hxxps://github[.]com/ggml-org/llama[.]cpp/releases/download/b10819/llama-b10819-bin-win-cuda-12[.]4-x64[.]zip

Resubmissions

05/09/2026, 23:55

260905-3ynrssvcnc3

05/09/2026, 22:50

260905-2skyaatgpa7

05/09/2026, 22:29

260905-2eqxdateqa3

Analysis

user interaction
yes
max time kernel
622s
max time network
617s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ggml-org/llama.cpp/releases/download/b10819/llama-b10819-bin-win-cuda-12.4-x64.zip
Sample260905-2eqxdateqa

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2576	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331210132410879"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{9A36310F-818E-4DB1-A655-08E54EA4E7FC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4564	2776	msedge.exe	89
PID 2776 wrote to memory of 2876	2776	msedge.exe	90
PID 2776 wrote to memory of 2576	2776	msedge.exe	91
PID 2776 wrote to memory of 2876	2776	msedge.exe	90
PID 2776 wrote to memory of 2876	2776	msedge.exe	90
PID 2776 wrote to memory of 3464	2776	msedge.exe	92
PID 2776 wrote to memory of 3464	2776	msedge.exe	92
PID 2776 wrote to memory of 4540	2776	msedge.exe	94
PID 2776 wrote to memory of 872	2776	msedge.exe	95
PID 2776 wrote to memory of 4540	2776	msedge.exe	94
PID 2776 wrote to memory of 4540	2776	msedge.exe	94
PID 2776 wrote to memory of 872	2776	msedge.exe	95
PID 2776 wrote to memory of 872	2776	msedge.exe	95
PID 2776 wrote to memory of 4332	2776	msedge.exe	96
PID 2776 wrote to memory of 4332	2776	msedge.exe	96
PID 2776 wrote to memory of 4332	2776	msedge.exe	96
PID 2776 wrote to memory of 3820	2776	msedge.exe	97
PID 2776 wrote to memory of 3820	2776	msedge.exe	97
PID 2776 wrote to memory of 3820	2776	msedge.exe	97
PID 2776 wrote to memory of 5860	2776	msedge.exe	98
PID 2776 wrote to memory of 1224	2776	msedge.exe	99
PID 2776 wrote to memory of 5860	2776	msedge.exe	98
PID 2776 wrote to memory of 1224	2776	msedge.exe	99
PID 2776 wrote to memory of 5696	2776	msedge.exe	101
PID 2776 wrote to memory of 5696	2776	msedge.exe	101
PID 2776 wrote to memory of 1996	2776	msedge.exe	102
PID 2776 wrote to memory of 1996	2776	msedge.exe	102
PID 2776 wrote to memory of 1996	2776	msedge.exe	102
PID 2776 wrote to memory of 4684	2776	msedge.exe	104
PID 2776 wrote to memory of 3012	2776	msedge.exe	109
PID 2776 wrote to memory of 3012	2776	msedge.exe	109
PID 2776 wrote to memory of 3012	2776	msedge.exe	109
PID 2776 wrote to memory of 2460	2776	msedge.exe	111
PID 2776 wrote to memory of 2548	2776	msedge.exe	112
PID 2776 wrote to memory of 4692	2776	msedge.exe	113
PID 2776 wrote to memory of 2460	2776	msedge.exe	114
PID 2776 wrote to memory of 2460	2776	msedge.exe	114
PID 2776 wrote to memory of 4912	2776	msedge.exe	116
PID 2776 wrote to memory of 4912	2776	msedge.exe	116
PID 2776 wrote to memory of 4912	2776	msedge.exe	116
PID 2776 wrote to memory of 4568	2776	msedge.exe	117
PID 2776 wrote to memory of 4568	2776	msedge.exe	117
PID 2776 wrote to memory of 4568	2776	msedge.exe	117
PID 2776 wrote to memory of 5052	2776	msedge.exe	118
PID 2776 wrote to memory of 5052	2776	msedge.exe	118
PID 2776 wrote to memory of 5052	2776	msedge.exe	118
PID 2776 wrote to memory of 5268	2776	msedge.exe	119
PID 2776 wrote to memory of 2212	2776	msedge.exe	120
PID 2776 wrote to memory of 5640	2776	msedge.exe	121
PID 2776 wrote to memory of 5640	2776	msedge.exe	121
PID 2776 wrote to memory of 3116	2776	msedge.exe	122
PID 2776 wrote to memory of 3116	2776	msedge.exe	122
PID 2776 wrote to memory of 3388	2776	msedge.exe	123
PID 2776 wrote to memory of 3388	2776	msedge.exe	123
PID 2776 wrote to memory of 5616	2776	msedge.exe	124
PID 2776 wrote to memory of 5616	2776	msedge.exe	124
PID 2776 wrote to memory of 564	2776	msedge.exe	126
PID 2776 wrote to memory of 564	2776	msedge.exe	126
PID 2776 wrote to memory of 5176	2776	msedge.exe	127
PID 2776 wrote to memory of 5176	2776	msedge.exe	127
PID 2776 wrote to memory of 5176	2776	msedge.exe	127
PID 2776 wrote to memory of 5508	2776	msedge.exe	152
PID 2776 wrote to memory of 5508	2776	msedge.exe	152
PID 3104 wrote to memory of 3064	3104	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ggml-org/llama.cpp/releases/download/b10819/llama-b10819-bin-win-cuda-12.4-x64.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffbad80c188,0x7ffbad80c194,0x7ffbad80c1a0
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,9014679118478050118,626570485346146572,262144 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,9082843512237291669,6328043534279326852,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,6542367832856992472,14601687446781093797,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,10673921885818474499,16770603190184966886,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,12458795141866581296,18090585442871290136,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,11003337795333285466,15272561712026663698,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,4880589330965432646,2017836863680914456,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,13901394332475872453,17975681348630062925,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15299234540027673703,2509943307538679434,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,3539659415610094023,14290577905980989959,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5960,i,16180404868420776327,10369791516179580667,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4297590258673682666,11311467609121047413,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4297590258673682666,11311467609121047413,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4396,i,9785878528500354505,3731818853328848081,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,12153061112877061593,8409297547144682606,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,939302646615516740,15335132824063122617,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,6657349744765233328,3659942971493603614,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13692973015987970049,10954115188920662625,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6156,i,712995701088122941,16865115825855192091,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7156,i,3298316450471082714,11989904843612323083,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5652,i,933704456292224676,11347158135297105601,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13808634907047534446,10380385792195593581,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5664,i,2687318346223209569,5126118125062961716,262144 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3034816863141776438,16570291402120414431,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,10045358663120352212,18377113506674156172,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,8441755748701824804,14196008931773614251,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,6142251815147168976,12104961715564247446,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,8761146341720421126,14517738969040529221,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4392,i,18165486491502139632,13267755639490021060,2097152 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,11732053265632703637,997327640807697086,524288 --field-trial-handle=2536,i,17828074652959322873,5759861139208215917,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5600

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe"
1⤵
PID:4264

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe"
1⤵
PID:1196

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama-server.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama-server.exe"
1⤵
PID:6136

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\ggml-rpc-server.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\ggml-rpc-server.exe"
1⤵
PID:1288

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe
  llama.exe
  2⤵
  PID:3064
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe
  llama.exe help all
  2⤵
  PID:3156

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64 (1)\llama.exe"
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

0d28fb83-0642-41cf-9860-f446c0ffc9f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d28fb83-0642-41cf-9860-f446c0ffc9f1.tmp
Size 13KB
SHA256 80f2edce44e97372e7c5d836bcf6c019d6f635035868d3a2e4e88f6a7fe1bb72
MD5 aeb77904ec407dd43b1824f8ae3957f9
SHA1 883dd67ff68f63fe028f36c44346a4a5b662d3e5
SHA512 51b6e13d28e61739a64fce5edfc02d788d5b30b514f5dc2c35eaf0bac6fb297bb1a8f9f4fd03839711381b069c55d15ec3d43298da1fa2d11f6eb70c190bf497
SSDEEP 192:sxR3R1yM/jK1Ml8wO6/fSsLfpKrjD1IzoA8pi/g6+WNIYEpliKj+G4IgIJ:sxR3FI6/fSsLfpARi/5IeSCs
TLSH
T10452FA15AA249D7BCCDBD20DFA517F53D6F85573A1901E44AAFC8A1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 0aa6c5f9451becef3097762a19deb778d168f3b8921305f3c8010485f0e7525c
MD5 c11124179e8b042f1f326c5dbba8d3ae
SHA1 06aed1be3a3c5482df8524286936824ff707ea4c
SHA512 be89de502d8a24f23e21342bea06b51138a2994505dc88e22e70f776552e9a65bfaf2e52f07cc693ca838cc224071b938c7fd43cb8e3adbecbfaf34a4a2e5d71
TLSH
T13BE0208505E5C36EF302798752584B0C83C13F1EA3CCAE4927048C94B14598062C29B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3b2591426f065bb9a6f81a89767e81792e22cc9e4c01bb99f026abf60f3648ad
MD5 4c8fe3d08725a08c9685b8356e0f0328
SHA1 e2fc86feac2eea279674151abc6647c7bd78db82
SHA512 5a821807179481fdbec04329ad7e162d7233eb683b2c56c891d6833a48eb937063a0471d906a5ad2cb44bfa6297efba8684d71fd13059bd14c4f7d9c3cc03039
TLSH
T1BEE026D48ADCC36EF20868C75278870DC2C03F1E92CCAFCA2700A488B206480E7C6AB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4239a98141a685f4ffe1bfb0b87899392fbe6e6b65011dbedfab9d262e67ac96
MD5 f9d23b4e763e9b67bcf6c788e238d12b
SHA1 b1b95c64e41fc3b36d12f45849a1a82514ab05f5
SHA512 526451db3679382ac177a78a245d60c2bb188218d806a98e0d47c063874e68fa5cf757d5c6365eb4138e78bb918f176493bbc74c4fe2c182bd994fede51b6e95
TLSH
T1BCE07D8805C8C3BEF3446AD752EC574C82C13F1AE3CCAE8A1705AC847601DC8B2D3AB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 bd721f0a61773c07de70cc9c5c9880ca37a6bf378760a229aa133e6196e10fb5
MD5 c662cf698815f88b76b02ef5551e7690
SHA1 8ddc9f6582685612156c3b0305bd6e8b61ea1970
SHA512 4a42fce645c4dd0feaf78770525e2886d39b29add429b2b90d7440c9509bc66940dc11bd8d6eba06388b3242f88ca3964cdc7e9e7d919d4337891aac3a850b9c
TLSH
T10651B7966FB8D6E1D338E37163F0174433F9A8A94A079E022052FD32098EF87B0E0253
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5ecaddc63bf865bc26b6e84ee6811850df908b819dbfbd7c06929ae2602dca09
MD5 7db3d4a8144c32a0c01b09edbc842157
SHA1 a5c0085b31e8c6b2dcf0f6e023f5c449c24096aa
SHA512 cc0072d91ff0d04575d0825ee3adabee4601f501622eaaa1bdfd63d0ff30071bba6898784883a1a8d1dc0f02fb24befcd0a8aa43ae9824131765d6d8bb63973d
SSDEEP 96:ipL0DKHsfySupaJXIYaYNg8sg4OLA9WgyE7fWkcsOhs0ga9/k98DgWtK5wOrQOET:VTzD4OOWqDiDnP
TLSH
T110A13F4A5B7A87D0D76993F9A2E00776F3F8A4F96507DE42B053EC310A8AFC2A4D0153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe599253.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599253.TMP
Size 2KB
SHA256 167d8279160593ff1cd78f151ff0c19a1c336d393cba232c2d993d773cf98770
MD5 cd38b94640c5a7d5d92b38d239c07dd8
SHA1 b169ac3efe8ea9a417cd157dd4a137c187142e7a
SHA512 3f08da432fd0f542f07cf1653a6641cdf80000da3e1b3937076d979db4c77fb2e3fc932654491b4f8bf5108d0e8e8e0eb297859c01c633c90eecb8b907c14874
TLSH
T1CE51B8566FB8D6E1C338E271A3F0574433F9A8A94A079E022052BD32198EF87B0E0253
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e24419a6a93e208d2d6e9472a4b3d734b5462a5028f39a6782d3b780b537f171
MD5 ac66f9bd6c48a1123740adb78b7e67c4
SHA1 379ca5ad31d21d3e52feb0b13f2c03fccfcc9857
SHA512 603f911450e75ae19891af18675347f2d0dd91ea965db1fc8b50efb0099cd34089351faa00fdad2798ef5f2dcb6f7b7fb6fdd71537083e9e94b5cac00fad422f
TLSH
T152519CF787F5956D9B0196F0AA08AE1FCE2C0525832C786985E06E17D3F3472E041B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e00b2605e6c9dc7752b4d3da7f3c0d6368d95d002de47c8dadccda35ddc6e478
MD5 eb7a7c86170c18789c1a78f9395cdfb4
SHA1 7295e80e6d36f3b98c0537cd127a7c1e00505fc0
SHA512 4d22bd1fc0afc9343a29f279cf8cf43beba66492d184f701725b381e3e496ccee20dcffac939bda33e0b4ed1d42f2e31075b13d006041ce7f5fe900f740c883a
TLSH
T10F514AF747B1956D9B1196F0EA08EE1FCE6C0521835C78A985E06E27D3E3872E041B6F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cffd09d621f4724b4e1be81db3f5743c5e58ad5364317e26300299eb806d6328
MD5 c34d58793fa16540f31118e00ddb1935
SHA1 79529a88b2b826daed51b321ae82591b5ac15344
SHA512 ba48d88c0c8baffb5b3f48d5affa4cb468e89fad08ef9b8faa31c16f0ec7f3072d725fe82b9cf1a801ba96f0851e565a51c1dc6681f179ce6708b8277734d043
TLSH
T1E0517BF787F5956D9B0296F0AA08AE1FCE2C0521831C786A85E06E17D3F3872E041B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6467e7151a91dbbfda569e96a57e3212d1dc40a74198c83bbbf5dd7176cab8c1
MD5 8f5a64e8c5efefeb8c7029c80d43c4ca
SHA1 02b8c68153fa6bbdd5e97c05c0f64ddaf2f78692
SHA512 76efb254f62d7516b9e3e811d5818ce898d0e59dee9cea477113074f42d4c5666ee40d07f31e45cc695a346a640d3dab96f7e04fae4cc6530c39dfa6a64d218f
TLSH
T1AA514BF747B1956D9B1196F0EA08AE1F8E6C0115835C78A985E06E17D3E3472E041B6F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 73e210a5d3c3c5d103e64317663289a85c34086e4808bfed1eca8a9575d5f1a2
MD5 5aa07cbbd8925f13d1b379669095a359
SHA1 6787b2280d7514021b8ce5c0d1118ace2b5c26d9
SHA512 164a69f8d8a96749ee9acbb53bf3c056ad2cea693f3e62ab872238191b8eb9f6e62026ec61287a3388ebadff36c61c04c300c9f5cb5dd0df1b257ccdc538d706
SSDEEP 192:sxRYR1yM/jK1Ml8wO6/fSsYfpKrjD1IzoA8pi/g6+WNIYEpxiKj+G4IgDxJ:sxRYFI6/fSsYfpARi/5IaSCP
TLSH
T1DC62EA15A6249D7BCCDBD20DFA517F93D6F85573A1901E44AAFC8A1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9e46cd3ede4e0b42b8d23909eac07fba396948c913f815490344ef950a8e087f
MD5 6a9a11620c91384558e901dc27eedc19
SHA1 32f06fa9249dc7239d5bf060ae111a41fd235f36
SHA512 5483de139a4607133c305f8a99cd8fd818040641ac9dac3450b05c2665b72aa267605aa8fb36bb9ef819ea808978fac69fa6d590466123d6620bc9704dcf161a
SSDEEP 192:sxRlR1yM/jK1Ml8UQJO6/fSsYfAKrjDtEnzoA8pw1//g6+WNSWjdYEJ5iKj+G4I+:sxRlXqU6/fSsYfAYTM/5jdeSCp
TLSH
T17C72F911A9249D7BCCDBD20DFA91BF53D2F81523A1901E44AAFC8A1C00E7BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 128d9ffa0c8f261c61847ac54b8e2b9d5284aa0d57233fcc07047f7f347c51f7
MD5 3a70c1b5e3a37e873d684fd8e9cee6bb
SHA1 2ebef65f49fbdde5e2fefde2b81c0229b4851440
SHA512 79116c3a5894eedaa33ca12317158d0d9f566052c0b15c4d3aad31f6e69ab3de5c62a375222d57349b1bbc9912b4e23c6daf956e7bf77c479b9790557e069132
SSDEEP 192:sxRlR1yM/jK1Ml8wO6/fSsYfAKrjDtnzoA8pw12/g6+WNSct8/YEL5iKj+G4IgDF:sxRlXI6/fSsYfAYOJ/5g/8SCp
TLSH
T1A462F915A9249D7BCCDBD20DFA91BF53D6F81523A1905E44AAFC8A1C00E7BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c106354f010e1cc9e777e1de36904be8a5443b7c9bbb072c9e8c4f57d6ccb078
MD5 e265514c265f63b4deeed544df89a91a
SHA1 e03e816b0b876300161a3ecabe91b65ac699728a
SHA512 5110eedd9925477c5468147283bb14ecf2f92d534be591c8a529c26e3ca17c1d70680b03b0e7bfae17da1c25c9aaebc7ffe8cf69d30fbcc8429485d30730ec30
SSDEEP 768:0hiiBaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsOV8dron6R:0hiiBaWgH7f3Qu1jaNI8WA
TLSH
T1ECC21B2B640CCB7E4F844EADEC25AED76DD801CB9B984D5447EA884C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\59c90d6f-555f-4983-9137-46014d8e455d\index-dir\the-real-index
Size 288B
SHA256 1c699a1fbb59f734677d88d8b7ade5bbf527d57d3c3e0331f5c3d417e85b07fc
MD5 2bc4426488cf1cd8f910630e795847fd
SHA1 69de4acee5b230e4b8b364577b1c8080f38701ed
SHA512 c8cd932bde659a946b26b4fd472e16cdccaccf6556f2a668c3ef806ec867234140a9d4365f163515c82d669203425a61d4b5c3238e2c22e302bbd8721c639072
TLSH
T19DD023CFDCB26546DB2124790977251D333705FC2107691B00EC143E7E7377E6945905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dd0c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\59c90d6f-555f-4983-9137-46014d8e455d\index-dir\the-real-index~RFe5dd0c0.TMP
Size 288B
SHA256 6ce0b4aad4c5ee51cbfd17c0282f8e7eaa338a570d28bd3a06204c68f5f3f03a
MD5 baae212d59ea653eb2f500ad9eb3bd1b
SHA1 25365bd2244a3ca7d5919facfda014bb3936fdd8
SHA512 5d92480db48644a1f22de0d9b779b971357f78e0fdebcc126fc7d87215136c69561560b8c13566c791e537b09a53ee8c6adf234671632ab75076f3fa2b0b7447
TLSH
T168D023DB4551A961DF371439158356153337083424159E2511ED143F49727DC5985506
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8f6174229fa73620d2261ee99d8ac9c0891579b07d1ebf0761df7687751a9c48
MD5 c527c1b027538635b125c25ed882d722
SHA1 eb9fe61420b7874d87654df66f28154f0931138f
SHA512 40b2dfca121b75f22805747b5d8191e426011f3ace7acecd58b72cabb59c4fbad633b4f27c1ad5bc4fedbadd6af49d5659a29adc1bf2fa30ccc74f929072ec5f
TLSH
T1E8E0687B2CE30800A8AE87DA10758160011578989A0AEC8E555992C760723123446C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ba50efebda5e14f44d635b72b8eba64737da06203702f7ec0ed0949ba181b678
MD5 918276014bef43d4a70c739db7c6a727
SHA1 d9271368358ef2763609cfdfb9db0aa6312d1a84
SHA512 617ea93ab5761ba3cc129756a49cd98ee2bde80f1f939b65c3841a8d0984994473157dd015a8e19cd39ae2170d59a7225b5aa2b4f00b591a84b059312fe331ee
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XH7kh1DZpVW9yogdVK4kgzVcbDa9puHYp8c:CeTieYgQxAl+eODgc1W+9M+XH7kh1DZl
TLSH
T14D91F541707752843C7DAA1982788C3E92C27872301CB96B7B6965E64F66E039CFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a28d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a28d6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f37fcb2ccaaf755c304bed01a9483d51f9c73127cafe2e4fb1f9a90e5817d519
MD5 80883746a47c20738b2e05b1f3582be0
SHA1 91ab8ae783fb9468d9e8b83493cf6e01a425b76a
SHA512 1f3a6748bab54a8ac6e3dc272df7462ae9167fe47fa73f4eb78e1e68c351bbc909a38f5dc7a1c1f1781f4702c34f65c088c275e08f7b9daf849ac5a20a5d2d1a
SSDEEP 768:Rj355qGQjD0cK48dHeByERRFzjK3YicTRKMi:Rj35sGA0p48dHSyw/0cTRKMi
TLSH
T152F2BEB068A5ACB70CFBC28A7A177757EEF0415385C86A60D5DDAE0E05876DD030BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 45749e1be6e80379684a530b69966de5d303f78026fd13f6f1c964dcbb512f82
MD5 6861900c4d9494a165caa1fff3d6a946
SHA1 667c79f9c77a54a534c14b913886fc4597fc053a
SHA512 070a9a58365a348cbb2d5e2ee19cfea260c262bdc4f509312b1a268a78c7cd0bafb55254a2590970625c96d3d43baa6e49524964296d1ddfd2a77457b705693a
SSDEEP 768:Orv+4UNbdl3Z5qGTjD0NK48dHeByERRFzjK3YicTRKK:Obsbf3ZsGL0k48dHSyw/0cTRKK
TLSH
T1D103CF70A8A8ADB34CFBC28A75077657BEF4015381C91A64D5DDAF4E458B4DD130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f6719f28d4db2f74cbe12937fd16288eea604c1bc78bce1afa8a00880af4128b
MD5 fdb987f62faea54f69bfe30283aaec99
SHA1 5349d86c1d064f345339ee3ec830f9a74f09c5b5
SHA512 92e235f69768803aa78e5e886dad949e665a181253def72def4fba4d2dfcc82a08cb6e1918cc336e2ccdc5790b78a7b0eb836ae2955f48da834cde52c66efc8c
SSDEEP 768:xj385qGQjD0cK48dHeByERRFzjK3YicTRKMi:xj38sGA0p48dHSyw/0cTRKMi
TLSH
T199F2ADB068A5ADB70CFBD28A7A173757EEF0415385C86A6091DDAE0F04876DD030BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 4ab501045f35e5128722ab4ea9286de0976c77a5cd7b868dd147e34de13dfe38
MD5 b2fad00e20ebb5c7f92bfe29a3450cca
SHA1 1449077e35c6cb5895ead5d7e61143983aad762e
SHA512 65fe8425e347b39a8fd9d5663c07b770002102c77d02ed0139f74358a90b29666d478cae60568d4c04f1eff4acebf32f5c558c524dc0fe427dde49019dba8d6c
SSDEEP 768:BFH43ewg15qG4jD05K48dHeByERRFzjK3YicTRKMi:H43GsGI0Q48dHSyw/0cTRKMi
TLSH
T17AF29EB25C949DBB4CBBD78ABA573756EEF04153C5C5AA60D2DDAD0E01871DC030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 dbcfbddbf539bfd10278b5128cca3237add1d99b0a1df2cf420b450ebc21d46c
MD5 4c57804564b21ee0f806269ef5a5db5f
SHA1 44aad2366fb9437cfad4ad64abc69c045f324fb3
SHA512 abc9ff375a5b4afd9daac7799946f8d231d21bc895a5c551a7b59b1f9dfe7b48f8eb00028ad02b2430c4a6af906df38e85e19bc7de5cf6952e41c8eac3219fce
SSDEEP 768:Db355qG0jD0HK48dHeByERRFzjK3YicTRKMi:Db35sGs0q48dHSyw/0cTRKMi
TLSH
T10CF2BEB068A5ACB70CFBD28A7A177757EEF0415385C86A60D1DDAE0E05876DD030BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 df437e9485d3a6023a5964beb9e76ab1c1fa2c97ab66782830e9d29b52b29707
MD5 8b40541223841c3c38158f5508d7ce67
SHA1 2574a834783602852d10c9638fbe54fdfbe59b5b
SHA512 b2d4a1acacd1eb60da80753241560af1b8d4800f8714c6d634d18777b9f9a7ee5162b73e41587889a480af8438faca169fb1159aa22c5f5bda4990b74f2e01f6
SSDEEP 768:BFzT3KwgE5qGAjD0lK48dHeByERRFzjK3YicTRKMi:zT3hsGQ0s48dHSyw/0cTRKMi
TLSH
T184F29EB15C949DBB4CBBC68ABA573757EEF04153C5C9AA60A2DDAD0E01871DC030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d1b6fab9c528bf4795926c2e4fe7bc83a6eb9cf268a8ac943285d3c1d88522ff
MD5 a9a972552f124158ad9a51015cc25b27
SHA1 4ca93a92f7c5803eafef34bf1b35e3c531eec5ee
SHA512 9348c2ae5706ce5052dfbc5076ceda7c1926a361f12e75b30d218f54abcd90148001540957910b40ed4b2bb45b862299bf30b0fc6ce7d4ca079352a6218f528b
SSDEEP 768:Yrv+4UNbdf32qG4xD0DK48dHeByERRFzjK3JieVH1SCj:YbsbJ3vG60m48dHSyw/nEH1Z
TLSH
T1DD03BE71A8A89E734DE7D28A7543B657BFF4421382C81BA4C5DD6F4E468B0DD030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5b937182e71121b079d25d985eb6aec2eeb31dab5d0ca92172ceb4b4c411d069
MD5 a54d8bd20e842f2597c6337c1a9c45fb
SHA1 f16072c6dac8ce28917a7786d542866eea5eb310
SHA512 52a2a8af2af464e125cc1464b771177b8441a1bc2e020367a601729d6633fb8829f3d1953d5bf911b42cc62585ec6f915bb6f1210d60c88b15d0287759238239
SSDEEP 768:Qrv+4UNbdf3/qGxRD9K48dHeByERRFzjK3YseVH1SCj:QbsbJ3yG7U48dHSyw/OEH1Z
TLSH
T1DD03CE71A8A85E774CE7D2897643B657BFF4411382D41BA4C5CD6F4E828B0DC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download