hxxps://cdn[.]discordapp[.]com/attachments/1190363530466181213/1207053950285774868/RevFreeAgain[.]dll?ex=65e77a17&is=65d50517&hm=f48abb0203a76756eac7c05a6c025c8c2a51635ed4a1011c5bdb874a9ccebe5d&

Analysis

max time kernel
50s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23/02/2024, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1190363530466181213/1207053950285774868/RevFreeAgain.dll?ex=65e77a17&is=65d50517&hm=f48abb0203a76756eac7c05a6c025c8c2a51635ed4a1011c5bdb874a9ccebe5d&

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 613216.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RevFreeAgain.dll:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
564	msedge.exe
564	msedge.exe
3384	msedge.exe
3384	msedge.exe
1724	identity_helper.exe
1724	identity_helper.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 2332	564	msedge.exe	80
PID 564 wrote to memory of 2332	564	msedge.exe	80
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4240	564	msedge.exe	81
PID 564 wrote to memory of 4764	564	msedge.exe	82
PID 564 wrote to memory of 4764	564	msedge.exe	82
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83
PID 564 wrote to memory of 2176	564	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1190363530466181213/1207053950285774868/RevFreeAgain.dll?ex=65e77a17&is=65d50517&hm=f48abb0203a76756eac7c05a6c025c8c2a51635ed4a1011c5bdb874a9ccebe5d&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa3e153cb8,0x7ffa3e153cc8,0x7ffa3e153cd8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6248454137462245889,14403086578618538261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07d740b3-3443-4e77-8daf-e3cd6be78b8f.tmp

Filesize
6KB

MD5
cb79c4002a78f9909816984376729edd

SHA1
0f34bb2c96ad8882112e60dfcc16fc26841977c5

SHA256
02460146315089399469bba5b1f66c0ca7cfec4998dcab49802fab93046ff274

SHA512
3ed5988d0c5d57a83e95520550ce352a3bca7c995c489159928d759c00c8a16faf121962bd938d580a097020702e978ca0a1be6528cbeeba1916b364f4a04759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4d9c5e16d5b1ef7ec017de9007631398

SHA1
737856b29e9227bd9cd9aed0da96cafe20c1cca1

SHA256
150fe16135ea9e4f1994d6007bac5daa3250ce50336241cc5e20ac02605265fe

SHA512
c101112ad0f4f9568bae5099c7bf8b9c89f416aeb1e6f3ed9a71a2f559bc350eb8468288ffa9644f36cc2413d2b257cb39fff27d3b83d1c86046cfcd1f0971f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62da7b72f124da5f83bf065dc2865fdf

SHA1
684312e7cb983924cd89c24b6d28ddf29e5efaa8

SHA256
c53c3e48a91643d5f2d71d8d3715b0465cf8f44f671cb6b6e1fce03b98dce7e2

SHA512
cf2ab84e04aef792a47b78ae23a18c28c0c7660045212d844dd3cb923db6592ba4f4327e0406c9863850bd3603c1d2d3fdfb156fa2caa73dd453b4544eebd697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
406a1d6fe0addf9a0229daccec14bfc1

SHA1
a9a18d2acaf2441f6de8d432ad34e759ab1b36c4

SHA256
1ecf0d66386f4e193bbd533fd8f59f04ab939bf4d680e168a89c720a1c97f942

SHA512
cc9a890336267fb6e87bc3a39896f383200fe27ded4210c6897e3ebdc95a7673f104324fdab383ab2c44b0e744befe4b7a40d42b5d7ad54db751b7fcaeac4c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a0040061bac65b175266dd7113a144ed

SHA1
799090e7c25056072c0eb9ca1058557f37381dba

SHA256
b8b2bf5aafff6336f0318924fef50f40f2b20c687fec6bb22e4e87ffa885d2c7

SHA512
ab2bbd0f8c16dc8cf6113939c623a5b62dd5bcace9a240df4a36a006594a5068ed9ebfb133ca9d5c8c5faaf679c11e775e839e3e3dee947d7aea57c74151a9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6068f029ad683b8ecd80a8b2a9ba7668

SHA1
2461ee1274196b95efe4398b02452ebc471bb47b

SHA256
f1e9679b4e8464f6ecb987233ec8d3f16b14945098b85d96ce04f93423351a67

SHA512
4aedffd5bd45704069a4a0fbd226de9dab0ccd83b2efdfc9ddcbe98231a74a8acb73a339f0aa3afe9774e8067ea1f7e40e8de6ae587c5bccd18004775bd7afa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f5aa.TMP

Filesize
48B

MD5
d078dab2318f8bb5e67c5e286fce8d36

SHA1
2a7f94fd41e5eca8801dfd561e8743f39e49b1f2

SHA256
9ef9b28cf4769763f150e8a505a9c5bf4432345b5344a32b2b6e6408aafbd41f

SHA512
8355544aee827172c717e192fa662515026a61429be039fbc0430b28b49d8cc56ca90055bb6f51b9131d179c5238c1ff71f4f49a8ea71f100c0a575bffefa05d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0c0eaea297311eadf4b80cd8866c76a

SHA1
2c2ada4a22eadc06c7d7b84393b407c04fce44fa

SHA256
1d77d9a72adc0ef948b839dd589b6e7b271294ac2778dc29649845fe9d7633b4

SHA512
18906bfcf2c0092d07953cfc72e1607158df62750f7835d7045cdecbd6ab541040c794219c484a35d76471d97ab34dd6ed9001299f002f6b085748d14715023f

Download Submit
C:\Users\Admin\Downloads\RevFreeAgain.dll:Zone.Identifier

Filesize
224B

MD5
96092273143698e84fc870c9f98d7e68

SHA1
6f2fbd370ba1df078f9d340f3559381bd2ef7ab5

SHA256
77d98d7bb8c3150df3bc456ca0c4d523057bb7979062e8601887d5b8ac40ec73

SHA512
5c96e4b63b74c6a26dd28da1774e1b4ffd59f2d7024d56f3357b2a50665938c3af5438cd00da430a064dc79718561098d4b9ba4e4d993d22a5ddf2f8d289e5c2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 613216.crdownload

Filesize
199KB

MD5
ef7498f9582cbe64fed819afd8cb8abc

SHA1
237e6c1f11204b55175f5ff7490855544e013d2e

SHA256
f3fe88098fed9e2b321c6a89d9b759b31ce8c79f31a4861cd53ba7a5445b4848

SHA512
ba5ae800e68cc5eef5b0b9845beb230fc8b0d0f4a608744097d46ca3fd7c4843925517c2956b12abb54382ec03c18bfe45e3449fd35f781edec8610a61bcfde8

Download Submit