hxxps://microsoftedge[.]microsoft[.]com/addons/detail/zip-rar/cmaogjomjgkhpnjkbmhiidonhanoagmi?gl=US

Analysis

max time kernel
214s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20230221-de
resource tags

arch:x64arch:x86image:win10v2004-20230221-delocale:de-deos:windows10-2004-x64systemwindows
submitted
26-05-2023 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://microsoftedge.microsoft.com/addons/detail/zip-rar/cmaogjomjgkhpnjkbmhiidonhanoagmi?gl=US

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3020ea58-d096-483b-9582-eee50301781d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230526130141.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

powershell.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2064	powershell.exe
2064	powershell.exe
3044	msedge.exe
3044	msedge.exe
1768	msedge.exe
1768	msedge.exe
1516	identity_helper.exe
1516	identity_helper.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2064 powershell.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msedge.exe

pid process

1768 msedge.exe
1768 msedge.exe
1768 msedge.exe
1768 msedge.exe
1768 msedge.exe
1768 msedge.exe
1768 msedge.exe

description	pid	process
Token: SeDebugPrivilege	2064	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1768 wrote to memory of 4252	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 4252	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3596	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3044	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3044	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe
PID 1768 wrote to memory of 3192	1768	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://microsoftedge.microsoft.com/addons/detail/zip-rar/cmaogjomjgkhpnjkbmhiidonhanoagmi?gl=US
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://microsoftedge.microsoft.com/addons/detail/zip-rar/cmaogjomjgkhpnjkbmhiidonhanoagmi?gl=US
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb70cb46f8,0x7ffb70cb4708,0x7ffb70cb4718
2⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
2⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:8
2⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
2⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
2⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
2⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
2⤵
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
2⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff6ab075460,0x7ff6ab075470,0x7ff6ab075480
3⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
2⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
2⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=service --mojo-platform-channel-handle=1868 /prefetch:8
2⤵
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=service --mojo-platform-channel-handle=5092 /prefetch:8
2⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=collections --mojo-platform-channel-handle=5100 /prefetch:8
2⤵
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6060 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
2⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=service --mojo-platform-channel-handle=5216 /prefetch:8
2⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --lang=de --service-sandbox-type=service --mojo-platform-channel-handle=1200 /prefetch:8
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1400,2605845428563634858,4682291182540487431,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
2⤵
PID:2160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
ca36eb371759d01870736dd83b1af0c3

SHA1
b89e65958f5f1ce2a6f387da97b1ffb3ca20f2d8

SHA256
383501ade6ac2f5ec7605cc4ca5c091a7d10be978148d15384ac4cbc37a4f2e1

SHA512
23e5fd444f143f29f8af0598eb4d4286a8a1041e9eff4d72407a03fe608d324bc39a8464bc901d37f31ce3af7964e559e5f4ea71d13a8b6bd37ff2e91af305c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
360B

MD5
5dc31ef85ad0b41a9cbbdb996bc00cf4

SHA1
10369a826dda6246562473bdaa7cf09ed177c9aa

SHA256
73828efb8281253d65ed4d9084ac3628813d34a32f2584cf0ae97a213e36fdd1

SHA512
874ceaa961621d77fd5573012e589b70fa5300c41f0ea742fd9fcdc4ced53efbe68202f5391e9308e468c0ca8866ef45b67015df1cd16bdff4d41f4107359e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
100241934ec5f7637957bec4a188d818

SHA1
600c219922de6a394c31c1f85e43807414f2a1df

SHA256
909a94866bcd69a0d12ab5e5841936f0523423e9b087a51abd93eeb1fc81759e

SHA512
8827cd2014b54e259be66b3276ed1c5b95789fae23fcf06af186ca17afb9a19f234cadbee2be13f6679e834a5004084529af34e537b40ffa5929ea78c4e1a388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
967B

MD5
eb954a49969be517dbf0bc44ff4e602b

SHA1
c523de0467229aba2d0c812361e220df1d446f78

SHA256
593c9f536d26e37af6aa26ff5d24f1b309e20ce8c5c0cd8ddde4f74ecb982286

SHA512
6d1442df2760cb9f8ccc4e4df06be2a307c36f19226e1a9a8c2115fb4866ceed4e6bb045fa030f0be5af937f532a59a19fdb687a277f4b386372e54615f830e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
0ae0910cf0dbf05542efd92969cf93f3

SHA1
9c8ffc7dad5f77df8cb1a8b77b8694bb53eeb290

SHA256
9fd4fbfc6c5c53e82fa7cc5fdf6b5b9bf88952d1195dab5c78d06ec746617579

SHA512
ef76cc87c260970773308385418add5ef64605d0ae8ada475503b7c9fcbc83d70531b3b7512564b25e5518fc60fd72a20ab93d5213de9de7bf75cf77587cb690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ed2c0a1a079f21d325d1977350db86c1

SHA1
56785dd29428df74318193b747ea1bf16156b72b

SHA256
52c1748940ad04ec479dc8a25d4ab48c4ca3554fc58f87db51427ef83cde7523

SHA512
55954d93a374fc0ffa06067b9fa7193b3c9a2fab075583a228f798211bd3a036c071254be21b890422ce2b623519575a984bbfaa19ee778201ea23f388e0d1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
09132760b841c07bb2a31e9e7214dcbf

SHA1
06bb740443cec3e1a9192c2be57ab522e5c5d61f

SHA256
338f34047dd5234833c25fc62887e70ad311f91e9e40d2d314add9ff640a3111

SHA512
05aa803a0a64b8ff0499ef0d60fcafb906bf670a63519ce6d825bee586595325834cbab6804422148bed8c76e1621a9a5265c4b52a3b820e9bd28703ab3c1500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a9f5389986e5b2f72d88eb155e1f8516

SHA1
97eb6da419eac30d9c9c79c24f17f0c49bdf7d1d

SHA256
afb7dadebff61b20d79fc3e46805441511984bb42d74ca7946bcc86ae8114d5c

SHA512
87777580c698aa34c5267ff05b0bb6dbd58bb7be321941ddce5c771bc1ab2ff31dae3e662d8bc35aa86e6a905a98c42467bc4a6797e96077f891154227692b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4d302b071015eac90d8e0169b885da56

SHA1
a36899c2149da06049a287c818f8e423a84e53cb

SHA256
6c7b343fa4ffadbf5e58da33db36d357990b4c9a4b62dad0c30132dcc0d1806b

SHA512
33611c641dee5a397ab8fa9f304938fb616621b81c14bff4a8ec44a22aac935c9c4e808afed6b1f412278d3680edf717b4f4de94bff25249d6abb693ed6aeae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
cded7f1ad1947a047d072afd8c4742b4

SHA1
9555df99201ce00a92c72e55fbb5446c00eccf4c

SHA256
21802ad77341fc68228999eec2519cbd7a2e7595e0e09c12709884aaecb18e3e

SHA512
8ee7b1b56cb61e1ec2a80c47b5b599a88b78360e45fc8a53b45f82f0c327b5a5bac084195920c0f593ffece7a3bdc09115f65b8380ca66eddd9d8d3aa5590970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
82ea7c3aafce26116337c5dc7d5978d8

SHA1
4dad877b4a0eac6762feeb09458f0a66c5bd4fad

SHA256
5c0ab6e93484a14fec2c3e51817ce0aa5a5ab7d05f24af7153eaa0e0675e0b0d

SHA512
2abcaac5857f4badf558688984bbf82032a747dc54d3beb35ad67737dba032c1b158d97a5cfbab906ece2a278cc6521f3ca4588b1f7def2d1f43fb03303ccdf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
5f42d561ff48ac390f6c04061299e4c5

SHA1
500b2b6a784547d73ce41157a5f6fa1f9fdf1dbe

SHA256
531739ae58addda66f94b756163894f3cf844593ba6158353f370f573008d2cb

SHA512
3525bd863f75571cc7d34f9363f356ca472d6460290e809e93be3bda92cf7e180631f10ef1c0c8e0575f6e93da481c515929058eeefb60f3e7a19e500490b8a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
c8641313c33eaf609de7841b5bf37401

SHA1
1ffdac4ff28a6e850e3c7cedd24503b7368e1050

SHA256
a784643a10629c41af684b0daa90d66daa8de63040ab3c10d1ca5f7268bdffb0

SHA512
205069ac7237336aec848929a0ddc5993d535fc0d2c385ec607d5367a938f3d8072af144089afb53879e19b9936638136d57eb8dfa41438fb14f1e9ad7e1fa13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
52b2fd9f806baf6eb862924960023986

SHA1
8ca78d820268a5c1c0c526001c2c3bf8d9ea4ffc

SHA256
e9db12a4597bc0156e77e4b629cd69bd416aa29c42437d38a232e06df2bcbd29

SHA512
09527cbbc5ff404d6fc9cd53cfb61f4a67ff06ea0153ac8ba05f47ca65f2d8ff9c3849c22c624d76f386e3ad21438179b2f9bf672c76a31b041c6b15ba2eb44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
efd97ea75d52dba8fbdf1871ff585630

SHA1
9344381e6bd5852b3daefb0c49598988e90c78e8

SHA256
d406d9eb36ea7fc48f26525aba73adcdcfb5a78d848f45282cd3812580a858cc

SHA512
d37589d6674db584d0f15cdc67430544c3564e6cfe4237b581bf9594195daacd4902ffc6ac15f9335ccdf98530564aa784ca736613d30152f072ccf062cfda80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a7d9.TMP
Filesize
1KB

MD5
b5e6f7802b9771a38bbae5f313bbc3c4

SHA1
fbfa0163da53cd28ca642b0a8008b09c55d14d28

SHA256
0bb6f41d1bc1c3818ba86e185b0ad4d2df6f6e5d1fd227718752198d0c42ed85

SHA512
a6330dcddc5a2b8f605778bf7c41bd767a4b0de3d65c794861be7281c149cd9f5a451b2c2bc5334f3e51667ebb919d1b36af0f92cd0e4515795e4041b7868f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
fa2fe560ce9bf06b8f8a08e354377939

SHA1
b75a1605ece23ddeafef290d9cbea5b66d365b04

SHA256
7d0bae8f1c03c4d5948bf340bd76460b06d406610aa3ae4fd6fb6911f6f84242

SHA512
612a0cdbf6b381b09d200c48d33e5d32a2f7601e104c3239336dc3fbb60716ea324412c8f4fd436f673de47957c73ccc3a92f7abc088a53072ca709a0b4ce79e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
a0cd81997539ea697d74acbe50f024ca

SHA1
7d9112e0c0e57676339a52b5e43e87460b1f9e87

SHA256
69505f2907b4b0fc97ef51c06823cf6cfea83da907421a4c77ac5f993d0bfa0c

SHA512
ab4078c654ebdb04a0339bbb154b71a9b0cda00059c13e3ede334755bde603cea0c8a7cdb409192419c9b7cd60e9a3f6025f2c4ca28c05fed2022e0d32a02eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
3af6b705c3ce8bceee593ce53459ff4a

SHA1
387e23243170a4f6ba56d2d66b67bcd69b9ab743

SHA256
50f64c854601cc4299286c9e69d4723c6676fd5ce90c6fee35294259899f9815

SHA512
e28b78ff8efbdd557bfabe06b7191f244f726065158b3c039ce3322c183f506b8394ce2472dad1c0759de4075e7b0851b07aa1b9e73b9710d74bbf9c292947b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0qpukxc.dbd.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
204efec6407ff69d0127ad8cc8bdcdec

SHA1
8a628ef48ff448b1999acd550de88866de6cde8c

SHA256
d1c631732a08e908bf2dcc6cb1bcbb43f4f54462ce0a2c7cd9bd47c7ea8d7be1

SHA512
55477d00d55855119df82175a56e720e4f33b69f66035db7d3c3e5151a4fac4f29027a011133f94a4f909661339094b6b4b05bd177fa7b056cea9e30bdeaa6af

Download Submit
\??\pipe\LOCAL\crashpad_1768_DIAEIOAAGWQCLFMQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2064-133-0x000002A841140000-0x000002A8411C6000-memory.dmp

Filesize
536KB

Download
memory/2064-148-0x000002A828A60000-0x000002A828A70000-memory.dmp

Filesize
64KB

Download
memory/2064-147-0x000002A828A60000-0x000002A828A70000-memory.dmp

Filesize
64KB

Download
memory/2064-146-0x000002A828A60000-0x000002A828A70000-memory.dmp

Filesize
64KB

Download
memory/2064-145-0x000002A841D50000-0x000002A841E54000-memory.dmp

Filesize
1.0MB

Download
memory/2064-144-0x000002A828BA0000-0x000002A828BC2000-memory.dmp

Filesize
136KB

Download
memory/2064-143-0x000002A828A10000-0x000002A828A20000-memory.dmp

Filesize
64KB

Download