hxxps://gettgmacro[.]com/

Analysis

user interaction
yes
max time kernel
102s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gettgmacro.com/
Sample261024-d5mewaeb72

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	81	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a4f5efa43ad66b4e	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TGMacro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2780	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	TGMacro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	TGMacro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	TGMacro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	TGMacro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{E68F2245-731C-467B-858B-CCA6BE4D11F6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4268	TGMacro.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
4268	TGMacro.exe
4268	TGMacro.exe
4268	TGMacro.exe
4268	TGMacro.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
4268	TGMacro.exe
4268	TGMacro.exe
4268	TGMacro.exe
4268	TGMacro.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4268	TGMacro.exe
4268	TGMacro.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1232	3312	msedge.exe	83
PID 3312 wrote to memory of 2780	3312	msedge.exe	84
PID 3312 wrote to memory of 488	3312	msedge.exe	85
PID 3312 wrote to memory of 488	3312	msedge.exe	85
PID 3312 wrote to memory of 488	3312	msedge.exe	85
PID 3312 wrote to memory of 4696	3312	msedge.exe	86
PID 3312 wrote to memory of 4696	3312	msedge.exe	86
PID 3312 wrote to memory of 3720	3312	msedge.exe	87
PID 3312 wrote to memory of 3924	3312	msedge.exe	88
PID 3312 wrote to memory of 3720	3312	msedge.exe	87
PID 3312 wrote to memory of 3720	3312	msedge.exe	87
PID 3312 wrote to memory of 3924	3312	msedge.exe	88
PID 3312 wrote to memory of 3924	3312	msedge.exe	88
PID 3312 wrote to memory of 3264	3312	msedge.exe	90
PID 3312 wrote to memory of 3264	3312	msedge.exe	90
PID 3312 wrote to memory of 4760	3312	msedge.exe	91
PID 3312 wrote to memory of 3264	3312	msedge.exe	90
PID 3312 wrote to memory of 4760	3312	msedge.exe	91
PID 3312 wrote to memory of 4760	3312	msedge.exe	91
PID 3312 wrote to memory of 2676	3312	msedge.exe	99
PID 3312 wrote to memory of 2676	3312	msedge.exe	99
PID 3312 wrote to memory of 976	3312	msedge.exe	100
PID 3312 wrote to memory of 976	3312	msedge.exe	100
PID 3312 wrote to memory of 4680	3312	msedge.exe	102
PID 3312 wrote to memory of 4184	3312	msedge.exe	106
PID 3312 wrote to memory of 4184	3312	msedge.exe	106
PID 3312 wrote to memory of 4184	3312	msedge.exe	106
PID 3312 wrote to memory of 1580	3312	msedge.exe	107
PID 3312 wrote to memory of 1580	3312	msedge.exe	107
PID 3312 wrote to memory of 1580	3312	msedge.exe	107
PID 3312 wrote to memory of 1756	3312	msedge.exe	108
PID 3312 wrote to memory of 1756	3312	msedge.exe	108
PID 3312 wrote to memory of 3520	3312	msedge.exe	109
PID 3312 wrote to memory of 3520	3312	msedge.exe	109
PID 3312 wrote to memory of 3520	3312	msedge.exe	109
PID 3312 wrote to memory of 1276	3312	msedge.exe	110
PID 3312 wrote to memory of 1276	3312	msedge.exe	110
PID 3312 wrote to memory of 1276	3312	msedge.exe	110
PID 3312 wrote to memory of 2648	3312	msedge.exe	111
PID 3312 wrote to memory of 2648	3312	msedge.exe	111
PID 3312 wrote to memory of 4704	3312	msedge.exe	113
PID 3312 wrote to memory of 4916	3312	msedge.exe	114
PID 3312 wrote to memory of 4420	3312	msedge.exe	115
PID 3312 wrote to memory of 1092	3312	msedge.exe	116
PID 3312 wrote to memory of 1092	3312	msedge.exe	116
PID 3312 wrote to memory of 1092	3312	msedge.exe	116
PID 3312 wrote to memory of 4568	3312	msedge.exe	117
PID 3312 wrote to memory of 4568	3312	msedge.exe	117
PID 3312 wrote to memory of 4568	3312	msedge.exe	117
PID 3312 wrote to memory of 3436	3312	msedge.exe	118
PID 3312 wrote to memory of 3436	3312	msedge.exe	118
PID 3312 wrote to memory of 3436	3312	msedge.exe	118
PID 3312 wrote to memory of 2504	3312	msedge.exe	120
PID 3312 wrote to memory of 2504	3312	msedge.exe	120
PID 3312 wrote to memory of 2504	3312	msedge.exe	120
PID 3312 wrote to memory of 2848	3312	msedge.exe	121
PID 3312 wrote to memory of 2848	3312	msedge.exe	121
PID 3312 wrote to memory of 2848	3312	msedge.exe	121
PID 3312 wrote to memory of 4144	3312	msedge.exe	122
PID 3312 wrote to memory of 4144	3312	msedge.exe	122
PID 3312 wrote to memory of 4144	3312	msedge.exe	122
PID 3312 wrote to memory of 4148	3312	msedge.exe	123
PID 3312 wrote to memory of 4148	3312	msedge.exe	123
PID 3312 wrote to memory of 4148	3312	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gettgmacro.com/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffbe05cc188,0x7ffbe05cc194,0x7ffbe05cc1a0
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1348,i,13010469866263181599,6242953911785756289,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,7324404740888543883,16371806166710202183,262144 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2444,i,17731397921505310564,5530275641499327394,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16780332076859500818,3600629398772218409,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4101307472971113807,12078210144847283194,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,15784804348502184285,4549169068428748798,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,15365233679082464720,8918554886898936062,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5096,i,14548062104366239972,4128207922253342660,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5092,i,9065619298075850397,15198567017565466367,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5892,i,17371775486449370564,1062474208276565846,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5892,i,17371775486449370564,1062474208276565846,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6220,i,7723060986348441136,3522157591593093358,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5892,i,2426417172451969411,5189641320125141244,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4232,i,7224805405501371104,6085349052069242070,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6516,i,3590800944466547947,4939078988710724698,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4168,i,13042892645623563125,7350740188676362019,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6424,i,503797046759280718,998491716147532206,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6620,i,13416926343818798100,6723782391157592025,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6624,i,13396183293464928281,7150175908776408700,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6628,i,7324128217992773824,5683112842045050540,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6664,i,15837129061765766825,16184612246677309944,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6728,i,12046558205457709194,2489759381726271785,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3696,i,1333134887238160853,15227512856669303661,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2768,i,7434709854995245046,11753275300999930335,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6480,i,12111918210949745665,6725225732494419991,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7468,i,17104598384574933533,7375296803994307425,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6772,i,17434574057338872562,2541530109425575102,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6256,i,11192039992784663971,9340257963046366798,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8004,i,14470015486641164732,11011082796530889909,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=8180,i,12965888346183536240,5651633969003785523,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5856,i,14771528267364458652,475275440549043734,524288 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3204,i,7449652767780096510,4738630431690489171,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=756,i,2582007672821383656,6286062084507602938,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8068,i,2341337661171344260,11878763707440220696,2097152 --field-trial-handle=2284,i,4796540959371302142,6655885351800388340,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1984

