hxxps://www[.]cpuid[.]com/

Analysis

max time kernel
299s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.cpuid.com/

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cpu-z_2.09-en.tmp

Executes dropped EXE 4 IoCs

pid	Process
5236	cpu-z_2.09-en.exe
1516	cpu-z_2.09-en.tmp
5968	_setup64.tmp
5976	cpuz.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cpuz.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\CPUID\CPU-Z\cpuz.ini	cpuz.exe
File created	C:\Program Files\CPUID\CPU-Z\unins000.dat	cpu-z_2.09-en.tmp
File created	C:\Program Files\CPUID\CPU-Z\is-97THD.tmp	cpu-z_2.09-en.tmp
File created	C:\Program Files\CPUID\CPU-Z\is-TJ31H.tmp	cpu-z_2.09-en.tmp
File created	C:\Program Files\CPUID\CPU-Z\is-AQHDC.tmp	cpu-z_2.09-en.tmp
File created	C:\Program Files\CPUID\CPU-Z\is-BPV33.tmp	cpu-z_2.09-en.tmp
File opened for modification	C:\Program Files\CPUID\CPU-Z\cpuz.exe	cpu-z_2.09-en.tmp
File created	C:\Program Files\CPUID\CPU-Z\is-3JG49.tmp	cpu-z_2.09-en.tmp
File created	C:\Program Files\CPUID\CPU-Z\unins000.msg	cpu-z_2.09-en.tmp
File opened for modification	C:\Program Files\CPUID\CPU-Z\unins000.dat	cpu-z_2.09-en.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	cpuz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	cpuz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cpu-z_2.09-en.tmp

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 421727.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
4388	msedge.exe
4388	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
2696	taskmgr.exe
2696	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	taskmgr.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5756	taskmgr.exe
Token: SeSystemProfilePrivilege	5756	taskmgr.exe
Token: SeCreateGlobalPrivilege	5756	taskmgr.exe
Token: 33	5756	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5756	taskmgr.exe
Token: SeDebugPrivilege	2696	taskmgr.exe
Token: SeSystemProfilePrivilege	2696	taskmgr.exe
Token: SeCreateGlobalPrivilege	2696	taskmgr.exe
Token: SeLoadDriverPrivilege	5976	cpuz.exe
Token: SeLoadDriverPrivilege	5976	cpuz.exe
Token: 33	2696	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2696	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe
5756	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5976	cpuz.exe
5976	cpuz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2724	4388	msedge.exe	83
PID 4388 wrote to memory of 2724	4388	msedge.exe	83
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 5056	4388	msedge.exe	84
PID 4388 wrote to memory of 2988	4388	msedge.exe	85
PID 4388 wrote to memory of 2988	4388	msedge.exe	85
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86
PID 4388 wrote to memory of 1840	4388	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cpuid.com/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff8c0ef46f8,0x7ff8c0ef4708,0x7ff8c0ef4718
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6872 /prefetch:2
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:432
- C:\Users\Admin\Downloads\cpu-z_2.09-en.exe
  "C:\Users\Admin\Downloads\cpu-z_2.09-en.exe"
  2⤵
  - Executes dropped EXE
  PID:5236
- - C:\Users\Admin\AppData\Local\Temp\is-L62RD.tmp\cpu-z_2.09-en.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-L62RD.tmp\cpu-z_2.09-en.tmp" /SL5="$901F4,1966792,58368,C:\Users\Admin\Downloads\cpu-z_2.09-en.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\is-U0MDL.tmp\_isetup\_setup64.tmp
      helper 105 0x458
      4⤵
      Executes dropped EXE
      PID:5968
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\CPUID\CPU-Z\cpuz_readme.txt
      4⤵
      PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14137958826116219215,9848366914139362905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5756

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Program Files\CPUID\CPU-Z\cpuz.exe
"C:\Program Files\CPUID\CPU-Z\cpuz.exe"
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\CPUID\CPU-Z\cpuz.exe

Filesize
4.6MB

MD5
28d0f05b4aa1c04d1d20687287696876

SHA1
b0c3ccfdca6a2be57386a39fbe0627c03bf2fef1

SHA256
07ee15632c25d9519f0e045a091f67c79e432ee01f07f2c0064d0b739840cfc8

SHA512
9d5f1f2e997a338fd7de8fb556a43004b287d101d07cea501bb18d7def392d2026e3af4c52ee14415420217c549b02bf08eda9cfa4d6f5eade9c03f9a9d3b0e8

Download Submit
C:\Program Files\CPUID\CPU-Z\cpuz.ini

Filesize
610B

MD5
ade3fdb9c3f674c9d13bd7960066c0f4

SHA1
a09c458d48626dfe523924c7590394ea42dddb51

SHA256
dc021bffc5774a018a91164a9ce88da4c1745b4e3590d28651469c5f86f2ffeb

SHA512
5852209caa72dccdb6aedc11aaa518663163d328ca79d94f079768021132f06476d513d82e9c00549d0c647d3796621954ed50e2e0c79bec74603dac1e6fe8b9

Download Submit
C:\Program Files\CPUID\CPU-Z\cpuz_readme.txt

Filesize
36KB

MD5
4822336a7c15f6548d9adf08f87eabd7

SHA1
dab842c033067e05589ea9b4a77b561266d8ad26

SHA256
333939bd029a3325e4377fc6f33c57bd43647356b84d479732a493f5c1eaa8bf

SHA512
78b787f24c91bfffcfabf9a7f0cbb56ce626b5eabaad35ad809163271873acf8b87705e0e77c9adadf652cea735f3cd9e9b49a6d38c10d92b14937249e2e7e78

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
69KB

MD5
87e793f495c98be82c521595ba309438

SHA1
632b0f23168106635bc7cf268bb7cab3e4a82cb6

SHA256
27efee87b8069d5409fde429cd83533cc497ff22939d8dbb012b5ff5a5d3a52a

SHA512
c2845f47552f23a5049f98bfde39471ab8fdcc27990f8992f39e16b105bae5be5888717f0262263471e2bb9759b0f709c6fe8eb5adb95e28162ab0410fa3d119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
88KB

MD5
b15fb028a42ecf69f84fc9130d08dc27

SHA1
037edf4098374a27bc14a22987cdab0609cb3c0c

SHA256
1cab11bd593586c13a707f2fe5d930f72993c2662d6e87142a268e9e0edca6e4

SHA512
c2000d4dbeef6e01ede7f11477202652d9b13d56b35e1aed4a73b5a1a0f1f70c019e0d449bb87ecae21a90ed5def7193206db49dc12df592a5381abcecd0b935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
50KB

MD5
b4fc76b503104eb28b6e16a42f33c5f8

SHA1
52d5687ae69b0f55c71c24a7be1e4ef94ae325c7

SHA256
84641df9e5565ef25a999a33df55f04177c807213cf533cc8b9255b9204812a7

SHA512
1786481f04a022bb5b548c6ea5060328a219e1d0ea82bcb1d1df087a1b89918e97420c324def26fae00cc602d888ee5bc50b31779a5a487acd7353f0cfbfe570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
140KB

MD5
a48a2fa2e75bf0b9fe4ba472cf2df2bf

SHA1
070f010131ed5c390cfbe58eb8dc3bc880b7afde

SHA256
ede5be2ba28a1f15cdaf8f1c69f454590b7ba6bccdb31419432a30aa0f01bdc0

SHA512
0d344624daa8000200104cce6936cbf2f9ef313080eb3d3037b72453076d8af63668f3479c3fa137e67dd29108e1b7221dd97f6b378c3e3e519de25f8c32baa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
19KB

MD5
69ef77257c7fa3a494a232f90b05d55c

SHA1
19dc83dc05f718e9693de231d48bf0307d8d29a2

SHA256
d1ec04bcd468208a30012d660d1e857bd9d4d937957d45bb10cc7483de435421

SHA512
1b95ee10d622e1468e04691dc47fcb59da6349ba8cdc0814ac8d27a0ebcb9c09692ef1b86533ebd59f2bca87f3340cbe032a011223afe4e7db018af47bab38ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
2b845c3bbfbcb4e28ffbd1838368decd

SHA1
4414c101a651bbc06ab2d1eced6932338278e7fb

SHA256
addd85cdf92ff6c8fe37ab271bbaf49b204ebb8f0e0782ff412959c1e9ac57e4

SHA512
c6a374402b6b038387d385b81040d0d6ae83b2a503be91335b4b641e9eaecace2696871b7ac79af7e78e526212de77f128738cd47142c8ff1494a11bc3a4548d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8895ef8cbcf693fa_0

Filesize
53KB

MD5
0d272d03e22fbc87b81f86ead9085f06

SHA1
8b8fba31e9dbb8ae3436f2df878fb7065426f31d

SHA256
6a039201ca602e96f791e185deb8e64a0cf928ba6ebd092dc7c21120e751505b

SHA512
f8148023c5861216875f56d71be5d41bc5770c8d98727faed81bd773af0566cb761c973dc542b5b17ffe402c9b22a6df4510b457051b9f27b31bbb24701cc64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7618a1c4bda3a0cdb1d7e826fe4d879c

SHA1
4c05f8038cee61568dbeecbdc0586e48813a2679

SHA256
038a0fc65f711ad641407e42ac89499682f690e6b47ff1defb20bb185dc49ead

SHA512
ab5b2173cb49bc7266bf9d3720a7b14acedfbfca7341bb1ecf0566df9b5cf771aafae4daf98dbb1fb2563fc767d74d61a69cd46eec4076a9493ec8edd75b9831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
164b846fad4225f81130533d276716ae

SHA1
2f47d86f4abef2cbd383260d2a6c3adf25ce686e

SHA256
2046607c25f0b7ca0208d7cbe5699e6ba079896db03d5883ae31b6a9ad9b9496

SHA512
1d8d8cc24c28192c99f4a6d007c36ed68900772f76d8f5325c4823e462bbdb3f4d3a3bd8e67baafa1a00a107643ca517914fc03004bb438433737f0aeebae8dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8004e18ef525a86f3fc9388fdc394b41

SHA1
5a1c0b486f84e7ce54769868bc3b5132015fe98f

SHA256
a228002c41050b3f03333d7a4713ad27dcd43fd3433b8f37f83db2cdb16f4d2a

SHA512
381a2b9b955dd9d6ad6f5b22aa7851b20d5ed3aa36ec4a7ec2c649a8b572a5526f22389715ff26bb12018ad5e0360547f7d75fdf0ceccab420f94061b3d17fec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fcf18464ad6f24479d5972f22a7ecb9e

SHA1
c33a907bc8682493b1ffe4789e6cffbe8956ec4f

SHA256
3234093d38db944cfeffaa4c3c6080d9e4abde59ced66e9fd412d4120516a59e

SHA512
88f202429ef62ab6ebc5a97ca8257029bfedcbef33069af1ba2fc377f01d58d510db55c47289351cc3906955b16b271e8519e9161d24d91d0110950a6a3a995a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
694a198c9ef867b39e1c884d0b019c68

SHA1
04a18752983af2a94f835389b5679cc98605ae00

SHA256
8f85e3991350dd735d8073f9391135ac6bf6b1729752e45b9ea436277e1377f9

SHA512
19f9e162ac1b9531b48ff31d8d18ecab910303ab6af693f070bb37782e77eefdaeba890606ed8b5ecc3e5298f2704c2a7d3af277811abb2970921907e12d7c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c9f3ba519878ec018d886913fa94f9eb

SHA1
95762f7ae14f1639f9651cdcd5139f63f428fbe5

SHA256
9b5e2efa96010ac81fba5fba5c5c4d3d4beb64d9522a88153f4ae801dd89ab3c

SHA512
321f5a89a2d38d1c6b7a88d54d09666d62fa7813ec71bfec8f2202a3423e53d84c69dd9b024f79314476600f75fced235450d95064925525b2ba25d47be99114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc33de6e412c7c1ee5122e7cba57968c

SHA1
9f772940b1dfec1a5c5df5148d53d28ec9cc701c

SHA256
6a3214cbd23045a94f93fcc03af4dfad57d7e5cc3afcbf68c4c4a670dc23319f

SHA512
1d5931523e31bcaeebc144cd5e8ef4ca55382a229a3fbddabd1de3963f4fa178eb1d94c4cc01f1a125103a223c1491b4f3b2e4015113f1674e227b9df5896740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8872d3260414382d7794e21054ca4741

SHA1
8392bff15f40c5d843defc8e4ae4203264432da9

SHA256
fd304ab50ceef2efe5f2ac44a669c26f7b4d63ecc33ccab86079333a511a1770

SHA512
274bee17aae87e2c19a914f1b4c6b09d8ea059bb4fce661a4add6dd6bbb4e0fef8189cd9a006ef0021c9d489d5b8d4e12f924a3ea6e064c91f49f6174b7023ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c2cce5c1322b9c9c0e46460ab9e05de9

SHA1
88cd973a4c03c3d2f93f444ad80ffe8980c0e49a

SHA256
2480e87aac84233405a5db012370bdca8c7fc1a7e2ff51f965e7b0afd356638b

SHA512
8c85f2adfe61983f6b060634678e5b24fc0367504e2f382def37bcf3a0abd535443e7dbe87cdcc1b596385b381589181529ce0095d6664431c62e456ac5cacd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f8cbca4e5da33864f0c587e674d79c0

SHA1
fe513405787c62ba9d831982b95dced25c1777c4

SHA256
b9d9cc0dab0c0e7a8a0d8224ce947f3f6e3866b00ccb634c7e3e83b6bcd0be5b

SHA512
10bb5218f03849f3e5141ed75a177613b72f304c30400847f1f136959d76e66179f58f75512fab98d9fab6a1d5ae887a7d8d43475cbc18e34414e26de94910e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
549831ca44e9fd779522984a0213f2c6

SHA1
4526f417ff709464d86e895946872bd9eb77979b

SHA256
04b05c17b381568899ad72591ab9fe56244e654a1dc70ef2656c57a93c145303

SHA512
6c0fb4d9ec234198443f8cb68213de6d70bf375c6b7dbf8b9187227a17342d1f046757fbf32d071647bde7013e621e39a4904649c8a6acffb5f03098881c8514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
11fadddcf1407ace6bd8003dc51c4ac4

SHA1
0bd20c74bba9cca97abbdab8e82788f8215fc397

SHA256
8c7f9e78bb747e09384fd77f1eeab7924fe4e9e4cbc390e75bfa5117aff5d8fa

SHA512
b8529dc9d263ed5dc7c0b8322785caba2e51767cfc4e493bb07347c94261aaca7269b233f6887b62d2a08a44d773e90524c122bf1a46ead932635c9bf151762c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b4d9.TMP

Filesize
705B

MD5
3b830882280769c212503ffa2cd39b90

SHA1
1ba43d46c6b6a697f101ef533e9175a02a7cd13e

SHA256
37b13a1b9d3d27cad6df7fb4f3f9023ccfd8a8d9feb345385dbfdd1ce5b24d48

SHA512
1600aab582f53c7875c0c5381d0089bf99e0cd7574a777c2230278c529903339b8d3fb92a419bd4d096dbcd827b86b51da1383685d146c9978bba2dbc4c7367d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d5e789735b5605a2771f5ccdc1bc29fa

SHA1
dea8247de1c027ffd227e60412366fb909fd31c4

SHA256
c6a68924e6f6b173c084fde43fa75a18df4eae03aa2026375a5c559f0eb1a176

SHA512
e12d04e9931e703434c891f7063a86cb60be74c810ac688e62be7f2c7a2d3b2c528e65b31d82db8f1cac6aa7b5605571d391381af5d7bc736c7631fa66a8ac9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ddeec4a0e4a6be5440b6936c1641c31d

SHA1
17b6c956b5240658e44893230dcdc0b639de1e6c

SHA256
d9daadcf51e5591d7b0f7964532fa0eb326b27f0b66bbdbdc0f0f8a177b74bf6

SHA512
8510e06ccd15ab41c1603071e021f0af6c5eb2eb6fc1ccffbe156ae9f23b353ea7fd88a12d60b43ead755340bd7ee7b55ba8d3bbd9ae00f717a7b69b7d9d70e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9d93f54959d271c89a48a7076722996

SHA1
0c8aee460de78b342c7ad29bfe5a30a7c0e9bb6d

SHA256
f190924fe81553cd46e9dacbe666978fe189c4201698800d23c8832b24f511d4

SHA512
0605aba924d17dd1d15da32ddfce6b8f1b46f73d3ecb1acde1f52c61f59664954b0e81d8af68323c9a8d2fc9a7b1b89ae25ad2ad3079d7bf5c149049effd5c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5be60e89de81a56b36a278742be040b8

SHA1
084287a52447e80a20c3f3833d7e392b2de88070

SHA256
4d7e113dd2bedbfd461ed5cf3f018b572e623758e8f5a1a253daf1936a9f14b9

SHA512
253845cc024a7a773a68d1dc817cc04d27ecca03bf9bf71c75881771ad17b40f2785bb25dfee081b99fcbd373718dd614c04bccfc6cb71f358b59edf51d51b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1f84389ca4fb5104103252d63e71fc4d

SHA1
1854dd8cf59461f9a2cd1c19fb8e419a551c2b4c

SHA256
81ea6d96c2bf1e0f89ba92f33bf7112c46e2edd258ae9e2f29ba4d01957efe17

SHA512
2fb330ce4ccc8653a5feaef1590dac556ef0e9181f9cd05a4b5242a3db5ef0ddd86b1f7157365aa658d95f8f5c8b6100c123a40d0e8b47249cde53f784462fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L62RD.tmp\cpu-z_2.09-en.tmp

Filesize
723KB

MD5
77b6d18b219d145c73f779d0d82f6bd0

SHA1
485d5eda874bd28898b5abfbe36944616aafc0f0

SHA256
aab8b17924b8f250d1ca477fa705d342bf620ff5864ebbc0b5e5d177c43a1743

SHA512
5164338c98eb1f5cb831ac8a02a62c278d331c9e3c649d27a0141611de85957bde38cffbcb8a816bb05d207d8632c4000cff40b2ce8880aae8cbe38dcb296163

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U0MDL.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 421727.crdownload

Filesize
2.1MB

MD5
f1ce59f81de106aa0ca4672e5971c6f2

SHA1
21d9ca7a12479a0ec2af4f1c567489a1192b7a21

SHA256
657b7f4e403269768cd20f1a5b481878cecc775522ceef119b2723e0844f2361

SHA512
0e77a515b35ee33a9d7e887f1e8bf0b243d0b2a5168c471b2b66c5345b31b690bca81bd392f086b129070db68fe7d3d79647fe07f2657ebc6fdf8acaa8677a71

Download Submit
C:\Windows\Temp\cpuz_driver_5976.log

Filesize
1KB

MD5
ae80e1e42cbf4d8879676e7ee38c1983

SHA1
f5f33bca41843e9b084d75834882cd261d10011a

SHA256
9bc42d8c8063a5da1777d0cf2cb048406922f009015211996d26a6d98f9cbf4e

SHA512
592a1d62d7b21e5429c1f4499f954e4e1cea997a44366a5c7889195b913b7f64f25631e0b10fdb245209a2f079ece6256ce869274bb06c82590f1d1f99a68f04

Download Submit
C:\Windows\Temp\cpuz_driver_5976.log

Filesize
1KB

MD5
42d4f96b6b31ab387eb08a91507591ed

SHA1
70bc5e2df5744d7a5179e35e9b6b5ec4a3ab97f7

SHA256
dc9b449e2d44bf0626ed21682f884bfefd35d33b20daa7782833cdec801ada34

SHA512
f83f0ef2d3bd035f80d4921e18f644b08a7ecc9e9db750fce3f805f17bd99fcf0b7fc51ec187d9596c2e698908867d66a8508be34bbfb2c679f57cee01c54630

Download Submit
C:\Windows\Temp\cpuz_driver_5976.log

Filesize
2KB

MD5
661138b097b291218cee28d6a9657185

SHA1
20a5baf74dbc5801e64b64992943ba14d605f331

SHA256
a663c46136e87a144e655c23b5b39fd9d9bb6c15dcf64a215909144a9e7e5408

SHA512
1d30b2d037c2a92b9297b22c4405c9d9455d5e5340b55a319a2a62028c233203ade8bd1796e779a0ca62610b0098f72c5f1c94cd69e3cf2d6db54c6361eb07a8

Download Submit
memory/1516-580-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2696-471-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-472-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-473-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-470-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-468-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-469-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-463-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-462-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/2696-461-0x000001F778D40000-0x000001F778D41000-memory.dmp

Filesize
4KB

Download
memory/5236-581-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5236-521-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5236-576-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5756-237-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-240-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-239-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-238-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-241-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-242-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-230-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-231-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-232-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download
memory/5756-236-0x00000231D4230000-0x00000231D4231000-memory.dmp

Filesize
4KB

Download