hxxp://ncxplayer[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ncxplayer.com
Sample260930-tsknhscf47

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3828	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{73DC24D8-C5C6-4C4B-8509-98D5E84C45FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
220	msedge.exe
220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2568	3428	msedge.exe	86
PID 3428 wrote to memory of 3828	3428	msedge.exe	87
PID 3428 wrote to memory of 3992	3428	msedge.exe	88
PID 3428 wrote to memory of 3992	3428	msedge.exe	88
PID 3428 wrote to memory of 3992	3428	msedge.exe	88
PID 3428 wrote to memory of 3524	3428	msedge.exe	89
PID 3428 wrote to memory of 3524	3428	msedge.exe	89
PID 3428 wrote to memory of 2836	3428	msedge.exe	91
PID 3428 wrote to memory of 2836	3428	msedge.exe	91
PID 3428 wrote to memory of 2836	3428	msedge.exe	91
PID 3428 wrote to memory of 1684	3428	msedge.exe	92
PID 3428 wrote to memory of 1684	3428	msedge.exe	92
PID 3428 wrote to memory of 1684	3428	msedge.exe	92
PID 3428 wrote to memory of 1036	3428	msedge.exe	93
PID 3428 wrote to memory of 1036	3428	msedge.exe	93
PID 3428 wrote to memory of 1036	3428	msedge.exe	93
PID 3428 wrote to memory of 1820	3428	msedge.exe	94
PID 3428 wrote to memory of 1820	3428	msedge.exe	94
PID 3428 wrote to memory of 1820	3428	msedge.exe	94
PID 3428 wrote to memory of 2084	3428	msedge.exe	101
PID 3428 wrote to memory of 2084	3428	msedge.exe	101
PID 3428 wrote to memory of 1912	3428	msedge.exe	102
PID 3428 wrote to memory of 1912	3428	msedge.exe	102
PID 3428 wrote to memory of 3604	3428	msedge.exe	104
PID 3428 wrote to memory of 3572	3428	msedge.exe	111
PID 3428 wrote to memory of 3572	3428	msedge.exe	111
PID 3428 wrote to memory of 3572	3428	msedge.exe	111
PID 3428 wrote to memory of 4664	3428	msedge.exe	114
PID 3428 wrote to memory of 4664	3428	msedge.exe	114
PID 3428 wrote to memory of 4664	3428	msedge.exe	114
PID 3428 wrote to memory of 3492	3428	msedge.exe	118
PID 3428 wrote to memory of 3492	3428	msedge.exe	118
PID 3428 wrote to memory of 3492	3428	msedge.exe	118
PID 3428 wrote to memory of 4500	3428	msedge.exe	120
PID 3428 wrote to memory of 1896	3428	msedge.exe	121
PID 3428 wrote to memory of 1664	3428	msedge.exe	122
PID 3428 wrote to memory of 1312	3428	msedge.exe	125
PID 3428 wrote to memory of 1312	3428	msedge.exe	125
PID 3428 wrote to memory of 1312	3428	msedge.exe	125
PID 3428 wrote to memory of 3516	3428	msedge.exe	126
PID 3428 wrote to memory of 3516	3428	msedge.exe	126
PID 3428 wrote to memory of 220	3428	msedge.exe	130
PID 3428 wrote to memory of 3612	3428	msedge.exe	131
PID 3428 wrote to memory of 3612	3428	msedge.exe	131
PID 3428 wrote to memory of 3612	3428	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ncxplayer.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa352cc188,0x7ffa352cc194,0x7ffa352cc1a0
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,3960407416917328860,6730247604893034440,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,2570255696676286518,14761570281075383663,262144 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,569474912733849837,17558808809419682113,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,15579187653640604093,8443702922823937128,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12944809601450743577,57956286125098922,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13524005680050698915,4032067804860038648,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4392,i,4371528597264316724,18024590202121743789,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,16449369082644139586,15438017576882480161,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,12689309987654562524,17727270260195914606,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3599867549591788583,4622836741952985698,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3599867549591788583,4622836741952985698,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6140,i,22113504509952562,15280986572203612848,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3520,i,7140634144433216516,1445100119457074082,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4952,i,1010760499748077133,2524057807103219942,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,12548798155438464351,6721278547091467332,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,9477106007148965487,16416106076495698498,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,18043345917000991794,16223565538422878854,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5180,i,8808690225441389544,3765684341622684923,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,17842629135381743143,5484929565641892222,524288 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,14414758426697633834,909913038771709985,262144 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4388,i,14514160770332692430,5510912179918592921,2097152 --field-trial-handle=2272,i,9593195661076392731,13757407261059376051,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 84b2eea17e8fd6254e0d6fcb0cc3343b5a46a690020da8a09765ec45f42f5ece
MD5 4f89dad6015501f62f7a85fd47143684
SHA1 b0532a842c802996709e461f824b9b02737b88a0
SHA512 ee713c6ead0d2e4f7d8cce2ff3ec1566b8d2d5ae5c2ab9926be3319f7ac6164479d78ab0b5d987b0f44223f54c697a6a9d90c2335995003876eda680937b3eda
TLSH
T17361A48014908CF5F7AC713C93DB2487B236DFF950875E420769EF399787B9A51E0190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591ca6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591ca6.TMP
Size 3KB
SHA256 638f7c0786fe63c0bbf5db59929227fc8d21090377f9e83e12db08e17e5b5745
MD5 24e0b3a6e42716536bb8274d7664f31f
SHA1 4b96d4f004a974682d8c82852678e4e9da26fb9a
SHA512 113e7c19d9ba65e82c8c76dcdff9a195f0dc18cd20f09910bb7cd12956758fa297cd05f15a2ca0dfca4838dfb1de21b0bee0061917ccd5d30b5c6c7f772de30e
TLSH
T1CD61938014808CF5F7AC713C93EB2487B636DFF950871E42076AEF399787B9951E0190
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7854e27bc88edc3db661d2ead9de7d977e7ffa30615a060d6b1bbb7dba0bc0d7
MD5 22209766aaf1285d05a0d5016e08937f
SHA1 0c05a0843aa90d5f9855a88c87137a75596eae27
SHA512 97efc2df1c9752c7a5cc3e6b7e72419783c8317e9fde03452ccbb4c84bc17efcc163c1b59e4406707488baaab5db655239db33b5ec711180d7c8b746551f7eca
TLSH
T1AB117DF3C3D585AE8A0116F09A24AE2BCE1D0606821C7D5986D4FF2793E3475D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2976f42f8274c2c0257c93ebc513578fa2390d6541016c7007df6890724b98da
MD5 a13d60c098d8fd5137b918e4afe8825c
SHA1 ab33ec596304d9112a9aff66895555078bdba618
SHA512 aa6c151a5205131e8eab72a62487c70d3b8cbbf9c5e92722ef3e5305c31a7a54266c47149e19818abad5084a1e0ba7d4a4b136a151f98d746a1ce587dde922e9
SSDEEP 192:sxZDRzWs/f7sE4XIdpPOHLB6+WNGYgUVaIgrJ:sxZDIs/f7st4GHuGr9
TLSH
T1E722A7566E28A97B8CC7D21DBA15BF13E5F91032A1D51E88EAFCD61C04E6ADD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3ea0f34d1b9aa3d63e61f72aeaf7dad909cb0548c44ba11a45878eef4d122f2c
MD5 781eb9b06d0838dfcc7bcc06f327204e
SHA1 7fdfccbadae57410250115a079d8a2ed6d2d4e03
SHA512 5d8b6d711bc3eaa6730e8f3fe69123a31a7a26cb0bcff7e56acfe12d2534c4d22ad878e4f259aab9c4c6aaad482453271d7a1331e97ebe967be7fd05df93b0ac
SSDEEP 192:sxZDRzWs/f7sVY6XIdpNOHLF6+WNGYgNVaIg5MJ:sxZDIs/f7si64sHqGEO
TLSH
T13A22B7566E68697B8CC7D21DBA55BF13E2F9503291951E88A6FCC61C04E7BCD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 790dc8d644355348f22ab95ce13ffc94d46dabc4087f5958f9737c42e2482721
MD5 907082a7fa316800aa756854e8708cbe
SHA1 0067985c09b34186d81ae0ea17165080d9f746f3
SHA512 d9c739b3b398d94c1adc9ddfed312d3fbe0d80cb7091b802f53a0ff2e0ac25c15fe2d2552b32d6899ceb2f8a88e46c306efb640238334a9736c9578f7bed1fba
SSDEEP 192:sxZDRzWs/f7sVY6XIdpPOHLl6+WNGYg/VaIg5MJ:sxZDIs/f7si64GHqGOO
TLSH
T1D522B6566E28697B8CCBD21DBA15BF13E6F9503291951E88AAFCC71C04E7ACD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 00ab16291ffc46319d159823a1b2b290076f023f89b5479c67ae006116918330
MD5 8206d3181a7eacea4202d2bee4f3d3f2
SHA1 f2cd933b8881a58e06001dc6651cf5b84d305712
SHA512 c0dd15b34c9e8f177ed46504b2dff461261c22891d6fc84b32a94545f79f4033c00f3018ce06b0a9e8c7827a15a85a661fb6fa4555556c951c27a6e571892e38
SSDEEP 192:sxZDRzWs/f7sV4XIdpPOHLjVf6+WNGYgUVaIg5mJ:sxZDIs/f7sm4GH3VcGrk
TLSH
T1A622B7566E28697B8CCBD21DBA55BF13E5F91032A1D51E88EAFC861C04E6BCD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ce9f66d75909630e3bec642159953a9e0973c56c811b587de92f8f0e08e4e23a
MD5 9c719742fc7649ba1668ae0c4eadc699
SHA1 d2f650ee95e029422aeaf56cb4248b58b0be6d3a
SHA512 f2d170a78c681c5e8e6bd81dc4edc30e1442527135ba0cf3f9f30e597de5ffe4b7556e71145810c77c02079000d723d335e494226d91caf42e2fa1de69d00b33
SSDEEP 768:4NichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzProH4G:4NichfPWvPZplu1jan+LKgzcYG
TLSH
T148C2FA3B644CCB7E4FC01A9DDD5A6F9B7E9802C7A6588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ac0b7992b8556c5b1ba7b87b172a7122f60b02f0d0457cb626c8a780bd5843c7
MD5 d096d24735962e04b46d689511bf19d4
SHA1 d77ac5568f82769611957707cbab6f01fad8330e
SHA512 a057cec3d802bc3670b57c13281ef96e3b169fb96338da40fc87e717bfff9a2b16d3b9f7f2288c0fc9e6358d10a22a7c8d1cf7859f51fc6048fc6e74259c7eb5
SSDEEP 48:K0QTNQTsQThQT9QTPQT7QT/QTgbQTTQTmQTzISQT1QTgK9QT11QTXQTgxQTlQTw+:KoN+KmMqGFKKWsR/IKzyiv
TLSH
T1CB91F11130FB0395387D259896A59A1E024231F33168F96B7BBC44F95E2BE180EFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbd02fa9-326d-4667-bb7c-d67ec8cc1bb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bbd02fa9-326d-4667-bb7c-d67ec8cc1bb7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 196dc53df52e13e3cf45d29508dff9e1f561b96e415863f3c700955fa351b73f
MD5 972aff70db2103ee4f6a81f54068b9e5
SHA1 09aed0ca11963861c3ce8187a4808b5e7a57ff93
SHA512 9268a20144d7c3e1c984464cdb6aa8b64c030dd8f0916634c6baa620722833789c1a0a4aa0140a35778e45533ea845fad04ca86f62f3436c969ee2a530a0831f
SSDEEP 384:LZcIhsNC3tHm5XDiBGYX5Ew8+8jhEtgOIwZOy4Coz:ThuhMGYuw83FEXscY
TLSH
T142828E72DCB85C7B1CE7A245F54B36138FB88027A7C4AB9495EC5B1C01EB698130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 7f45b9f18bfabab39de0787ade577fd35c08dfd849599f3178cc16ad62f42b13
MD5 83a7da14b25fb9825f9af95294b43d92
SHA1 3f37f326297752bd4fbe510534ea1a24c484f66c
SHA512 734f009b7882b2e2781e841b7ffae851687f532ccd284845d99c5c50bc2db19086b0fc92aae45c18bbf84c732e34d0fb77b04c1cc5376c2a9419d546bf57105c
SSDEEP 384:QiFiZcIgzsNa8TUNTUlIlatHm5XDiBGYX5Ew8+8jJEtgOIwZOy4Coz:rFQ8rwgThMGYuw83VEXscY
TLSH
T1B2A26C7388B89C7B6CF79A85F54A32138FB44067D6C5EB94E6DC5A1C00EB5D8130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5accefa7954f61550ca6eb3fe0e082fe725fb1524198413ca63816799d36f3e5
MD5 d7024f6ac46c8fb41e783708edef4694
SHA1 1228d2a6596746a0d2a5ceae3d3ee433d96a0fea
SHA512 a53f767e0de52cab6e444f7fde6d178b618ebe1aa974a813cbdd3e59e356b61fdfa20cb1ce065bbe3074610fd31219fc5782c4c603a6e665a62e86e5fc413d42
SSDEEP 192:LJONz6DphmqQmiUy0Hq8wGYX59ezZCbY+okk7DFU6:lONz619zRwGYX5Ew8+2ZU6
TLSH
T1E602D835E8796C7B8DE36E55B54B3A239FE4112FAA906F84D5E81A1C01D768C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 350a05fc9947f5271be1c6d86daa96266d353a57122e3c6579ff19731390b1e4
MD5 f21e10ff96941be740169f7de6366939
SHA1 cf7e24729eb3f41581f255b36a6801fef87f2585
SHA512 be4c44c64ef5785ac792f1e54745f830c8c517ee0db72725b51518c5c7de26ec536230be92d90e408a6e4ec904440e9e2e53c79d40d979f75ede66842c904c1f
SSDEEP 192:LJONL6Dph+qQmiUy9H+wGYX59ezZCbY+gjjvkIIiq5poU6:lONL61V0+wGYX5Ew8+8j4EU6
TLSH
T170121A75E8B86C7B0DD36591F48B3A239FA4522BAB847B90D5EC1A1C01DF65C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a9804c8aceba06abefc33e8cbd144e7bc4b5752b04c47a6e07ef1651a23cb709
MD5 415366d1bb0f711d8cc52fbf7aa9da12
SHA1 7b2e33c18e74544766926d59c54c4ea63190b235
SHA512 d77a44e898f8ee32d0479f5936e8b78b7d375c180522b1984c35e028925ae718fb7e6e775270a7c308686335c477858eac8f894d614dfaefce00ad732aa63b77
SSDEEP 384:CZcIhsNCatHm5XDiBGYX5Ew8+8jhEtgOIwZOy4Coz:whvhMGYuw83FEXscY
TLSH
T191828E72D8B85C7B1CE7A245F54B36139FB88027A7C4AB9495EC5B1C01EB698130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f491a00-c064-4565-9529-57ff20e47547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f491a00-c064-4565-9529-57ff20e47547.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 20b989d22977575dbdf17a5e4052d730f17353ad2925302d377db03977914436
MD5 69185f1f23c1609a8be0326cdd4314e7
SHA1 fdde4f8fb7274a8507ec350bd95b53fa99162446
SHA512 fd4bb31452a361ec8e7f903b751e43e0428e4854b37dcccf022c15130701bd6d7e7750b962fe2187f9cdd02d76ae4b39f872df4e9ec93e28cbad097f0f6862b0
TLSH
T1F3414858BAF9104CB3B76F1AABF6A8AD487A79372E06D59D10110E4F0A23B41CC71737
MD5 SHA1 SHA512 TLSH

Submit Download