4836521456384a0ac204c8a1dc55ad70d1846a7d5d04769676ca7dcaf9cf38f3

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
supQ-Setup.exe
Size 744KB
Sample261030-ttya1aew6q
SHA256 4836521456384a0ac204c8a1dc55ad70d1846a7d5d04769676ca7dcaf9cf38f3
MD5 07afa1f319208101501e80df42b33328
SHA1 27dbf090603714179c711af5e45df0cf706993c7
SHA512 dfef83a18f644524edebe150d7ea98b2c819a809f217e2f38a9913a632942acd9b7c534be3e33f233ad9fb25aa0cc613fdd1ab970d2688c3ba1cd7e4f6db30fa
SSDEEP 6144:1bHzZpyMixT4dqCXzAUqacpC6UXj+Ezm/DNtfK8kfA3V0gVKgqPc3ck6xGBibOfr:JZqpOnzSNtIfA3sHPC/1bfACKc2gDr
TLSH
T1C7F47C1BF7E7CE5EE7662A78DA72636715E8E536697F824F23026913E8CB441CDC0201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation themida

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3392	powershell.exe
3392	powershell.exe
2664	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
5620	MicrosoftEdgeWebview2Setup.exe
2896	MicrosoftEdgeUpdate.exe
1084	MicrosoftEdgeUpdate.exe
5112	MicrosoftEdgeUpdate.exe
4680	MicrosoftEdgeUpdateComRegisterShell64.exe
3304	MicrosoftEdgeUpdateComRegisterShell64.exe
2988	MicrosoftEdgeUpdateComRegisterShell64.exe
4252	MicrosoftEdgeUpdate.exe
4356	MicrosoftEdgeUpdate.exe
3764	MicrosoftEdgeUpdate.exe
4204	MicrosoftEdgeUpdate.exe
1880	MicrosoftEdgeUpdate.exe
1536	MicrosoftEdge_X64_156.0.4314.56.exe
1568	setup.exe
1040	MicrosoftEdgeUpdate.exe

Loads dropped DLL 17 IoCs

pid	Process
2896	MicrosoftEdgeUpdate.exe
1084	MicrosoftEdgeUpdate.exe
5112	MicrosoftEdgeUpdate.exe
4680	MicrosoftEdgeUpdateComRegisterShell64.exe
5112	MicrosoftEdgeUpdate.exe
3304	MicrosoftEdgeUpdateComRegisterShell64.exe
5112	MicrosoftEdgeUpdate.exe
2988	MicrosoftEdgeUpdateComRegisterShell64.exe
5112	MicrosoftEdgeUpdate.exe
4252	MicrosoftEdgeUpdate.exe
4356	MicrosoftEdgeUpdate.exe
3764	MicrosoftEdgeUpdate.exe
4204	MicrosoftEdgeUpdate.exe
4204	MicrosoftEdgeUpdate.exe
3764	MicrosoftEdgeUpdate.exe
1880	MicrosoftEdgeUpdate.exe
1040	MicrosoftEdgeUpdate.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2904	icacls.exe
5060	icacls.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0002000000000574-372.dat	themida
behavioral2/files/0x0003000000000573-376.dat	themida
behavioral2/files/0x000200000000057f-420.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\identity_proxy\win10\copilot.identity_helper.Sparse.Stable.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Edge.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotStable\Square44x44Logo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Trust Protection Lists\Sigma\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\lo.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\mr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_el.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotAppStable\Square310x310Logo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotAppStable\Square44x44Logo.targetsize-256_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\pt-PT.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Trust Protection Lists\Mu\Entities	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\identity_proxy\stable.officehub.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\identity_proxy\win10\identity_helper.Sparse.Dev.p7x	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\resources.officehub.internal.pri	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\telclient.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\az.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\copilot_overlay_strings_bg.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\EdgeWebView.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\vision.contrast-black.svg	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\psmachine_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\copilot_overlay_strings_mi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotDev\StoreLogo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\mspdf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\copilot_overlay_strings_zh-TW.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\mr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\CopilotDev\Square44x44Logo.scale-125.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotAppStable\Square150x150Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\identity_proxy\internal.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\CopilotDev\Square150x150Logo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\CopilotDev\Square44x44Logo.targetsize-16_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\CopilotDev\Square44x44Logo.targetsize-24.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\copilot_overlay_strings_es-419.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\is.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\MicrosoftEdgeUpdateBroker.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\copilot_overlay_strings_eu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\kok.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotStable\Square150x150Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\de.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\identity_proxy\win11\identity_helper.Sparse.Beta.p7x	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotDev\Square44x44Logo.targetsize-48_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\identity_proxy\win11\officehub.identity_helper.Sparse.Internal.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\ResearcherOn.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\CopilotStable\Square150x150Logo.scale-200.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\edge_feedback\camera_mf_trace.wprp	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\identity_proxy\win10\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\VisualElements\CopilotStable\Square71x71Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\copilot_overlay_strings_nl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\da.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_da.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\identity_proxy\win10\copilot.identity_helper.Sparse.Internal.msixbundle	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\VisualElements\CopilotDev\Square71x71Logo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.56\Locales\copilot_overlay_strings_ga.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\copilot_overlay_strings_ru.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Locales\lt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\msedge.dll.sig	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	supQ-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	supQ-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4356	MicrosoftEdgeUpdate.exe
1880	MicrosoftEdgeUpdate.exe
1040	MicrosoftEdgeUpdate.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DA7B591-213C-4FD8-B6D9-8075F040981C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DA7B591-213C-4FD8-B6D9-8075F040981C}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\LocalService = "edgeupdate"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.311.5\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.311.5\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{98B7BC0E-5592-4F17-BCD8-205B74F12FA7}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5340	supQ-Setup.exe
5340	supQ-Setup.exe
2896	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5340	supQ-Setup.exe
Token: SeDebugPrivilege	2896	MicrosoftEdgeUpdate.exe
Token: SeRestorePrivilege	4252	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	4252	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2896	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeIncreaseQuotaPrivilege	2664	powershell.exe
Token: SeSecurityPrivilege	2664	powershell.exe
Token: SeTakeOwnershipPrivilege	2664	powershell.exe
Token: SeLoadDriverPrivilege	2664	powershell.exe
Token: SeSystemProfilePrivilege	2664	powershell.exe
Token: SeSystemtimePrivilege	2664	powershell.exe
Token: SeProfSingleProcessPrivilege	2664	powershell.exe
Token: SeIncBasePriorityPrivilege	2664	powershell.exe
Token: SeCreatePagefilePrivilege	2664	powershell.exe
Token: SeBackupPrivilege	2664	powershell.exe
Token: SeRestorePrivilege	2664	powershell.exe
Token: SeShutdownPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeSystemEnvironmentPrivilege	2664	powershell.exe
Token: SeRemoteShutdownPrivilege	2664	powershell.exe
Token: SeUndockPrivilege	2664	powershell.exe
Token: SeManageVolumePrivilege	2664	powershell.exe
Token: 33	2664	powershell.exe
Token: 34	2664	powershell.exe
Token: 35	2664	powershell.exe
Token: 36	2664	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeIncreaseQuotaPrivilege	3392	powershell.exe
Token: SeSecurityPrivilege	3392	powershell.exe
Token: SeTakeOwnershipPrivilege	3392	powershell.exe
Token: SeLoadDriverPrivilege	3392	powershell.exe
Token: SeSystemProfilePrivilege	3392	powershell.exe
Token: SeSystemtimePrivilege	3392	powershell.exe
Token: SeProfSingleProcessPrivilege	3392	powershell.exe
Token: SeIncBasePriorityPrivilege	3392	powershell.exe
Token: SeCreatePagefilePrivilege	3392	powershell.exe
Token: SeBackupPrivilege	3392	powershell.exe
Token: SeRestorePrivilege	3392	powershell.exe
Token: SeShutdownPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeSystemEnvironmentPrivilege	3392	powershell.exe
Token: SeRemoteShutdownPrivilege	3392	powershell.exe
Token: SeUndockPrivilege	3392	powershell.exe
Token: SeManageVolumePrivilege	3392	powershell.exe
Token: 33	3392	powershell.exe
Token: 34	3392	powershell.exe
Token: 35	3392	powershell.exe
Token: 36	3392	powershell.exe
Token: SeIncreaseQuotaPrivilege	3392	powershell.exe
Token: SeSecurityPrivilege	3392	powershell.exe
Token: SeTakeOwnershipPrivilege	3392	powershell.exe
Token: SeLoadDriverPrivilege	3392	powershell.exe
Token: SeSystemProfilePrivilege	3392	powershell.exe
Token: SeSystemtimePrivilege	3392	powershell.exe
Token: SeProfSingleProcessPrivilege	3392	powershell.exe
Token: SeIncBasePriorityPrivilege	3392	powershell.exe
Token: SeCreatePagefilePrivilege	3392	powershell.exe
Token: SeBackupPrivilege	3392	powershell.exe
Token: SeRestorePrivilege	3392	powershell.exe
Token: SeShutdownPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeSystemEnvironmentPrivilege	3392	powershell.exe
Token: SeRemoteShutdownPrivilege	3392	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 2904	5340	supQ-Setup.exe	89
PID 5340 wrote to memory of 5060	5340	supQ-Setup.exe	91
PID 5340 wrote to memory of 5620	5340	supQ-Setup.exe	93
PID 5620 wrote to memory of 2896	5620	MicrosoftEdgeWebview2Setup.exe	94
PID 2896 wrote to memory of 1084	2896	MicrosoftEdgeUpdate.exe	95
PID 2896 wrote to memory of 5112	2896	MicrosoftEdgeUpdate.exe	96
PID 5112 wrote to memory of 4680	5112	MicrosoftEdgeUpdate.exe	97
PID 5112 wrote to memory of 3304	5112	MicrosoftEdgeUpdate.exe	98
PID 5112 wrote to memory of 2988	5112	MicrosoftEdgeUpdate.exe	99
PID 4252 wrote to memory of 4784	4252	MicrosoftEdgeUpdate.exe	102
PID 2896 wrote to memory of 4356	2896	MicrosoftEdgeUpdate.exe	104
PID 2896 wrote to memory of 3764	2896	MicrosoftEdgeUpdate.exe	105
PID 4204 wrote to memory of 1880	4204	MicrosoftEdgeUpdate.exe	107
PID 4204 wrote to memory of 1536	4204	MicrosoftEdgeUpdate.exe	111
PID 1536 wrote to memory of 1568	1536	MicrosoftEdge_X64_156.0.4314.56.exe	112
PID 4204 wrote to memory of 1040	4204	MicrosoftEdgeUpdate.exe	118
PID 5340 wrote to memory of 2664	5340	supQ-Setup.exe	119
PID 5340 wrote to memory of 3392	5340	supQ-Setup.exe	123

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	MicrosoftEdgeUpdate.exe

C:\Users\Admin\AppData\Local\Temp\supQ-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\supQ-Setup.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Local\supQ" /reset /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2904
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Local\supQ" /grant "*S-1-1-0:(OI)(CI)(F)" /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5060
- C:\Users\Admin\AppData\Local\Temp\supQ_Prerequisites\MicrosoftEdgeWebview2Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\supQ_Prerequisites\MicrosoftEdgeWebview2Setup.exe" /silent /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1084
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.311.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.311.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.311.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.311.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3304
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.311.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.311.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2988
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjMxMS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezk1MkQyNzAyLTY3M0YtNEZFMi1CMkM1LTAwRDNBMTYxMDc0N30iIHVzZXJpZD0iezA4OUVGRDY5LTExNjctNDlGQy1CRkZFLUQ2RTk1MkVBMzRDRX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7NEZDQTQwODEtQzlCNi00MTg0LUFCMUUtMjg5QjIxRjI0OEU3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzOEZhbnZ3Zk1jZDY2ZzdMVjJQZWFTUjdXVU92MGx1RjRodmlpclRvaytNPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjY1IiBuZXh0dmVyc2lvbj0iMS4zLjMxMS41IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjYwNTI3ODU2IiBpbnN0YWxsX3RpbWVfbXM9Ijk4MCIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4356
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{952D2702-673F-4FE2-B2C5-00D3A1610747}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -join '|'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\supQ' -ErrorAction Stop } catch {};try { Add-MpPreference -ExclusionProcess 'supQ.exe' -ErrorAction Stop } catch {};try { Add-MpPreference -ExclusionProcess 'Injector.exe' -ErrorAction Stop } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3392

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4252
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4252" "860" "820" "848" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4784

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjMxMS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezk1MkQyNzAyLTY3M0YtNEZFMi1CMkM1LTAwRDNBMTYxMDc0N30iIHVzZXJpZD0iezA4OUVGRDY5LTExNjctNDlGQy1CRkZFLUQ2RTk1MkVBMzRDRX0iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0iezJCRUVGRkE5LTkxMUUtNDNCRi1CMzdBLTAxMEMyN0Y3NTgwNH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxOTEiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7aWtPMUY4UjUwZFQzNmJaZHJoOStMT3QydTI3Tm9aSmxOL0NiVG92T1dxTT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTQwLjAuNzMzOS44MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNDgiIGluc3RhbGxkYXRldGltZT0iMTc4OTE3NDMwMiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDMzNjQ2NjQyNDg0MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9Ijg2MDY1OTQ0IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Njc3MzM2MzUxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1880
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{653CF6D5-36DC-44C5-907F-0DB1221B39B7}\MicrosoftEdge_X64_156.0.4314.56.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{653CF6D5-36DC-44C5-907F-0DB1221B39B7}\MicrosoftEdge_X64_156.0.4314.56.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{653CF6D5-36DC-44C5-907F-0DB1221B39B7}\EDGEMITMP_40A96.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{653CF6D5-36DC-44C5-907F-0DB1221B39B7}\EDGEMITMP_40A96.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{653CF6D5-36DC-44C5-907F-0DB1221B39B7}\MicrosoftEdge_X64_156.0.4314.56.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1568
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjMxMS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezk1MkQyNzAyLTY3M0YtNEZFMi1CMkM1LTAwRDNBMTYxMDc0N30iIHVzZXJpZD0iezA4OUVGRDY5LTExNjctNDlGQy1CRkZFLUQ2RTk1MkVBMzRDRX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7OTUzQThDOTEtRDdFMi00Q0M5LUEzNjQtQzQ4OUNDNDJFNzMwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtIaHZISVdwVU5aVE1uVjJWVDFsZTNmNVlKUTlPU29URDZNeEhEbEE4OVBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNTYuMC40MzE0LjU2IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iNDgiIGNvaG9ydD0icnJmQDAuMTciPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTY4OTIyMDUyNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2ODkzMjUwMDMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTE3NzMyNzExIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9kYThhNzQyMS0wZDZhLTRlMjgtYmYyMi1hY2FjZmFiN2YzNzA_UDE9MTc5Mzk4MjExNSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1LJTJmMTNuRVdiM0ZKaUJIajJrVk5VWXJDaFNwOUI2S3EweGNkTjglMmZFbFdLTXNnMzQ0Ukd0UUpEN0UlMmY3YzJZeWN4UWRkalpSdjdlOVE5NDhzdUlQb1lyQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjIwODQ4NjIyNCIgdG90YWw9IjIwODQ4NjIyNCIgZG93bmxvYWRfdGltZV9tcz0iMTQ4NTgiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTE3ODg5MjkxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTk0MTE1MzMwMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjI1ODM5MjY3OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc2OSIgZG93bmxvYWRfdGltZV9tcz0iMjI4MzQiIGRvd25sb2FkZWQ9IjIwODQ4NjIyNCIgdG90YWw9IjIwODQ4NjIyNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMzE3MTciLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_7z.data

Path C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.56\Installer\msedge_7z.data
Size 6KB
SHA256 25f380fae35a572aec4e59403d08d9330dea7bc186abb9ba9ea06178c4473bb0
MD5 3ddda561b65e9e3aa0566a2cf725f142
SHA1 f31448c9b527d3e0b25aa6ddebeedc4d8576a42f
SHA512 ae84e0ce4e2e0bab1aac2a3c81018d3374fd9b273a13073aa2844eba1782afe206dd9d29e4ebf8752df777a340e4a5753f1aab0f8193d16a3de91e63cc7c791a
SSDEEP 192:CwDbpTIS40/AmpA4hOtlHL7W89PA++wrab:CeR4AA1PW89Ycab
TLSH
T146D19E496451F1B8D59422AFC3CF7CA0BEB4FD108DAA356EFC944886E35C28E4597822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopilotUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\CopilotUpdate.exe
Size 22KB
SHA256 317b5c369a0ec34695bdb06216562677c4cd26ccfae020cbeae5377cfe2359e6
MD5 c5ab137e00a2af985248e0cd5d630cfb
SHA1 59106ef0f3238b175ed3782901610bcc9c8660f2
SHA512 25ea311f6a707578a892d1f9ac6a8590d7d1f1d38b67b7c2db65dfb7cd03df4098f637f1a1c0ca7ad33c509ce4842e67c020a7e1e35deb65b940eeaf9747d2ae
SSDEEP 384:0+m1xOBF1m6yWAH/ELvmtmKeWp4FIIHlNw9fPOxFR9z+FG6u0:7qEdm6yWLqEKp/PO59z+du0
TLSH
T152A29EC2A7784082FAAA68B0852DED837C3CBFA3495057577098F50D2D237C1FB2675A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeUpdate.dat

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\EdgeUpdate.dat
Size 12KB
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
TLSH
T1A74298117BE4C690F4B22E310D7ACFA65B3AF542AD74C60F7380231E8EB6B058971312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Size 241KB
SHA256 77eab60d345f7a5f28d579ec545bed560a3c0996958eb4721bdaf44dfafe54dc
MD5 6cb5ee2d66e7bedd43431d9502f189f3
SHA1 89b293487178ad9bd836ecaa1069558cfa568203
SHA512 3b11666d5cf57a958afc21b424212cad2066e1f8a9be9bf0c2b2eb04fa3cce4083cb725df656fbf6434ca1703970755086318359651869a6007d60d26195129c
SSDEEP 3072:STz8czCHaaV9zLKT5tIu6ohreuD8bG4sZAEtSffDBt3Q:8xbaV9XKT5t7fujQyLnQ
TLSH
T12734F76519FC24E3D5E6D2F8DFD4C962B319E9B6A010CCA74283424ACE13E815DA7E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\MicrosoftEdgeUpdate.exe
Size 202KB
SHA256 ba7b3bb414f4bc6ef9a1f11c22861e1526738756b5a91695228e926eef91167b
MD5 45e42a0c9a4a5df5860980f1b9f9f4f2
SHA1 d1852b776a4a2a525fd77fdb81ea077455c3c8d1
SHA512 b000e568409a9901b6a7d8e43c9635ccb39ebe0081ee6517d39e65fff775b8c6192e787f3ecfa57621019df5ad4b812889d603122c4271758b2ce8ed20524f4a
SSDEEP 3072:Pmrf6YGagE9c7l0DhtR6Vg9fh/yOn86ImWTDV7B+oYlHQ2cXDThwb97B5eomjm/G:j7l0Dhr1xn8RDtB+XCx
TLSH
T1E4144D1277F80A68F8F36E3058749F299A3BBC319D34EA6E2650218D2D34A51DD31B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 275KB
SHA256 be38bc993e43ef34b6d16549c33f385a283b63cb7bc4fc3051466090e2d13f7b
MD5 9faea34ebb929f0826dbeeedee3161df
SHA1 0e075b27530c1360be37d4d092b55ca4a2d5928b
SHA512 c4ea7de699d9d03bace917e0647151b501ed75d14ce56714ce446ac48c80305ba394da98edeebc2ab4204852f7e0a9f27b9112a95be2ff39126b14048edfb122
SSDEEP 3072:BY8DYihO5cj+g80OKZMvun3bctal7QWRoY466tInporuWjj9vKm9G:G8D9Ecj+g8VKiqbIGohB9t9NE
TLSH
T13C54C6691AFD04E3E4B5E1F98FD48942F160E8726720CEF74291424A4E13AD16DBBE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\MicrosoftEdgeUpdateCore.exe
Size 372KB
SHA256 6cabedaca021b5c6701533d22f8eae141ef840c791a15506a55cc883216efd3b
MD5 9c45e4394703f83a57dae5f7feea65f8
SHA1 e81eafe79f46d72fc25b5642593f49e804779253
SHA512 0d9573059d4e40c776230ccaeca59a706766c8c11f15277b075ea3ddcd6d0ed6f2093cb8490f64bca01b88335c76f0643694335b515c89a3b9461a377979c60c
SSDEEP 6144:UmSq0LZQujFJi/a9lm5YTKX/TMtQTuGVlwAO8E5J98Y0Nh+BlN+:d0LZQCJi/a9lm5YT3GEuE5EYMh+BlN+
TLSH
T1E784492528F84073D0B695F98FD4D923B478F8726B014DFB93D246499E22AC26177E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.TXT

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\NOTICE.TXT
Size 4KB
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
TLSH
T1C181853AB362077206D007909A9A9CD7F92FA2ABE35A6744B82CD10D133745DD3FE564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdate.dll
Size 2.5MB
SHA256 77e2dddcf50491a169753478fb407edfd1c809167da5a31820591cdaa78e4a84
MD5 6a8bc8d865067be052eada32669ee5ba
SHA1 0c45ac11f31255b92210bd7aa994a57a65310ca8
SHA512 92f041d3987cd3abbd11bdc3445efad45b16692b7ed24e05894bdc96a8081695f40c50ae3a8a1e1f9fd3797c3fa2ab6defb1f737314b4660c66cb1cb6de70df3
SSDEEP 49152:tLncw8rU1aPPBdRTuON844eWKHRP2QNx5l9zF+epsRtmciYO:tLnzOU1aP5dRdNb4PKxPBzFVfXYO
TLSH
T1E7C57C2125E44076E8F386B4CBECA916A8B9F8361721CCDF63C0854E7A729C25577B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_af.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_af.dll
Size 29KB
SHA256 bbb15713082c25b87c635d2b5d7ddb08cf81a0f9a56ecdc328ab18543f85ac82
MD5 4f0a182226ce93c605373f300ccef83f
SHA1 8f95df191dfd1ef0c941c95f8ca2adb8e913f0d7
SHA512 f7c7df25aa66e50c785fcacb90660010a26bdf4ed1d1a3e5fbc3415aa58b9efe57c20e426b833c613f4f5688774ca94c651e28c414ca6f40c053be924203cbb5
SSDEEP 384:zQvVFXh7BWmqIWpjrYiVDxlwCiO+OIHlNie2QR9zkF+TA:PSrO+ee2s9zM+TA
TLSH
T18BD2F99053F8810DF4F73F30BDB896925B76BD92BE34956E2240A55C1831781EBB8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_am.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_am.dll
Size 24KB
SHA256 2401e59cc5a5229f528f4962c1527f38af5f5c8ab7f6a8a1efc1249fba207163
MD5 da2b6d0e7be319838efb57c23a2accdf
SHA1 c7abb3e302fed52ba7bc5472da3aab2aeb45fb04
SHA512 6c492273945c621409322df59dbb92512adc2c0b84c25476af94a931d14360be9016e09488bfd9bcf79d29d7a7c4261d7efff305bb3e1d16bc1d72f14126065d
SSDEEP 384:T+0UVFXh7BWmqIWn0Kl8SsFKIHlN1g2QR9zkF+0n:1We8Ssc2s9zM+0n
TLSH
T14EB207438364890AD0677D740648CF6769BAFF0D1E14416BB116FA5438E53A3FB3AB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ar.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ar.dll
Size 26KB
SHA256 15ad416936f7c75097292c40a8e527b6d25ee440f5e3f97b21b30962b1906bdf
MD5 6ad2d901e296e8a5a54bc21f7be84589
SHA1 dfcbce0386c146d4a4c6f069e75fc8d044ac8255
SHA512 b9e98f56f9bed88ac5464a64865ead7cb61f433cda751eef1862bd9b6f9a6851c4b7b5416950abcfbb189c03ecaf106c25a871b93d06b9e63b116c1d608d0f9b
SSDEEP 384:5W0PBbBWmqIWkYwTPsQtXvfG4IHlNsER9zqWQu7a:W6bpXvfBo9zn7a
TLSH
T16FC2B9425E6CC13DF457AA34C16ACB53A23992478DD8223B66309D0409A5772EF2FBFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_as.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_as.dll
Size 28KB
SHA256 1507ffcd4f7e4959b0dc20b83d58dedf1e93a0b1ea250f8007cf70131cc1c482
MD5 883885c91fa361a0071d0f21a8ab8bbc
SHA1 b09805fc0080f8df982e881681747dc5dba9d089
SHA512 dada8933542262c11c05f07011b79261a7e07597372a9dc4db020a9fe4d7d0575972a9c5073aaa28509bc570313b2fb0df13168bd1a0cb94bf8c26e9266d6d9a
SSDEEP 768:8TZ452DuUu3+F/bE6uEJKIlHpyULi9zzqN:8a1zzqN
TLSH
T1DBD22C515750B524D5FD643C02D28DBB1AFDBACF081CA4B920E3E10479A63FA9F2B19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_az.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_az.dll
Size 29KB
SHA256 f6125cf0af8995e11430fa34e0dd84f735c360620398da5fe0e03c9984026a51
MD5 a8e9e935ce62034e5e7bb64d44926461
SHA1 fac2ba68d2168e8bca8f79e7576e1ff7435794cb
SHA512 dbc4cfca97e035cbdecd9d1f416594b571945e15a558b78035e37d2711b6a774d8514d4d1503c670b5abff31d68810b592cf350193bacd3b147e6dda837317e4
SSDEEP 768:jnIOFe5FEuo//ctGFLFS2rF9FTFYF+WYULi9zzxb:jhFe5FEuosAFLFvrF9FTFYFA1zz1
TLSH
T17BD21E6093ACC105FAF35F705874BD931ABB7FB37A34914B2292A04D1C713D2AA34B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bg.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_bg.dll
Size 29KB
SHA256 8c895099b2af8732f6a97cf1ebb9bc1ccda4807e0db55b87b0ccebf3b40871ad
MD5 ad9fdaef64c9520c4d2f17d7d479502d
SHA1 08fc8c699eb24c1f2689bba89cc7a8f2d4f3df44
SHA512 c9d5efcfd6f88d1429714a9d76da858a236b981b57e6b5b5c15cce9ef967070f877b85664ca5a54c4ede01dedbbb0e105ccbb6823cf26d0dd03aa0e72db8f451
SSDEEP 384:yG3VFXh7BWmqIWDdsSCCdCwd0Qgv66n467IHlN/OER9zqWTCu:G9dshCUCgCr6SOo9zRd
TLSH
T196D20A4FB97C8100FA55E6311FA6C6F735BAB751672446C6A24FBC68201D332B7292CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn-IN.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_bn-IN.dll
Size 29KB
SHA256 106705048f7e0fe55bd01049cde7761c7c2a4035d80f7ba51b98d87526a6199d
MD5 2680e0de7a1517dae64df14539d94da5
SHA1 6e34fff760885de0fdab7a6988beca8530d047e0
SHA512 3a407d1e9adea46efb650f5996cdbb45540a88f118642b357aec497220e7b11979fe40427c4c08fe39131ebb4596c07ccba616b4ac8dd59074ebda30c1254197
SSDEEP 768:ehvAGEtJtVWCZsnM9/rvoaqPdQ8JBlH9PO59z+dJI:e1AGEbYj4zeJI
TLSH
T1BCD24016A710B814E6FC283C07D6DEBF1DF8B241242CA4BD25E9EA0419A23F65F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_bn.dll
Size 29KB
SHA256 096560af794124c97542fc088d2e64805015be89fcc80ce4469998bb773816b1
MD5 f9f761d9633ec06a1cd02bf1f47a5129
SHA1 deb144d6b11aaf85e0a185521cd53fefbf5bd5d3
SHA512 773255666ca780d1d97441c8bb4e41063ff953e466a7081f41801cacdb67a3548a4d1a5c8aa6b4962903dd71d805b8e82ad5ec31f67a1df34f44830993c358b9
SSDEEP 768:JcvAGEtJtVWCZsnM9/rvoaqPdQ8JBlH4AU+9zVB:JEAGEbYo6zf
TLSH
T1E9D24216AB10B815D6FD283C07D6DDBF1DF8B241242CA4BD25E9EA0409A23F66F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_bs.dll
Size 28KB
SHA256 4b25772e4f318954264abf2b29e1802ac052d6e2069e2db887fb1515e27c4cdc
MD5 ad25f8d6c61ce6ca7d7f7fd8b2c0ef4d
SHA1 9348100dd2d379305710f1705f82f442c589e9c9
SHA512 23bd5de38727e389fc29229502ed22e44b7c6c21d9b61041e75eac91a59b1d4aa3288af292198b8d8c232647d4bd230f56f329d312e515f1af22dbe4e97dae0d
SSDEEP 384:s7/VFXh7BWmqIWOaDAmqRDU5NLCdJlwc/Xi+UFs47jIHlNYaR9z7WckC5p:Hv6lwc/Xi+ms4rW9zaFC5p
TLSH
T1F8D21E41A7F85159F5F77F30A5B457621E3FBDA2AE34910E2240668C0931782EFB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca-Es-VALENCIA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Size 30KB
SHA256 5d1b4cff935e4029875fb9f359ad8716545992971ffeaba9ad4af3d02576cf24
MD5 8ce8b89cb20bfaabb6d4cceeaa06f132
SHA1 a340de0c067d1c9fc0f218a32b0a6a0f4891ea00
SHA512 2740eee4799562cbed7da696cb7cec3f158464061865dc458121bceee17729adfec71c7259daa2b8dd683a99ca4e9aae6ee39fa3e70998a0b5e660a2d0516f6d
SSDEEP 384:DiVFXh7CWmqIWEbkbOnGNfNFoBWk5gZAbIHlNW9fPOxFR9z+FG6C:4SbkbOnMffoBWFuZPO59z+dC
TLSH
T113D2DA41ABF84655F6F72F707D7899525E3ABDAAAC38D10E2200A50C08B1F51EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ca.dll
Size 30KB
SHA256 93af01d1b6af96b8a38f62ca04647750388973706b1fee6fffeabc03d5cbfe26
MD5 8146e8bf435f7ddbda40def76d491f90
SHA1 5361002e720296032a18a93f4cac01454e5aca54
SHA512 380d7cb200f703204bb21781596977c7cc12623301cd08736b8bc9f4dde1a762a5b2ed8c0062180fd82a7ef83ffa1f8ec0880b7cf82af52bdd1fabe915292d31
SSDEEP 384:jR6fVFXh7BWmqIWNHEWdvDNfNFoBq1ZQtxIHlNOerj/R9zrY5ib:L7HEWdvpffoBqkerjZ9zrr
TLSH
T138D2D841ABF85655F6F72F707D7899524E3AB9AAAC38D10E2300A50C08B1F51EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_cs.dll
Size 28KB
SHA256 38a37fa27ec7adc6b45479cbafb254b0393e4225394b11462e550071a0360690
MD5 270fffa8f3267d0f09fef303e7dbb0a8
SHA1 db4b5e97956ae3220d1264826c5f13ae85da420f
SHA512 18cbf8e243ea5205a34f92fcca42f320e7958d49a25672154a74616b76587984eaeb535ada89caedba623bcda8a952d7340d26004ed0a17ddf5a74151e7825bc
SSDEEP 384:+qmVFXh7BWmqIWPTL7PGQxQFnwd/9IHlNejMR9z7Wc9Pp+y:BlTL7nnA9za6PpT
TLSH
T141D23D4166F84185F2FB7F3069B44AA21D3B7D96AE34C14F6640968C1C31BD1FAB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cy.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_cy.dll
Size 28KB
SHA256 cbbe5ecd76a2ea483458949875c31017754f0e4b5c1e36c21e6cb2bb1df94503
MD5 fb9f4560bbf0479184a6ee50f69abf71
SHA1 74df7d987521ef6dba2f1b22c12b6e75bb60f822
SHA512 8b816787bb1815e1ae837e1f95fb0ab761105db28e1d30aac9ddc93a8585a9f7f936d9d7d2b455547df5d3a2c86c9aa3cb2ae4fc7ff92c85f0193925d7e74f88
SSDEEP 384:kQ+VFXh7BWmqIWrtZEmiuTHsyi7zAaaVamjyC8oyUFxOFqdJ8cIHlN/2QR9zkF+v:dNDWZUjxdJm2s9zM+v
TLSH
T1F0D23F5143F8814EF5F72F74A9B5A6962E36FED6A974428E2380B1081C71782DE3473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_da.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_da.dll
Size 28KB
SHA256 03f364d47d9f3a64919268de161d57322236ae18f0e1b69a7c3bf741b3f32a66
MD5 41c3a19d288ac75d9c613f5773b8b183
SHA1 b157283d80f0fb20bb3daf615bd7cc68d100cfea
SHA512 202f2df1e6dc35af40a5a98dbe762fd8f2cced1240df8583f4043dd48d000d3047da3e64f46d448c2b1c514d31bf8c13d048e4b193cd5c72befd87fb1773ba1d
SSDEEP 384:HSnXVFXh7BWmqIWem4HcyvBdIOIHlNS69fPOxFR9z+FG6Y4:ayn4PIO6PO59z+dY4
TLSH
T16CD2FE9167F88219F5F73F30BDB98691197ABD96AE34D61D2200A44C0C32785EBB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_de.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_de.dll
Size 30KB
SHA256 80f688e5bc551d7d5419dc3ff5a715879ffb43e305655dd7af681ea2ce1e0b91
MD5 b63531e3048cc4ce3fcb16e9c82077e5
SHA1 90817532beae54060fd98c56fba27a9e1e6cc21f
SHA512 645a9074c5bc6cef3eba7029ba6c7c1e6646d66adb9a81c26e061389ea3bab9766a937cf15c158d0f8e9947fb085fe16707759facb11262a63c94775e623c95c
SSDEEP 384:v5mVFXh7BWmqIWCeI4FBhj3ZnsYxrPbLWIHlNSLCrj/R9zrY5YS:jgetj3ZnLxTbLOLCrjZ9zr7S
TLSH
T13FE2D95157E88608F2F73F30ADB897962E76BDD5AD34EA5E2300A05C1831741EB78B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_el.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_el.dll
Size 30KB
SHA256 a20979ef711052b948f642da8c7d28a64a29551ae649d54491d624b07d36bb79
MD5 c55ae1304c2cf319faad843bbf738eae
SHA1 4eadfd8a13cbd81fffd8d9e8566932574d304484
SHA512 189af5e29e22109ce8d84d149cfe9820fac507371aa2c88b194636436fa4bf80f1fc07e93d8c6b13153363d29aa3f2c1ac087a38fac5c2e037da5b414066ed57
SSDEEP 384:yebVFXh7BWmqIWPnBzBUBOTG94vTZtfFkmmFK9q87PgbYIHlNdyAUyR9zV8XL:expnxdFD+yAU+9zVCL
TLSH
T13DE2208E0D7F9701EEA6ADF244738A1B5A3FF5860810DD6732F070489D1DA129ED7A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en-GB.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_en-GB.dll
Size 27KB
SHA256 ca9d01bc5b59af52f6942d521ae065edf92c50d56e7a1b8ac6866eb630754453
MD5 5654cfe78a9112f8f7a8d1d375fa202a
SHA1 e960c1c29451d61fcf323348f60827a49924c765
SHA512 3206d7173e5e22f15520d01fd5f6bde286087399e6073e0c0ed7224530e239bbd74f3d72c905bc8163d3a2c8aeff32a0638e40a77414f5b8a49b379047ba0537
SSDEEP 384:GmVFXh7NWmqIW1kagyonbe1IHlNbER9zqWo3A:uYagyoyEo9zgA
TLSH
T1F4C22F81A7F88119F6F73F307EB496A21D3ABD92AD34D65D2200A40D1872B51EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 c4ede9bfe71d700171035a2c209e42831c9843d6ff8dd74a61201dc80be09bdc
MD5 284e1b4cf11194a3e7038852dda07dfa
SHA1 5abe67c578d3c32d4a9758959b3605ef53cbd1af
SHA512 f423fc9e05a5e1984333cc7785f167bf71711dfd484e8e4349c82cb31f18722f5e02e96dc1244e50b027c6a745e5d2aa20d6417d5e9e6d1d2d12c8977a86e496
SSDEEP 384:7ZZVFXh7BWmqIWIkagyDlBlRdIHlNW9fPOxFR9z+FG6d:e3agyDlpvPO59z+dd
TLSH
T12AC25381A7F88119F6F73F707EB896A21D3ABD92AD34D61D2201A40D1871B41EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es-419.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_es-419.dll
Size 29KB
SHA256 f2394f994d626dfb64cd26842ba0aa3d8cfb49b879b86ee80ac3c10e8db124df
MD5 7b285e8e9d6531dbe870bff43453e5d4
SHA1 f72668f9c5e3c16e8c6f007aa3fa61502cb1dc8b
SHA512 e35734f57767e2a7b6e1af8c77d16083d008a779070d35428de9c06bba35e8fe3065ff7b12cdb5d8eea1ea5d77b80e785206ed3199acea89558d74a251f62d03
SSDEEP 384:WEzVFXh7pWmqIWfadyUr4a/IHlNKAUyR9zV8P:oEdrHxAU+9zVc
TLSH
T1F8D2F9409BF8924AF6F73F30A9B856A65D3ABD92AC38954E1210A51D0C70F41EF74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_es.dll
Size 28KB
SHA256 304c929838ada82b8850d2ee3bf711433eb5941090069a4c316b923811be6675
MD5 eb3ffcde3f24c5b4bb43849285ed5d93
SHA1 c35193e243cafd80f8ee5132043d9d7f69d1b263
SHA512 2383a682ec1e47cb5183ff8b7d9c0152ff7209d34df8787e8921ad3e349cdb024e2bbcf8ef5d41c3356adc26da8708008640de59b89a37e99feb01aeaacd4ba6
SSDEEP 384:czIVFXh7BWmqIWTt3MjNIjIHlNQAUyR9zV8h+Hp:q5t3MjNIXAU+9zVL
TLSH
T14FD2FA409BF89246F9F73F34A9B856A25D3ABD92AC38954D2210A51D0C70F41EF78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_et.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_et.dll
Size 28KB
SHA256 bc54febd768d31bd6f6888a690f1a3cc7e21ed38356526debc1752d62368401b
MD5 49fe3ffcf0b8598e76bef6acb353e7e0
SHA1 5d1e28af809aad7ec329d03557fe47962841814c
SHA512 ab4ec00ab763f386ef7e62e7dd34031ba2a65a8bb69b6bebd531e63fb3eced7d4cd1436b3f6dab54c950d4920f736ce901b3320f85e80812d94ca94a55b8e273
SSDEEP 384:7lAIVFXh7BWmqIWQVc0dEyjELtX7giw1LmbVdMTwAiDiMIHlNQ9fPOxFR9z+FG6F:pKy5jELBgr1LwdfAwjPO59z+dfmFk
TLSH
T107D20C81A7E89119F6F77F30BDB496521E7B7E93AD70E50E2600A51C1C30781EA78B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_eu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_eu.dll
Size 28KB
SHA256 24c95afc28d40cc133245e3724610a4684b86e367efa47120a9eb379a2819481
MD5 09d1aa75e4e2f5840db3dc32ce5974da
SHA1 f2ad5d3c52f849797909ff94dca498806ce64db2
SHA512 82e1091fa700b64fd0dd2543f15b4cfbef05e151b4b33e5153e552271f4886b4ee180625edcff43fa507bfdd9dbd8ede9ded7a60c44885c44c8443bae52a04eb
SSDEEP 384:qCMVFXh7BWmqIWicLpNrX52FOX3z14OdIHlNLf5rj/R9zrY5e/:LhR0FOT14Nf5rjZ9zrn/
TLSH
T197D2408797F89158F7F76F30A9B895D61A77BDA26935C52D2200A51C0C32381EE34F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fa.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_fa.dll
Size 27KB
SHA256 e7fc1498379e8ef5659b52f7e441d623000bbe5bfae0c5810ce51b02e491788e
MD5 c5525d64fa05cda8d1c844c1699ad78c
SHA1 bed27a4eaa92775d636a6cbe3293b3d6ecb1b190
SHA512 8913d0481e5c4bfd0fc5a6b702fe006f65215db24fc76773d68d148bf35832cdd2ca06f0ce8712deff37ac37c6be613314412e4991d6d3c8dd4255106d82e1ec
SSDEEP 384:mNa8PBbBWmqIWxXlQEqt0A0Q6Gf6IHlNX9fPOxFR9z+FG6l:9sr2CxPO59z+dl
TLSH
T12DD292099DA6C430F9632B34C50BD9733535A29D7841C9361FE5A93C19813BAEF2F62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_fi.dll
Size 28KB
SHA256 170405ff3bd0632d9f4b0efaf646fd88337e1025d29bf1713c6d639036a3e572
MD5 9c341fd4420793a07a029c1d07f14aa5
SHA1 ef022be7d3057ad829a540e25f1d05a08a86afd2
SHA512 28b70d1a78df696e8392b96e2d82c224aae0f1ea61f7a4494cc1c582bda4b25948f1a75e3c5c8a93106ed29bb92e507e1529b3e43100ee355ecfb29602effe2d
SSDEEP 384:9TxVFXh7BWmqIWjJWHJWEFIxnyELZWEYXsN6ZKFl+EoOh0vFqrIHlNlER9zqW8E4:m5JOJOUjyIo9zHU5
TLSH
T16CD2008157F8C269F6F76F306EB887521A367ED36DB5D21E1B00A50C1C21781EA35B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fil.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_fil.dll
Size 29KB
SHA256 4214046bb7c700e77d9890b6521b826b98c69f37d17bc8e2612e6e29304461ea
MD5 52914cc8838afb1720eb359c8ce4d1e6
SHA1 40695deca543e8e6d1cae867be455a5622e10882
SHA512 f6a58c02b2f455342a99b4966e31f8370420f2883c69a4599808df51ff9414cf4f87aefd6ddee305afc89372b3743044b7f895c698f86d118a86a3e796e51776
SSDEEP 384:EaVFXh7BWmqIWwsXsjbjkbkzkrJqPDLiu+IHlN5W9R9zzR4Z7NF:4WsXsjboIzkrJqLLT4/9zc7NF
TLSH
T15CD2EC81A7B8811DFAFB1F307AB8A6A21B3BFD465D38D9052240951C1832391EF74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr-CA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_fr-CA.dll
Size 30KB
SHA256 b6e6a606ae3c8f9f96e6b1384d5a6647c3ce855f77303c33d9a78510805cb02c
MD5 9aa602e5d70aeb25c86bf8460b02f9c5
SHA1 dbf807607ddbfbbe2cf3c7d351d834c08b897781
SHA512 8e14d0ed92439987608a01073f41f476ae04ce121299f210870920df5fe07535b7d57407640bd1c4e9ddc9e3fd28cd88436e783e2dc7d98fcc0369959268ccb0
SSDEEP 384:lWVFXh7NWmqIWMs7otIRr0UP4IHlNIQ9fPOxFR9z+FG6QTe:3qINRrNPmcPO59z+dQa
TLSH
T1A8D2B781A7E88215F6F77F31BCB996521E3B7D968D30D51D2200A18D1C71B81EEB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_fr.dll
Size 30KB
SHA256 c1d690622c4a7eb2424dbe79cac0e40604f0b4be63bd46ded832eec180c82694
MD5 6b54ec4a70a6eebec69e33c56b6000fd
SHA1 b42f0834dfc333fd72f7727b24aa31fcf0b48579
SHA512 cb9bd48c9cb40c5cd6339a52850b44708735ebdd22cf52af6363d8d3768bbb30c6e8dd44d82f5ef9efb07b5b3803360a56ee9f10fcb05f9260e95598e5bbde65
SSDEEP 384:CaAVFXh7BWmqIWs8bW6408VIHlNdR9z7WcXQ:Pq8n4lm9zav
TLSH
T120D2A745A7F88201F6F73F31B8B996521E3B7D968D34D51D2200A58D2C71B81EEB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ga.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ga.dll
Size 28KB
SHA256 416ba3c400451340bc707175d507e245bb06b717a2753485da9477ff61b289b8
MD5 5fe7e8ec77cd0709c7d4e200a07ec052
SHA1 e732ebcbc72221bca746f26111ef8583c7afc4e2
SHA512 44a566e083fdd7fa606b0caa8ba7b7e1b9b44f7e74c26bed6337c667f0bacb56bf41725b706a3ecaa3196a0b77853db35b04edf9cb48cf30aaf860151a5f4ff8
SSDEEP 384:9ODVFXh7BWmqIWh5vCQkcYoIoAxP7GGIHlNpR9z7Wcb:vn5vTYoIoAlCH9zak
TLSH
T130D20F5403FC810AF9F72F3069B487676A36BD92AE38D21D5640A68C5C35B52DE34B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gd.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_gd.dll
Size 30KB
SHA256 a3279eac65418abde033e1809bbe232f42e420e7294e9c6e960a36e68f0b3c2a
MD5 979f8d9b0115a3c77598d22159edf381
SHA1 f775bf674c9a7cba070b8c36ba52d8cb796876f9
SHA512 760929defb61d7c5cf8fac6e61735edd5abecad15ca76504bdfde62e34dcd1e1524165dbe1208d0ec59aea6f4f1ee27868cfa54287aec4ada07219ffd55f1889
SSDEEP 384:2+0VFXh7BWmqIWQFYiA73DpfDfqKiXjR8xGIHlNLR9z7Wci:H2FYiA73Nbqfl8xJ9zaF
TLSH
T194D2EB4457EC8644F9F76F382A7587A26E37BC926D3886992300650C5D31B82EF39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gl.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_gl.dll
Size 28KB
SHA256 c9df96f44ba4257bf05ac0bf84ce162d44163e7738e6df4bfdbf2d098c1422ba
MD5 01b8510970600d4b44c6a33384c1161a
SHA1 f968aac4ab56ff784adb168928de40b91342eeaa
SHA512 a819d44d893617fba1361c55ae06d8dce205676f035e8f056f1658abb83100179308e4bd48a81fe25f7cf6fc1b1956a58b54d572088f324d39a37fbcd7e59661
SSDEEP 384:YMTDVFXh7BWmqIWisCCp2RK+oOIHlNDW9R9zzRF:KEse8+ou/9zz
TLSH
T158D2FA405BF89246F5F77F34A9B896A65D3BBE92AC38850D2210A5090C71F41EF78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_gu.dll
Size 28KB
SHA256 2e639a1bf0295490d51278b2900ba839c9fe4c6a598deeab735d7a1d95704a43
MD5 a53e82122576c9863498bb9792446b1f
SHA1 05ef735f5cfec9e8a5e4792622a117c1dbf7c868
SHA512 d7b03fe71e62705bba7e1c5e4b772b7450788736847e64bef1755281c6fa2cab9e8bd05f7ac3a7d719c351c8def8a727ee1a63e900d30a6d3a44707dac46c9c5
SSDEEP 384:lYwjVFXh7BWmqIWMt7vdQrsojGtCAPPFZCxT3CT6xytiIHlNrbU9xDE3R9zKCdU:5OSCrng/ULi9zzdU
TLSH
T1F2D273662BB781CFD06E683482F9E973B7395191D520E1077165A3833DE3382BB2A75C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_hi.dll
Size 28KB
SHA256 dae440e5712348e850b889025e08950730a03c63978775e4bad522483009d388
MD5 6ab4c6ccfdbe6731095b25d348161193
SHA1 6b4d1c63e026b906f3ce7a65549f9c39d6f1fc2c
SHA512 da9a23e9c5e5f03714ebf613b64c218eda8de2b8f14ca30eda533721d7aee73447915f2f0d6b2a2577c898bdec9ce2fd30082bba1b9febf8e8c15d37d45dafec
SSDEEP 384:gowVFXh7BWmqIWBQcqYmmqkKMIHlN142QR9zkF+gS:T/QcqYmmqkj2s9zM+gS
TLSH
T136D2930204808F18E05C6D78E43987F76CFB7465B9CD13C2AAC171F8DCCA37B9A69A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_hr.dll
Size 29KB
SHA256 e80c7b074e81d6d43ebd7694a0de09845ec608a6b82aa9b603e9d4c28a40b13c
MD5 8b717e854f33d4d9f9a7d8cfb20512b2
SHA1 d71bda95644fb11af8d69e95cf9c712aca20f9ae
SHA512 df0b894fa357134515d6eaa7b28e92f6ff38e418776ab4c5d23434e183f38f9e4e73183e9e5bb09b8fe5987ffe3d25926b992e2bbf066d7e10a077c7d99b4aa0
SSDEEP 384:/jlVFXh7BWmqIWy/fbmrsCCa9gNk8qaEa/cIHlNLPW9R9zzRgUu6:wezqJva/5u/9z6Uu6
TLSH
T163D20D41A7F85159F5FB3F30A5B557620E3FBDA2AE34910E2240A18D0932781EBB4B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_hu.dll
Size 29KB
SHA256 6812bd352575f9fb584d4e8aeef633f362572d463a6f62f984d5a93ac4bd2f71
MD5 49e696d81044fbb747287f456c22210f
SHA1 a2bc5e54db347b89225537ffa669a21ce55dd3ee
SHA512 bdf95c4ee1db43b8e0870e6bd3883657ad0d170f31e2d80a50cb2847834316cce2f214fd250f6f497fe06a04cb1128ca4f92627a88074d6c3ccff66e4e00d0c8
SSDEEP 768:YwKkZ2hSV6S8yotbufJHw1bNJlP3rr9zOhMeP:YwKkZh38yvRHQb5BzhE
TLSH
T1BAD2208192FC4146F5F75F323DB487961E39BA65AE3CD21E6280A28C1D35B81EF34B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_id.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_id.dll
Size 28KB
SHA256 c96f98ab2132ab0b0694388fb72a5413ee26cc05f301e4c0bfdc578b26a84e9a
MD5 177728ccfff39f8db194f5e6d23b73c1
SHA1 651a3edcad62e04a592beca7fb830ad945bb56a4
SHA512 4d02cd76df84d2a33c3424fbf814350e93312b9d906661c0f034120b59feb2109a926c32d46960f632c5f873d92d5dded934ac30fd79a6d416fb9a7810f5a650
SSDEEP 384:uyFLVFXh7BWmqIWGPC8kJZT9r6T1fQC6IHlNMGER9zqWBF8lQ:Mw7no9zZd
TLSH
T14ED2DB4197E88159FAFB1F306AB896921E6BFD93AD30A65D2300B91C1C717C1EE34B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_is.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_is.dll
Size 28KB
SHA256 8417f827d05253ed850d9fec070619fb2e522d34d4d4dca20aae5752effed21b
MD5 8dc7701b7e0971f389c5c56f73fbbbaf
SHA1 0db7adfc33d208fe825ac90b4f836a832516ef75
SHA512 71f57c60ad6eabcb14594017ce54d4e4cb1e52f83616758b0137050e68f471543f65264979809bd4a358471768131677252bb97613241365d9f07fc5b83b4e0a
SSDEEP 768:tFBkg5TpAhr+8wp0xoYpGYrPz2s9zM+fg:tFBkg5TpAhr+8wp0xoYp7rakzdI
TLSH
T158D20E84A3EC4109FAF75F3058F596561E3BFE979C34E60D2641A94C08363C2EA78B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_it.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_it.dll
Size 30KB
SHA256 b145d46ee1ecdc5659c6c5fb71529b44761271ae3cfb252cd9906286b41fa8b7
MD5 d35b1fabfadf928edd9cca952fb802b3
SHA1 bcf1a5323192235574fda47132f776c2ef8f1cad
SHA512 449e45a73de47a4bd35102eecb4649d586129c45581fd0aedeb0cbcc37c41be75fd1b81f6611d739500bdb73609c8f688ef120a3027d77cab73463c60ecc6d4f
SSDEEP 384:yOkVFXh7BWmqIWtuu1+JswzvIHlN1kDU9xDE3R9zKCm2:nV1+JTzlULi9zzm2
TLSH
T1C1D2FC5167F85218F6F77F30A9389AA60D3BBE82AD34D51E1241945C0831B61EEB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_iw.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_iw.dll
Size 25KB
SHA256 c94680e9ab1d9d28bab35e0a98d20e0b8eaa5d99075d6b30592d233623ff08eb
MD5 5bf53b5cb95dfcc5b66e0f29cbce845b
SHA1 e96cdaa62a60b771af4f5e69e84d191213c5bbff
SHA512 587d46034ebfafc14e12903d7aefef4ce8c10b60d7a9e3ebaf6958c1f002e86bb2d6803a5806e5b8996d354b4656e0ce4b9ba215167d27457d851fbf90e73151
SSDEEP 384:nMnPBbBWmqIWqbW1x4SCJ54LGA/ExQNIHlNjPU9xDE3R9zKC4:nicCTJULi9zz4
TLSH
T107C283415B60C1D9F965EF33826F8A2F6A35EB00163872177018A9A42D6E7D2DF2D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ja.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ja.dll
Size 24KB
SHA256 b96139cbfab121cec81474149743966aa152d30de63d69b1819afe287e1d038d
MD5 3575d75b828dc9cabcbc008c22773721
SHA1 a53dd599706d8295f824466d6357e2e59a1228ae
SHA512 edf3a1a2398aa6bcef4980b4b3c2dcfacc173e895d1b312600e35f5856798312ca57490f765f9434e5a91524d6cc951b913be88b524ecff9892dc7c228bae48c
SSDEEP 384:a+6VFXh7BWmqIWq9gu2/2x4oIHlNLriSR9zYxem:N8fArr9zOem
TLSH
T1D0B2F7896A64CD4FF8F65AB001B0EAA63E7DF6614AD148522241F40E18507C7EF3BB3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ka.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ka.dll
Size 29KB
SHA256 678cf15f1d8268ee2e41924c099156d03ebbc47420ffecd86c73188a635a39fb
MD5 8fbef2d74a7058068584a4f53119d02d
SHA1 3111a6757940629e770c50c4a7b2db81304e665d
SHA512 b102b3a774919ea69559bd3eb151642e1c03c0a16d51246c3b7c60368ed9872616319402ef4cd400ae161327a4459df01b326e6a3a3d21017cff3d7a05bf5956
SSDEEP 384:HsvVFXh7BWmqIWkodoA7s4THmES4c9OkrIHlNB9fPOxFR9z+FG65E:Dbc4PO59z+d5E
TLSH
T1E4D23F0247938822E59D6A7069BCCFCE753DABC12550551BB390BE88A911BC3DB7F336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kk.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_kk.dll
Size 28KB
SHA256 c56a9d21facaf76136f085e3e42476c08bced228ca83c5e201c3f0c0b04ec2d7
MD5 a9b7373a6ea958dada079ab91624db4f
SHA1 346d95c8ea1f95670e3e10d0693b8ac319eb639c
SHA512 b1a7fcc28b7cedff1bc7853a9262aa7dc50eb745fb3ce777747be4a0f911629c31fa9da8c0b23d215bc3ff1a5b1c6919f3ec7a9c0c89075fef5b943e0f8eb801
SSDEEP 384:QCuVFXh7BWmqIWn9MvPQwdIHlNs1AUyR9zV8r:H5WvPQwt1AU+9zVk
TLSH
T19AD2944F6930E601E4A4FAB04AA18AC315BAF3542B5846F7BD5F75182864B33FF35AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_km.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_km.dll
Size 27KB
SHA256 7cb2018f127688e94307d686d3b111259e035575d6b5abf0b0b472f87f728e37
MD5 c543dbe1cfe39e0e761194ca0f7a9b86
SHA1 376ec60c56f2baf3d5002aad019668c254316e86
SHA512 5fe601c0b45e4b37073225142e92d7209904ef9d040a59b84f676ec5d0883b23829149c85e1ac846ee9f29e5b187d2168a23c7a66d1c5cfd79bd7882194ad3e0
SSDEEP 384:f0VVFXh7BWmqIWbfJoxeUnPcS7cePBpxCNpJPIHlN+b4J9fPOxFR9z+FG6rz:tYxdPX1PBpo/JZ4/PO59z+dn
TLSH
T11AC263D41170C0BADD23D534C1B5ABBA3A36B1DB9A396D072211B8550A327C6FFA5BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_kn.dll
Size 29KB
SHA256 d0e246a7f0fe98899d7591b7dbd6359afde6de44c9f7ccc93d7d090c67a5014d
MD5 859c1823ede52dbb695ee638ed377eb3
SHA1 737709f54690d6cbb009222adea431be9e61bae2
SHA512 94af159bd28906ed9343aaa7d220e47dc681b3feec0847ede16bdbb2d2667e7bde938ce9ed50742c265f9d12c349bf18387298503b62169864bfa0cb674b18be
SSDEEP 384:rrvVFXh7BWmqIWPQd4SyQRPbw2IHlNM+W9R9zzR/GqF:qdQ65wR/9zNB
TLSH
T105D2718AC3B7C415D4C53EFF016769FEE520BA8744E116D23206904C5692BF9AF35BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ko.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ko.dll
Size 23KB
SHA256 69e94a74711f0a71b26a03f88314cf9d8b6d330aadc964fb4944a4f3ce7de7a4
MD5 2dce9d5f375a9bd7403206a471f676a8
SHA1 5c607a3043e5126f8cbb062a47b4db3a341722b4
SHA512 073f1d1a82b9fd22815e2899ff3fbe34d6eb39aa6aa056bf8797d181080b1bb2c7d596fce4380c46470eb4a51eb091bf35de5110161ac8df4fb751bb775b793a
SSDEEP 384:7tLCVFXh7BWmqIWLlte7yWYDeYhHNjLUtUB1SGGgrxYQ8lJDuhIHlN8xU9xDE3RM:ZRJM+OkFz/xULi9zzKB
TLSH
T1C8B2F85692B8C042E8A1BE320AE5CFE7763E62815E138457B740F15C2C563D2EF3979D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kok.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_kok.dll
Size 28KB
SHA256 14d0a1e7130fec56f3f7e05226263ab192cee86f8c13645c19d1d7c5f1a90cc0
MD5 964ae077af6b86f25dcb786768df6468
SHA1 de907e87d778558e8fc96633c02d38641fec11fd
SHA512 fcc63ed38da5fb8657d4249f0f6a1f4d6175015fe1b211ffb7ea288451113624e356a9a044eb3e360b0988558fe6f90162d1eac83d4471d43de42b2a09075e2e
SSDEEP 384:rEn1VFXh7BWmqIWoRr+hjZ+hjgOjWfoHIHlNEDriSR9zYx02T2:okhMKwFDrr9zO0Y2
TLSH
T1E2D2974251808724F67CBDB8E0784AB35DFD2114F6CC13863AC872E9D8C637FA65D6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lb.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_lb.dll
Size 30KB
SHA256 c32f2e640084f33669181169af92b2e39bee986e3f205e0b74ee93f89a884655
MD5 13f8c45d55e2d1683aeee300aacc1efc
SHA1 990baca0205541ab5b8a42d59eacc0e6cdc19717
SHA512 99caf0abed211cf11dd82a4b96cfb0b98cde448e0cd0ec92f16d9590ac3c11e1077e2adacf2aed5edfc3ed05343338f37a66a3ffdae90a49bf365d291ca551d6
SSDEEP 384:G10VFXh7BWmqIWpse3swt/bmTRigvyO0IHlNgAUyR9zV8e:27s4sSuAyKAU+9zVp
TLSH
T161D21E4167F88129F2F32F307D7596A22E77BD86AD34DA5E2240625C1C31B41EE78B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lo.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_lo.dll
Size 27KB
SHA256 2b3dd8dfb7f0e53b769bff330400034d314138318fe086358776de83df1430d6
MD5 19cf56054914b924d1ba98715b1233ee
SHA1 4a3e9a85829cf23ca645fd88bed68d3e4053cbc8
SHA512 dddb15588ff9a163328a68f0713b9b8c13b1690d91b234601957997201885dcbff93ed961d9c3ee99cae14498cba610ee4a56e8c970060ecb9d3adfc81e5e98c
SSDEEP 768:XgADgApU01duiHkJwbMQpxZZPUpprjZ9zr+h:X7D7pU010iHkJwbMQpxZZPu1zrQ
TLSH
T1E6C295FC92E0C01BE5EDA7F0D45DAAF57DB62604070345676744A838AB633C2EF78645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lt.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_lt.dll
Size 28KB
SHA256 94148e64f7249f9f82164ee09c5e4f33f5336ceb62e834798d741874cb0033c8
MD5 9b8884c7c6e2d971a63436ae832dbd7c
SHA1 f4430bd8ad5b2645077426dcffd4ca7d8db77dca
SHA512 7ae4c231c86e8839a38031a6275ba60781d2f55a397a4819f8329fd60408e88b29265bdf2eca2a88ae85527e72620cd0be5a2e6d7b325fb748b19bf5511f171f
SSDEEP 384:b2wnuVFXh7BWmqIWyrVs2BZJ1f+jmU55z6B60Kmr6YDfIHlNmzrj/R9zrY5/x:TZIrB31f+jmUnz6B60NDNrjZ9zrkx
TLSH
T127D2205593FC4149F2F76E3096F89A571B3BBA566E34C20F2100A18D5831BC2EB7872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lv.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_lv.dll
Size 28KB
SHA256 7790b39730e5d1952edc624a6763a092c9d2fb98b2dca4f6ec386c31a2b66181
MD5 be21b54e7bf1ad2e636a3efa5f0c2dba
SHA1 291ed5df633f339b559bbe99684c50d2525cd2b4
SHA512 48a0d11ed094743cb9014ecfb3dbff43bd7369a059575a5a064ae3a8fb0eab0701de2281b1805763e90b8f790791e29ae0f51e5d9c88acba1160358422f31b31
SSDEEP 384:mPNVFXh7BWmqIWeYppSepDyvK5x/mIKIHlN2T2QR9zkF+Nqy:3x62s9zM+NN
TLSH
T187D2418597EC4259F2F31F3069B48B562E3BBD926E34D10F2100E55D1972B81EFB4B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_mi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_mi.dll
Size 28KB
SHA256 98d92635335623495af4e6da2b87616911f42cdd19465ef53dd7ebda37fde9fb
MD5 4294ff5ef69743469d4930b38c66fb08
SHA1 adc629b4fa246825fc7f2853485c9c24c92f19be
SHA512 788079bfcf44b6c8ebcb5974d2c887c4fea511fdb66bad05a42bbaaa5c420be903af811e4ffdbe8de6fe02e0f6405e19c849d4e7b95f346fd911c32a8bb40538
SSDEEP 384:fYSVFXh7BWmqIWqHDPvhHXBRDEWUDrF1/rzLOWsMVbwwH9hlnyxNCzIHlNwrj/R6:IaRp/srjZ9zrM
TLSH
T1FED20A4256ED4246FAF73F3042B497562E3BBE23E93CE74F2500A56E15323C29E24726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_mk.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_mk.dll
Size 29KB
SHA256 28159a1a233a569d5afde5c18f848da467190da4178d81c5a11f8f66c4c5c880
MD5 104960031e316b083d54ddb18fe11100
SHA1 d5c89f7e55f6e7bd58b68b01ff3e9dc605a30b4d
SHA512 edbe79b7ff3ecc64f17ce048536cb3569f4357497b572cca21f26b20f43d0bc206ad76a7f55b45c904976f605570b6de20c085d29bb4a175dccdfface05cd60f
SSDEEP 384:YbDVFXh7BWmqIWGHbnGAYeBCEdpEXeR5qcIHlNbgER9zqWxIXymse:/0LjgUp0ILo9z7o
TLSH
T102D2104FB9BC9204F691E6310FA5C7E635B9771067244686624FBC68302D732B72D6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ml.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU163D.tmp\msedgeupdateres_ml.dll
Size 30KB
SHA256 7532ae54fb566abde611c3d915f54b7d140389ce6d88e277821544bb7b5f7be5
MD5 d0a91170ebe27d820af701f83ff814e5
SHA1 4b03a965f73e69ea8638c60e7728f5f790df243b
SHA512 7c9031ce55a92001516bec5baad679e438af4779960a3ba47246ea56d20be85731fdb1ba15f42cc46c0e87b19e22f705e09b823e406399c3eec45a7e9dd87afc
SSDEEP 384:JhUVFXh7BWmqIWlh3l/cdGKXpVcGOR/uLZpIqCX841SGCIHlN1U9xDE3R9zKCWds:Lkd+1BULi9zzufE
TLSH
T10AE261676550FA53FFDC14B40E4ACA57E6ECAB0EC9582669192061F23D9E3036F2C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 138KB
SHA256 84e61e5379b6e525878198682b149f557ed199a6a0b277e2504f330c1aca6962
MD5 38a8126f10261c4ac87120d6ab7a2afc
SHA1 7f26004f93e294694aa8f422100621b91167c197
SHA512 fdcbdcf9413b8a710fd9edc9b480e523c1238f31cfbae1d487e005d47c7575681e69ef8c04e6a3512ead1dd66252dbf5399f47e02e5554bc6c8d8600486450d2
SSDEEP 3072:FZGKWkJ8siBxyPuIMpitGZidbBcfHFoGQM8oy8+:dJQyPGidbBcPFo7oyh
TLSH
T1E8D318663BF90669BDF78A16EDF6DC66797BBA562C29C40C1091128E0C32F01DD7072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rvhhfilp.xq5.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvhhfilp.xq5.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeWebview2Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\supQ_Prerequisites\MicrosoftEdgeWebview2Setup.exe
Size 1.8MB
SHA256 00c6e5a7413c37753bb92e176539dbf691a101846a622e00a9faec3f23e2816b
MD5 efb192170a79be23ed2d5939fee545b5
SHA1 eac27d80d12c51233d388c83e2076241e7a99456
SHA512 7e2822eaf1585039959b7f2b9d3cfc5c8122ea6ce0470acba9712ef426966d16366c06c35812b4f27459dd6a3968f665a78377cb5e4448a338262a0449035179
SSDEEP 49152:riGF3GTlZlKgXGXBgfoyTYC5RrvMM2G1t+So3PlK:rihTblK1XBgfoyTJlP63NK
TLSH
T15B95222137D04035E1B31A3155F68AB25E7EBE314F6959DF23412A1D0D30AE2EA76B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Injector.exe

Path C:\Users\Admin\AppData\Local\supQ\Injector.exe
Size 1.0MB
SHA256 2be53c74933adbd10b7567f490d93a30014e04ae3b1a3757f3dc9e4c88dd25ee
MD5 1c592899e3194b84ddf08fc8f438e603
SHA1 e60b3cb60fc0e6ea37c797b1360c6927286e3a5c
SHA512 84a0a9fcf5bd94d68c6edb1c774c73c94d5081af2ef280b7a56c9f947fdf2302a5b3ce78efeb691fc901d8223cf7ccc248f96f1d5c5d11eadd2c369a7deea90d
SSDEEP 24576:lMBOtakNRd1da++BArKDlpWcybXk5nke6:luu5dXa74Yby2nke
TLSH
T12F35F003BB068EC5CD4693726E3257947694CC1A1BB19F1016153B69BC833F8CEA6EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Users\Admin\AppData\Local\supQ\bin\RobloxPlayerBeta.dll
Size 27.2MB
SHA256 fb72c3aab9cc01b5b4d49019f8ecf515cc7794bbd534de2b3bef8bc2945f795c
MD5 e82d408235ba45141ca22695875801e4
SHA1 159aa6d69309d9d1a0355ea6783827309ec413c8
SHA512 1977b0e2dd5ec8ff130670e44f73377faade9a61bc6eea423fb803a761b967bd0196f1d434c048fc74a9f164b1d3f32d6c455b16cb88a5fbff002955b64aaf41
SSDEEP 393216:brhVSq/6s1wCyYx2RbEKyk0VZOirT/QuzWGh3EwX3h1QVuvai9W0DB291FGzTZvR:/iNYF8uHkQ3/9V7Qk95DBQ1wv5
TLSH
T1B15733CBB9970D55CCF2C87C496741270FF5B78E82C5D020A597E2269CAFB104EB972A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\supQ\runtimes\win-x64\native\WebView2Loader.dll
Size 160KB
SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
MD5 cce1332e0af440bc54fdf04eb543d4a0
SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
TLSH
T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DexC.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\DexC.lua
Size 91B
SHA256 bb6943ad0c93a58cf8c7925e7b518b6f0748aab49e026d2672ef8526a5804304
MD5 ab1f96db7b271d5888fc2bfb0abce8c2
SHA1 62016d251b7c4adda96e2ab5a96b617504869ab3
SHA512 092e357063f1c02a6fcd7d440c699acec58d767f3dca991f687f07ce1b7f7e953fc32e86df29412414826af420d94883d24cc8254791220546003b724a0d9041
TLSH
T1C7B012DFA401462D073184C1A60DA09DD921C00CD820C163D1E58414C6508275131D15
MD5 SHA1 SHA512 TLSH

Submit Download

Eclipse Hub.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\Eclipse Hub.lua
Size 304B
SHA256 9e646aa1834dd6307fda1b299d43bb90a72116d346e6145a7c256574f4c3570a
MD5 51e5425ccc11304aeba8957ae423a0da
SHA1 06f4b6071f96da77de6473bbaa84a52c138719a4
SHA512 60106ea76c797cfa37ec621c295b0957742307d3d6a96249a8586ad01bf4860e96329d6888d3602591ecbf37e21d2fd7baee43d5887068773104e6a15d2973a6
TLSH
T132E07DCBC6962681E40000585EE82955E3D1F01031225C74B4F506CB476556C18BC34D
MD5 SHA1 SHA512 TLSH

Submit Download

Infinite Yield.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\Infinite Yield.lua
Size 98B
SHA256 0d4c6ca6f3d473c9fe81f3952ddd76796b5cc8def107219a5b6dd9de4618744c
MD5 e0246b17ddf86c45719e881d09987d64
SHA1 797d7322d3b11d9065f6ddea181d63e1e82dbac8
SHA512 ed989e87e89c2fd17f98a855fdc63f70d4a275c9c8e566b7f547b484b185c3f40f9a94fd1d314ff9c8f70f6f4223106bcfeda12a53676e9e98e62351872d9f7b
TLSH
T197B012BFD411926E0F3254C8481230D8CA30D42CCAB2C0E6D2FD4468917350BE030915
MD5 SHA1 SHA512 TLSH

Submit Download

Myriad Validity Test.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\Myriad Validity Test.lua
Size 108B
SHA256 90c81aab0562bc4b7948a66a516c4f849a3bbb20de783bd2bbc04a661a8b1f52
MD5 3c6a6433beeeee1924bb16a220cd30ce
SHA1 ae68df6cb4f83688c765bda937cb279a0a19d290
SHA512 f3c581464d922c4be5fb1ee7751e4981cf9b70955c592e1b44b2b0ca4c50fe1ad9c538d8a0ae98d76cf40067b79344861ca199e6a5ff7f2775f5ea221826f7a8
TLSH
T165B0127FE715A25C5E36BB81CC8F115CFF12914DAC11C5AE413F12B6D512074B1A668A
MD5 SHA1 SHA512 TLSH

Submit Download

UNCCheckEnv.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\UNCCheckEnv.lua
Size 28KB
SHA256 e8d53406c916b8e827c65c8f00d8a18b1379e693fd0379e8116e749bdf860cf5
MD5 b76726d10354343d9af5c268e40b47c4
SHA1 7103c78071be0c65c8b3a217168cf7909aef748e
SHA512 5caffd8a06058e890fe4ae35430539281cf53fa791221189f0f6660778a83fa42cc3e5374ce06ff325420d92006c2bfe1003f1486714e889964075da66b046eb
SSDEEP 768:JopEYRzOKMrGrE7BWf9r+T+f9TkIuP4hUUsbU8FqQFBF5UXzRFEe3cSG5Sg/i5rx:JEKcZuy9p
TLSH
T150D2866EF583B5A202F130F0F53FD009B676CD70A2395559B1DD50E46A289AC8893EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sUNC.lua

Path C:\Users\Admin\AppData\Local\supQ\scripts\sUNC.lua
Size 187B
SHA256 ec68e566df3d569e343991049ca95c4fb510c33abf9bce8c3b99bf0dd2cc2afd
MD5 c5931bf51cd50128a5f4f1abeec63bac
SHA1 6beabce147aa46cbe0a460db67a5d225105125ef
SHA512 d425ae2b25d499e068ccdfe7ca977a5fbb15e4cc7945978cde829427651b0be4d1f7a810e04c72ca4b623af50420b6c1727127a4dccc2f8b0f2334dd5b03809e
TLSH
T1D2C01269C84B8A7C52331490C44F3066EB16866A34BE1423B0FE40004E710A52416E1E
MD5 SHA1 SHA512 TLSH

Submit Download

saveinstance.luau

Path C:\Users\Admin\AppData\Local\supQ\scripts\saveinstance.luau
Size 1KB
SHA256 140d6b7154137e9861aeb5819f80924f033ddbcee2c497f69432820240b4a75b
MD5 b1c6f927476b86085f41a2847acf70ff
SHA1 179f4242c3f84466b31073ef732de5d819743f54
SHA512 0b3ab9eae5145864e8e2502175d9cd56c9cbf19b0c35e141428c5908388b590eda16236139ae90e8be4c180ef2955f07a13c82ec44cb9caaf649c3857f5d5fea
TLSH
T14F41628B12172CF80D7500A4A54FB48AFA3DA19812395620B0FC3C897BB13AD71E72CE
MD5 SHA1 SHA512 TLSH

Submit Download

supQ-Module.dll

Path C:\Users\Admin\AppData\Local\supQ\supQ-Module.dll
Size 4.3MB
SHA256 6bac6b072c8e056478eea8435814202c08578d243bed1cc43ed9aafef1ceca9d
MD5 ee4e5c7108f1642d4f7c8634c2385f4b
SHA1 058ff32739b1768be40ceb8509fa4cba58556728
SHA512 3ea4841625f1872278ec21f749b51b8817c6a1a6815aaadbe25c89aa87c46e7d4e67569a5004df58732aa8cf3add33ece41f37dbf9ca2125228df219b2feb9dd
SSDEEP 98304:Dd5rqfl1WZJUHMqe1MD3QaxVOMb7mBj09WUO9b98:DHCluJUbND33VfbX
TLSH
T13E26121BFB47899BC723813C85630B2647A5DC258673434B3389B60EEDA679ACFD5381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

supQ.exe

Path C:\Users\Admin\AppData\Local\supQ\supQ.exe
Size 20.5MB
SHA256 d625fc367aef9cf146c028161f9d59d1950aff964627ee334527d61ac5ddae3d
MD5 a155fb6d996935f7992b6d9ecd0d40e3
SHA1 90ba4b0d9dd0de80b2ba84800fedab2e1fe01d66
SHA512 726fb0acbc7bdfd9d4a84c511a350b5b385d6303c3699e4384259aeb490b266be0df150ecf69c513666777db8ed8d998b8669f1ea10411ad18c103aa9fa87c45
SSDEEP 196608:y3RWEISKq4FDsOb9xqSNTKArx0+P/ubAUdMwJ2Z+oz2JOxq:y3Y3FDRtTfx0+3ubAUiwJQNI
TLSH
T1EB27AE30FBEC4E29D2EE7732956101B617B2E85A2776D74A210CE9FA1D237414E813E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

supQDecompiler.exe

Path C:\Users\Admin\AppData\Local\supQ\supQDecompiler.exe
Size 8.4MB
SHA256 3bad6d7fdbb252f062ad441229edb25633b49b7822640c9200da76877fbb0a26
MD5 c3e9f5a79949c6d4d092bc678864c1bc
SHA1 10e60bdc11883f50c83a39741e56db22eb2a0479
SHA512 8d2f2578b35c9a14e7aa0468f5183d71628344fe9eb9eb7f52e0e815aa34db7eb56d0a6a8c12891cd3b796e9b304c984fb98cd648a6ef9dc51d0cf0938cb84a6
SSDEEP 98304:Cavpj4LEHfmIlriizasffdx3Z4kLlMDLcfmx3AbC0nK5NXBPT+wO:CaOLyjrzjlD/20wByw
TLSH
T14E963A157A5BA8ACD15ACC3083478A63592134DB1B36BCFF40D886352FAEFB05B2D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2664-437-0x0000019C5A510000-0x0000019C5A51A000-memory.dmp

Download

memory/2664-432-0x0000019C41FF0000-0x0000019C42012000-memory.dmp

Download

memory/2664-435-0x0000019C5A4F0000-0x0000019C5A50E000-memory.dmp

Download

memory/2664-436-0x0000019C5A7B0000-0x0000019C5A862000-memory.dmp

Download

memory/2896-337-0x00000000746A0000-0x0000000074920000-memory.dmp

Download

memory/2896-311-0x00000000004C0000-0x00000000004F5000-memory.dmp

Download

memory/2896-361-0x00000000004C0000-0x00000000004F5000-memory.dmp

Download

memory/2896-312-0x00000000746A0000-0x0000000074920000-memory.dmp

Download

memory/5340-4-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-7-0x00000268D5F90000-0x00000268D5F98000-memory.dmp

Download

memory/5340-1-0x00000268B6A60000-0x00000268B6B20000-memory.dmp

Download

memory/5340-365-0x00000268D7F70000-0x00000268D7F82000-memory.dmp

Download

memory/5340-362-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-310-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-132-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-2-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-3-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-0-0x00007FFFBC87F000-0x00007FFFBC880000-memory.dmp

Download

memory/5340-5-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-366-0x00000268D7FD0000-0x00000268D800C000-memory.dmp

Download

memory/5340-9-0x00000268D5FE0000-0x00000268D5FEE000-memory.dmp

Download

memory/5340-8-0x00000268D6010000-0x00000268D604E000-memory.dmp

Download

memory/5340-6-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-425-0x00000268D80F0000-0x00000268D8166000-memory.dmp

Download

memory/5340-426-0x00000268D7FB0000-0x00000268D7FCE000-memory.dmp

Download

memory/5340-10-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-11-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-12-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-22-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-266-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download

memory/5340-444-0x00007FFFBC6F0000-0x00007FFFBD094000-memory.dmp

Download