C:\Users\Admin\Downloads\TGMacro.v3.053.Portable\TGMacro.exe
"C:\Users\Admin\Downloads\TGMacro.v3.053.Portable\TGMacro.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed
  2⤵
  PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://trksyln.net/projects/tgm-gaming-macro-tgmacro/installed
    3⤵
    PID:1496

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x2cc
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c1505e9-3dea-4d74-8cfc-b9f5b29bb1d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c1505e9-3dea-4d74-8cfc-b9f5b29bb1d0.tmp
Size 26KB
SHA256 669f9702b2cc4d93a51a8c3a384c08858fda0b0ca54c74804b19ad5146633f42
MD5 f6340857082cf783217e4a7123fb321a
SHA1 d09177b806043d0d0df57c3133dee92265b75186
SHA512 8e1d01d44fb58e257d72c07fad527d15403a8281803b3fceffb8a926806677e0c0c6f63056d23066e014c00a6f6d92ca03f4a3d31dd0d88b3fe137c087a97e0a
SSDEEP 384:NiF/QkUSv8xsNZc8TUNTUlIld8pYM99Vp5u8iEm+aFE2IBMtU5IIla9:EFByqcwgenBkEEFE5QU5LA9
TLSH
T1D5C218F248D7583AD9AE9B53A73E3D038EBCC117B5945A90B7885A1CCD861FFD306902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d779b7d-3c50-468b-89ec-f226e692ebad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d779b7d-3c50-468b-89ec-f226e692ebad.tmp
Size 392B
SHA256 6452bef568dac92fc8f7ec21e88c170fe2eacd9a821c3ee51747c912ea49c636
MD5 601e3dfe18ed5039b71df54dd1b5886b
SHA1 c9ec21f0521f051d5e7bb2aafc49db6cb29ec504
SHA512 44a2756672c73df2770af4cc2f8a419a78d4b5f1379490f82a3e2e8349d9fed43d337a3e083ca9c9a8af6244da67293e1f84903b0b1d6f668fa98293457d07c6
MD5 SHA1 SHA512

