4836521456384a0ac204c8a1dc55ad70d1846a7d5d04769676ca7dcaf9cf38f3

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
supQ-Setup.exe
Size 744KB
Sample261029-245rtstwc1
SHA256 4836521456384a0ac204c8a1dc55ad70d1846a7d5d04769676ca7dcaf9cf38f3
MD5 07afa1f319208101501e80df42b33328
SHA1 27dbf090603714179c711af5e45df0cf706993c7
SHA512 dfef83a18f644524edebe150d7ea98b2c819a809f217e2f38a9913a632942acd9b7c534be3e33f233ad9fb25aa0cc613fdd1ab970d2688c3ba1cd7e4f6db30fa
SSDEEP 6144:1bHzZpyMixT4dqCXzAUqacpC6UXj+Ezm/DNtfK8kfA3V0gVKgqPc3ck6xGBibOfr:JZqpOnzSNtIfA3sHPC/1bfACKc2gDr
TLSH
T1C7F47C1BF7E7CE5EE7662A78DA72636715E8E536697F824F23026913E8CB441CDC0201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation themida

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3284	powershell.exe
3284	powershell.exe
3244	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
22	4980	supQ-Setup.exe
8	4980	supQ-Setup.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
3312	MicrosoftEdgeWebview2Setup.exe
2968	MicrosoftEdgeUpdate.exe
5364	MicrosoftEdgeUpdate.exe
1996	MicrosoftEdgeUpdate.exe
5032	MicrosoftEdgeUpdateComRegisterShell64.exe
3952	MicrosoftEdgeUpdateComRegisterShell64.exe
1652	MicrosoftEdgeUpdateComRegisterShell64.exe
1348	MicrosoftEdgeUpdate.exe
3084	MicrosoftEdgeUpdate.exe
4360	MicrosoftEdgeUpdate.exe
6040	MicrosoftEdgeUpdate.exe
1980	MicrosoftEdgeUpdate.exe
5828	MicrosoftEdge_X64_156.0.4314.50.exe
5420	setup.exe
1092	MicrosoftEdgeUpdate.exe

Loads dropped DLL 17 IoCs

pid	Process
2968	MicrosoftEdgeUpdate.exe
5364	MicrosoftEdgeUpdate.exe
1996	MicrosoftEdgeUpdate.exe
5032	MicrosoftEdgeUpdateComRegisterShell64.exe
1996	MicrosoftEdgeUpdate.exe
3952	MicrosoftEdgeUpdateComRegisterShell64.exe
1996	MicrosoftEdgeUpdate.exe
1652	MicrosoftEdgeUpdateComRegisterShell64.exe
1996	MicrosoftEdgeUpdate.exe
1348	MicrosoftEdgeUpdate.exe
3084	MicrosoftEdgeUpdate.exe
4360	MicrosoftEdgeUpdate.exe
6040	MicrosoftEdgeUpdate.exe
6040	MicrosoftEdgeUpdate.exe
4360	MicrosoftEdgeUpdate.exe
1980	MicrosoftEdgeUpdate.exe
1092	MicrosoftEdgeUpdate.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3032	icacls.exe
3896	icacls.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0002000000000574-371.dat	themida
behavioral2/files/0x0003000000000573-375.dat	themida
behavioral2/files/0x000200000000057f-419.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\copilot_overlay_strings_fi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\SmallLogoCopilot.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\platform_experiences_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\wdag.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\copilot_overlay_strings_th.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\VisualElements\CopilotStable\Square44x44Logo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\identity_proxy\win10\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_as.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\copilot_overlay_strings_tt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\lv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\sv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotAppStable\Square150x150Logo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\VisualElements\CopilotAppStable\Square71x71Logo.scale-100.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\kok.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Trust Protection Lists\Sigma\Analytics	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotAppStable\Square310x310Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotStable\Square150x150Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotStable\Square310x310Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\VisualElements\CopilotDev\StoreLogo.scale-150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\VisualElements\CopilotAppStable\Square44x44Logo.targetsize-256.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\Locales\bg.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\copilot_overlay_strings_mi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotAppStable\Square150x150Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\vision.contrast-black.svg	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\copilot_overlay_strings_sr-Cyrl-BA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\identity_proxy\win10\officehub.identity_helper.Sparse.Stable.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\VisualElements\CopilotDev\Square44x44Logo.targetsize-48_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\Locales\copilot_overlay_strings_lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\ur.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Trust Protection Lists\Mu\Analytics	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Trust Protection Lists\Mu\LICENSE	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotStable\Square150x150Logo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\icudtl.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotAppStable\Square310x310Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotAppStable\Wide310x150Logo.scale-150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\lo.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\WidevineCdm\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\VisualElements\CopilotStable\Square44x44Logo.scale-150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\VisualElements\CopilotStable\Wide310x150Logo.scale-150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\Locales\copilot_overlay_strings_he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\Locales\sk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\EdgeUpdate.dat	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\identity_proxy\win11\copilot.identity_helper.Sparse.Dev.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E17AB34A-DBEC-4B48-96EF-625A30A0EF7D}\MicrosoftEdge_X64_156.0.4314.50.exe	MicrosoftEdge_X64_156.0.4314.50.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\copilot_overlay_strings_gu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\msedge_wer.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Trust Protection Lists\Sigma\Staging	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotStable\Wide310x150Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\identity_proxy\win11\identity_helper.Sparse.Canary.p7x	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\copilot_overlay_images_200_percent.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\Locales\copilot_overlay_strings_gd.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\sr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.50\Locales\sl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotAppStable\Square71x71Logo.scale-100.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotStable\Square44x44Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\VisualElements\CopilotDev\Wide310x150Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Locales\copilot_overlay_strings_qu.pak	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	supQ-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	supQ-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1348	MicrosoftEdgeUpdate.exe
1980	MicrosoftEdgeUpdate.exe
1092	MicrosoftEdgeUpdate.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{C8A33483-0767-4C95-BB03-F92337E58568}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NumMethods\ = "29"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{C8A33483-0767-4C95-BB03-F92337E58568}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CredentialDialogMachine"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{C8A33483-0767-4C95-BB03-F92337E58568}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{C8A33483-0767-4C95-BB03-F92337E58568}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\ProxyStubClsid32\ = "{C8A33483-0767-4C95-BB03-F92337E58568}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77ED12D5-5A0E-41EC-80A3-91B2C23866E2}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{C8A33483-0767-4C95-BB03-F92337E58568}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4980	supQ-Setup.exe
4980	supQ-Setup.exe
2968	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
3284	powershell.exe
3284	powershell.exe
3284	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	supQ-Setup.exe
Token: SeDebugPrivilege	2968	MicrosoftEdgeUpdate.exe
Token: SeRestorePrivilege	3084	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	3084	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2968	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeIncreaseQuotaPrivilege	3244	powershell.exe
Token: SeSecurityPrivilege	3244	powershell.exe
Token: SeTakeOwnershipPrivilege	3244	powershell.exe
Token: SeLoadDriverPrivilege	3244	powershell.exe
Token: SeSystemProfilePrivilege	3244	powershell.exe
Token: SeSystemtimePrivilege	3244	powershell.exe
Token: SeProfSingleProcessPrivilege	3244	powershell.exe
Token: SeIncBasePriorityPrivilege	3244	powershell.exe
Token: SeCreatePagefilePrivilege	3244	powershell.exe
Token: SeBackupPrivilege	3244	powershell.exe
Token: SeRestorePrivilege	3244	powershell.exe
Token: SeShutdownPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeSystemEnvironmentPrivilege	3244	powershell.exe
Token: SeRemoteShutdownPrivilege	3244	powershell.exe
Token: SeUndockPrivilege	3244	powershell.exe
Token: SeManageVolumePrivilege	3244	powershell.exe
Token: 33	3244	powershell.exe
Token: 34	3244	powershell.exe
Token: 35	3244	powershell.exe
Token: 36	3244	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeIncreaseQuotaPrivilege	3284	powershell.exe
Token: SeSecurityPrivilege	3284	powershell.exe
Token: SeTakeOwnershipPrivilege	3284	powershell.exe
Token: SeLoadDriverPrivilege	3284	powershell.exe
Token: SeSystemProfilePrivilege	3284	powershell.exe
Token: SeSystemtimePrivilege	3284	powershell.exe
Token: SeProfSingleProcessPrivilege	3284	powershell.exe
Token: SeIncBasePriorityPrivilege	3284	powershell.exe
Token: SeCreatePagefilePrivilege	3284	powershell.exe
Token: SeBackupPrivilege	3284	powershell.exe
Token: SeRestorePrivilege	3284	powershell.exe
Token: SeShutdownPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeSystemEnvironmentPrivilege	3284	powershell.exe
Token: SeRemoteShutdownPrivilege	3284	powershell.exe
Token: SeUndockPrivilege	3284	powershell.exe
Token: SeManageVolumePrivilege	3284	powershell.exe
Token: 33	3284	powershell.exe
Token: 34	3284	powershell.exe
Token: 35	3284	powershell.exe
Token: 36	3284	powershell.exe
Token: SeIncreaseQuotaPrivilege	3284	powershell.exe
Token: SeSecurityPrivilege	3284	powershell.exe
Token: SeTakeOwnershipPrivilege	3284	powershell.exe
Token: SeLoadDriverPrivilege	3284	powershell.exe
Token: SeSystemProfilePrivilege	3284	powershell.exe
Token: SeSystemtimePrivilege	3284	powershell.exe
Token: SeProfSingleProcessPrivilege	3284	powershell.exe
Token: SeIncBasePriorityPrivilege	3284	powershell.exe
Token: SeCreatePagefilePrivilege	3284	powershell.exe
Token: SeBackupPrivilege	3284	powershell.exe
Token: SeRestorePrivilege	3284	powershell.exe
Token: SeShutdownPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeSystemEnvironmentPrivilege	3284	powershell.exe
Token: SeRemoteShutdownPrivilege	3284	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3896	4980	supQ-Setup.exe	90
PID 4980 wrote to memory of 3032	4980	supQ-Setup.exe	92
PID 4980 wrote to memory of 3312	4980	supQ-Setup.exe	94
PID 3312 wrote to memory of 2968	3312	MicrosoftEdgeWebview2Setup.exe	95
PID 2968 wrote to memory of 5364	2968	MicrosoftEdgeUpdate.exe	96
PID 2968 wrote to memory of 1996	2968	MicrosoftEdgeUpdate.exe	97
PID 1996 wrote to memory of 5032	1996	MicrosoftEdgeUpdate.exe	98
PID 1996 wrote to memory of 3952	1996	MicrosoftEdgeUpdate.exe	99
PID 1996 wrote to memory of 1652	1996	MicrosoftEdgeUpdate.exe	100
PID 2968 wrote to memory of 1348	2968	MicrosoftEdgeUpdate.exe	102
PID 2968 wrote to memory of 4360	2968	MicrosoftEdgeUpdate.exe	104
PID 3084 wrote to memory of 1632	3084	MicrosoftEdgeUpdate.exe	106
PID 6040 wrote to memory of 1980	6040	MicrosoftEdgeUpdate.exe	108
PID 6040 wrote to memory of 5828	6040	MicrosoftEdgeUpdate.exe	111
PID 5828 wrote to memory of 5420	5828	MicrosoftEdge_X64_156.0.4314.50.exe	112
PID 6040 wrote to memory of 1092	6040	MicrosoftEdgeUpdate.exe	118
PID 4980 wrote to memory of 3244	4980	supQ-Setup.exe	119
PID 4980 wrote to memory of 3284	4980	supQ-Setup.exe	123

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	MicrosoftEdgeUpdate.exe

C:\Users\Admin\AppData\Local\Temp\supQ-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\supQ-Setup.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Local\supQ" /reset /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3896
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Local\supQ" /grant "*S-1-1-0:(OI)(CI)(F)" /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\supQ_Prerequisites\MicrosoftEdgeWebview2Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\supQ_Prerequisites\MicrosoftEdgeWebview2Setup.exe" /silent /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5364
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.307.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.307.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.307.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.307.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3952
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.307.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.307.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1652
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMDcuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4zMDcuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzIxOTc3RjItOTEzRS00MkE4LUFFOEMtRTJGQkUzNUU1MTJDfSIgdXNlcmlkPSJ7MkM0QkQ5Q0MtRTdERC00QjhCLUJENEItOTgzMjQ2OUNEMTE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0QzBBRjNDNi05QkE3LTQxNEYtOEE4NS1GMzJEQjkxOTc4Njd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNjUiIG5leHR2ZXJzaW9uPSIxLjMuMzA3LjE1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjI0MjAzNTAwIiBpbnN0YWxsX3RpbWVfbXM9IjExODMiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1348
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{C21977F2-913E-42A8-AE8C-E2FBE35E512C}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -join '|'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\supQ' -ErrorAction Stop } catch {};try { Add-MpPreference -ExclusionProcess 'supQ.exe' -ErrorAction Stop } catch {};try { Add-MpPreference -ExclusionProcess 'Injector.exe' -ErrorAction Stop } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3284

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3084
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3084" "876" "736" "900" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1632

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMDcuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4zMDcuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzIxOTc3RjItOTEzRS00MkE4LUFFOEMtRTJGQkUzNUU1MTJDfSIgdXNlcmlkPSJ7MkM0QkQ5Q0MtRTdERC00QjhCLUJENEItOTgzMjQ2OUNEMTE3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7REFCRDQ4NkUtODIzMy00MEM4LUE4MjEtRTEwOEYwMDAwMTg2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtDZmVLc09uWDU0ZW9UbG9tUGpLeEJtYVZFZ1VBL1F2OUtHN0ErMkM1empBPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0NyIgaW5zdGFsbGRhdGV0aW1lPSIxNzg5MTc0NDEwIiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MzM2NDY3NDE0NzUwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iODYwNjU5NDQiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2NDA5NDIwMzkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1980
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E17AB34A-DBEC-4B48-96EF-625A30A0EF7D}\MicrosoftEdge_X64_156.0.4314.50.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E17AB34A-DBEC-4B48-96EF-625A30A0EF7D}\MicrosoftEdge_X64_156.0.4314.50.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E17AB34A-DBEC-4B48-96EF-625A30A0EF7D}\EDGEMITMP_E97D3.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E17AB34A-DBEC-4B48-96EF-625A30A0EF7D}\EDGEMITMP_E97D3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E17AB34A-DBEC-4B48-96EF-625A30A0EF7D}\MicrosoftEdge_X64_156.0.4314.50.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:5420
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMDcuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4zMDcuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzIxOTc3RjItOTEzRS00MkE4LUFFOEMtRTJGQkUzNUU1MTJDfSIgdXNlcmlkPSJ7MkM0QkQ5Q0MtRTdERC00QjhCLUJENEItOTgzMjQ2OUNEMTE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1NzIwQUQ3RC00ODMwLTQ5QkUtODkxMy0yMTE1QjM2QzUwNUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O0hodkhJV3BVTlpUTW5WMlZUMWxlM2Y1WUpROU9Tb1RENk14SERsQTg5UGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1Ni4wLjQzMTQuNTAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSI0NyIgY29ob3J0PSJycmZAMC4wOSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjUxNjc4MDc1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTY1MTc4MjE4NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4ODY5NjQzMjQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzZmNzM3ODk1LTRlMGQtNGYxNi05M2M5LTFkOGFjNDFjMTEwMT9QMT0xNzkzOTIwMTcwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVVsbUJNUG9MZzFxb05ZJTJiNUZDZDMwWkNCMzZpczkzVjhTeGRlS0l3OElZamJReTBKZTNrTW12eE5zbXlRT0NjTmtoOTRzMCUyZmtMNk9JTHRkN25DQnd4dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjIwODM3MTUzNiIgdG90YWw9IjIwODM3MTUzNiIgZG93bmxvYWRfdGltZV9tcz0iMTU4NDIiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODg3MTkwNDU2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTkxNTQyNTcwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjI0MDU4MDY5NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjY4NSIgZG93bmxvYWRfdGltZV9tcz0iMjM1MjEiIGRvd25sb2FkZWQ9IjIwODM3MTUzNiIgdG90YWw9IjIwODM3MTUzNiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMzI1MDgiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_7z.data

Path C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Installer\msedge_7z.data
Size 6KB
SHA256 f3157d72be4f1dbdc58704bfccebe82464edd5245733c609caa6f903f63dc217
MD5 5a05f2149c031a134e9873f583c203b2
SHA1 cce7f5335ba79f8f17b003265f78cc23448c3066
SHA512 57ad764e3679b815a465964d5112a980563a65c711d1652324a154529635c1d760490a17b60f8217a9f8344ec06535b2ab7a51b4989ee6a13d311946c081b461
SSDEEP 96:Qp5pfJP+jrRi9rBgmegZSIJ/VWV9yn0lRydRDF+T/rCYBxgz0vccXwfubkGNPfez:QP8rwBD/R9WiogJOOYBFvXbk+fa
TLSH
T1F9D18DCC714056F1E6F6C8FF7E73284D8346644C5E97899B00DA2DBA811A8B368F1D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopilotUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\CopilotUpdate.exe
Size 22KB
SHA256 203bbf35e5d4b6e10fd4fbd833c448491091f80246a5a6ee8c224570578cfa93
MD5 74aa007c165df5f9a3122ed3ee03ff9b
SHA1 860cde2e162af0504f741c4eb5c0cb65e72f0449
SHA512 0d27482995312869ef7b069df86ba1a16d8f02bca3612e8d853b276acb562ffaa856d768079fefa74ecbcd87e2a9ebac783209293a758849af8fca1558a52ebd
SSDEEP 384:B261xOBF1myyWAH/ELvmtmKaWC4eLIHlNSriSR9zOfDs2:QeEdmyyWLqEKWRrr9zCDs2
TLSH
T176A27CC29B788082EA9B68B05169DD877C3CAFA7495157936099F40D2D237C0FB1772A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeUpdate.dat

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\EdgeUpdate.dat
Size 12KB
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
TLSH
T1A74298117BE4C690F4B22E310D7ACFA65B3AF542AD74C60F7380231E8EB6B058971312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Size 241KB
SHA256 62bcb973a31cca9d622957ccc1c7cb1314527fd8b329330dacd373d03a126112
MD5 57ae1cab1a608a39fd521b4036e4f258
SHA1 3e420c0f0f8c7ba181e0fa632647c8bfb639f0f7
SHA512 609a93f2a633560d573f44455d40cff5828d16d6054e5ebc60f60bc4a4475fc3de76f7b3657bead58928b245d16348f40b3bb87e38c3f664b3f73503ee278271
SSDEEP 3072:SGD8czCHaaV9zLKT5tIu6ohreuD8bGUsZAEJSfUGqQ:dhbaV9XKT5t7fuvMyvT
TLSH
T1E734F76519FC24E3D5E6D2FCDFD4C962B319E9B6A010CCA74283424A8E13E815DA7E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\MicrosoftEdgeUpdate.exe
Size 203KB
SHA256 dc71da1c16fb7c4c216fe62560aa9a870945ec44f20d4de57eb842519d30264c
MD5 a06207b67a9bebdadb2339921b943ae1
SHA1 f4636213c588e30b5146e2bbb749932073bb07f7
SHA512 ddaf613a811348149b58e82fcbc033ddb7bd2401b571b1dde56502947ca3ff4662047968a4996db765df423e6de2e7f79cfb24f65ff6a54bcc75548e1806fd03
SSDEEP 3072:hmrf6YmagE9c7l0DhtR6Vg9fh/yOn86ImWTDVhB+GtwKlDR6W2kFPYOckbNTGzCc:l7l0Dhr1xn8RD7B+UC
TLSH
T181145D2237F80A68F8F36E311C349F6AAA3EBC359D35E66E1544218E1D35A509D71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 275KB
SHA256 a603d7660419c20158d32b43d405b249bfdbac13f233a4c3a866c550adeda742
MD5 f8ea8aa59077ce3995c4bd7e932a9625
SHA1 14dda762236e9d76ad26dbd036aabae6357a1d6a
SHA512 218e736a8e64370a8d975db4c10cb77f0946de05a1121e41c658596af9c67876c1bfb21a2a55fc678aa2eaf3d85b814fb3407de7e3c2c5bfb8cf1a58da2de0de
SSDEEP 3072:4A8DYihO5cj+g80OKZMvun3bctal7QWRoY466tTnporkOjj9vNzikw:58D9Ecj+g8VKiqbIGohB0D9hk
TLSH
T1CF54C6691AFD04E3E4B5E1F98FD48942F160E8726710CEF74291424A4E13AD16DBBE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\MicrosoftEdgeUpdateCore.exe
Size 372KB
SHA256 c1c61fd7e80c07ed692a24643024fc8386e3fe75b19c5224756843520b7f12c0
MD5 bbbb72ae3896584a40aed5199138f056
SHA1 61c0d41ce1606ebcc7cd31e19d26749ab6120e76
SHA512 58ba54981f05862590309ed03563a462c48a00e474e49689f9d3a0204d248fc927ca2e97715dcfbe9d88c89e9b70ee62d72489f92921ba3c537244231d4413fc
SSDEEP 6144:DiSq0SZQujFJi/a9lm5YTKX/TMtQTuGVlwAO0E5u98Y01h+tlN89+:e0SZQCJi/a9lm5YT3GEOE5tY0h+tlNG+
TLSH
T115843A6528F84033D0F695F98FD4D923B478E8726B014DFB93D246499E22AC26177E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.TXT

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\NOTICE.TXT
Size 4KB
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
TLSH
T1C181853AB362077206D007909A9A9CD7F92FA2ABE35A6744B82CD10D133745DD3FE564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdate.dll
Size 2.5MB
SHA256 7da6b49c641a4a9f5f2ca89b5fa896a8dd9b018e76ba6b68aff8fb9e932a0cf9
MD5 7519e96a64de480a0116b9145931d706
SHA1 19b57042441d4ad1f76353a42904d1354b3ca80c
SHA512 4f62a18c95c0bd7801e8b4e4ad06b6dacee8c338d7b37fcb5036c750fa03fd48ff8890e0c82481df64413205f9c30d6a0bd100c20d9e6d0ea683810eaa7cb3f0
SSDEEP 49152:Nj3f/cXCwu2cp2torPZzaK8207abKV0Ei5zb6zRsxtvAWY+4:Nj3XeCwu2S2wZzayKanzbMyHY+4
TLSH
T146C57D2125E84072E8F356B4CBECE916A8B9F83617218CDF63C0854E7A729C25577B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_af.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_af.dll
Size 29KB
SHA256 c78d4034ea94e4c184d12b8d636cfcf11a0c92faf08468c4e5569470525b7bed
MD5 f8f1936a3348094bc250478ee40a1a13
SHA1 eb77e31e826c1c8e00444ca08bad78313aadfa82
SHA512 43edb662d4646a1aaec808df90d831b37f903cf0d49bb0a959898284f5348695b5c7902a64e96950ffc5372a3a65b45d4e5fae9a924284ddc8f3d9078b9bb8b3
SSDEEP 384:M385VFXh71WmBIWQjrYiVDxlwCiO+mIHlNfariSR9zOfDlFH:X3rO+7arr9zCDlFH
TLSH
T10AD20B9053F88109F4F73F30BDB49A925B76BD82BE34956D2240A55C1C31B81EBB8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_am.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_am.dll
Size 24KB
SHA256 b0f56c8fe2e3c2cf94e6a24c7d4f482b37d432b2f662806a2e1e61e856f825cf
MD5 d3c02cb70404d5d038085a25a104d316
SHA1 a1ce633710b1d02aa072918228a10d4393f24aac
SHA512 7c8f5de86c7095c2d8348246f0ae28667816595416c6d85b36aef668fdefbf45dee77af69ddfd0cf387401b1df1406d350f31453693ac45636df23149e603c14
SSDEEP 384:tOn6VFXh71WmBIWe0Kl8SsjIHlNBcER9zwU:nbe8Ss3o9zF
TLSH
T10FB2074393608A0AD0677D740648CF6776BAFF0C1E2541AB7209FA5434E5762FB3AB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ar.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ar.dll
Size 26KB
SHA256 5b5722a3f3327c53ffa059b3f6b57e5781778051e6229a602b7a6323030b661c
MD5 b74634ec327a75dd04befedede201b77
SHA1 7c5303eca9c3865929090400629050b37a78301d
SHA512 0d4b69ae7c2f728405f01424e183b11008e0d5954dc66d388dc6f714f417913b107930d24c8061ec6f87434f8a490db4d368d62387f95256f20fca48df63bf3b
SSDEEP 384:O6sPBb1WmBIWnYwTPsQtXvfGtIHlNJtriSR9zOfDS/13IR:IxbpXvfVtrr9zCDS/ZQ
TLSH
T197C2B8421E2CC13DF457AE34C56ACF53A23992478DD8223A66709D0509A5762EF2FBFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_as.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_as.dll
Size 28KB
SHA256 b3ee281e8d2bd337fdeb4ca9dd9f98554ff07b5eba467a5f39298253581e7e86
MD5 a45f7da372f97d3c386ae255e0e69698
SHA1 6a68dd61c7b65b38ca3d8391dd14551f93d4985e
SHA512 2d2d9906af16f2f57fe06ddc69e6d2038be8b0d5315c0cb8085e487e68cdd7d72eea588235633dd8b16944a1100bf4e48c766b62716d7a4546ccab714ee9ab7e
SSDEEP 768:V48Z452DuUu3+F/bE6uEJKIlHpyULi9zO:Gp1zO
TLSH
T1F4D22C515740B524D6FD643C02D68DBB1AFDBACF081CA0B920E3D10479A53FA9F2B29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_az.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_az.dll
Size 29KB
SHA256 4f196ca52b0dc10c4634cf906396b1212c469e5e18a306e3f129f03a21098ebd
MD5 61a225cf93f50a04f349915316232c6f
SHA1 a716ef183966ced0f897348b1620c25e37c58993
SHA512 93e659d5e48c90e1e02c97bff556f260ceb3fa8c05b1cf2ce0af648dd8b5da1a5edfca2c39f91b5e02f4a5733303f638010960418489137c542d9177b5c55f56
SSDEEP 768:HUSIOFe5FEuo//ctGFLFS2rF9FTFYF+WxAU+9zVb:0MFe5FEuosAFLFvrF9FTFYFn6zh
TLSH
T176D2FF5193ACC105FAF35F705874BD931ABB7FB37A35914B2282A14C1C71392BA34B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bg.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_bg.dll
Size 29KB
SHA256 ad5ab05207ed99f17db681f85b8a22f04c927f00a507563ba2f73267053a33eb
MD5 ecb2e615c3626e73ef1f06d8fd30af36
SHA1 48e846173ae73eef5dcb3ad65181e6299d9645d2
SHA512 be620b34afe2af6bbabf3fbb01dad3c95b39c53a04f88e9d4510f28daa007af01ef86ac8c9c35203deeac0f422d2da2d613b66abeb9b0b7ab446fc2bacde7305
SSDEEP 384:I++VFXh71WmBIW2dsSCCdCwd0Qgv66n46LXIHlNCdW9R9zEg:kgdshCUCgCr6FQ/9zJ
TLSH
T10FD2FC4FB97C8200F655E6311FA6C6F735BAB751672446C6A30FBD68201D332B72928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn-IN.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_bn-IN.dll
Size 29KB
SHA256 cd018cb2e42f18388c963fdce4f9e15203174210e44fffa323d2a9bb86ddcfd0
MD5 f82a8d9e2dec2fc95b5be29ac8993ac3
SHA1 81491f62927efe5a71c2c16f4a9a483cb2f84d0a
SHA512 8add0c4ca906770042270f9019c89c1603223acc8aba5da5ec99a4e88bba392b738169ea9f161a7ecbcb8c25334c62d2e11e7c5905f6624f4ae3cb97b19aa2db
SSDEEP 768:KEvAGEtJtVWCZsnM9/rvoaqPdQ8JBlHt9z1vj:KcAGEbYNz1b
TLSH
T187D25216A710B824E6FD283C07D6DDBF1DF87241242CA4BD29E9EA0419A23F65F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_bn.dll
Size 29KB
SHA256 49b096f8fc11c456685c622b5aa6df66b9a9ff3372f892e0e8753418b5756802
MD5 9cc0fcdafb09bfcc91b36df0d26791a5
SHA1 0d12ff33d22bccb68ce6f135e8d5efb53d2b6cc3
SHA512 8e0e4c2e88f613e37f71a869a1964cfaf1c2282f2b876961516aef86bf157255f49cb9d059b8e7f85c2e179787417dd8cdac3b10268f7ce6b19d2bee9a8c20fc
SSDEEP 768:u5vAGEtJtVWCZsnM9/rvoaqPdQ8JBlHLULi9zmF:u9AGEbYl1z8
TLSH
T164D25116A710B414E6FC283C07D6DEBF1DF87241242CA4BD25E9EA4419A23FA9F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_bs.dll
Size 28KB
SHA256 ec1b922047f383e1bc6a4525f10555e73eeec31fe0ea5ea6884a66cc45171250
MD5 2bf6e133f474c7a2a1ece8b6e83a2239
SHA1 7f49bb005da469e070a06afcc9225bc0b5f2f48c
SHA512 d4fd5722b883613d2e50e3fc2dc9fe95c0e46d44e487f0cff2f851b8a563a2fa707eac98d4bad196372f1e0d801eecf86e2bf4a7831eb67cf95c88454b02e709
SSDEEP 384:5j+VFXh71WmBIWpaDAmqRDU5NLCdJlwc/Xi+UFs47rIHlNpriSR9zOfDeWbpF:ME6lwc/Xi+ms4grr9zCDeWT
TLSH
T143D20E41A7F85259F6F77F30A57457660E3FBDA2AE38910E2240654C0931782EFB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca-Es-VALENCIA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Size 30KB
SHA256 94122b63ae7e0ad6ecba1fe2259741946903fcb7b2b1983daa952b25bfeb9210
MD5 698e2460edc837d0d8cccdac7bd77e11
SHA1 7fa8a2425e6e3e76b5e76165992b239a384e4007
SHA512 a844f705234e108e6948b07c63583adada5e43e2d83804a44a640eb6adcdbf51f0f4f5b9c3c423a51981034f8425d933629e32097e7520ac5516cf695d4684e2
SSDEEP 384:J6VFXh7mWmBIWZbkbOnGNfNFoBWk5gZAdIHlNy5U9xDE3R9zK6iSS:hvbkbOnMffoBWFuJULi9zE
TLSH
T1C5D2D841ABF84659F6F72F707D7499625E3ABD9AAC38D10E2200A50C08B1F51EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ca.dll
Size 30KB
SHA256 461b0ad4191a29660978211d5ff72c4c4547d571351f671983f4df549266521d
MD5 28648f0e37fb710b29c859ba06dc2065
SHA1 4df3b4d6c6f7f92db20ba51a2945a2f518e402aa
SHA512 80f0f6e9f25eb61e585730ae66309d44d48bbf3812660929f5050e65f6bdd3f0b5b29edeccba5b46c76dace5985ed3e3d6be6d9c4207fa49eb2fce2bfefe25e8
SSDEEP 384:/ShNVFXh71WmBIWwHEWdvDNfNFoBq1ZQtGIHlNOA0AUyR9zVhzbo2:i3GHEWdvpffoBqk6A0AU+9zVi2
TLSH
T10DD2D941ABF88655F6F72F707D7499624E3ABDAAAC38D14D2200950C08B1F51EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_cs.dll
Size 28KB
SHA256 c35a767462bf8407c81578bf7ef90baeff6ffa7e7dc420346a8d52119af6d8f7
MD5 c33bf9b456ef89eadb6f56cbd793f2d1
SHA1 fd9735a46b08455c767ab7a1326c362b67ae185a
SHA512 c6d60b5d16b6b070e41cb0ff46a87c36e4d885cc59c9aae5dbffd6acb02d3545930634f131e33b8c2fcca7550bdbf696815ded64b5ab959297270d801390540c
SSDEEP 384:8ltlrVFXh71WmBIWsTL7PGQxQFnwd/ZIHlN7Crj/R9zsqbBTqm:8j6TL7nuCrjZ9zdJqm
TLSH
T1DED23E4166F84185F2FB7F3069B44AA21D3B7D96AE34C14F6640A64D1C70BC1FAB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cy.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_cy.dll
Size 28KB
SHA256 b3f728e8c8a9155b39d09307b8834ff71bcd0a62557b20af792a30bf4fe994f5
MD5 5b8cadd1a14004b4e5cac118b38c5328
SHA1 bc4b69b16611a1f8ad726c1a559c5f40618efdc0
SHA512 f79b2ac1e0b09f26b2da6cabe73d73d37a66f8aad0ee1141308eb69aae40e71f23d6ff44f7a81af85ebeb2ca98d3967c154497b057584bf38d1f98e107585db3
SSDEEP 384:CVmVFXh71WmBIWctZEmiuTHsyi7zAaaVamjyC8oyUFxOFqdJDIHlNhEW9R9zEVd/:zmDWZUjxdJI/9zcday
TLSH
T1E9D22F5143F8814EF5F72F70A9B5A6A22E36FED6AA74418E2341B1091C71782DE3473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_da.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_da.dll
Size 28KB
SHA256 d5a82d43bc3529a3024324f6f2ad4d4437fdc96df00d16384438a165834bfb7e
MD5 8150f9eba3cc630da14ffedc46a6cf66
SHA1 da1a8f1972b32ae7a875d81fdb6b4ad767be488c
SHA512 9689ee596e8054247c32fc75621370ec83b5dd0b401df861ffe53945fc48b725025456718ee3d29c8fa765f38036bbf0d3cc73abd1ffa768a79fb0db85d31fd9
SSDEEP 384:nlWTVFXh71WmBIW7m4HcyvBdIIIHlNnER9zwYnx9Ot:4xg4PIJo9z/nx9Ot
TLSH
T108D20D9167F88219F5F73F307DB98692197ABD96AE34D61D2200A44C0C32785EBB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_de.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_de.dll
Size 30KB
SHA256 025dab179aa162ced79dd3c83669de80abe39df871b80c51be5447418d996ac4
MD5 cc3fe67a374e2c6716cc20238517ba9f
SHA1 88d983a0b782e7f0d1959a82d1b30b64a2c6de73
SHA512 5bd2e2c3c7357f7662c0a8fabd5c06e7e1f84f13a25ac0aac798967457dc75b10188bea432caff6c8180f89ee1296b439d9677f67f7645d47536695d6b244c35
SSDEEP 384:vGGVFXh71WmBIWheI4FBhj3ZnsYxrPbL9IHlNIwAUyR9zVhzk:1Xetj3ZnLxTbL6AU+9zV+
TLSH
T1FCE2EA5157E88608F2F73F306E7897962E76BDD6AD34E65E2300A05C1831741EB78B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_el.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_el.dll
Size 30KB
SHA256 e579a18c7e739ecdd446e1670da61576848ee4bf87e11999d4f11b49c140a42b
MD5 503a2e61e6145d8f7a25396d77ab72ec
SHA1 499f88df99881567232a68bd5b3ae85023ce6de6
SHA512 dc90a55e7b3ad0d0a9f311afbcb69669ac080a5e043f2e7fe47a27741b526f7b03deef5775e9fe91b16a343278fc30e98493b23b03165bd4bea23267745429c2
SSDEEP 384:nmaVFXh71WmBIW+nBzBUBOTG94vTZtfFkmmFK9q87PgbWIHlNSgriSR9zOfDT6x6:RwpnxdFDfgrr9zCDT6w
TLSH
T1DEE2208D0DBF8711EEA6ACF244738A1B5A3FF5860814DD6732F070489D1DA129ED7A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en-GB.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_en-GB.dll
Size 27KB
SHA256 96253e85109add468bd3d4f82e476c0314d5be5b9fe4f97f873d4fe7d23a4e5b
MD5 c33b4e6f02fad533f79b9be20d6a8736
SHA1 6bbbb39470fee6810905de860a5cc3c6563bd060
SHA512 91842ea117048b0b3cd67438d4267e5133df05052af15bd6ee8f1d97aaf0490e0cf751ddb565475dac9c7f62867b77a099879cc741b46d91f6e21c5923bfc09c
SSDEEP 384:QuVFXh7xWmBIWGkagyonbexxIHlNC+7AUyR9zVhzYrk:LBagyoyzwAU+9zV2rk
TLSH
T1FEC25281A7F88119F6F73F307EB49AA21D3ABD96AD34D65D2201A00C1871B51EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 72889515a0e7e283c9be820aae81172ec18dd2d736b76841c82f5702b2328580
MD5 2d1f35f6a140a2e1e1adaea7a2a8f0e0
SHA1 94b03ef70eebedb07f086ab1a57171de89e85104
SHA512 d4e394709bfd7471e6c2f34b615777f87d3bfd1dc08760f5a4c86f0eacd4cdc6530c56f2ea8917c4d615832abcbd335504b26717954209ce57dc54eec6c79ec4
SSDEEP 384:vZQVFXh71WmBIWHkagyDlBlRNIHlNI0RW9R9zEJCocc:6eagyDlpEs/9z4Sc
TLSH
T13DC2518197F88119F6FB3F307EB49AA21D3ABD85AE34D61D2201A40C1871B51EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es-419.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_es-419.dll
Size 29KB
SHA256 ef738115b59368b67c7bc96b4bdb693067cd89eaf064129f92b2469383bff99e
MD5 263413f28cf53121a4fad9d85bed495a
SHA1 f9f8cd416e0ca38e18cf1558f899002b6fa5f039
SHA512 a1334a38709eed1b093f0021272a696e8607d5837eac91a665d4c9f295efbcf435a76f6996d38eb6524a959adf788e53939ce2e7df49b9c4104462ddf7e0e815
SSDEEP 384:1ogZVFXh7dWmBIWYadyUr4aeIHlN3U9xDE3R9zK6iIgO:/BdrHLULi9zDgO
TLSH
T15DD2E84057F8924AFAF73F34A9B896A65D3ABD92AC38950D1210A51D0C71F81EF34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_es.dll
Size 28KB
SHA256 bebc9569781e73e3e276685d82b73c27e411e68472a278f06c3b45d61ccae6da
MD5 fb3325ec677ab92bf6fcda463b0b787b
SHA1 26faaa49e464b9458c63f722e6797a969c4189cf
SHA512 04ee52200b483577928f25225304c8424db57ea78b76b81c4d87d232a0e21551b13d4e665c8880213ce89892cca312e83379c09a29807ab5dfa415cd58639d52
SSDEEP 384:5ApVFXh71WmBIWit3MjNIjIHlNy9fPOxFR9zJL3fc:YQt3MjNItPO59z53fc
TLSH
T142D2FA4057F8924AF6F33F34A9B856A65D3ABD92AC38950D6310A51D0C71F81EE38B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_et.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_et.dll
Size 28KB
SHA256 2c9c4861d2a753ab84a06d9ece1a742a74a2dde41b076a59ff9a2fc36e7121cf
MD5 d3d5156b8516992cb276f4c5ef42d34a
SHA1 bb686bf17dbee19b16a8b3bfe0ab76466f454143
SHA512 09fbc6e1a787400be37ea975ae051d29f9c6dcff82fdded5bd9ec10205aa434747316319136938af6d8e8c7cf42d96cbd43e7f3620936b9101d1e0ef47300edb
SSDEEP 384:M8lVFXh71WmBIWHVc0dEyjELtX7giw1LmbVdMTwAiDi8IHlND79W9R9zEd9wX:Xx5jELBgr1LwdfAwmU/9zR
TLSH
T129D2FB82A7F89119F6F77E307DB496921E7B7E93AD70E10D2600A51C1C70781EA78B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_eu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_eu.dll
Size 28KB
SHA256 c30cb1e8942a4f1bd963d8f1ed008fe2ed5f046793ca21946915c2c93b44d786
MD5 136626dbaa37f4813a6d66c57b06a31a
SHA1 de3e5bf1a00fcd4ec2225a01ace5c16a2294a0ab
SHA512 e892def341e819336b3bcd400dd57c066296bee3660dedfc9fe3cc77b133e2a1bbb57f5521a779dec24926ee6ae1dc378322066d0b0cabcb2061420fcdf070e5
SSDEEP 384:ornZVFXh71WmBIW1cLpNrX52FOX3z14OXIHlNUV9fPOxFR9zJL3NuKL:EL8R0FOT14+PO59z53b
TLSH
T1AFD2409757E89158F7F76F3199B895DA1A7BBDA22935C52D2300A50C0C32381EE34F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fa.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_fa.dll
Size 27KB
SHA256 4ab025483540ff20051a1db414583a34026318ffb3bfaaf88d7ce1b7d18e9060
MD5 996df5255189137aca8f40e1aee7fe11
SHA1 6aa8456cdec7c1c489304d75ab3ecf5441fc7309
SHA512 961b1ad29efd18a0e7901624028f24b621e8b5a9915305e49bf221bcd68dc34cf39188e0e3cb57efe5d23d49eee58e89447c44729101aeed5fc1d1d26ba8785c
SSDEEP 384:TD0PBb1WmBIWiXlQEqt0A0Q6GfBIHlNgI9fPOxFR9zJL3TyXY:wxr2C1UPO59z53D
TLSH
T1EFD292058DA6C830F9632A34C50BD9733535A2DD6D8189361FE5A93C19813FAEF2F62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_fi.dll
Size 28KB
SHA256 0782e0ee3f86ad52bda1fd365d0de155198e222fb7d4d2c106eb46a9e89be78d
MD5 53599ee6ab40ece114ebec7d06a8b3be
SHA1 706281982898b58f197757d2668943b458d81776
SHA512 29c34439d0eea8f268f1842dde1171062c42afa07a4bbea444e0c41dd6cde86b92805682ecc3966b2b64c24cddaa05dbe27d426ddc32a186ee58dad7fd68c52f
SSDEEP 384:nm5WVFXh71WmBIWgJWHJWEFIxnyELZWEYXsN6ZKFl+EoOh0vFq4IHlNc3+W9R9zx:kmuJOJOUjy2B/9zx
TLSH
T10ED2FF8157F8C269F6F76F306EB887521A377E936DB9D11E1B00A11C1C21781EA74B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fil.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_fil.dll
Size 29KB
SHA256 0f46645a463baa4fccb4dec33a3a7b7cc1481263c32cdfaf0f4927f76abfaa05
MD5 faa0d1faf5bec0ab0b886fd7a48373f1
SHA1 bd4c598ba0c3d9efc1649caa733e01f8ae10d696
SHA512 01be4d4b5290896fa1353279860f77bf572189ffe74ea65083d723e34c60d287e28c64a41d24ed3eca8f123cc0bfcf1b0fdad60871ac7edda9fedfc3e888ce4e
SSDEEP 384:PzVFXh71WmBIWLsXsjbjkbkzkrJqPDLiukIHlNVM5AUyR9zVhzL9K4I:5JsXsjboIzkrJqLLTMAU+9zVVw4I
TLSH
T188D2DD81A7B8811DFAFB1F307EA866A11B3AFD466D38D9452240951C18323D1EF74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr-CA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_fr-CA.dll
Size 30KB
SHA256 6d7fcba0b8f91f273c72158b3ac3229ce3a53078ae573d5b39dcf5da0304ef17
MD5 0247991e948b16079094fa47ac352c06
SHA1 03e72d8c5828d9106732de1132eb79213a466a70
SHA512 0f04d4ba097715fa1684b96072c9366a187c818643cb5ca65acea0b36a79009ae2a3359b06c70550cb1ce95ba083a09d14efe9da4d0b259d758ff5bbd5311067
SSDEEP 384:vOVFXh7xWmBIWps7otIRr0UmIHlNzU9xDE3R9zK6imPGNCn:6PINRrNPULi9zINCn
TLSH
T174D2A781A7E88215F6F77F31B8B996521E3B7D968D34D11D2200A58C1C71B81EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_fr.dll
Size 30KB
SHA256 fae1948912a81b8c695da516744222f06b542b0ea6d63626e7be14264f871f51
MD5 dcdad79cd2e824b48cc106cbbd076f36
SHA1 c36af9d798783cbe7cec18024df4d261a1849675
SHA512 fd1578807f7ac9c49b7e4f43cf6a8af3386a1707d51d59578e9d1477b223519213b5ea3b8f552b2114136e00f9d642183e619060f85fd9a4c8fad1a289b298f6
SSDEEP 384:G3xVFXh71WmBIWJ8bW6408XIHlNu9fPOxFR9zJL3Lv:cP8n4lRPO59z53Lv
TLSH
T188D2A781A7F88201F6F73F31B9B996521E3BBD969D30D51D2200A58D1C71B81EEB8727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ga.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ga.dll
Size 28KB
SHA256 054efecf8c0ab7a021712bbdd49588c250a55260aeddfafd124c915b6de2b312
MD5 05b81830ddf8d4e077b4f1279514110a
SHA1 7605fbe3a57d75623bb4c23c217e1103ae616dd0
SHA512 af52dc43c05b86e0e2c7634d248bf9850d4d66b7b8820fa4322b09a8f88904a80772902bfb32fb5ddfc56757ee1c9e5edb5211191461a620cc694b6fe199aab8
SSDEEP 384:54rVFXh71WmBIWk5vCQkcYoIoAxP7GcIHlN5552QR9zkswuoa:Ci5vTYoIoAlCP32s9zZ
TLSH
T146D2ED5043FC810AF9F72F3069B487676A36BD92AE38D21D6640A68C5C35B52DE34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gd.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_gd.dll
Size 30KB
SHA256 6022fb77d0e5bd5d0915e3c641e3663d0a03572908ade300ba123214a28aaea9
MD5 9e33707cedaf60351dea70619e28180d
SHA1 48b3380ab9baa8e6428b4d6fa896873c739c5d56
SHA512 8219f5bb88c9edbeaddcdec5e46714bea5a74e70efeff95a77bf6a75a8272a03d60418ae9d188241b63842fc7bb05f43d77fd60dcf159de82345ed5de4733176
SSDEEP 384:p7pVFXh71WmBIWlFYiA73DpfDfqKiXjR8xEIHlN+9q2QR9zky:1DFYiA73Nbqfl8x/2s9zl
TLSH
T1D4D2FB4457EC8648F9F36F38297587A26E37BCD2AD3886992300654C5D31B82DF39B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gl.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_gl.dll
Size 28KB
SHA256 5771e5e39af5dce2c66f4bae098b68de444f7bc0f65484f6c436d64515333776
MD5 38bccc665d44fde0f2cb94197dd53cab
SHA1 a3d8387a519007e875d285197f5c922da23e7f77
SHA512 26e054a4f5b7d6d3c5e0a53d086d96824af2c440cc92e4424fd2582c944f0f62a37c7bf17585296521f0ec220696fc66279292ef0b4fed79ccb14eaa1ade8948
SSDEEP 384:JnfyVFXh71WmBIWXsCCp2RK+oIIHlNtR9zE04J:MBse8+oV9z18
TLSH
T1BCD2FA4057F89246F6F73F34A9B85AA65D3BBD92AD38854D2200A5090C71F81EF78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_gu.dll
Size 28KB
SHA256 2c29e4b4891252076509be7574d48fdf9dcf939328281f98b443d2e3b368346a
MD5 f5ed2da2c03245e4a5581ac4307ecd77
SHA1 af33859f6d979880778ef7835e1de85e02f87733
SHA512 2122c423334af2178eb11d5dd3b969adedf4e788d5513ba2098671f14bab8612c82c8b944a2f79ce931947686cdf0c1d9123c43d747e4e375b73af1dfe10dc1b
SSDEEP 384:zSBVFXh71WmBIWjt7vdQrsojGtCAPPFZCxT3CT6xytWIHlNIuriSR9zOfDD:czCrngkurr9zCDD
TLSH
T167D272A62BBB41CFD06E287082B9E933F7391185D521D1477165A3873DE3342BB2A75C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_hi.dll
Size 28KB
SHA256 c0b60b11e56f88b41096bd68250c0b6253aba1aa710c29c3ca4926ecc6d04c8a
MD5 b909dbf68593e9e083bf8b28f539eaad
SHA1 b6c53828ee43cde79848b47c2dd920441d22b30f
SHA512 ce9d7b8e4436575dc7a7f0bddac15b4231ede92aab40c8f2da2e73485f0fbb9a59122b32924bf88cbfb4412933ab136c3eed8c2a6ac99cbedceee79d70b13c4e
SSDEEP 384:rxNVFXh71WmBIWkQcqYmmqkKuIHlNtRSU9xDE3R9zK6iW3+:NqQcqYmmqkcRSULi9zM
TLSH
T199D2830204808F18E49C6D78E43587F76CFF6425B9CD13C6AAC171F8DCCA37B9A69A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_hr.dll
Size 29KB
SHA256 10e087ab25f7705a6598308923f15463c44093e1338df40cc692c585e07f4828
MD5 6826a258d75d43ffe84f49b14d5462a6
SHA1 57f7eeafc8fe2091db39075884e9632f91423b4c
SHA512 7c07afb12d572e975e599db247a633980d66e9569e8802661bd51c799b90786646a23b8319dc2400ec57b5a65abc1c83dad1e82f414d6711dccb38e2fda05ce9
SSDEEP 384:c4kVFXh71WmBIW5/fbmrsCCa9gNk8qaEa/0IHlNE9fPOxFR9zJL3H:cpzqJva/GPO59z53H
TLSH
T1D0D2FC41A7F85159F6F73F3099B857621E7FBDA2BE34910E2240658C0931781EBB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_hu.dll
Size 29KB
SHA256 53e55c37923d6f5cf4d3854f6c11e457fe5f10caee2394d9636d85e17aeab464
MD5 036df7278676fecd7bc5da40e71c5a8b
SHA1 11d06d6e659bced740d7f1df64061354d06cdda0
SHA512 18c3ac9d9d0f9eaabaff8dc49733345ae414b6c4d7d7a1fabc6ab8c992e8aa5d3e360e428993fd5c026cbd34bf1065ebd3219128c3da8541fd90555109b75a22
SSDEEP 384:5x+VFXh71WmBIWiYhYkZ2hUrV6S8bfkWuNxoRLbufJHwHVbNJjIHlNyW9R9zESOE:a7KkZ2hSV6S8yotbufJHw1bNJw/9zgE
TLSH
T16CD22F4152FC4546F5F75F323DF487960E39B965AE3DE21E6280A28C1C36B81EB34B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_id.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_id.dll
Size 28KB
SHA256 e9e5991fe4e594639d2a784c56f1d47303e900d1962ea49ab9c8c63ca7648c1a
MD5 b7d1bd8c407221d97cb456af373bd0c0
SHA1 cc9c78f2658ef7305f28ce3cfddbbe3074575d21
SHA512 2beb987dd3da1f1b500d88db656f59431ddde69d2912f0f487c9732ee780a2e9d67aba68e507e2886c462838a077c73ab8b030cf0bb9e576cd861845a881dd55
SSDEEP 384:LF/DVFXh71WmBIWLPC8kJZT9r6T1fQCTIHlN1R9zE0BAi:Xd7Q9z1P
TLSH
T1C7D2DB4197E88559FAFB5F306AB89A921E6BFD93AD30924D2300B91C1C317C1EE34B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_is.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_is.dll
Size 28KB
SHA256 5db577c5c9056c6fdb606c685c1b8cddb5b956c8a7f9861985f3c5abae8f5b63
MD5 8f647733194d9ba99cf03243c1f09fcf
SHA1 015698ab713b8a7221544d6921b15646a51ec6e4
SHA512 cf56a334b9a00d829996cda248af4f12420443cb95b5f2ddc2230c0f6937794a967532fdb749d339ace8c216af266b6b2164fb338f492d5711b33e852976e037
SSDEEP 768:yoBkg5TpAhr+8wp0xoYpGYrPoVAU+9zVs:yoBkg5TpAhr+8wp0xoYp7rgD6zK
TLSH
T154D2FC84E3E84109FAF75F3058F597561A3BFE97AC35E60D2641A94C08363C2EA78B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_it.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_it.dll
Size 30KB
SHA256 72eb3e313890cc3d937bc59523237ea399c51a32f0b158b4d8db3385b7d9cb5d
MD5 2a6053d9995ed13e5bd976a7fa027346
SHA1 6190298b2c019d581c53e7d3411e3a5dfdfdbadd
SHA512 ab550f07dde1eafc61c3f6e4540e69fde37e43d14554ebdd442e952609891540e4eff4335286cac3c000db3f45c26a731d4cb6d21d419204a2e53ff483627a27
SSDEEP 384:MsRVFXh71WmBIWmuu1+Jswz8IHlNxfriSR9zOfDJru:LW1+JTzHrr9zCDJK
TLSH
T1EBD2EC5167F89604F6F77F30AD389AA60D3BBE86AD38D51E1241905C0831B61EEB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_iw.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_iw.dll
Size 25KB
SHA256 feb0cb4d2b829f821ddc6a4800df024023b9fa044d71e5ea400c0dcb279a33df
MD5 889a37c18df0af1e2a80eee7791e9998
SHA1 c4b33bbce8e99f7d3e69152c077595a68bf5f5c9
SHA512 e0b1e9380deb3f7e8b2b3ad7b60da6e538a1a5cfb87c3634187f5e3fae94d98c3befc8defeb781dcfb881cd10dea49cba0d2efb061c214217bbb8fcc84a24ab9
SSDEEP 384:G0yu8PBb1WmBIWlbW1x4SCJ54LGA/ExQQ1IHlNLW9R9zEpJh4:GfjcCTh/9zGJh4
TLSH
T133C294411B60C1D9F925EF33865F8A2F6A34EB40163872137059A9A42D6E7D2EB3D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ja.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ja.dll
Size 24KB
SHA256 a45ff8aaf4b341d51f0ec9b95d528164e07846155eafa18e8b362bb1e18f6bf6
MD5 a396b8679f0df6c9c9386ff1ac2b7930
SHA1 940e85652128cf1de73868b9a211878a3950323b
SHA512 3afc6d894a05cfd1a50f60f106a0ba8ba198741bd218b95624bbfb0a87e576cc3916638d550b0f9a386609c1c31cfe6d35eb6335b25151e0d750693323fa66b0
SSDEEP 384:ebTVFXh71WmBIWL9gu2/2x4hmIHlNHW9R9zEeW:utfK6/9zm
TLSH
T19BB206896A60CD4FF8F36DB101B0EAA63E7DF6614AD148512641F40E28517C7EB36B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ka.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ka.dll
Size 29KB
SHA256 0306b06b402ac37c09505115acae3ef411521cb6d7a9ba04fbfe71650eaecafc
MD5 12adb612344de5288fb906ec24272a64
SHA1 6fef7149c2fa357c4e924c844da4d7cd5b48511d
SHA512 4b0cedc5b19ccda6745bb2a059c12590f37c3d4bd2f1a76d5a92450159b2d8a53fc6552b96d0a030ae1eeb896ee5778ed53bf2135a99d14c33f7beb8ff378845
SSDEEP 384:sgR9VFXh71WmBIW9odoA7s4THmES4c9OkmIHlNhTLR9zE0D2f:9xUcdp9z1DO
TLSH
T13ED22D0247538822E59E2A7069BCCFCE753DABC12550551BB390BE98A512BC3DB7F336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kk.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_kk.dll
Size 28KB
SHA256 294d35b817d9771ba37ccdc9397a0077864030d1f057a8df1f638d8191e8890b
MD5 8a8a52b9cbc379a43feeaa93576041b1
SHA1 33e36d9baa5fce3032c312f8fa804af943aff5a3
SHA512 3259352afea655a5d76fef85e52afad29aaf22300395f86948a0602a5566e1fc83a976dd923cdec91888c44d7a1d10d1527fa303994a7a0b8cf6ec396e309828
SSDEEP 384:RikVFXh71WmBIW69MvPQwXIHlNJAUyR9zVhzGp9:Z8WvPQweAU+9zV69
TLSH
T1F0D2834F6530E601E0A4EAB04EA18AC715BAF3552B5846F7BD5F751828A4B32FF35AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_km.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_km.dll
Size 27KB
SHA256 355fa9a66be2a3163692954422f717223bef51d7f728795c8af7536c748f7c51
MD5 04a166f5ce7a01fa4daa44dded0e1cde
SHA1 01ac416a537616d88be81dab558ad70dd287d1f4
SHA512 aa4317f7b637f52bc840a2bf0d12fb1fd306645cdbf67a0aa9526bb04228f037af126ab88f0d512ebb3f9d0f1a03de48cf51c45a8f1720ed1d390a033d12217b
SSDEEP 384:wi8VFXh71WmBIWufJoxeUnPcS7cePBpxCNpJDIHlNFprj/R9zs7:+NxdPX1PBpo/J+prjZ9z0
TLSH
T1D1C264D41170C1B6DD23D934C2B5ABBA3A36B1DB9E296D07221178550A327C2FFA5BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_kn.dll
Size 29KB
SHA256 93c438461535d608573037cb4b9b6c29c083c8432efc7923ded779d7cb04b384
MD5 50fba2cbab84de202272b7d46ba61d49
SHA1 d53c5614ea500307a289ab74deb32f7316482da3
SHA512 ef964028d579c8cae66ef71ed44eda4c2f9366e3fc2f4f1f2bc7c60fb30efe405ce885bc969ed323bd498b9e222ecb400d83bfa2d05c23c87f9630b3d0737d1b
SSDEEP 384:E7qVFXh71WmBIW+Qd4SyQRPbwTIHlNpXsU9xDE3R9zK6iNNJP:DkQ65YXsULi9z8
TLSH
T196D260CAC3B7C415D8D43EFF016759FEE520AA8354E116D23206904C6691BF99F35BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ko.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ko.dll
Size 23KB
SHA256 93f5d3aa76dab8e37ba228675508caf3c49f5475b0bb8f9fca4f094ba21545cc
MD5 dee1b013f11998b15322469f7a73961c
SHA1 96208657352c0fb0a247047df40b3437a7944a83
SHA512 00ea00d5e3e35ac4281ada0fa0a750d367c46842608fcd8c52b6bf48bc741c7839ac8d20f5c215ac43af107e3ee007ff402aa57fb2966a32a58dfd44744b622e
SSDEEP 384:sn3VFXh71WmBIWSlte7yWYDeYhHNjLUtUB1SGGgrxYQ8lJDuiIHlNWER9zwAS:gQM+OkFzuo9zvS
TLSH
T187B2F756A278C042F465BE320AE5CBE77A3EA2915E138457B700F19C28163C1FF3979D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kok.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_kok.dll
Size 28KB
SHA256 18d72ff67cb48d9919c1e04227d91cb28244e19642e0376e0f17b0c7ecc45b10
MD5 d0ce6d083e092c7995f62c97a58578cc
SHA1 943ce933405617cdb621218ac7d11852b4c02877
SHA512 7fe60e4c806c59ded6c5d2500722f42bf71cca0cb2d014b09b62b17da7158b77cf1eebe6151b10b97bccc377a46bc6dda50980d1fed8ad4921de6cbe9f2c3da4
SSDEEP 384:9EnMVFXh71WmBIWFRr+hjZ+hjgOjWfosIHlNNs5R9zE0KBD/:qIMMKw69z1c
TLSH
T1CBD2A74651C08724F6BDBDB8E0784AB35CEE2114B6CC12867EC872D9D8C637F675D2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lb.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_lb.dll
Size 30KB
SHA256 bd686694b089150715f15b2f3c54a32e121d352de6da25278e2562109e213c4d
MD5 0365ebc64143ba5e19ae994ccf846a1b
SHA1 d858e5da21e89786a82a54490de395e57bdf8abc
SHA512 633ba7066fd89f0fc166f832cc0b6813ed2594e95fd6291094481f880fef0e062e40a5850fbe6bc1fb50235cbaea199b7effe501ade77412f372506dbf39e79b
SSDEEP 384:KiJVFXh71WmBIWGse3swt/bmTRigvyOEIHlN+wAUyR9zVhzmPS:Tws4sSuAynAU+9zVEPS
TLSH
T14DD22D4167F88119F2F32F30BD7596A22E77BD86AD34DA5E2240624C1831B41EE78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lo.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_lo.dll
Size 27KB
SHA256 1c06468b3992bdac367c84c8735ba33d54c1ea5037bbedb391afedb4b7c9fd1d
MD5 df60b4c5eff5f73acc2e722e9e8016ba
SHA1 7408de7c7992ed81e2e687a50005484ce571cad2
SHA512 56ca9746231a1050d435acd976d887ddb6dac4f7fe923a838e2e8b62a71de22c839369b28aa349a5aab9ae14f5ede213703cb9266e0dad09dbae1da92d3eb2dd
SSDEEP 768:MXtADgApU01duiHkJwbMQpxZZPUlAU+9zVa:YKD7pU010iHkJwbMQpxZZPa6zs
TLSH
T14CC294FCA2A0C01BE1EDA7F0D46DAEFA7CB56605070345776744A874AB623C2EF78644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lt.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_lt.dll
Size 28KB
SHA256 556ab04f27bb96df3dc8e4e4951cf84f753098bb4c648a4c2119d821d15dcd97
MD5 01a4c28a530763b4f90fd41b63a3730c
SHA1 cd47cf7bec8b2d94cfffca5d1fb7e2b0ab59de37
SHA512 160d306e55086850a230eea71c3096d25a6d394c9d758449d95e18b876364b11919e5f5d45f1a5cca1a8354c5ed016845345c6899db42c5252757b7fd98869da
SSDEEP 384:MSwnHVFXh71WmBIWnrVs2BZJ1f+jmU55z6B60Kmr6YDLIHlN4e/rj/R9zsx:+djrB31f+jmUnz6B60NDN0rjZ9zY
TLSH
T1FDD20F5553FC4149F2F76E3096F89A571B3BBAA66E34D20F2100A14D58317C2EB78B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lv.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_lv.dll
Size 28KB
SHA256 e3868c923117c50f6d028ad4b4d30d80e347ad72ad70cfb1af3cdc3a227a10ca
MD5 c869163222a36d66e5b042510224c2fd
SHA1 804a3c699b4ed141a92525d9ecac170f2ae9f5c1
SHA512 5e74f342bead9473bfcc0ff680560fec0de83da558d46ef58d0ac74be54af4099b3218737c0e037981af307a8ea5b92059baffb485f012f72d8f92edd2c4032b
SSDEEP 384:AaypVFXh71WmBIWvYppSepDyvK5x/mI9IHlNlkW9R9zEk:E7Aa/9zt
TLSH
T184D2228197EC4219F2F31E306AB48B622E3E7D966D34D10F2100E55D1972B81EFB4B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_mi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_mi.dll
Size 28KB
SHA256 a64edb46c7e3193e7d71883a22ad7fec0c071925ca434cef1017eee8b5f1f91b
MD5 c3409e070b4a9b0cd54d35ee7873583c
SHA1 7369f1336ff308d867b18ee02b3a08b39d4dd304
SHA512 412f9c219ba609f1be4a06b30fd74b0eac4b5de637fdaeb1b840194ff2248c1819bb6fc07a770af8101ac1b03ecc70d823687a784ae0086f16c519f67f47323b
SSDEEP 384:e3LVFXh71WmBIWvHDPvhHXBRDEWUDrF1/rzLOWsMVbwwH9hlnyxNCJIHlNiKiqAl:eRRp/dLAU+9zV/
TLSH
T146D20B4256ED4206FAF73F7142B487562E3BFE67E938E74F2500A46E15323C29E24726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_mk.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_mk.dll
Size 29KB
SHA256 2f4e6f0cbf738f45b79579ef4a439172756c790c4c2dab5267fb0e67dbad2977
MD5 b20f26b227ed6434784d2747e6bf6b37
SHA1 b2a3300fab77bf75ae02d25ce125ce933f1f6fed
SHA512 1c075da0e821dfefb3d01d58b6273378896a63768223afdde1c017d19a5e93e06d09fbfe5a3a930caadf840e2b2c0f91bca266f5230219875761ade29f925d00
SSDEEP 384:QYFOVFXh71WmBIWtHbnGAYeBCEdpEXeR5qnIHlNXG1mER9zw06v:wzLjgUp0Ii1mo9zAv
TLSH
T1BDD2214FB9BC9204F691F6310FA9C6E635B9771067244686620FBC68302D732B72D6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ml.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAC6.tmp\msedgeupdateres_ml.dll
Size 30KB
SHA256 69a959d5591f946c2f2b0b743b3702578c2f456359bbce5261d0c3cc32425dc4
MD5 433fee8d34b103f9725bd55234fbc845
SHA1 96596447cf0c01b3e632b4adfe67794520bf062d
SHA512 e22947f1b024b28d1f729a32b5a4fb4c291fe83a626ee4b6e6457e1955bd70558b7043ed01551dc51db97dfe647d68eb79c29527cf06b3094111a1cb19b6840d
SSDEEP 384:ECthiVFXh71WmBIW+h3l/cdGKXpVcGOR/uLZpIqCX841SGOIHlNRFnR9zE0IkL:E+qrd+1xP9z1PL
TLSH
T1A7E250572560FE53FFDC14B40E4A8A57E5ECAB0EC95826A9192061F23D5E303AF2C7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 136KB
SHA256 a0876fe2db0cb2cc1c20115f125d9c013c08582b71885573aac4169270eca1f1
MD5 6e07047549fbf0ae18ba8b004f942057
SHA1 ff8b11bb90bb12f335641b1d0b5f41a63b5622f8
SHA512 ec48bcacb54b1e2535698ea996cdbf9e83766aab22eb9a28e6c71287d0ae83b1c2a475758a43e19380ca1daeccd9aab83e2242877f01cc8588e4597d8bdb861f
SSDEEP 3072:xlAEYrffsi09yPuIMwiF1gs4WLUNFozQMIsmO/:8fwyPls4WLWFoSsmO
TLSH
T1D7D3292637F90659BDF78A16EDF6DC66797BBA662C29C40C10D1128E0C36F01E97072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lvjvxpzv.134.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvjvxpzv.134.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeWebview2Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\supQ_Prerequisites\MicrosoftEdgeWebview2Setup.exe
Size 1.8MB
SHA256 13f6d9cdc8c3e7186e4b180db7f48e199ee97d631480e8391fb3106f338fb21a
MD5 e1a43811eb0b275df6db8c1c974cc7e1
SHA1 ba0cb196abb79ca32e3222f4b085dd0eaae0c6f2
SHA512 3cc09a15dea80f01ce429b605ef69163eb8627f2eba13eb2f49f724cd23a96d3eae455d6c0ce5cef67e9e6c2c9c5eb53ec3255bf7463b64197bebec58368834b
SSDEEP 49152:tiG83wD/Fed6SQP476cq98utmkYm9INAG4vUucckbk2uf:tiuDYd63f6ImVWIKK3A2uf
TLSH
T1A895231531E18031F1B22A315AF596B10A3EB8314F76589F13446E3D1E75AE2EB36B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Injector.exe

Path C:\Users\Admin\AppData\Local\supQ\Injector.exe
Size 1.0MB
SHA256 2be53c74933adbd10b7567f490d93a30014e04ae3b1a3757f3dc9e4c88dd25ee
MD5 1c592899e3194b84ddf08fc8f438e603
SHA1 e60b3cb60fc0e6ea37c797b1360c6927286e3a5c
SHA512 84a0a9fcf5bd94d68c6edb1c774c73c94d5081af2ef280b7a56c9f947fdf2302a5b3ce78efeb691fc901d8223cf7ccc248f96f1d5c5d11eadd2c369a7deea90d
SSDEEP 24576:lMBOtakNRd1da++BArKDlpWcybXk5nke6:luu5dXa74Yby2nke
TLSH
T12F35F003BB068EC5CD4693726E3257947694CC1A1BB19F1016153B69BC833F8CEA6EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Users\Admin\AppData\Local\supQ\bin\RobloxPlayerBeta.dll
Size 27.2MB
SHA256 fb72c3aab9cc01b5b4d49019f8ecf515cc7794bbd534de2b3bef8bc2945f795c
MD5 e82d408235ba45141ca22695875801e4
SHA1 159aa6d69309d9d1a0355ea6783827309ec413c8
SHA512 1977b0e2dd5ec8ff130670e44f73377faade9a61bc6eea423fb803a761b967bd0196f1d434c048fc74a9f164b1d3f32d6c455b16cb88a5fbff002955b64aaf41
SSDEEP 393216:brhVSq/6s1wCyYx2RbEKyk0VZOirT/QuzWGh3EwX3h1QVuvai9W0DB291FGzTZvR:/iNYF8uHkQ3/9V7Qk95DBQ1wv5
TLSH
T1B15733CBB9970D55CCF2C87C496741270FF5B78E82C5D020A597E2269CAFB104EB972A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\supQ\runtimes\win-x64\native\WebView2Loader.dll
Size 160KB
SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
MD5 cce1332e0af440bc54fdf04eb543d4a0
SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
TLSH
T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DexC.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\DexC.lua
Size 91B
SHA256 bb6943ad0c93a58cf8c7925e7b518b6f0748aab49e026d2672ef8526a5804304
MD5 ab1f96db7b271d5888fc2bfb0abce8c2
SHA1 62016d251b7c4adda96e2ab5a96b617504869ab3
SHA512 092e357063f1c02a6fcd7d440c699acec58d767f3dca991f687f07ce1b7f7e953fc32e86df29412414826af420d94883d24cc8254791220546003b724a0d9041
TLSH
T1C7B012DFA401462D073184C1A60DA09DD921C00CD820C163D1E58414C6508275131D15
MD5 SHA1 SHA512 TLSH

Submit Download

Eclipse Hub.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\Eclipse Hub.lua
Size 304B
SHA256 9e646aa1834dd6307fda1b299d43bb90a72116d346e6145a7c256574f4c3570a
MD5 51e5425ccc11304aeba8957ae423a0da
SHA1 06f4b6071f96da77de6473bbaa84a52c138719a4
SHA512 60106ea76c797cfa37ec621c295b0957742307d3d6a96249a8586ad01bf4860e96329d6888d3602591ecbf37e21d2fd7baee43d5887068773104e6a15d2973a6
TLSH
T132E07DCBC6962681E40000585EE82955E3D1F01031225C74B4F506CB476556C18BC34D
MD5 SHA1 SHA512 TLSH

Submit Download

Infinite Yield.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\Infinite Yield.lua
Size 98B
SHA256 0d4c6ca6f3d473c9fe81f3952ddd76796b5cc8def107219a5b6dd9de4618744c
MD5 e0246b17ddf86c45719e881d09987d64
SHA1 797d7322d3b11d9065f6ddea181d63e1e82dbac8
SHA512 ed989e87e89c2fd17f98a855fdc63f70d4a275c9c8e566b7f547b484b185c3f40f9a94fd1d314ff9c8f70f6f4223106bcfeda12a53676e9e98e62351872d9f7b
TLSH
T197B012BFD411926E0F3254C8481230D8CA30D42CCAB2C0E6D2FD4468917350BE030915
MD5 SHA1 SHA512 TLSH

Submit Download

Myriad Validity Test.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\Myriad Validity Test.lua
Size 108B
SHA256 90c81aab0562bc4b7948a66a516c4f849a3bbb20de783bd2bbc04a661a8b1f52
MD5 3c6a6433beeeee1924bb16a220cd30ce
SHA1 ae68df6cb4f83688c765bda937cb279a0a19d290
SHA512 f3c581464d922c4be5fb1ee7751e4981cf9b70955c592e1b44b2b0ca4c50fe1ad9c538d8a0ae98d76cf40067b79344861ca199e6a5ff7f2775f5ea221826f7a8
TLSH
T165B0127FE715A25C5E36BB81CC8F115CFF12914DAC11C5AE413F12B6D512074B1A668A
MD5 SHA1 SHA512 TLSH

Submit Download

UNCCheckEnv.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\UNCCheckEnv.lua
Size 28KB
SHA256 e8d53406c916b8e827c65c8f00d8a18b1379e693fd0379e8116e749bdf860cf5
MD5 b76726d10354343d9af5c268e40b47c4
SHA1 7103c78071be0c65c8b3a217168cf7909aef748e
SHA512 5caffd8a06058e890fe4ae35430539281cf53fa791221189f0f6660778a83fa42cc3e5374ce06ff325420d92006c2bfe1003f1486714e889964075da66b046eb
SSDEEP 768:JopEYRzOKMrGrE7BWf9r+T+f9TkIuP4hUUsbU8FqQFBF5UXzRFEe3cSG5Sg/i5rx:JEKcZuy9p
TLSH
T150D2866EF583B5A202F130F0F53FD009B676CD70A2395559B1DD50E46A289AC8893EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sUNC.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\sUNC.lua
Size 187B
SHA256 ec68e566df3d569e343991049ca95c4fb510c33abf9bce8c3b99bf0dd2cc2afd
MD5 c5931bf51cd50128a5f4f1abeec63bac
SHA1 6beabce147aa46cbe0a460db67a5d225105125ef
SHA512 d425ae2b25d499e068ccdfe7ca977a5fbb15e4cc7945978cde829427651b0be4d1f7a810e04c72ca4b623af50420b6c1727127a4dccc2f8b0f2334dd5b03809e
TLSH
T1D2C01269C84B8A7C52331490C44F3066EB16866A34BE1423B0FE40004E710A52416E1E
MD5 SHA1 SHA512 TLSH

Submit Download

saveinstance.luau

Path C:\Users\Admin\AppData\Local\supQ\scripts\saveinstance.luau
Size 1KB
SHA256 140d6b7154137e9861aeb5819f80924f033ddbcee2c497f69432820240b4a75b
MD5 b1c6f927476b86085f41a2847acf70ff
SHA1 179f4242c3f84466b31073ef732de5d819743f54
SHA512 0b3ab9eae5145864e8e2502175d9cd56c9cbf19b0c35e141428c5908388b590eda16236139ae90e8be4c180ef2955f07a13c82ec44cb9caaf649c3857f5d5fea
TLSH
T14F41628B12172CF80D7500A4A54FB48AFA3DA19812395620B0FC3C897BB13AD71E72CE
MD5 SHA1 SHA512 TLSH

Submit Download

supQ-Module.dll

Path C:\Users\Admin\AppData\Local\supQ\supQ-Module.dll
Size 4.3MB
SHA256 6bac6b072c8e056478eea8435814202c08578d243bed1cc43ed9aafef1ceca9d
MD5 ee4e5c7108f1642d4f7c8634c2385f4b
SHA1 058ff32739b1768be40ceb8509fa4cba58556728
SHA512 3ea4841625f1872278ec21f749b51b8817c6a1a6815aaadbe25c89aa87c46e7d4e67569a5004df58732aa8cf3add33ece41f37dbf9ca2125228df219b2feb9dd
SSDEEP 98304:Dd5rqfl1WZJUHMqe1MD3QaxVOMb7mBj09WUO9b98:DHCluJUbND33VfbX
TLSH
T13E26121BFB47899BC723813C85630B2647A5DC258673434B3389B60EEDA679ACFD5381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

supQ.exe

Path C:\Users\Admin\AppData\Local\supQ\supQ.exe
Size 20.5MB
SHA256 d625fc367aef9cf146c028161f9d59d1950aff964627ee334527d61ac5ddae3d
MD5 a155fb6d996935f7992b6d9ecd0d40e3
SHA1 90ba4b0d9dd0de80b2ba84800fedab2e1fe01d66
SHA512 726fb0acbc7bdfd9d4a84c511a350b5b385d6303c3699e4384259aeb490b266be0df150ecf69c513666777db8ed8d998b8669f1ea10411ad18c103aa9fa87c45
SSDEEP 196608:y3RWEISKq4FDsOb9xqSNTKArx0+P/ubAUdMwJ2Z+oz2JOxq:y3Y3FDRtTfx0+3ubAUiwJQNI
TLSH
T1EB27AE30FBEC4E29D2EE7732956101B617B2E85A2776D74A210CE9FA1D237414E813E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

supQDecompiler.exe

Path C:\Users\Admin\AppData\Local\supQ\supQDecompiler.exe
Size 8.4MB
SHA256 3bad6d7fdbb252f062ad441229edb25633b49b7822640c9200da76877fbb0a26
MD5 c3e9f5a79949c6d4d092bc678864c1bc
SHA1 10e60bdc11883f50c83a39741e56db22eb2a0479
SHA512 8d2f2578b35c9a14e7aa0468f5183d71628344fe9eb9eb7f52e0e815aa34db7eb56d0a6a8c12891cd3b796e9b304c984fb98cd648a6ef9dc51d0cf0938cb84a6
SSDEEP 98304:Cavpj4LEHfmIlriizasffdx3Z4kLlMDLcfmx3AbC0nK5NXBPT+wO:CaOLyjrzjlD/20wByw
TLSH
T14E963A157A5BA8ACD15ACC3083478A63592134DB1B36BCFF40D886352FAEFB05B2D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2968-335-0x0000000074750000-0x00000000749D0000-memory.dmp

Download

memory/2968-309-0x00000000008D0000-0x0000000000905000-memory.dmp

Download

memory/2968-310-0x0000000074750000-0x00000000749D0000-memory.dmp

Download

memory/2968-360-0x00000000008D0000-0x0000000000905000-memory.dmp

Download

memory/3244-431-0x0000022E1A880000-0x0000022E1A8A2000-memory.dmp

Download

memory/3244-436-0x0000022E1A920000-0x0000022E1A92A000-memory.dmp

Download

memory/3244-435-0x0000022E1AB60000-0x0000022E1AC12000-memory.dmp

Download

memory/3244-434-0x0000022E1AB40000-0x0000022E1AB5E000-memory.dmp

Download

memory/4980-7-0x0000014C349D0000-0x0000014C34A0E000-memory.dmp

Download

memory/4980-12-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-3-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-4-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-5-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-6-0x0000014C17540000-0x0000014C17548000-memory.dmp

Download

memory/4980-8-0x0000014C17590000-0x0000014C1759E000-memory.dmp

Download

memory/4980-308-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-9-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-10-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-11-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-365-0x0000014C36970000-0x0000014C369AC000-memory.dmp

Download

memory/4980-13-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-14-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-15-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-424-0x0000014C36A30000-0x0000014C36AA6000-memory.dmp

Download

memory/4980-425-0x0000014C36950000-0x0000014C3696E000-memory.dmp

Download

memory/4980-364-0x0000014C36910000-0x0000014C36922000-memory.dmp

Download

memory/4980-361-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-0-0x00007FFDA7F4F000-0x00007FFDA7F50000-memory.dmp

Download

memory/4980-1-0x0000014C15400000-0x0000014C154C0000-memory.dmp

Download

memory/4980-2-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/4980-443-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download