hxxps://TheBreakdown[.]xyz/MCLauncher

Resubmissions

20-11-2024 11:31

241120-nm2f7awbmf 5

20-11-2024 11:30

241120-nmm9kawbma 3

Analysis

max time kernel
151s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-11-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://TheBreakdown.xyz/MCLauncher

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1660	msedge.exe
1660	msedge.exe
3568	msedge.exe
3568	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3632	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3632	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4768	1660	msedge.exe	79
PID 1660 wrote to memory of 4768	1660	msedge.exe	79
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 3628	1660	msedge.exe	81
PID 1660 wrote to memory of 1164	1660	msedge.exe	82
PID 1660 wrote to memory of 1164	1660	msedge.exe	82
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83
PID 1660 wrote to memory of 4756	1660	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://TheBreakdown.xyz/MCLauncher
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff058d3cb8,0x7fff058d3cc8,0x7fff058d3cd8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3900 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15825809500584464061,14368108119315056757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
0fc89d24f97d3af36c5328c0106cbe46

SHA1
3b15ae43a112cf8986045a4cca23fc13eccbcd05

SHA256
68d377fedc65cbae9999dace2486e938e2c9df1d1d1de42c6f0f0019dc800fd8

SHA512
f97742a427204603225933b3b7934b22188bdeda84b5b4f4ed91956e76d4b9fb0170154c35118a371bfcd3e719b36ef5f52b1ad6661cbb6e90641bbcf3382a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ab6a16e08ae891e2e190cb9902ed30bc

SHA1
f831a856fde8790996f0c12bb4f8aff2827259d3

SHA256
d093014e6ed2f316672544e5d770702f8dfb01de1cf4c6c2fa638eac50fa9b1e

SHA512
380982b913f873ccf3b65ff49dc2ddc1799264f02cf32e6a8767abb33e7abbccdb14360e9b473cbfb95b6a33fccaafe96e3461c26386d5fe7dd57d3648cb6ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7338955851d277a4bec6e69b383e7798

SHA1
e4a97bae496019c4f44fd7d0f94c1a578795ecbc

SHA256
fb437dc4b5080199d0bcbf2d61066f4e81a4c27faf527bb7482a58f09edf3d9f

SHA512
98199d62f562ec5f6ca30900a0f15495e1dfa3fc1440195a751ccb7b55b1d37b1f1e2027fd408d9a7c7ed4e3177c4573c43db21c6d52c07c65c16e68b8295d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b69ecb8c4e8070225016da5cdf8eba6b

SHA1
7db39ac233338f5a93d410da8192e8e9168a74fe

SHA256
72633238fac13b6aae57a1258b16f973a51ca6cd8d1d9cf77617f9fbc3435527

SHA512
6997f897b0335cb598c12a4193a07bfa11af05308a038f375d656cc013e98fa5ee433b7d34b873f8f81ad91ff7f2954ae5e48ad260de4d2f3420a15774ef0ad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
195b2a53c0c0fca5db191cc2f4b37529

SHA1
d698ec51949ab665321dc8cde25da1b49eff93cd

SHA256
d9505d702430178bc05424c3036291433b899b48ab4f62953ae13643abe5087c

SHA512
ae67e101d04cf6ec57e6ca2f022bdc793c890fc6accfc1d2e868f28a0fccb1c18d510ded5582f5b3b53606403c11c759930fab640b586d9a7c5d8355cdef00ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3a559e96e50bd9e3d68a89b3d8e1ae8

SHA1
0228e943e4a1d66760795a40a083711602010084

SHA256
79a4cab65aa1352a957193e946c21823644b94a188392b2ac80b0133cb65cc50

SHA512
75d2e9cfe76dc2ba53994195695790c26144f91ce358ccc9effdb7049743fa8754357ecab3847d643a2764d7e24629debd8a64d0d41d81e26ecbdf9e212117b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9aff542a415a3bf4abdd68a1c832f1e

SHA1
76f6ce98763b523394bd71631ffb679fa66ed9db

SHA256
5d59d7ab112cf30a93b87357086bf4e870d89ee23eab1964f8f729709c9079b7

SHA512
8aa6917e76cd578b8fdb64256cb7f67874fad9b17f958ae607fe6ce73b6eec9850df7f8de89a79d321c8c8354b9863a11bbfe415cbdce2fe87f5c0ec4af8fe5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d90c22b77bca1c356baff8f969b01b6c

SHA1
e1aafd579439964e181ab117eed0c4045cca421f

SHA256
67d40018def0bf92e33f03e605929d3710eb5c16ce86a5f3cabbae8d8cdc6337

SHA512
a20b333c94ff85137976ee737002e7d4583740babdd9eeea69cf8d0e29bcb62af3ada83fe8038baab4395c70de0beecb09e95b407eb2f9064c56a7a94753964d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40c2cd9903abf2245244f92dad88db45

SHA1
7e4ce06efb1be61ab2058671995622b90d181660

SHA256
3019622c9600b4138b81fddc35c5b5a4ad84f70e1650473c03c718c72becdd20

SHA512
2e0bf5c3df87d50cecc5492392ca47b80466b6b8b90939b304ddc9ba3ac72061d5b4408cdea8ba4e2a8532ab6d429fbd8aa2e112d1ed50961a7077929bf336b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8f114de6dbbfe882d58f2fd7ea4d8aa

SHA1
bd9e92628fff12237c61144196db21bdb5c0e5ca

SHA256
7f777327491f5918cf83b22e26be0539827f0389222e110029716c1d10c21c95

SHA512
9e75f4f0dab3f5aea36a9b18961201d35c03bd8effe5f6fe9cae6dd2f3bd2abac9d618f036d46b7cd1021086c2462832e54a4ee3b9cd74fa1429264828611483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aead07b9e01391c68518f5ad91171215

SHA1
f6be9a0c1c00f4ced283b52380f5e83e823964c8

SHA256
51d742dea6af5b8ccd73c6baa2e07fb5066457833e4a3b7e97837b8477816bd8

SHA512
d759b24415f4371cd8bab8d555ee7363771aa6b01811edd86a0a46675550ac613232bb99a5cce45104f4f6a453731b7441dfb7cee36485db50b49fccffad4f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8ea4835f81e3c8661d1c40900dd16f15

SHA1
6c178df7f3b61c6177edf27d4e96589c0f2da610

SHA256
7114ca7410dd635c46960fff507c35bc1796977dd35fb21dac510ca9768b4650

SHA512
ea377d14ac4052e9cc4967f7acc634e8a1e52a5231845a7a6cf7c6bbcd6350d8e22600e540d2c3354219ae731119e78cad9de5e10e3ab21d59b8f593ac4a1c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e53f.TMP

Filesize
1KB

MD5
dfaaa7cff8994663559649db02ac4da9

SHA1
f30a1becee42340268d8c8718bbb9b842d04a1d2

SHA256
41d50801d3d0bd2cbddb8c0c2c7ce80ec03184281cdb1585aa49c59cd0ff4d8d

SHA512
a3542ebbcf08736c9a6c967e8f2f05d1c30b0b38de4a25b2d9318b65de74ff79bad2a7b0bbfb1fb0a3358b2925072d9e66a9941947988ad00c6c78c5986888ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
179179e9b79501802cc3d711143e2cc5

SHA1
c3e2535dd7b6453a5701ee24a3232c9c82a9ee45

SHA256
d0a8f77249b28cc9fad21e5e97f5e68ad4712d89840d43f9df3dc92067399b5e

SHA512
9a10e88cfd1462045263a644cca7c08e5978dcfc5dadab8da952df5dc811eebfea73bfc66bce6cdb64f616bec09fb33aeaa42ca6882da51cfd824f04f3d27fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bcf0126cf46280540f6737d1ffdfc15f

SHA1
d08f40c5e4447d60b8e00bfafdecc08cd4a837c3

SHA256
99d64a4b85f9a0cdfd264057ebcb21361005f365a37e7b75050c8098ede245cd

SHA512
be2acd8bd8e9545300554da4f0130eece29869d0ab1b496cd21b6bb59b2a435e34d322c84a0f4d2d684741c9defc1fffd1a8fea18eeb18bfa99f7dfd0058f5cc

Download Submit