hxxps://www[.]google[.]com/amp/s/sevenlionscapital[.]com/time/money/mnfcmb/otto[.]erni@volvo[.]com

Resubmissions

12-10-2023 15:10

231012-sjz66sff3x 8

12-10-2023 15:01

12-10-2023 14:56

12-10-2023 14:52

12-10-2023 14:50

12-10-2023 14:46

Analysis

max time kernel
80s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/amp/s/sevenlionscapital.com/time/money/mnfcmb/[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
3296	msedge.exe
3296	msedge.exe
2636	identity_helper.exe
2636	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2820	3296	msedge.exe	82
PID 3296 wrote to memory of 2820	3296	msedge.exe	82
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 3696	3296	msedge.exe	85
PID 3296 wrote to memory of 4444	3296	msedge.exe	84
PID 3296 wrote to memory of 4444	3296	msedge.exe	84
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86
PID 3296 wrote to memory of 1204	3296	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/amp/s/sevenlionscapital.com/time/money/mnfcmb/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffddf5946f8,0x7ffddf594708,0x7ffddf594718
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17695236190139229309,7193845269037002662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
456df603b6bac94c95ba635a2002337f

SHA1
c3aea9da93bb4a713e207cde7746429199db98a8

SHA256
22b1b8dbe119f3f1852e6ae333599e5e7009b776f7b2efbaa47200d0c935c1ef

SHA512
64d062cc5839c68dbf335d8f7f297cabd5cef21019bfdd3433496a231f8ccade7afca2cc27d8dc16237b24434d578a6d3cc659d78b156706a2df7d20a245f478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6564d94a57901f6d8f75b15b2e21347f

SHA1
8d1c9d70d41867f9af72783793ccd83376cd6cd0

SHA256
15d629d246654993e7596b5542a1bd9196646ff47aab2732274b3a5b7b207a21

SHA512
22152b0fba9a914ef409e9f4b61b3783c39c085244e70ee437144f4e72dc6df9f3a7c57e6cbd91da951eee9943131bf45ba3d691f3187a740c7f2923611b84c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ac4fc54256f5e9af21b9abe277a3c45c

SHA1
c3f24d536a0431d6a64af42fbae640ebc737bec2

SHA256
215cb2344a83867590528d6ae19bd40893651b8e672590467fd1cd9a31ad3a01

SHA512
c2f51dc8ff712079abc8d9c9d7924379e2cfca8fdc491ba5486234bfee0e61b01bf81df4e2e277706537e4a56b6055b550b8c571b58e61cfe57ad4d82566e7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e45934ef23bbffe64b7f972412869f5b

SHA1
0ba8112a2c99d7b3c492c03eed91bf6151e1bc57

SHA256
aa36c2d259d962b992a7c24e80737af86ffff87cfff108dc7a29bb2cc26d7a07

SHA512
a9f4052df603f6cc150ffbfe45705eb80b02bf66c60981fbc700459ee163cdb26ad513f9eaacb9740cdf8195321b296daf45fe04ce96cbb5e1fa59a28c226bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
951f44546bf649e50b9e978d7b065cb6

SHA1
1292c4a3dd0e3490d64c4f08ef2f6ecaff9098f6

SHA256
030b3a3d1215813ebee7fdb34dbc3778816cbf7ade1c4f1f4fd3aebf9094cc48

SHA512
53d77e06fa3b1e741f72ce7a3f187741ac8db61885770935238dc03e9cfa920f20902800252fcfc5ea09662d4d55a0205c0eb583e24a09bca2e9bcc1672b5e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78397acb30fd4a78e25218310be99919

SHA1
8ea2657483ea375681015b489840251a18fe4aa5

SHA256
f51315521947db796cf7e74e4844f7e466ee727aa97ea2379cad6d545a6b32ad

SHA512
436e1a511bc1ccbe16f6f287c8cbfabe9ab8248dcede704a63efa8d0a66cd9e58d7215d6db05432dc1998b6a085d4454f89e82e9d7c7e59bfb05250f5a30b45a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
208de36148a54e4640b731989ca84715

SHA1
41124f958cbbd58abefbb781563411fb4013d721

SHA256
f66c7d07fc8506522ec29d2392bcba8f7b271312b3e79ad14150cd494918cf18

SHA512
b8a52af8c1c15d5c79e1b755817df8e8f81e6d34eade2a7736aceb0299f505cdf4673bc166508340c5949a30ff04684f1e7604a36979dd7bb172376da67bf37f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9923cbb0aa27e40af7931a97f2c9d6ae

SHA1
3ce2793e679f32c909b05f280178212d6f80cb03

SHA256
424666f5c4c5a25c6d1a9b691eeb588a4a9d78168dff68634db495e1243610d0

SHA512
c7cb769755ef918e1e803271d40c169643067de1f886500198b109a87933afcf29ee32672e19d2d516447d3b6fc12bf7a68b6696491b94f8e2bcd10b5e7b670c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6453a817693a6df450e291110cfbdba

SHA1
73f23aaa09c52f264ccbcafaf84f0bf448b67bde

SHA256
cf414e9f73daf607e9c2ed272a6381e18b0cbebb709110062ef9d47f58ae42b6

SHA512
8b9882ab86ba0c8e11e6af3de4e0ee958046ce14eecd421c3db4e9d51718a7e78c91dc8db79a6e622d9a57faf0713e7f39ca0038748e81269bf6b4135c56fbde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bbf6598e7d197c18446a878598a4df70

SHA1
0643f109403c106bbf37969716585ad8cd1d35d2

SHA256
aa42b47659bb04000c79800dd20f44e4e0ebd898751c93da3b0ebb8c7f503854

SHA512
41087aea9758dbb1010db997e1654cc44bbe1d30bad8c97059b5519de7f6e7ab1541f4b201c398b74168ad1b2a7027753b56ce00a187e3cf7273cde8cfe6809f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582bdd.TMP

Filesize
539B

MD5
11a8d39626a9b728b9bba2c0861e4480

SHA1
f420185ced331ef4aa482f48238b8a7832ce225f

SHA256
6e83ef6797486fd3c80b7d6a7645d597b5ef0b96feda262b62e55e8fc29ff4fc

SHA512
90c8d4aa1c48a498cbb6b9ae55f77656c76972db7e5ded9b874693160358e774d8f97874cd8241831576d7eb2545d229dbafa6d649f34cfe21b639b051a690ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
54e23a45e7b9e5e1b8cd785985c3d84b

SHA1
621d1500ab17dc44768c845993eacc50f5099934

SHA256
b113c910a092114af5480f38f3e586b71a199ab029c45f346f4e47d6733e2c64

SHA512
db95115c495c89025873de501a94e8288e7563745a93cf724b9b2ca3387c753afcf9132e42d847b8d33d2b6ba855a7fbd6285da3e8e8c0f4d139b1da4e670446

Download Submit