Submit Download

3fb03c0c-99b4-4457-9785-515f97f7ed44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3fb03c0c-99b4-4457-9785-515f97f7ed44.tmp
Size 8KB
SHA256 e2007a7b6bd65af8a195d6ccfbceb5a8e5a4f309a29908a89d46a7d770da7fe0
MD5 64f898e523774f3c8785c5b5ed694e26
SHA1 ba8a9bd07efaede62557d338e7406ff1249c08fb
SHA512 65b86e62a195e1945d2f6f5f774f2df7b08607acefff2ea0a25687f6a9eff88d665d6859ccf4c2836146df80656cb12e0470561c2bde3410dde855e0d61bd294
SSDEEP 192:SONk6iDCQmiUy9pHq5u88P1uhfSqTIlU6:SONk6/GHq5u8iEjMU6
TLSH
T17702E939AC683C7BADF3AD15B58777175FA4013BE6952F84C9E81A1C41D729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

938391e0-e131-468c-a361-83f45bed9e5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\938391e0-e131-468c-a361-83f45bed9e5e.tmp
Size 392B
SHA256 e83ff7274c71314e72da4ba56fd7a1433094d9840e9d41ccf2bbd271c9fe70d3
MD5 6e31546f5b433db273cb40031b29998f
SHA1 b98a2594502dc4a0e66c7db7c5a6a7ca3cd85d73
SHA512 eb1847f8eef47c2b54676c54df6142ba20b4a842805f8308f94583ba7b62a1a379d4e487e096bba03662476193682c3174e2c92ced5878255f93af2d033b47ff
TLSH
T144E00203F34145D8C015157441531F204F83C0340150072B0F34054C7C343087E516D1
MD5 SHA1 SHA512 TLSH

Submit Download

184006f2-0513-40c8-ab42-8eaf0366aa6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\184006f2-0513-40c8-ab42-8eaf0366aa6e.tmp
Size 105KB
SHA256 73d0e97f18eabd66ced5f78af8d0ee3a36d197f120279f6fe22862877514d939
MD5 48ffe64f366166704c21161efe0b504f
SHA1 a6403dde2edbd6b341ad301811396e7d3aea1af5
SHA512 ad78beb367abbdbb0a58e28566138180a03a9826f30f2dc412a05e0ca179742f6e123202adf44a50da1f4b71145ff6cb0cde66f326d4e9b116ce56b2281ea253
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

382e41ed-8160-4a20-b236-65e45c3dde7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\382e41ed-8160-4a20-b236-65e45c3dde7f.tmp
Size 13KB
SHA256 5f6576a317e3d32f5008a5a31dc690f777f9faf3252e22818535468c6cf48e50
MD5 7c926bfd93625ccedc570f56c2c3d730
SHA1 f8ddca1c9cab6b9fb44e1649c2a6aef4320ea117
SHA512 c34e84f184f323f433b9a848182d684ab249327349cb4db3340794e902f4b4f0059272d2996bf42c782718b0c86f8e4253ff475ec08938c66815e164ad93dd89
SSDEEP 192:sxZgRtucBWK/fJsaR6rmqdpTyxV1zHW6+WNiMb/Yaz8oFpIg51Q1UspwQRKH:sxZgKmWK/fJsaR6rHGHbN/rjDsp6
TLSH
T16D52C652A924E9778CC7D509BE35BF12E7F900228D961E9CABFCC61C05EA6FD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

853f4d0d-7949-4780-86a4-5bedca2c8929.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\853f4d0d-7949-4780-86a4-5bedca2c8929.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8826d999-b361-458d-b4fb-546cc9314293.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8826d999-b361-458d-b4fb-546cc9314293.tmp
Size 9KB
SHA256 8daa1f440626bf3466460cbd2f18b01fc324d4bc6fabe0c080b6f2db5156ff91
MD5 c21274c7cf30615fd8cc26e73cd50081
SHA1 1397a691adb1fa0d044fa0f7af88c29d17ac45d9
SHA512 d900ed0214f8ebf7608ff600e126aa756909650b268b9fdaeca6078714691c9a5d652b61824623741f9089d3dc15682a66a2a2765cd25f496f58d66b0a5ed2f0
SSDEEP 192:sxZgRtWK/fJs5R6YTIdpJHW6+WNGYaN0oFpIgrJ:sxZgKK/fJs5R6YMJHbG5j9
TLSH
T19212D8516E38B93B8CCBD20DBA25BF53E6F9503261D11E58EAFC961C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c4573ecc9880aa93b88d56bc04e490ce9c0ba02b3036a8a1477e953875f83781
MD5 c4d01865b0b21f91ccef41641a0fee23
SHA1 a04d95bcdce62abe7941694be0872b1d9c39f866
SHA512 886e6856a2862c04fb61f4b920535b5754b61788396dae7a484acdaab133f952e8eca58f9666506d25eee1ef98e75c612986ad5a68e4a32e8420b64387df0fa9
TLSH
T186E026C50DC8C23EA30A64C7056E830C83812B1AD7C8AA2E2710C588700A080E382AE1
MD5 SHA1 SHA512 TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 45KB
SHA256 940e937d624dff1d92f851eb934d25d8f553b21ece4ea0cd28ce09a9c26d42a3
MD5 44e017eb03ad119606b480cec663fa30
SHA1 9241911887c38c5465f7c2e52241aa36cef8fe71
SHA512 fa9327022c36d67b6a43370f035d1e7817e65e0a8260a14084dff52665372fafa909c2b1e41e7590aca67086c84f975093ceeb0c2169afad18f7dd066ea3bbe8
SSDEEP 768:n5tNF8slLi+NBxYf86HMA0PF8/3SDtPoHMzqQqZKq1r/sFD5f0tjlLILDkF1OYh0:5tNHxNBx286HaGfSDtPo0q5rwDetRwDH
TLSH
T17523F10BD1C595933AE03B3E3ECE143C80846699A757B2E2F12A350AC6E4F59C50F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 50KB
SHA256 cc43a2f682b9cda760358ab5a96bc632ccdcdb31d6b1750aea60d363960fe45a
MD5 2a8931601c87a4b5b091064b8cd8c3c4
SHA1 9c0b6ffff916a8ba086648cebfeb8f521328fb8a
SHA512 40876b946008a2af93a7bc46d6765f93b0c154bca418b798f1fac59092f824b0c9b904e449a365b88f42ac7b318701d2c9702c7ed7a25de3929c83eab6fdb00a
SSDEEP 768:8vAMAXsLhft1ujPb0Dg/GzNINMV/It0lvMAHM9/FHMkuJzmqNRihFvaq11e/lDZ:SAM6stF1uzb0jzNSMuay9skmvivvy/pZ
TLSH
T185330122F6F3E6C54895ACA3398A4F3FB6869028C2F6D8441D516B073BA50C9585F50F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 32KB
SHA256 d6a1c69f95f705162627a7f2b948f4ad975041f5296027e09d2fe6a0dc8f3a45
MD5 4393b2cae8ffa20f9f2f9b71579401d8
SHA1 3fdeb30e403a0692fbbd180dffede9f99f32250e
SHA512 201e84f5dddb25be0145aa9b6afd49c4c8a92ef406899784853597e9bfa0fa9654822b1807f06c5893d5cf9019a64e47c1c4fc7d62b59dc51ce6ca5712da59a7
SSDEEP 768:OnAIGXzfiLcS2U+2XFPXrwK49kgynH/Pod:OnL0z6LkIxbwX9eH/PC
TLSH
T142E2F14571BAE8D0E3EF5047261B5616CB0D00A0BCC5904336ED3998A6DCD2AEDFBE62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 47KB
SHA256 45e5c6ee25a2e1ddb13a76b149985aaf1801993f8a55f22f02d47fddf09a5363
MD5 1bec560b18f0057b637d66b2cc7c02a5
SHA1 9e553137b40449a42be8010cdf70074d2374c792
SHA512 62c8c986a1894622ba3ec80c9361c30d03a917acf0e08de324773da39d9b9d22d0fae7520cefc3088cc40f3e8512257e6ed7418857ea6f7875e1c7b82406d661
SSDEEP 768:F8sZOzT+G4FePKbJt7aYfZXX3CP+en5hujCU81/wVMXfEbmPPIxONkx+jXAqaH+9:Fjw/4MKbKWMn5U4IVMMbm4xOW0jpae9L
TLSH
T1462302F387ADB7B8D6E8492AA4B002F4D44A44CFD734D590613C27D72DC630D77AA418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 78KB
SHA256 3b11e845b5a0dea8edc9dc0c1c58daa74604d8f50bf3b1db6082a3528fac2fd2
MD5 2d9f25b4a1ad3f9bc59207ad4645a6f7
SHA1 249d5c3333e4bda3aad5df2588a82cfabd6483d9
SHA512 a4b992defe6c3472b311f0f944a98de1f61bfdc8364d59864b8864928c3226c716606d78f6dd116fd32fa352e9a34c2a8ab0d76985013ebc33d7c782ef193d19
SSDEEP 1536:NP2s5OqoTWINBvmdA/WmbTvFhMIYsGXfZa5KgEm3vbpA6IA2kvOD4QD59i:N95ObiI/+dVsjFhzYsGXfZaEJmfbylkN
TLSH
T1E47302C6947FBAE4F3416C29C514949C58F2672C0C5F3A48EFA3D7248799697E4328B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0db151572a9bd85fdc0483b404bf909c8e64f233d273ae8a107bda6d82ee0e99
MD5 0a4557cef7c140464e6ad07cc03c883a
SHA1 a13775f1601e22f1913573ae56d608c16ba73c20
SHA512 6d5dae294c7bf9ff18f4d71617d61f984f54a21b63e22ff586889efbf9d686ea9f4c1eac405b783d997b63919a7ca6aa21011066436a6dd584817c3ac5931a7c
TLSH
T1A361C7F571A341E9FB88467393D6948B317065B0A9831F6230E9F4789CCA7158CF781B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dd35987feb02fa8c2d88a0a25eedf6217798a539ca4c84919d17183f76d5cec8
MD5 17a6ee15d53aabcbee34b9c89b42a4ac
SHA1 d71b35f1e86aea6d2c3da66b67d2e22b480c4644
SHA512 78ad64aab95867d667650947b5ba6c529ad253c9c6384bba68bf19c58548c87b2fa5722a4e967f85ac33296369f99326715db2ed95a58975bc1a668c170d6326
TLSH
T1FA61D8F5759341E9FB88467393D6948B313065B0A9831F6230E9F4789CCAB158CF780B
MD5 SHA1 SHA512 TLSH

Submit Download

94326b7b-cbeb-4383-b99b-aab827ec7f89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\94326b7b-cbeb-4383-b99b-aab827ec7f89.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

158b4e37-69af-4e93-aaeb-d908cdb5fb38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\158b4e37-69af-4e93-aaeb-d908cdb5fb38.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

2726d675-0c59-46ef-b73f-1e2f7ca9b9dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2726d675-0c59-46ef-b73f-1e2f7ca9b9dc.tmp
Size 210B
SHA256 793178762cdc1da5acafbf6421f83b93042a7ae916fb8fe0ebcab459f77bac9e
MD5 d01e6e042269f498a800a4c78eb3343e
SHA1 1deba3983a6ca137063755840d2c32b53d79a796
SHA512 4d491b09ba04968888f66dd2fd7c7b0aae1cce1a4d49c0b2e90d16e1cc0ffafc4f4ca968fa14db4415abd75d59276978284241f3b0925be8a30fd1bab43df428
TLSH
T13ED022733200B171A63CB9AA302AEC8BCB7200640C4BD1D452D4948CBEB5C7F040B2C8
MD5 SHA1 SHA512 TLSH

Submit Download

7b1416af-9af3-44c9-8ba4-fe14145abce9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b1416af-9af3-44c9-8ba4-fe14145abce9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d9f58766-33a8-4fc9-8138-3e5a6f790162.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d9f58766-33a8-4fc9-8138-3e5a6f790162.tmp
Size 9KB
SHA256 a3026d5f6b39f25d14dc6709e9fea5e60231ce094f623b6c5a9ed580802c12ee
MD5 92acf8e76e5f65f2f959747328a6ca9f
SHA1 6014e633103afd2c829eddae7f08eac044d2986d
SHA512 983584c89063f365bb25479082d78cec3b09e4e23b7ff17b029008c07c0464a0b19f054e1b88692edc806218dea7b02019043fc2ec61fa8ee7b55ff85cdd6f9f
SSDEEP 192:Dl2gU1bhGtchTAUiA92zWhgOy0sPCslpLhfCVDei+QIV2wsE36pS:DogU1bhGtchTAUiA92zWhgOy0sPCslpD
TLSH
T16212EFF787E8C65DC87256F29A143F1ACE5D0A1843183D66C9E5FE8F63E2031E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8c986083bde99471671eaf7d7fafbdaf5ea44f96c9fb8072d6ef4b3e4fbdba35
MD5 18ad353293b875ef2f7b02b2aced4ea4
SHA1 24c87d6df59e80f52e47bbebffb3dea200dcee71
SHA512 212ff9bcb3c8486944363d92599d5f697e0a8eac03b7f702ac8cabf4526b9d935ed795ddd09231f5eb14642d3a8b748fb10b1db4468c03823d8d5837732b8209
SSDEEP 192:sxZgRtucBWK/fJsaR60mqdpUdyE8V16AHW6+WNhV6H6yXYawboqFpIg51Q1Uspw9:sxZgKmWK/fJsaR60HoUHbO7XTqjDsp6
TLSH
T11362D792A924D9778CC7D509BE35BF22E6F500228D921E9CABFCC91C05EB6FD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ebfa0f10d3e7378fa67a4f90c0a241feb424bd52704ecb0ac9567af1bb9a44b0
MD5 5d1ebce1da116f32377d9f6b7e6cc56c
SHA1 637b2029547541cc6b47998487107417e80ccf7c
SHA512 54527b77c84c725aa3f6a5a32445a287a00e90df59ce67ad7c7506553cb9e5122c2df08cae93cb2ff2050ed6332fba0f8d49872d417d769c97b78a901875242b
SSDEEP 96:KMIQKxiGOhWKSs6B6DGq8gcY4INL6CYKi960YuCi90G:izp9B6DGq8gc5IN2CO960xCi90G
TLSH
T11A91036531BB0A1538BD258893769B7A124231F37015F62BBFBC40E25E6EE040EFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a55ea1d6-8100-4c3a-888c-7750a2e33ac5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a55ea1d6-8100-4c3a-888c-7750a2e33ac5.tmp
Size 14KB
SHA256 cba706758d8606aa854187bd6026f7ad5f86121e2421f213967de359bf9eec99
MD5 02284ebc138936aba7e127d3ce863340
SHA1 5e52fd74e27c28d4edcaa8b963c45c320af2a554
SHA512 775695caeec3dcdbfa4132cbd0c20cffd525c5757fee670d04bbecfeb9de9e7df563798f33306e781e42f1284b0f396f99e749acb8461119eb3820f5e2d895d0
SSDEEP 192:sxZgRtucBWK/fJsaR6TmqdpUdyE8V16ZHW6+WNhV6H6yXYawyoqFpIg51Q1Uspw9:sxZgKmWK/fJsaR6THolHbO7XaqjDsp6
TLSH
T18E62C792A924D9778CC7D509BE35BF22E6F500229D921E9CABFCC91C05EB6FD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b462ad64-cc7d-4b18-b90b-d7d3ae374c01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b462ad64-cc7d-4b18-b90b-d7d3ae374c01.tmp
Size 9KB
SHA256 2f52780a9ca8c8850773571c0832af8b785551a8fe2c198359160407a9293280
MD5 172f65619e09c8a73763594fbe03998f
SHA1 faba521f19ba49bada3766a8b21ce7121e6ddb48
SHA512 51afb680ec4f77dc9ff7861822721ed3cd0d1b918b777aa39f5713ca97726e94ccf37aa8463c30b3f061971359dfd381017c5b12bba1af5a97ca24e91811c48f
SSDEEP 192:sxZgRtWK/fJsaR6dTIdpdV1zHW6+WNGYaJ0oFpIg5nJ:sxZgKK/fJsaR6dMNHbGljX
TLSH
T1FD22D851AE38B97B8CCBD20DBA55BF53D2F9503291D11E58AAFC861C05E6BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcca0e4a-0020-494b-8852-9274a4f6a584.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bcca0e4a-0020-494b-8852-9274a4f6a584.tmp
Size 13KB
SHA256 f5bd1dfcf55a5db3766a35a92c794ec67d1a8a35c0e4b2a34547c160f219d230
MD5 ee2e79f4e531fb82d68dc6be89269c12
SHA1 a8a33f283fa57b6db65773df510fce27f6daf7d0
SHA512 b792aa927212e882d31810d911737ff875cdb5bd1d32103bdee554aae7169dd7e772bba5811e00f7eaf68adc4eaee112cb3c134f5fb63d7b69a17ee81de2e9e9
SSDEEP 192:sxZgRtucBWK/fJsaR6JmqdpedyE8V16kHW6+WNi6yXYaB8oFpIg51Q1UspwQRKH:sxZgKmWK/fJsaR6JHC4HbaXZjDsp6
TLSH
T12F52D7926924E9778CCAD509BE35BF12E6F500328C961E9CAAFCC61C05EA6FD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd6effa0-13c8-4d97-8b6e-bd8697c90e70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd6effa0-13c8-4d97-8b6e-bd8697c90e70.tmp
Size 27KB
SHA256 be807f153984a51ab7268a9d11f6df2cebd7b34fb04e5220c12a1c285f8ec288
MD5 8705bb52360156ad9b48828d8caf9bd0
SHA1 d5b0208de10cffd37998718ad98e433476d81ffd
SHA512 b2e6d36bc1f30e0df7781f39a8c052fb42a41f717ea1afd4352d599900356220e2ba1acbff1c5c7a0c5d4647297a292b3f8aac0a92643cf5cb4e74dc8144ffbf
SSDEEP 768:cpyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3LroYZYk:cpyQRbrWvvlpZu1jaXKLf334YZYk
TLSH
T18CC2F93B640CCB7E4FD01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e89eeaf9-f5b1-498b-9b4c-b394f067a838.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e89eeaf9-f5b1-498b-9b4c-b394f067a838.tmp
Size 14KB
SHA256 a6a16fced3c60b556d3f527a97e378c843d789f6889e0b6f4d4e58510f63f04d
MD5 d7dfd70432aadaab49fe82ed369d8111
SHA1 d98879ab05fc27f6d24804d9ce7b24950f40600d
SHA512 0dee22d2420769754b8a1d2b789f94c5872567a3990e4993c7fad948a0b75a7597291e389c9aaf945cc25d8788800c0d2c27665ff8f5482af2849a8c7625cce5
SSDEEP 192:sxZgRtucBWK/fJsaR6LmqdpUdyE8V16ZHW6+WNhV6H6yXYawyoqFpIg51Q1Uspw9:sxZgKmWK/fJsaR6LHolHbO7XaqjDsp6
TLSH
T1EB62C792A924D9778CC7D509BE35BF22E6F500229D921E9CABFCC91C05EB6FD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f479b5e6-0f25-460d-88eb-c8ceed4de960.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f479b5e6-0f25-460d-88eb-c8ceed4de960.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

53c8dbbc-917b-4dd8-80b8-e4c42d561873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\53c8dbbc-917b-4dd8-80b8-e4c42d561873.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0a42be717b05717d397690b31a1cb8dc530bddd845e389cc55662db1f9a06209
MD5 c4f071ae88b9ddc721968c8cf45adb93
SHA1 825c472ad5b40fde9fc336e2101b75b0001bc1c8
SHA512 5ab67dd8145347a2c2619cb54726d781e6f9b904a72cf2c4d597ca2c5c404786edee934f21d7b0a325819b1cfad510c02a66d64474011d837b1fac696f01ef42
SSDEEP 384:bQkUSv0sNiUh8pYM/Wa2p5u8iEm+1E2IBMtU5IIla9:V0Pn+akkETE5QU5LA9
TLSH
T157826D7698A86C3B9DF3E550F64A36039EA48217D7D41F94D6DC6B2C05DB2EC230B613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6895f3dab33fa058c41583f52d4a2e97531b0ad1db8c220821e799ddd256f5d7
MD5 bc39d13d90725042c3c7dea82114be70
SHA1 9d217e6efd1516313ccecd4f6fffa4a20fa3834a
SHA512 0f958a07a2c4dd763aadf3f7752aff3d03be2821d4a9ef6246a4f8a482331cbbc2fd0d9b55dbe1ebbbcb66c3471b9b008710b15d2518d70d22706d704447290c
SSDEEP 192:XJONOh6iDLQmiUynpjq5u88P1uhYoetARuZqqMU6:ZONOh646jq5u8iEm+IEU6
TLSH
T18C120936A8B87C3B6DE3E954B98736135EA44227DBC96F84D5DC261C41EF2AC130B513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c5d3e913e802d532093df34a550546af4f6c660474a7799a5bdc1e6c4a9d5baa
MD5 9420c4f757d7a34a994dc250f5d9e61a
SHA1 4ad71b941ca5cd816e21b90c6e5bd435a942fefc
SHA512 33e7b48278c845192b2dc9ae8a1c9fc347166bfbaf80d81a6938fcd6276ab4e8425b99f41e8d779c998f9ad9b6dcb27c11cf95567ae8d25bd95ffd49d23d2e0f
MD5 SHA1 SHA512

Submit Download

cba996dc-6ec1-48f0-9d73-ada37d955c42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cba996dc-6ec1-48f0-9d73-ada37d955c42.tmp
Size 18KB
SHA256 2133f3caaccb2f24348e9c694f17d2d1480edb584a20240b36338c97e85490d5
MD5 fb94a42aa07ad6d1e771562a1a525515
SHA1 383ca1144cc3e2797d0387996842ae5e98d23e4e
SHA512 c4cb44c31121d93c1d91821bb7c37c564fca71728b3a2ed15db28d7a9fab14a131d385f7a14b369bf161d007ba9c9c8dc0d6e82a2c3427c2a2f797a6a9f827e6
SSDEEP 384:iQkUSv0sNiUw8pYMhdRp5u8iEm+1E2IBMtU5IIla9:a0PKTtkETE5QU5LA9
TLSH
T10B826D769CA86C3B9DF3E510F94A36038EA48227D7D41F94D6DC6B2C05DB2EC130BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df078944-c578-4485-9806-417c8911f5aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\df078944-c578-4485-9806-417c8911f5aa.tmp
Size 26KB
SHA256 f32e09245b437a92dcf5fb6e31c3ee241a6b66cf16a339a449379297eb2bb639
MD5 827592c101deba9d1fe34ceadf0c47c3
SHA1 a4c6966e65820b606ff8dc88318230c3334bc721
SHA512 14aa4415b7ecbc3b7007613a6eb25fc14ab634b4d525a7d5c62aedcc04c69a7ddb87ef011994eddc809684eb780405bf532c9615836ff3d9599614612385522e
SSDEEP 384:NiFvQkUSv8IsNic8TUNTUlIld8pYMaya2p5u8iEm+oE2IBMtU5IIla9:EFxHPcwgeTakkEOE5QU5LA9
TLSH
T115C207F248D7583AD9AE9B13A73E3D038EBCC117B5945A90B7885A1CCD861FFD306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e24b5fa5-70e0-48fd-bd50-57d2d0443e00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e24b5fa5-70e0-48fd-bd50-57d2d0443e00.tmp
Size 392B
SHA256 df44534a29f2763e54d1cb3e78cdfb357e138b5d4c77794f037f860863fd372c
MD5 6378f163dedb1b92aba1703b46839846
SHA1 bc4cce32c75d8102155b34cc278c105e85d608c4
SHA512 a93ed7163ecb6cc272a2d20d5f5ed132184ee031711f588c18bcbb241c23d899ed089ab425b75c3cbcec3789914e7c4ba39a6a8ab3fed787a496420774c90d2f
TLSH
T1C9E00102E34145E8D029167441931B215B92C0250292072B0A2405587C246086E61AD1
MD5 SHA1 SHA512 TLSH

Submit Download

8f048c51-a459-4391-901e-dd8e024e8c85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f048c51-a459-4391-901e-dd8e024e8c85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a725e08a865c15a38f35b9da68b3bd1de1b1523b07d76c53e5964c402ab84e20
MD5 14e384b21ab4435adadc4e880cfa796f
SHA1 a9b6a13508933a8695a0cb6781787dd783caa157
SHA512 76ad565399a9444c94e71947a6517f454a51ad25970aae498fc1c8b48dc9fa7c4ac645fcbff09a3151044a6f4b5959c4878a2c0a49cd4aeeb9a19d36b6a6e090
TLSH
T15C41289CAAE91158B3B76E5A9FF7A56D843BBC732E06946D00010D4F0A36F44C871737
MD5 SHA1 SHA512 TLSH

Submit Download

1ac12e8b-0e58-4fa3-8fe2-b6b22f8731c4.tmp

Path C:\Users\Admin\Downloads\1ac12e8b-0e58-4fa3-8fe2-b6b22f8731c4.tmp
Size 31KB
SHA256 a44ddc839e89ee787b0b430c04ec44e5d3fcbb55472c0837b89909c99f5a9e85
MD5 a40dde69fcd017b47083e7ac3a6ac8db
SHA1 174d83c894ba118cc7f5c553c360768f9659c04d
SHA512 ddc261a2b5d327595c010ae06c2c945ea6fb4854ff89325a4492e8ce93d95eb59b4d8da44d9471f85a385f3d989e87ccf6b4a4aa388b6e8ead6e44ae0672bdd0
SSDEEP 384:c+PH2aJlkOK96hqcR9BK2vxRFzqoMfMu7KqwyGMn5Um6lbYJ6kRl2CaBbzurmMLa:pHUcRO2vxRgxt+bplFzm5Lna
TLSH
T112E2F14901B69832C0FABD37D24E901C7CDE7BDBCF540E9A150338C55AFA79E84AA640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TGMacro.v3.053.Portable.zip

Path C:\Users\Admin\Downloads\TGMacro.v3.053.Portable.zip
Size 937KB
SHA256 e39c2558d8fef8112a12576e73e8b992dcbd670d2959a32dfbfc484594c0e15f
MD5 367993367301edb550375eea0f895172
SHA1 3ad6dd18699add8263acc6c9f0945dc3f5cb2c47
SHA512 5abdcdfef1dc39e7c57e3cc602a6f0ca8f008773f22cec68d2938b2d2063e21bf670231662544755a88dc204aa8041e947291fa573902323ecf6edae62eda139
SSDEEP 24576:rbjp57u4LLKMWsPgogWO36sGQtIG6WLQuoru:DLuU1fPgog3UQ54uj
TLSH
T1461533E102F3FF990B68E83AE1FE584D21C2C1B561BA1D56CF4A38B0D1C771EA61D846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\Downloads\TGMacro.v3.053.Portable\settings.json
Size 1KB
SHA256 9e23b9693a9369a6e0f36a80f021f08e551b7e2e4591a96a5871ad2dab92ba89
MD5 48712e454e5e89f60187331a29f82ff8
SHA1 14ac29c2ce091770676562014e7374762cd65573
SHA512 558205b19ec12da809f81886743c5ab95b7a28b697399d903c7d8e51c81743b81c984fbd9b6ea13d28c30835c35c376bbedb714f7e7048728cec23d12924422c
TLSH
T159213621D1040E7DBD7ACA16C25DAE46EF6403BB3105292FB1FC5A4D6FB352B31A644B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4268-696-0x0000000000EB0000-0x0000000000FA4000-memory.dmp

Download

memory/4268-701-0x0000000006540000-0x0000000006AE4000-memory.dmp

Download

memory/4268-702-0x00000000072A0000-0x00000000077CC000-memory.dmp

Download

memory/4268-700-0x0000000005DC0000-0x0000000005F82000-memory.dmp

Download

memory/4268-719-0x0000000006B60000-0x0000000006B98000-memory.dmp

Download

memory/4268-720-0x00000000063C0000-0x00000000063CE000-memory.dmp

Download

memory/4268-725-0x0000000006D50000-0x0000000006D58000-memory.dmp

Download

memory/4268-699-0x0000000005B50000-0x0000000005BE2000-memory.dmp

Download

memory/4268-698-0x0000000005A90000-0x0000000005A9C000-memory.dmp

Download

memory/4268-697-0x0000000005A60000-0x0000000005A90000-memory.dmp

Download

memory/4268-757-0x0000000006D60000-0x0000000006D6A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads