hxxp://benstechemporium[.]co[.]nz

Analysis

user interaction
yes
max time kernel
20s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://benstechemporium.co.nz
Sample260820-tmlzds1bmb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1376	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317159178038578"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{24C5D6A3-92CA-42E3-BB87-359E15B56885}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3896	2688	msedge.exe	87
PID 2688 wrote to memory of 1376	2688	msedge.exe	88
PID 2688 wrote to memory of 2140	2688	msedge.exe	89
PID 2688 wrote to memory of 2140	2688	msedge.exe	89
PID 2688 wrote to memory of 2140	2688	msedge.exe	89
PID 2688 wrote to memory of 1884	2688	msedge.exe	90
PID 2688 wrote to memory of 1884	2688	msedge.exe	90
PID 2688 wrote to memory of 4156	2688	msedge.exe	91
PID 2688 wrote to memory of 4620	2688	msedge.exe	92
PID 2688 wrote to memory of 4156	2688	msedge.exe	91
PID 2688 wrote to memory of 4156	2688	msedge.exe	91
PID 2688 wrote to memory of 4620	2688	msedge.exe	92
PID 2688 wrote to memory of 4620	2688	msedge.exe	92
PID 2688 wrote to memory of 4640	2688	msedge.exe	93
PID 2688 wrote to memory of 2144	2688	msedge.exe	94
PID 2688 wrote to memory of 4640	2688	msedge.exe	93
PID 2688 wrote to memory of 4640	2688	msedge.exe	93
PID 2688 wrote to memory of 2144	2688	msedge.exe	94
PID 2688 wrote to memory of 2144	2688	msedge.exe	94
PID 2688 wrote to memory of 4424	2688	msedge.exe	100
PID 2688 wrote to memory of 4424	2688	msedge.exe	100
PID 2688 wrote to memory of 4424	2688	msedge.exe	100
PID 2688 wrote to memory of 4880	2688	msedge.exe	101
PID 2688 wrote to memory of 4716	2688	msedge.exe	102
PID 2688 wrote to memory of 4880	2688	msedge.exe	101
PID 2688 wrote to memory of 4716	2688	msedge.exe	102
PID 2688 wrote to memory of 3356	2688	msedge.exe	104
PID 2688 wrote to memory of 2488	2688	msedge.exe	106
PID 2688 wrote to memory of 2488	2688	msedge.exe	106
PID 2688 wrote to memory of 4824	2688	msedge.exe	107
PID 2688 wrote to memory of 4824	2688	msedge.exe	107
PID 2688 wrote to memory of 4824	2688	msedge.exe	107
PID 2688 wrote to memory of 3592	2688	msedge.exe	110
PID 2688 wrote to memory of 3592	2688	msedge.exe	110
PID 2688 wrote to memory of 3592	2688	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://benstechemporium.co.nz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf556c188,0x7ffbf556c194,0x7ffbf556c1a0
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7972940579835448551,1653231698073288636,524288 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,8589854030630049859,6977902136790025675,262144 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,3185868553709812767,15664244342757822461,524288 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9777552317990655018,10436637210881082085,2097152 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,17196433204135503669,15402186449728444196,2097152 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,13041830637578071544,18446552997668047750,2097152 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,17259970295023315600,480520780217401838,2097152 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,15674945269047976532,15898736125455432155,2097152 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,5428334810706340108,15279043130892495294,524288 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,3738615027681806923,11518614984515836172,524288 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,14630539720432926816,6935013010665108069,524288 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,14630539720432926816,6935013010665108069,524288 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5314172070490793228,7616751083807519064,524288 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6344,i,11311729799393075975,17761905746233557420,2097152 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6516,i,17674950671109359455,13037568903776364184,2097152 --field-trial-handle=2264,i,432839806112798815,15279122269328600301,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 1024KB
SHA256 dc3f346b0af3e7d2a1b361569200c3de5dc77957ff5138d42055600f0d0d2be8
MD5 ec2626904b83e01ab297013c74b808b3
SHA1 1872a31da533583000231cc22104a5c76f9b5bd0
SHA512 ff9f0e448062d7def17ed24c40d8ec11201005fb863e5417b875478bd7ac5871e42cd9a81805b8838d158c7184a3c631bcbfafb619fa7ed911471958e90aac91
SSDEEP 24576:a5Rnt/sFdou5WPIU9I2pjwr+LOws+ySLZT:a5RyFauEP39SrjMySLZT
TLSH
T15C25237622CB4A0EDD3D3BBD6F7B5E6ED54046E2E17F83DF480028584A0580E996AF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 1024KB
SHA256 ea275b1b51d51e1584778a755b429e2bc73c5d5c5de35982b885151a1dd85046
MD5 c1d0a29789fbb625923f9fea161923d4
SHA1 9ba0156b3c2a8e84f6ce0f9154a895d49f0a14ee
SHA512 6283b08a8e3be3bdfe187275bcd4668a88c9b22793996a1916fa2ebe13cfb75abf149aab0c69089bc9b5bc9a3b7ba36715e982f6c0c8cfbc3b37a05cc7bceb4f
SSDEEP 24576:MaJaT+G65Lq+nf5xcx3EMLrMtuP8G+fehycCncc:MLTMuafPcx3DCk8Dehc
TLSH
T14625334192D50321EDFC27357BB9025323F22BF3831D1BEB796278D99C22D8E54AC996
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a11fbae140054eaa7a5ecc098e72971321e9c2938fee9c0d4682e31fbf660d3c
MD5 5e4aeca7d193c0ab41bae44f1678d4e8
SHA1 c21038f2ebb8090e428a1563629a9b9993f40c02
SHA512 76f4152b099884d4250190ac6032afe5949e2e1e3ca555082073de6863a49280bf294165e69d4eb07861db482ca0395dad09f4af1a7c6a3f58ded5689c1a2b4e
SSDEEP 192:sxZ1R+Gky/fKstLxjxIdpDBHW6+WNYhW/YLEOQQIgrJ:sxZ1wty/fKstLt69HbP/q9
TLSH
T1AC22C9116E38B93B8CCBE21DBA55BF13E6F95032A1945E48EAFC951C04E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 557943b063b933bbc3c8153bee5a684135e253f13482512a7c43124794885b5c
MD5 fdc86e8e6652f86e50ca551424fd9407
SHA1 185f22d3d4b42312334c5afecf1fd78cca217281
SHA512 168e835c1ea244677b48af3b44c75f19f5cf4718c381ea6d2bb09e02acc32b0b9771b62a11f90edc452ff6584fb4098a1b22352b7d4769b2bb1ac29bf5bb3b9c
SSDEEP 192:sxZ1R+Gky/fKs0LxjxIdpDBHW6+WNYthXYLkOQQIg5qJ:sxZ1wty/fKs0Lt69HbkXWc
TLSH
T18E22DA116E38A97B4CCBE21DBA55BF53E6F95032A1905E48EAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5235fe51aba1b170b282e5d698eaf9878f70dcce89dba4a6ac37266ca028c354
MD5 4da5c7a6d0422ce68bbaa8f1099bc0b4
SHA1 4c68446a9bc57b9491a80dd71b8ccce05ad7dfa3
SHA512 f66442b6524178f9972f7872783284efbc42d70e18d5368c6aac26482074baca32d9dec8240cb8a81edadb11e751748a2ec9ebcefc2043c4b4a29dd963929f1b
SSDEEP 768:a1O6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvtro8L:a1O6fP1Wvxz3ju1jaZILIsvG8L
TLSH
T146C2E83B240DCB7E4F801A9D9C5A6F977E9802C7AB988D8447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6a5bd358d908b33fc727ebea1b48347000ebbce68c7c4cf3249e756e2ceb055b
MD5 6282cacf658d132116d35c6da450d168
SHA1 791040146b13c1851a1b708d04c58155bb4bbd9b
SHA512 0e3ba4520bc909eab4018684c2aa2e66406dc31c786905080525b5bf7eef49760fa3e531cae58e7dcd55e03eb1c1b2a865c0e0ae615ed04ef935170b552098e4
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyZSI/KL6AXypGIPKTy0PyBsIXKZ28l7:KUAAKtePKSsKL6C6GQKTyWSs4KZ267
TLSH
T16BC1241332BA03026C7E29489255D7279E467563302DA42F7BEE40B21DA7E244EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 416cc8a01c12ef48f5d5d43f0f69e51811cbf681a037f9da6269be830885331e
MD5 eed21a02b1041e85be61444ad05b6f18
SHA1 5069e8473849fb89b8dd5ffe937b2ea2c7cb9beb
SHA512 7ab83a68963def2f80df9b2fdbf1568ac3624aac6cb8079315ee8cdb06227491bae45c2bd7e857a88521042a33a556c77638ad93023cfb86444085b302fc8a63
SSDEEP 192:qONY6O7+3hQmiUyuOHGttb0UO2rh26gGpuSU6:qONY61tqGt95O0M8FU6
TLSH
T11002E8346C386CB75AF3AE45B58727239FA5113BE9951F80D6E81F0C00DB65C2346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a4361e2125697773214d64241aa98c23c20a1de7eab329928eb99dcced23d6a7
MD5 e01353bda0f1773c968cf1237f7c12d2
SHA1 ed3007e65205ca5a6c851ab00ef311662fc64a68
SHA512 78bb3b0bad8a1fa9008251df1ec3f5154c0210f5ffc2de0d2d067452e645eee3039696933f6e8401fa404114c9c7d947b6735b76cc021becbea4ff5dd08681da
SSDEEP 384:BZcIhsNxpfc1oDmXAoWa95O0MWv/NPivU9oT:Jhw0CDcX/OOv/NPiKQ
TLSH
T104827C311C786C7618A6E245F98B36079FB94037D6C96E80D4ED9B2D01EFAA8230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cee92c9ece4b5360dfae9c6f8bf57a2731e540034b408f0291d30f1da7082948
MD5 97ce891d023bc925558d3ffe58f4fe07
SHA1 cc24aeda2f0d139b4b4b9c36b4ef43f3f99f7a78
SHA512 5cc66afbba287cdb7a3069dfec820b4f2af78b9bef5167688e741ef2dbfc6d90b0df3f452114e1302d956cad7908daa8d1af1da233a81e6f0e045d982bf9e02c
SSDEEP 192:4JON06O7+3iQmiUyuKHrGttb0UO2rh2Wv8EsqcNkqNDU6:eON064t+Ct95O0MWv/aPU6
TLSH
T13D120A316878AC7B1DE3A545F58736139FB50127EA8A6F81D5DC1E1C01EF69C234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b706372a820a049a63dec5f44a2783c5926a124310065531826ef22335b26376
MD5 3d6d45d25a106e1d12fa514254d32b9a
SHA1 31b3204c269f943efd888ff4a14c87de2eed2c3b
SHA512 d4bb69d11bcecf64e04628c6ae0da9e4a86f79cbe7606e7ebf8bc74252ea0b95d24ade5c093719cccf5aedf27ee3b0e78bc6fe43ed854b3941aa88baf6ecf901
TLSH
T10A412B98A6FA1148B3B77E169BF6A86D487BBC772F0BD45D10010D4F0A63B40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads