hxxps://theannoyingsite[.]com/

Analysis

max time kernel
21s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2023 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://theannoyingsite.com/

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{35C62B44-E574-4FCA-8D3E-00CB65BBBDF5}	sihclient.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
4860	msedge.exe
4860	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
1800	sihclient.exe
1800	sihclient.exe
5668	msedge.exe
5668	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4044	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4044	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1988	2016	msedge.exe	82
PID 2016 wrote to memory of 1988	2016	msedge.exe	82
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 916	2016	msedge.exe	85
PID 2016 wrote to memory of 4860	2016	msedge.exe	83
PID 2016 wrote to memory of 4860	2016	msedge.exe	83
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84
PID 2016 wrote to memory of 2124	2016	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8be6c46f8,0x7ff8be6c4708,0x7ff8be6c4718
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,14235268740217125218,2055775325025483050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x150
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
PID:5236

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
PID:4960

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv e53PHlbzfU2a2Lp9Taox1A.0.2
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
1024KB

MD5
2fe924eb16f814a9008dc97a104856c8

SHA1
f9d78de81408385bfa4f1184385e332135e1215b

SHA256
2eb791e0e334f9cab3d281b689785a0002b4f41ff76ad0f4c400179250d941d3

SHA512
58c24eeb11382ebd40211ce62de89c1cf0c7cd52e7d72734f13ccd0592c49ee7af2eaef5e376cfd59e72f00f86f819f1e248f1d69d34dc0654c5153398ac11ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1024KB

MD5
66e8d3f233fbcef98b88e11acbcf6ba6

SHA1
2b8b441695468ffcceafc2c4820a64632a98ced3

SHA256
28e490622aa7aa0a7ca15f3b804ec193205908d99b1402594b08252d71e7c731

SHA512
d151aaa04e68f4f19fc403620eb68525bd3e064b298ac6482917908e14e28f7b9970e8651621c682ec8cd04bf963cd716a5decdc43234863415c9c753015ffdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
1024KB

MD5
8a1eee5e0d7a9b9af323a96c9edf26e0

SHA1
b42cbf325c781ee148cdf73f348e5247edcb90cb

SHA256
e21779687cc413c3bf4b061d09e02782c95ebc510656be5f236dadd3e3e06de7

SHA512
6921316354aec68b001bb7a5205552dfca2f369dca6d1ac21d5ea6ba548edc75960668b386c3587896647da728e30ee0a1bcb950cefc2f09e424307c2eb52fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
21KB

MD5
f0d11cde238eb54a334858a3b0432a3f

SHA1
7c764fe6f00cab8058caeba38eb7482088a378f4

SHA256
579adf148a5905868140df9075b90a2ff33c9070dfd35b3ab869a2d9aacd9a96

SHA512
b3e590c88b462004b29ced18027f640addd1ea6ce9ae584820054ca508ce7d626acb3bd729e3693b50ccdc5e4694b1aa400cb33a315a475de47f5b25ed964d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
67KB

MD5
d8588a7d7bb0b66fb439edf73ee37563

SHA1
a2398d543e3fbeb197e2128654bb5a1afd599585

SHA256
2210c60cbfec62e2bebd2c77783511100072459b3d0cc296216eab8e72d8af35

SHA512
7c87e7b4ec1d643ce2672ef9badefad6832c6fcc4053cedad2d34c52004aed4e0a589e2f839ace7bcdb0f409fff836ca7ce20dc882d9982568176d4b1c830bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7776e4dcb3082b78f1a60bc39295652

SHA1
479142dd050d697c896f37a274469607f75b1eb1

SHA256
8daaf327bc49d382c3ceb9143db3202a7b9418a91ea82bba3a051261f3c44944

SHA512
cea2a6a255c67d5d955f5082e44ca42266084e10c93c1bad877d135c1cc06aabac2dd8778d7cc1c0adb5de4d46b93a73b4a58899a1667d5c5cabb7ced35ba9eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4ec5a47e222c2585a87799c0e9ed0fa4

SHA1
696649009ae15af774959575d3b78070bccc72c9

SHA256
8162221ca819454a7e775a8e8491fd97da6ee70bbea0014645024823673e0d45

SHA512
9ed1c40fcc6727553010b6fded4a89cd30b52a4654ff518f42b1edfe93120e7cf43a0504fd9c075af5af4da2f9852370736d53510e0f4cc325baac314dac965e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a9a6a1af577e5fb4874adbef1c2b42cf

SHA1
5a4edb35e0d25a55766d5eaa3150e3cc67c1ab81

SHA256
b7bc8e0106c41415afd02054117fc3d21d63946dc75f0d5b3e1736978ca81700

SHA512
88b45ceebc06b91f809113e09fbcc677f5ea7a6773a9a5f0b52bf839914b921203d0a0ef0b58cc623e955ac3b673e2b32d63b55cededa2b91e84e35d617f8abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5d655c07374b26629e8154db842bf2ae

SHA1
034fcdcf7d79c199265083a653a15a497c9af692

SHA256
9bb73a4309b6f7b49f0ebb28ee3cbdf9d8aa7658f08a40e6cd86063eed9842df

SHA512
8f6b47fd68752627d915eb5d71fd5b0ed97620f3c42468400b170e6a7704d6fc200a7caf9b79dbe4d59e969ee62681526682b6fd3d9f3fa2b5091ff71b2f7f79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8d0f68b5e58f237b123bc87c7267c040

SHA1
feec84e94b605b23a3d07b5d1d51cb56c9f9dfa3

SHA256
7d3ceca839acaf879a7801cbd83e05a926a93617a507cd3bd2975f46965593cd

SHA512
9b0b9b1a4d776f37649f90e3b070b19a5418f92fadf510ffe58d77737d9fb5c1bec03dcd83b5de215dceacdf832fe14ec5bf127fdc77dd840a9d4d3fb77a589c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc052d874ea61caec17b7161b2803f69

SHA1
b974b71414f37688ea59956b5fae42a0e754d4d2

SHA256
14024043a2342a66a184f4bdbfedcb32ce4dfa408525208c079898b859399de2

SHA512
4d7fe5eaf1f4d3224f5be83e920d63dfb3b70073eb24d97170831d8c02829ccc1a434f0fe0d0173e48e1985e2da28dd78c2d7da256b58bbc69a04e826a45ccaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
58c61dd7b7078ca352c8315f852663a5

SHA1
3165bd0c6d93cb76167807d057ffb5bdf8e27023

SHA256
8e0869b50b91c0be345ae920f52588b5d1abaa7131278e298778a741e4db8184

SHA512
dbc4a66284c838a6a1e236d5ac5be2ed8b979b90380df338b88459b6d003d351f9b692f6f5fa6f7be09e8fa2fe393f55572f06bb1e40154f7da3d170d4171967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
77848b8c7d9922f3bc95d8f47a9b984d

SHA1
8b581be5b97e96e6dc2aa38b97d6b9990240575c

SHA256
5de6b427a7253bf08359479fa519391a19f9d1fdf54d934ccd7ca4430ffa3307

SHA512
8492b58b94d782a8921c4ee4b983790f3d59501e190224baa0c5a561f59feba61e67edc6dd346b3f778e203ccb1cedaa1d739ea18b35b797bf55fc46a7006509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
53c7b2cf2f9e0d26af3ac1e5322cada2

SHA1
8f9127d474791e9270056187340022aea341fce3

SHA256
016b1f8b284120c8e36ad433f09e5c34f1ef52d2ac627b79e431d0f45bff664b

SHA512
de4e8469ae1c530abb367c01423819c787b585082fe566505143ea87d18f508c303f321184310d52afc4d2a81b6b425d50c5ed36943b0e8da78f6fbcd851353e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
266404c2e5850322c5d1872ce48a5b5a

SHA1
7b8e1723b1b6b3a4d2b4f491bf3b53554879e8ee

SHA256
32b66e0a90e9800fff90dfb116d28f074ca00e0b600650ada504b52322d64f54

SHA512
bfe711a157bffda9f623b01dc255aacb5e3b3eb303b1a8b7a17cba627616b4cda0d5ecb716043573be058d9b8228e82af774cf1cd7a9857be31b5f2159476678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d263.TMP

Filesize
1KB

MD5
d860909aaf5134585d7b022da254fd19

SHA1
ae29639660597cece5e34243c385d3087eb0925f

SHA256
d87bbbdcbd54a6501ef0a915e13889d3763105d6225942f7f19d5096180840dd

SHA512
3632f2c634211e70f457b455eeee5ce649b3d98b939936e79699bcfa20ce2ed6a69b54aa9387b2382b3304e46434f487e7b619e1467f0cc5220d4239b0f2e0b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
4523910cacafafc8dea69397eef11226

SHA1
fb1ee2ff95abe8b7297dcf49818f4abc663c0ebb

SHA256
7d3e336ddea6114982a50c87ea9db05433352579fa7183f8302a6baeb90fe2f7

SHA512
c17350729e1c501a3016acc18367cce9cda8e63399c4f0cad4bb8084638aa937cb3c68d02a10258f3802b05d84d7144d1d8dad1d1ac790f8034019addb9f863e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
02f3be6664991ab232d4fd5dc2d9382e

SHA1
54e8601ab131ef6009ad1ea26bdb742009ad78ef

SHA256
36d7cfe9af66feaf8557235d46d6548cb2f78e000e2c2125fef4652208ab5cfb

SHA512
a45f646d92f6da7c0b62ac0dcd8103a91e8ac26d448877cb67470ffd873b02ea6e65943dd891c55ce228460814ce72392a951fba1ca9f69b2112a40d5b169615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
d02c71d1fcc8eef4913a37bc42d2bd7c

SHA1
ad23ab945bf2988d84546afd366f428a0faa1503

SHA256
6766d705546664c38e24d685616d7a017808c5b1a2e5ca8d7880bffcd3467d24

SHA512
b30b6fb47f7c853eefcf5f735d05129b0d871b23c3c122aec627732c74b42a6bf331bd6bdd94abd273e1a21cea45e591f12b8b969725f7a9c003c4957f541b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
07416f8ab3faa087e91f7bea79ee3b12

SHA1
cbbd4c1dbde3c68ad75e8976dffe1d135e178d2d

SHA256
8cd6a2787724a5c588067ac5292f2593d3cdcbe65abeaee79ece657efa9f427c

SHA512
a3df1cf7df7f8263607c709f8f6a1f523c624b14a7afd71adfb5c0dc595aea88112f1e5dc3d6143982a06e58a3e2354afbf21c20058358b2259d9ee841649bc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
72c786b3d22f906c4f8d83fedf407446

SHA1
81415e0f242f583bb7102e7d16e2cc6ba59eb37a

SHA256
f6e076657c3c3d5f28c084cb948461de21a0325c5f6e26073d3919d4a8174234

SHA512
ef74a536e981df70d5010faa43218001380aac9800bbf931f7c7a1b34d0f9e78ab70eaf55696c2289e9de862b1d32e6139967ae66f9aaccee4cf7a46fbd8ee12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
67c8be9d00e3977d5c8412722a45dc16

SHA1
5b95e05b6c8829fa20ae0fc6c4b7d44461f00ec4

SHA256
12f28ef239c59c29cd3e5b3e741f4c95ff68aaec99f0ae98375fd109705fd66d

SHA512
580553ce6e44f63658b512204727d17cfad528bd805a9975e3968fe6e5dcb72dbcfdc645f0a22172f9de1ec81043406406b5e6880f0310c15d6fdd08f911f9d5

Download Submit