8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7

Analysis

user interaction
yes
max time kernel
148s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TGMacro.exe
Size 947KB
Sample260728-el4eqaan9y
SHA256 8d0c5274aa4fc0029ee63911464fcd553cbb8f898214b08705f192b9558288b7
MD5 5c3c2231b01a9b769b94962b73d0286d
SHA1 a1025fdc8676ee922f464f67b87c33f1b2cbeb55
SHA512 f1fa002ac370a5012df15231a8725efa5255b760722a2e39950d40f52a6e98cd3a221d017dcaa0041a1432f12d7350e267636c62614ff39e786cc24fce72e80e
SSDEEP 12288:rQh0HIc4o0Y3C5tfCsn9N9+I6gPIOVycGmIyrX:a0ocMY3C5tfCsT/G5yrX
TLSH
T15D258D8277A4C904D5BB0FB844718B5093367D19BF67CB0A748D799D6EBA3C18A23393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TGMacro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296849701046194"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{B527CD36-8FC9-46F7-B442-0674D90163D9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	TGMacro.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1824	TGMacro.exe
1824	TGMacro.exe
1824	TGMacro.exe
1824	TGMacro.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1824	TGMacro.exe
1824	TGMacro.exe
1824	TGMacro.exe
1824	TGMacro.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1824	TGMacro.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4220	1824	TGMacro.exe	87
PID 4220 wrote to memory of 4528	4220	msedge.exe	88
PID 4220 wrote to memory of 4752	4220	msedge.exe	89
PID 4220 wrote to memory of 2176	4220	msedge.exe	90
PID 4220 wrote to memory of 4752	4220	msedge.exe	89
PID 4220 wrote to memory of 4752	4220	msedge.exe	89
PID 4220 wrote to memory of 4444	4220	msedge.exe	91
PID 4220 wrote to memory of 4444	4220	msedge.exe	91
PID 4220 wrote to memory of 2460	4220	msedge.exe	93
PID 4220 wrote to memory of 3376	4220	msedge.exe	94
PID 4220 wrote to memory of 2460	4220	msedge.exe	93
PID 4220 wrote to memory of 2460	4220	msedge.exe	93
PID 4220 wrote to memory of 3376	4220	msedge.exe	94
PID 4220 wrote to memory of 3376	4220	msedge.exe	94
PID 4220 wrote to memory of 3124	4220	msedge.exe	95
PID 4220 wrote to memory of 3124	4220	msedge.exe	95
PID 4220 wrote to memory of 3124	4220	msedge.exe	95
PID 4220 wrote to memory of 2784	4220	msedge.exe	96
PID 4220 wrote to memory of 2784	4220	msedge.exe	96
PID 4220 wrote to memory of 2784	4220	msedge.exe	96
PID 4220 wrote to memory of 4700	4220	msedge.exe	99
PID 4220 wrote to memory of 4700	4220	msedge.exe	99
PID 4220 wrote to memory of 4052	4220	msedge.exe	101
PID 4220 wrote to memory of 4052	4220	msedge.exe	101
PID 4220 wrote to memory of 2044	4220	msedge.exe	102
PID 4220 wrote to memory of 2496	4220	msedge.exe	103
PID 4220 wrote to memory of 2044	4220	msedge.exe	102
PID 4220 wrote to memory of 2496	4220	msedge.exe	103
PID 4220 wrote to memory of 5012	4220	msedge.exe	105
PID 4220 wrote to memory of 1900	4220	msedge.exe	106
PID 4220 wrote to memory of 1900	4220	msedge.exe	106
PID 4220 wrote to memory of 616	4220	msedge.exe	107
PID 4220 wrote to memory of 616	4220	msedge.exe	107
PID 4220 wrote to memory of 2444	4220	msedge.exe	108
PID 4220 wrote to memory of 2444	4220	msedge.exe	108
PID 4220 wrote to memory of 2436	4220	msedge.exe	109
PID 4220 wrote to memory of 2436	4220	msedge.exe	109
PID 4220 wrote to memory of 2436	4220	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\TGMacro.exe
"C:\Users\Admin\AppData\Local\Temp\TGMacro.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffa85a4c188,0x7ffa85a4c194,0x7ffa85a4c1a0
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,5727214545557961940,10522357741791121600,262144 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14844229229561399963,10854030183371770507,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,7182645206409301337,18183131935749199400,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,3271749996075435882,9898740854875036676,2097152 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17699315441355663788,11223879780435158015,2097152 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,15502500321277811703,11735244008205011866,2097152 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,69520466754280476,7849775461672461491,2097152 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,4931341856261793198,6900134096705466581,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,15354703779868643338,6704979732325496067,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,890061759467127953,10020414096238819335,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14200279507483357659,8964358158880053312,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,992448614828529370,12569735175977430702,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,992448614828529370,12569735175977430702,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,9896273448976686858,13183244322858467792,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,8956839234187673851,4617886933793886336,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,12036062413852149188,1032776107547469068,524288 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6456,i,14794256243867215721,4072846652447962829,2097152 --field-trial-handle=2288,i,2011365789190352683,13739022417641132240,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
    3⤵
    PID:2436

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x490
1⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8fc0daac07f1cba5e2be811f2c7da605f08db262b2865fb00c09cca1533fed22
MD5 e7619e69fbf9c7d9fe17c1999fa8b04e
SHA1 575f392ad5a4f23b51afaaffbf2e0b1238e1f1b4
SHA512 1fda98c206a6952201f19fa3f6e5a870c6772631901131a611e7ac3372afd4e6c0c7455ffe8763964b5b3ecf7e6001df946800d571cba6fa8590a382591c5194
TLSH
T1EDD0A722291CF4C0E71802709212CF003B2A14A22553560AF315CC2D98B40C156D6BC2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b306a3bdf0db89229a24cb507a31ae221f470d366e05a68e92081a9347039b8a
MD5 1786d2feb5f0f66d8dad822ab54cdb5d
SHA1 ebd4ed9ddb89cd54ff7fdfefce969561af819382
SHA512 cd29af9d621afa9bfb5c05447167cb02a84950986b2c615ea0fca8e6ae87aef2c3ed3b889ff2742b9b6f8c69680a1d2fa59ba74198c0e860fd816b20c8f32bf2
TLSH
T16E81F94401AD49B2F7B10F31D9D00A60B53143796E231EEB32F2E87DFA0EF56612D986
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5862bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5862bc.TMP
Size 3KB
SHA256 13c0b16dc1b0349b94de4639cb0ab2e3f394aa65f3a411eef913b36c2af710cc
MD5 c53281ea1b4335c15ba704fd93a648bb
SHA1 6707d6ff20542bf692e7afae27243bd5e78df998
SHA512 3b89cf5e7ac8435906b08e58f0caa8f8d638912b207850d7a651669754c4e061b8359743d994e581c1e22f0fb79114c46a692b5222c7e5b940ea47364fe7a15c
TLSH
T11C71C40402AE05B2F7A20F72E9D00650B47183792E771DE732F6E87CF91EF23412948A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 83fadc4f63e890943459b4fd7289fad7e5118531cd30543f13528119d9c5e6c5
MD5 ce33ed5011b7f0c279672d304a209325
SHA1 3d12166dbd826e7d52b44113a03005b3dc704930
SHA512 e5a4d563eacd32b86da359b8d4fe5c242fba18e0df2bafa9d3216ca41a89d2505cb9d79bd3b1b12b9c601657eb2d47bad1be62416a676d95ac33b2b163c4feb4
SSDEEP 96:DEJzNz+uIuNEuQuIuvuh/uZbGuFVKuzwpu4ufWMuYl:Dk5z+xoElLwwoGQVKKMtjM7l
TLSH
T12AA1ACF3C3E8C66D884555FCAB146E2BCE180914432C3D9AC9D8AE1F97E2C70E20099F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5a2f9dbbd387bdd6d8cd8e54477fd5300cacd577fb88bb88d8ed5321549f7c3d
MD5 150a0a9eb37e7a2467b0658cbc9d31f3
SHA1 d8b3ab0f0bbddae137a23ecda8c9033fd533ea6c
SHA512 be2c0644fcb98e49680363503296d122e3c01a73867fcb6782c864ecb80849d6a510b66ed5041c963aca2360be28d6e3ef1c41e08b66ca8b790c34e63e4ca18c
SSDEEP 384:sxZmm9/n/fnsvWvW1CDFtuHb0Bw/4VqfO:sOi/n/f0YW1LHb0By4Mm
TLSH
T16362E816AA3459778CDBD21AF555BB63D6F51422D6904E849AFCCE1C00E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 6084b08f1d207c9dfc9c2c06c5cbc80e77f2d3ca4d0fa4801002ff37b7ccc0a4
MD5 db8cf3e0412cc229ae1e021a0f46306b
SHA1 01a68e898b3068df417a0f695cd1b1b7a121d5bc
SHA512 e98d3c2a07f6623206b1b2054c8c2161165c3bb9ca67acc49a7cf56dbfb9629c10e9030bc9677df9713c189a21b66efbdee8bc0b05df5f6fe077d746b6c250da
SSDEEP 768:JJs6par7pLuLfx1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNfroWmR:JJs6pa9Efx1WvxzWju1jahILIsNMWmR
TLSH
T181F2FC3B680CCB7E4F844E9CEC2A7E9A7DD8018B9698899447FA444C03C67EE51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c5e20aee2cdfbe9c8cf1c91d0d0d4f384f9704e9567d7124948909d0e3efab4f
MD5 6f2e81b078e1de51b0ea0566e83383c6
SHA1 f7dd2b09520317c15dce39af62a4d6da3f8111ac
SHA512 7318ef230a0f3b25f6c227a57f837ac2577f38c8eaa7daa24ec01e81337bcd8861c740d91a63ac09444e2471bff72f659fc59e1db032ab2d34eb8883b832eed8
SSDEEP 96:KUAAKtePOrqKgAXe12KeASBCBuC0UEC2MzxgyCKYngICcSabgo:iitMlh9/
TLSH
T1D5C1021271B702223D3E291CA29997664F42B6633819F42B37AD00B55EA7F344DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5df45f5fcf30652620a7e2ef31c5c8cd910f1e00d5ac92e41562eec58af53d2
MD5 9e8bad5a31ddd9dd49d8f3baa8e4e487
SHA1 2b8b085ce1f767a864505aac35f776c2db1b29aa
SHA512 ff186ac61cde03f05b99500632d22f85e6fa900fab47b7ea9683aa7c39804b609eefee1a693a0158d095c8d9f2b87a18ffedc4dc9e62d0a773b84b02f65f8bb5
SSDEEP 192:qONT6O7+3hQmiUyVuGttb0zO2bH3gGdxU6:qONT61HGt9yO+LbU6
TLSH
T1BA02F8396C686CB74FF2AE45FA8727275FA5103BE9962F80D6E85E0C00D765C2343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f91b3af94d74df74332aa44c5c3452c80701f790aeba22d2b5eefdc3dfb9a12a
MD5 42e94830019474ee289a5226b29c417d
SHA1 180031011574462a97ba69d66db9dee8a1e713a4
SHA512 3138d1bec3a025f816863ab69e65072d0436ff33d3dba80799ea19f6746682222c40b1aa9078b6e42c670f6e5ccdea2619487e4d0b9c1363daa06be40dbacecb
SSDEEP 192:cONm6O7+3BQmiUyhuhttb0zO2bHTQ+2BcNVqpTU6:cONm6Vtht9yO+TQ+2GQU6
TLSH
T16B12193568689C631EE2B105F98727A39EA51077DD866F80D5E89E0C00DBB5C374BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d0daf8b26994a7cdd55aef68e96f8b5003461464a59166f31e6708899c925228
MD5 1a3d2ed06f7892e9421e4502c7c870ca
SHA1 897da7de8aaf41029ec5285c1b4fc0486aff45d8
SHA512 8ba9accc25ac52c87564b506f67fbe75483a6b41a06dcc1bb9160e2248f0d71f46b03b946286f86deed4c3eaf5de1a645d255a23b889e3777dc2566a14ed9d0a
SSDEEP 384:njsNMUGpGyFbMS4a9yO+TQ+2F9BAStQM1sF96MTp7:j3uShIOuQlFoS8F9hTp7
TLSH
T1C1821AB0D8A80CE345F2DAC5AA07E5172EB80137C9895D5CE7F9BE3D309F5B92352816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b3ec97ea-8c34-4af0-9356-7e67ad124e34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b3ec97ea-8c34-4af0-9356-7e67ad124e34.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 53710c5dd4fb123414e17c3e818968c1fcac69100f83b79a07e5567747c01976
MD5 e7e33789a65b6c5217849d8c1fb72287
SHA1 7cbf680f1fb48080a0cb336157145e0c53b731e7
SHA512 c212600e7034d76e0a0cc12f773e1d9cd0da5d3228bef400068717f35d148627537983acab3f0bce183bfb689aa5ce70c882d99ba347efdbd8566e59de4c7c0a
TLSH
T147414858A7FD0108B3B76E5A9FF2A86D087EBD372F0AD49D10110E4E0676E40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

0b4c20de-6f00-492e-a3dd-5bbde7c8241d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4220_1142264894\0b4c20de-6f00-492e-a3dd-5bbde7c8241d.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1824-8-0x00000000066F0000-0x0000000006C1C000-memory.dmp

Download

memory/1824-19-0x0000000006100000-0x000000000610E000-memory.dmp

Download

memory/1824-5-0x0000000005350000-0x0000000005512000-memory.dmp

Download

memory/1824-4-0x00000000050E0000-0x0000000005172000-memory.dmp

Download

memory/1824-7-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/1824-3-0x0000000005020000-0x000000000502C000-memory.dmp

Download

memory/1824-0-0x0000000000440000-0x0000000000532000-memory.dmp

Download

memory/1824-6-0x0000000005AD0000-0x0000000006074000-memory.dmp

Download

memory/1824-2-0x0000000004EF0000-0x0000000004F1E000-memory.dmp

Download

memory/1824-1-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/1824-10-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/1824-18-0x0000000006130000-0x0000000006168000-memory.dmp

Download

memory/1824-589-0x00000000060D0000-0x00000000060D8000-memory.dmp

Download

memory/1824-590-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads