8c6799f8ece4ab5846cc8beddcf52bd887a5ae896279652960ef8d943d453473

Analysis

max time kernel
178s
max time network
186s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hwmonitor_1.67.exe
Size 3.5MB
Sample260804-nsv7csdp4z
SHA256 8c6799f8ece4ab5846cc8beddcf52bd887a5ae896279652960ef8d943d453473
MD5 1700afd89562e87b5faad8efee23228e
SHA1 b1b00d24f13c80e1a150d3b46a486c1105e6161f
SHA512 6b440cff590a54c9c102f9c352201ad11a30896b002685b345a8f000494af4b80abd2706c48ad5aedfe9b6dee941cc08cfe52bf96c2f735c9fd9e78e3d4888b4
SSDEEP 98304:wwRE4jKygdS3/IAPsBzPTQfraBjvcozQ0fKXFwJfdY:A833vq3j7cuQKEFiC
TLSH
T155F50113F3CBE43EE05E0B3305B2A45494F76A616922BE5686ECB4ACCF355A01D3E746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery installer link pdf

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\CPUID\HWMonitor\unins000.dat	hwmonitor_1.67.tmp
File created	C:\Program Files\CPUID\HWMonitor\is-OGSKO.tmp	hwmonitor_1.67.tmp
File created	C:\Program Files\CPUID\HWMonitor\is-TPG96.tmp	hwmonitor_1.67.tmp
File created	C:\Program Files\CPUID\HWMonitor\is-0AATL.tmp	hwmonitor_1.67.tmp
File created	C:\Program Files\CPUID\HWMonitor\unins000.msg	hwmonitor_1.67.tmp
File opened for modification	C:\Program Files\CPUID\HWMonitor\unins000.dat	hwmonitor_1.67.tmp
File opened for modification	C:\Program Files\CPUID\HWMonitor\HWMonitor.exe	hwmonitor_1.67.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5688_1252732012\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_904735427\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1617681797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_904735427\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_416926803\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5688_1141613775\_locales\ko\messages.json	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
5828	hwmonitor_1.67.tmp

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x000c00000001c5ee-35.dat	pdf_with_link_action

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hwmonitor_1.67.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hwmonitor_1.67.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2120	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2944-1-0x0000000000400000-0x00000000004CB000-memory.dmp	innosetup
behavioral2/memory/2944-8-0x0000000000400000-0x00000000004CB000-memory.dmp	innosetup
behavioral2/memory/2944-94-0x0000000000400000-0x00000000004CB000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303172837442209"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{422913AD-371F-4553-A53D-1DAF9BD31B50}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5828	hwmonitor_1.67.tmp
5828	hwmonitor_1.67.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5828	hwmonitor_1.67.tmp
5688	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 5828	2944	hwmonitor_1.67.exe	90
PID 5828 wrote to memory of 5688	5828	hwmonitor_1.67.tmp	92
PID 5688 wrote to memory of 1028	5688	msedge.exe	93
PID 5688 wrote to memory of 5256	5688	msedge.exe	94
PID 5688 wrote to memory of 2120	5688	msedge.exe	95
PID 5688 wrote to memory of 5256	5688	msedge.exe	94
PID 5688 wrote to memory of 5256	5688	msedge.exe	94
PID 5688 wrote to memory of 5040	5688	msedge.exe	96
PID 5688 wrote to memory of 5040	5688	msedge.exe	96
PID 5688 wrote to memory of 2528	5688	msedge.exe	98
PID 5688 wrote to memory of 2528	5688	msedge.exe	98
PID 5688 wrote to memory of 2528	5688	msedge.exe	98
PID 5688 wrote to memory of 2012	5688	msedge.exe	99
PID 5688 wrote to memory of 2012	5688	msedge.exe	99
PID 5688 wrote to memory of 2012	5688	msedge.exe	99
PID 5688 wrote to memory of 6140	5688	msedge.exe	100
PID 5688 wrote to memory of 6140	5688	msedge.exe	100
PID 5688 wrote to memory of 6140	5688	msedge.exe	100
PID 5688 wrote to memory of 6080	5688	msedge.exe	101
PID 5688 wrote to memory of 6080	5688	msedge.exe	101
PID 5688 wrote to memory of 6080	5688	msedge.exe	101
PID 5688 wrote to memory of 5284	5688	msedge.exe	102
PID 5688 wrote to memory of 5284	5688	msedge.exe	102
PID 5688 wrote to memory of 5284	5688	msedge.exe	102
PID 5688 wrote to memory of 2896	5688	msedge.exe	103
PID 5688 wrote to memory of 2896	5688	msedge.exe	103
PID 5688 wrote to memory of 2896	5688	msedge.exe	103
PID 5688 wrote to memory of 1164	5688	msedge.exe	104
PID 5688 wrote to memory of 1164	5688	msedge.exe	104
PID 5688 wrote to memory of 200	5688	msedge.exe	106
PID 5688 wrote to memory of 200	5688	msedge.exe	106
PID 5688 wrote to memory of 672	5688	msedge.exe	107
PID 5688 wrote to memory of 672	5688	msedge.exe	107
PID 5688 wrote to memory of 5380	5688	msedge.exe	109
PID 5688 wrote to memory of 620	5688	msedge.exe	110
PID 5688 wrote to memory of 620	5688	msedge.exe	110
PID 5688 wrote to memory of 1552	5688	msedge.exe	111
PID 5688 wrote to memory of 1552	5688	msedge.exe	111
PID 5688 wrote to memory of 3116	5688	msedge.exe	114
PID 5688 wrote to memory of 3116	5688	msedge.exe	114
PID 5688 wrote to memory of 3612	5688	msedge.exe	115
PID 5688 wrote to memory of 3612	5688	msedge.exe	115
PID 5688 wrote to memory of 3896	5688	msedge.exe	117
PID 5688 wrote to memory of 2528	5688	msedge.exe	118
PID 5688 wrote to memory of 5832	5688	msedge.exe	119
PID 5688 wrote to memory of 2756	5688	msedge.exe	120
PID 5688 wrote to memory of 2756	5688	msedge.exe	120
PID 5688 wrote to memory of 3992	5688	msedge.exe	124
PID 5688 wrote to memory of 3992	5688	msedge.exe	124
PID 5688 wrote to memory of 4704	5688	msedge.exe	125
PID 5688 wrote to memory of 4704	5688	msedge.exe	125
PID 5688 wrote to memory of 5580	5688	msedge.exe	126
PID 5688 wrote to memory of 5580	5688	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\hwmonitor_1.67.exe
"C:\Users\Admin\AppData\Local\Temp\hwmonitor_1.67.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\is-0L8VR.tmp\hwmonitor_1.67.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0L8VR.tmp\hwmonitor_1.67.tmp" /SL5="$400C2,2755581,776192,C:\Users\Admin\AppData\Local\Temp\hwmonitor_1.67.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\CPUID\HWMonitor\hwm_readme.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,4073672192673782005,10253500174328615296,262144 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,8423823305013944313,16313161900422963826,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
      4⤵
      System Time Discovery
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,145064285742179935,15373084529668641267,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:13
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,2342097664848061524,16345793945332681034,2097152 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,15965432632915067457,4599926020994412322,2097152 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,12485736378644286664,9290893464305853189,2097152 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,11323039595286727336,7614629763468550850,2097152 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5328,i,5355409534118699669,15449272855752411423,2097152 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:9
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5344,i,6231131553748805507,353192670875769251,2097152 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:15
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,10858514533448089819,475183483597616668,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,13665191247144917209,8639990473654663644,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,15360354490162919053,10516065765662665037,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,1596372530619754434,8086176181565210029,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,1596372530619754434,8086176181565210029,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,15816819263874898520,9920312558676390137,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,15903206403305800930,7296909661400369191,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,11536683126595097022,14253939632685420674,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,11651370898527708310,12843044314031386376,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,15906616691407938591,3725282807645398034,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7584937818557964185,13582751246529117187,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3626265279997836718,9876049633968974698,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,5538263499920194819,1374762118371809328,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,3525917231383018049,16114334878050825547,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,15300616491967762989,14414888725492610743,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6558638559692548751,822806508393151965,524288 --field-trial-handle=2088,i,4725498680812602413,10095791072085247710,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:5580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HWMonitor.exe

Path C:\Program Files\CPUID\HWMonitor\HWMonitor.exe
Size 3.4MB
SHA256 bc62cd4aecac2e0a5ccb0b648fee515b0f053de06d14ca21680c3a2d45559b54
MD5 2cb32900f2f136634ecc85d474412082
SHA1 546df904d0da3dcc76107e8162266ded99eaae98
SHA512 420d8358fc2754f6647654ac0dbeb7f550006c16fd4a5938b506cc01fcdc6a8e434e6954685f52c081e06feb401b427ceb40c5eb1394228dc35f77f890625a38
SSDEEP 49152:EjuYMoA79UaP6nUM37oU9kwftgpHmluat:dYMpM3U0blh
TLSH
T119F56C40B36880D2E452D27596C3AF1BD6B63D992F7453D78660BBAC8FB33805C26F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hwm_readme.pdf

Path C:\Program Files\CPUID\HWMonitor\hwm_readme.pdf
Size 599KB
SHA256 323af0d04ba3c623789bb545e1e1bb8c543cf5fda303581180b0c9c2a1b7fdc7
MD5 a0a79812b69fabc866e98e92dc8ae8d0
SHA1 9059a960862b1b063643bcbc0ba6e6836ee130e9
SHA512 a91019a73d9da6ecab595f09f8623f636d11ccec65a309c5e0af711194682dd4350a876e0391a2e50a3a81ea0051ef0200c3d53a2da18b2131fd7e85bfea69b2
SSDEEP 12288:6w6oVLZht+cglXmOvm6rzY5+3qB/rJQ1et0vbjM0kBY/Paz7G6h9Ap9:6w6oVLZht+c+XmOvm6r85+a9JQ1eSzoM
TLSH
T16DD4F190CE5C3CCED1729AD76F2E791A785CF220E0E3925171AEC7438729EED9407A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c91d90f56e7718a4b9646c2512809fd408876f0a5b45f63240471fd127576e97
MD5 5eff05ed23db9ee1c9a7e24e8c958a6f
SHA1 a9a6976908ce23959058fd5dd0acdf0c3f230d52
SHA512 11fc19f2a068038460bf05b87020d22144d297f63f2eee791676ee3df1c9ce15d7f135f5e54151259abdf67fcd9993ba4f5345839a8b02365245019f28799d38
TLSH
T10F61ADA807B029F2DFA147755AD1E60A32F9889604B3DE0F41401DB15F07F9D16C2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5abe31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5abe31.TMP
Size 2KB
SHA256 55444618d1b75af7c01d2ee7166500a4b178ce6a005412cbb3d43cb2f506ddc1
MD5 b72c39a49902f11ae755e4828ec09d94
SHA1 94ac7e91bfe5de007aa532d874977650646f1940
SHA512 8e9a7ee4898498286f4a220006202d1fa52c85a717b8b1fa0fdc2eb026ea8ab695783b5444933d85ca5566d70baa9f8f5b93aacc546c05d1df550cc1cdbd9948
TLSH
T10451A0B807B129F2CBA446755AD1E60A32F8889900B7DE5B40401DF55F07F6D1BD2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fc9e40ecb2504c7f33919d7279735cbaaaeef1bd470be12b0d5eeaca9d3158a0
MD5 985d1a7fa78802b82a444be85bfaed48
SHA1 4482ab6c6415fb99a1cc40c9bb6d8e902cd651b3
SHA512 1d89cec67b041ac3e4789dfd0f3a97c816c1f3c2a8bba253bbdb225b0acf887e0e7d8e59743d87f7bd2a18c10d85d79d32265e64cdeb6660d94e37c535e5c2db
TLSH
T14C51CEF3C7F8863E890156F4AB146E2BCE1D0958832C3D5AC9E4AF1BA3E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 abb19f061625cf97a568a553ec3cba85b17c1278204bcc96a8e92a5519d2dfc5
MD5 b522b0f27000779679c4996f1bd97d38
SHA1 47098725cc83cf029d60b7bf1c5d9a6325145ea0
SHA512 58d77d897d24a74cd4d00e51e7c801651e306d29703c5a94b38e864cbd188db277583cc64d6f698c2941a8c7627d1b78c42db763a20cfe2f1df45871376a68a8
SSDEEP 192:sxRaRVCX/f+s4NTvZugFzoD8p4z/g6+WNIYCAOwRuOnGRIgVBZLJ:sxRaCX/f+s4xxtxG/5ICO4QL
TLSH
T10A42D7166D28A83B9CCBE21DBB55BF53D7F9603260902E54E7FC961C04EB6DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 28cd13b3c5f2f535e72e7a1ae9b09d7130323ca13d1a852d88ff2b1367da80d5
MD5 01975973a60f3e6ecfdffb18ba3f73db
SHA1 0cbde064d14f9cf36342870da92b857a4ff53dde
SHA512 a5bd9ca3453a881515e83b448ceb590a6596601f6a9959ff0078a8b33772e8c052248d569cae4d115bcdfa9d1a6df2955211937ce0ab1b4bc105f05b29e530b0
SSDEEP 192:sxRhRVCX/f+sjNXzvZugFzoD8p4z/g6+WNIYCiOwRuOnGRIgD4BZLJ:sxRhCX/f+sjRzxtxG/5IUO4QW
TLSH
T18542D816A928A83B9CCBE21DBB55BF53D7F9603260901E54A7FC961C14EB7CE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 04fc7d381684d4b864d386c17b8075261a5bfd540dc9476ab489f0817e55fd17
MD5 a1a72c7fb6af486b14172b76edfbe79d
SHA1 74e0c3ddd0c7a64a97f8362e816d3bfee3f71568
SHA512 e57ef7126c19f9c7dd25c2ce08144f07414d89b1abcaeb34af2a9a4cb4e9db8c735c79738fb1a448a76755a83a33a10d2b3fbabc32dd0ea0e83ce245f69ccbb1
SSDEEP 192:sxRhRVCX/f+sjNTvZugFzoD8p4z/g6+WNIYCAOwRuOnGRIgDiBZLJ:sxRhCX/f+sjxxtxG/5ICO4QM
TLSH
T15242D716AD28A83B8CCBE21DBB55BF53D7F9603260906E54A7FC961C04EB7DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 12ac56c5d748db017f7cc9beae94358df3c3bbd437d0cd2e969eaa76e7bc1cba
MD5 834191e1acbe2d71be310ac54f56fadc
SHA1 a8c6b174f4a2b62089a2b786822a8b5270fa4637
SHA512 025e329e2120c948b1eb12bbcea387707f67ac2c76485b344195d67c2adfbed61698a12a02ed4166590908efe5ea5fde906428b835de97b9ed75e34be87c3c51
SSDEEP 768:jC+vA17pLuLfDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgS0QqciroZ3:jC+vADEfDQWgQ+f4+u1ja3S0Vc5N
TLSH
T1EED2EA7B640DCB7F4F804ADDEC197E9E6DA802CB9698CD8047FA941C02C67EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef86be35-1f97-43de-8f79-fbc4571e59b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ef86be35-1f97-43de-8f79-fbc4571e59b0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 895735b3b223e5f5cc549da9a7608507841757d8703a21d87e05341f0432a683
MD5 dd836091459a5a9f2a6d2a497e6991cb
SHA1 06a48811aa66e5df59d95f1040ec6dadb091278d
SHA512 07ee6a899f8401b2b1fdadd27e51e989d7ce3d105e0c15a8a1e5930e6c5f24e526fed2bb86c0579b27858d0c62418ed643decf3239969eb4a351eb570e75037f
SSDEEP 768:4Y3MNemKMPp8+p3bd66j+4BRv86aLIWhojKgqmU39t:4Y3MNVh8+p3Z6n4yffgRU3b
TLSH
T147F2AF71E865DE738CE9D644B29277836FF424A395C05EE4E4DD6B0E014725E2B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1a54159ce5043fff6306a363328cf4774b1b5eecbdb1e29c84f7d33c58ccb52f
MD5 f30a91c2049a1d06192e784089ea53e1
SHA1 415548155a8f08929fb0733f12f2ea57fc91982c
SHA512 c6eff1c0342ea947231f4665f96d3348ea77051c8bad631dc31fa4e33443ffa4e474723a47944261fe8daf8465e3c0d5c895952248ff3043532d58437f256469
SSDEEP 768:cFQo3cwg9NelnXp8+p3bd66j+4BRv86aLIWhojKgqmU39t:Po3eNe8+p3Z6n4yffgRU3b
TLSH
T14A038D72D865DA7BACFADB81B74676839FF010A389C49DE4E5CC6E4D008719E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 266a3883914f34ad066613148bf9532d26b208ecabf75495ed5de7a0a8949a6f
MD5 a803a9e027033a99bc874af4eba76191
SHA1 f002f7d5c171e2fafec3e6323ebaca4311b53c39
SHA512 fa2cb2e8af460fc879b9dab2d7a9ac64cfe77e7f5d480a75bc147b8920fe5d0909dce1fcfe2a222715e6ddd7b69231919066bbec50080f849f52c1012f757bf6
SSDEEP 768:vrv+4UNbd33vNBmKMSp8+p3bd66j+4BRv86aLIWhojKgqmU3B:vbsbl3vNMs8+p3Z6n4yffgRU3B
TLSH
T1B013BF71E469DE738CF9D644B2867B837FB4249399C00EE4E4DD6B4E414A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 32bd248e4d3cdf9d5bbd1bdbcf23d5404c90155b2fe7d96b8438c46f45f000e3
MD5 f80094caa9c147c23d1d4b1b7df51453
SHA1 25619b18cadcdc246862d9bcb9e106a9c957602b
SHA512 cf108d4e8eaa58103439f6a809de3339be164a1117285dcb06c4a141596a85f38eba0a394529b0433057217b38933e02d878518f0d521839f8b629bc03c1006f
SSDEEP 768:FY3vNemKMPp8+p3bd66j+4BRv86aLIWhojKgqmU39t:FY3vNVh8+p3Z6n4yffgRU3b
TLSH
T1FAF2AFB1E865DE738CE9D644B29237836FF424A395C05EE4E4DD6B0E014725E2B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6aeb90b4c3dcbc26a2242bb524d9e2733a83d9ceae3b6815e7e5f0b448963254
MD5 7efc53971f8a5c4a0183cedb3b711523
SHA1 d6d29db13fa595671b9d601d1a2f0472bf3c19d4
SHA512 042ab552b68167df28c34c91ea741f1d814b2c73b71c04de8ffce7599df7fbbba2185134fe68a2ae868d247ef8dc2970c27043524c4e42270171b3110ed8ed1d
SSDEEP 768:Irv+4UNbdD31cwNp8+p3bd66j+4BRv86aLIip2bwCl1:Ibsbp3LL8+p3Z6n4yz0ww
TLSH
T13D03CE73F8A899739CE6C644B2467A437FF851A396C10EC4D4DD2B4E419A29E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

1d717438-4501-4d4a-afd3-feacd549775b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d717438-4501-4d4a-afd3-feacd549775b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5a7fb1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a7fb1.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

e764d78d-1fa9-4b48-b9fc-f809c6042383.tmp

Path C:\Users\Admin\AppData\Local\Temp\e764d78d-1fa9-4b48-b9fc-f809c6042383.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

hwmonitor_1.67.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-0L8VR.tmp\hwmonitor_1.67.tmp
Size 3.0MB
SHA256 36eda4d789b9f9160da58432b3bb435896b96551efb01c2c121dae5fd56b416e
MD5 3b97a98895bc368b51c99ec0ab68a8a2
SHA1 8669854038ca22bfd3bd32da594248c8978427e1
SHA512 17b1f1b690f4a105114cfa71a4b95524b47f4b47ad4e5d6518e5abf82fa761330177e520ce035144c42d21b46788a747ee66f6eaaeb55459b2cb4172685b0df2
SSDEEP 49152:GdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqBn333T/Q:4JYVM+LtVt3P/KuGUONGTi3Gn333TY
TLSH
T139E55C17F389613ED05B2A352927C1515937BE707A2A8C575BEC3E4C8F361886E3B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5688_1858857521\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CPUID HWMonitor.lnk

Path C:\Users\Public\Desktop\CPUID HWMonitor.lnk
Size 982B
SHA256 81b1ae6349edc050fa9c2567504685650684a45bab1e169028d347ef73299788
MD5 d4313c3c6f2cbce3947b9512d01acc35
SHA1 f36653b9a91c422a655fb61515f72a09eb6c9063
SHA512 8068f4b5a03b1faceead1c1c15b017397ab1137f1c4e17269ab8cee56d52ebc265226926784427d7931df58b94b1989c978cd9639247058347ad53e76887e64a
TLSH
T15B11AB010BF7929AD1F7A1FA0B7A2B01A672FB01B6240B9900E541421CB4C509E9DF63
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2944-1-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/2944-94-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/2944-8-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5828-12-0x0000000000400000-0x0000000000706000-memory.dmp

Download

memory/5828-88-0x0000000000400000-0x0000000000706000-memory.dmp

Download

memory/5828-6-0x0000000002620000-0x0000000002621000-memory.dmp

Download

memory/5828-10-0x0000000002620000-0x0000000002621000-memory.dmp

Download

memory/5828-32-0x0000000000400000-0x0000000000706000-memory.dmp

Download

memory/5828-9-0x0000000000400000-0x0000000000706000-memory.dmp

Download