BDD801E771AD94ED9620B7BE9E8146DBFBF08E6043281
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\EpicUpdate.exeexecutable
MD5:97DC047B7ED9C22FC6CC04E015AD26F3
SHA256:B04266CA05E8125A1544E68C8852F7D44DDE9C7E4F3B08A0383C0BF4AB6CFD2D
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\EpicUpdateOnDemand.exeexecutable
MD5:4DB797D996FEB565BA45DC8E05216DD3
SHA256:F47C6E9740B967A27AF7CF07D9FED9A1DBE147F7376255FA9BA0653F583A6807
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\EpicUpdateBroker.exeexecutable
MD5:EAC4C2C7F8972E771DCB83CF66DB8126
SHA256:E864735EE505D35181066D268E4963F51581E87058E5F9C15AE90803B2914A8C
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\goopdateres_am.dllexecutable
MD5:D88C63B686242CC71FFE7527E6BFC387
SHA256:1CC7BB6883BCBD0BFE08FABA1BBAE512FB5F9D8AACCE1A80EE55955760E9F0C7
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\npEpicUpdate3.dllexecutable
MD5:089FEB1D8AE5CC610C8E37C565B02851
SHA256:1DDEDE4C9920C59075F4D0C0B5C961EF80C14A1DEB932981D5837BC355511909
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\goopdateres_ar.dllexecutable
MD5:DE553EE3DAC04B2A52E5B8317DBE3922
SHA256:65E2F79B249B2944A8F81980486574B15DEFF2DB43ED61E5CF8EDBB32959D242
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\goopdateres_ca.dllexecutable
MD5:96A28B5D2F3BFB0787959491688E530C
SHA256:D56A28BE1253366645A16345175A09A63094785E3A88CB9D0B3FD2380BFBCD6C
7476EpicSetup.exeC:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\goopdateres_bn.dllexecutable
MD5:D57A370B804835A938258ED7859742BC
SHA256:AB965667AC81A9F405F9088C6A34E05C9F75FBB086DD721208983D543C48DDF9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
59
DNS requests
51
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7868
EpicUpdate.exe
GET
—
172.67.170.148:443
https://cdn.epicbrowser.com/win138/mini_installer.exe
unknown
—
—
unknown
6768
MoUsoCoreWorker.exe
GET
—
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
unknown
—
—
whitelisted
7756
EpicUpdate.exe
POST
200
178.128.252.188:80
http://updates.epicbrowser.com/service/update2
unknown
—
—
unknown
7868
EpicUpdate.exe
POST
200
178.128.252.188:80
http://updates.epicbrowser.com/service/update2?w=3:AzU283XMsEeDxce-2dhn8QJVBi93MYh11C_0JjXkiBErf1ed2QQvm2bjY140zCVClToKgV-6ums5LcGdbwOxj5TwwW4xxBMc2REsOgt7L3XhAJCUAiLmTetkDM3jYMDcsif_vdPIg45gDneB5zjH_qZPxMkdvEkOaBIjjoo2yI8
unknown
—
—
unknown
6768
MoUsoCoreWorker.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
unknown
—
—
whitelisted
7584
EpicUpdate.exe
GET
404
178.128.252.188:80
http://updates.epicbrowser.com/service/check2?appid=%7BB852E7B1-908A-48EF-9576-CBE23654D907%7D&appversion=1.3.29.13&applang=&machine=0&version=0.0.0.0&osversion=6.2&servicepack=
unknown
—
—
unknown
7472
SIHClient.exe
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
whitelisted
7472
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
whitelisted
6148
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7868
EpicUpdate.exe
POST
200
178.128.252.188:443
https://updates.epicbrowser.com/service/update2
unknown
xml
879 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5628
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3276
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3140
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7756
EpicUpdate.exe
178.128.252.188:80
updates.epicbrowser.com
DIGITALOCEAN-ASN
US
whitelisted
7584
EpicUpdate.exe
178.128.252.188:80
updates.epicbrowser.com
DIGITALOCEAN-ASN
US
whitelisted
7868
EpicUpdate.exe
178.128.252.188:80
updates.epicbrowser.com
DIGITALOCEAN-ASN
US
whitelisted
7868
EpicUpdate.exe
178.128.252.188:443
updates.epicbrowser.com
DIGITALOCEAN-ASN
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
updates.epicbrowser.com
  • 178.128.252.188
  • 206.189.4.63
  • 167.172.35.137
  • 128.199.39.15
whitelisted
cdn.epicbrowser.com
  • 172.67.170.148
  • 104.21.71.132
unknown
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.1
  • 40.126.31.129
  • 40.126.31.73
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 162.159.142.9
  • 172.66.2.5
whitelisted
crl.microsoft.com
  • 184.24.77.15
  • 184.24.77.18
  • 184.24.77.12
  • 184.24.77.38
  • 184.24.77.37
  • 184.24.77.14
  • 184.24.77.41
  • 184.24.77.11
  • 184.24.77.42
  • 184.24.77.34
  • 184.24.77.4
  • 184.24.77.9
  • 184.24.77.39
  • 184.24.77.30
whitelisted
www.microsoft.com
  • 72.246.29.11
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
EpicUpdate.exe
LOG_SYSTEM: [EpicUpdate:goopdate]: ERROR - Cannot create ETW log writer
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][OS][version: OS_WINDOWS_7][service pack: 0]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][GetNamedObjectAttributes][named_object=Global\ES-1-5-21-1693682860-607145093-2874071422-1001_Epic Privacy Browser_Installer_Report_Ids_Lock_57146B01-6A07-4b8d-A1D8-0C3AFC3B2F9B]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][DllEntry][C:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\EpicUpdate.exe /installsource taggedmi /install "appguid={A3AA2AD6-C357-4BB3-9625-6550647D956D}&appname=Epic&needsadmin=False&lang=en"]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][Goopdate::Goopdate]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][Crash::InstallCrashHandler][is_machine 0]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][crash dir C:\Users\admin\AppData\Local\Epic Privacy Browser\CrashReports]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][exception handler has been installed]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][ThreadPool::ThreadPool]
EpicUpdate.exe
[01/06/26 15:40:36.462][EpicUpdate:goopdate][7496:7500][C:\Users\admin\AppData\Local\Temp\GUMD9EC.tmp\goopdate.dll][version 1.3.29.13][dbg][dev]
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EpicSetup.exe