hxxps://github[.]com/ggml-org/llama[.]cpp/releases/download/b10819/llama-b10819-bin-win-cuda-12[.]4-x64[.]zip

Resubmissions

05/09/2026, 23:55

260905-3ynrssvcnc3

05/09/2026, 22:50

260905-2skyaatgpa7

05/09/2026, 22:29

260905-2eqxdateqa3

Analysis

user interaction
yes
max time kernel
634s
max time network
609s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ggml-org/llama.cpp/releases/download/b10819/llama-b10819-bin-win-cuda-12.4-x64.zip
Sample260905-3ynrssvcnc

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4352	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331261510766744"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{9BD63766-D041-4532-8459-2C211161658C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	taskmgr.exe
Token: SeSystemProfilePrivilege	1420	taskmgr.exe
Token: SeCreateGlobalPrivilege	1420	taskmgr.exe
Token: 33	1420	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1420	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2376	OpenWith.exe
1420	taskmgr.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 1468	5844	msedge.exe	88
PID 5844 wrote to memory of 4352	5844	msedge.exe	90
PID 5844 wrote to memory of 5860	5844	msedge.exe	92
PID 5844 wrote to memory of 5860	5844	msedge.exe	92
PID 5844 wrote to memory of 2736	5844	msedge.exe	91
PID 5844 wrote to memory of 2736	5844	msedge.exe	91
PID 5844 wrote to memory of 2736	5844	msedge.exe	91
PID 5844 wrote to memory of 3612	5844	msedge.exe	94
PID 5844 wrote to memory of 3612	5844	msedge.exe	94
PID 5844 wrote to memory of 3612	5844	msedge.exe	94
PID 5844 wrote to memory of 1004	5844	msedge.exe	95
PID 5844 wrote to memory of 1004	5844	msedge.exe	95
PID 5844 wrote to memory of 1004	5844	msedge.exe	95
PID 5844 wrote to memory of 2784	5844	msedge.exe	96
PID 5844 wrote to memory of 2784	5844	msedge.exe	96
PID 5844 wrote to memory of 2784	5844	msedge.exe	96
PID 5844 wrote to memory of 4636	5844	msedge.exe	97
PID 5844 wrote to memory of 4636	5844	msedge.exe	97
PID 5844 wrote to memory of 4636	5844	msedge.exe	97
PID 5844 wrote to memory of 2104	5844	msedge.exe	99
PID 5844 wrote to memory of 2340	5844	msedge.exe	100
PID 5844 wrote to memory of 2104	5844	msedge.exe	99
PID 5844 wrote to memory of 2340	5844	msedge.exe	100
PID 5844 wrote to memory of 4296	5844	msedge.exe	102
PID 5844 wrote to memory of 1276	5844	msedge.exe	105
PID 5844 wrote to memory of 484	5844	msedge.exe	106
PID 5844 wrote to memory of 1276	5844	msedge.exe	105
PID 5844 wrote to memory of 484	5844	msedge.exe	106
PID 5844 wrote to memory of 484	5844	msedge.exe	106
PID 5844 wrote to memory of 5292	5844	msedge.exe	107
PID 5844 wrote to memory of 3084	5844	msedge.exe	108
PID 5844 wrote to memory of 5328	5844	msedge.exe	109
PID 5844 wrote to memory of 5792	5844	msedge.exe	111
PID 5844 wrote to memory of 3356	5844	msedge.exe	112
PID 5844 wrote to memory of 3356	5844	msedge.exe	112
PID 5844 wrote to memory of 4672	5844	msedge.exe	119
PID 5844 wrote to memory of 1076	5844	msedge.exe	120
PID 5844 wrote to memory of 1076	5844	msedge.exe	120
PID 5844 wrote to memory of 3232	5844	msedge.exe	121
PID 5844 wrote to memory of 3232	5844	msedge.exe	121
PID 5844 wrote to memory of 4704	5844	msedge.exe	122
PID 5844 wrote to memory of 4704	5844	msedge.exe	122
PID 2776 wrote to memory of 1528	2776	cmd.exe	123
PID 5844 wrote to memory of 4516	5844	msedge.exe	128
PID 5844 wrote to memory of 4516	5844	msedge.exe	128
PID 2776 wrote to memory of 4004	2776	cmd.exe	140
PID 2776 wrote to memory of 5732	2776	cmd.exe	143
PID 2776 wrote to memory of 5764	2776	cmd.exe	147
PID 2776 wrote to memory of 1408	2776	cmd.exe	150
PID 2776 wrote to memory of 480	2776	cmd.exe	230
PID 2776 wrote to memory of 3696	2776	cmd.exe	233
PID 2776 wrote to memory of 5164	2776	cmd.exe	236
PID 2776 wrote to memory of 1812	2776	cmd.exe	239
PID 2776 wrote to memory of 5864	2776	cmd.exe	242
PID 2776 wrote to memory of 5892	2776	cmd.exe	245
PID 5844 wrote to memory of 4616	5844	msedge.exe	248
PID 5844 wrote to memory of 4616	5844	msedge.exe	248
PID 2776 wrote to memory of 2012	2776	cmd.exe	249
PID 2776 wrote to memory of 5572	2776	cmd.exe	252

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ggml-org/llama.cpp/releases/download/b10819/llama-b10819-bin-win-cuda-12.4-x64.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ffe61eec188,0x7ffe61eec194,0x7ffe61eec1a0
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,13633943526429164786,17195922492383959302,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,4975165529368859293,6696194044956915610,262144 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,4109112872149482237,5938156043239805711,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,8437452605438482286,6208731863322531228,2097152 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3672,i,11611581536300719908,14169897634573993529,2097152 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,11978851986997045640,5955126818818952346,2097152 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,9131589203318260013,13657807905667582973,2097152 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17775521955345460792,15918250395383143269,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,12035128361904419163,9936195273374718194,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1276936546183347104,9369971051604388364,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1276936546183347104,9369971051604388364,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16560134803948824384,5957442142998222166,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4836,i,5712479968206567181,4836948328182096046,2097152 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,11589117033329906975,15080262191725874576,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,16789297058238767814,7375965744481637607,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,16134411928977381054,9729234296108317202,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,15732322341533275346,8749440452461869207,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,15160638654218658551,15524510511459702110,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6696,i,9042389425196817578,17510939986600932103,262144 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13665696402515783715,86359178185684150,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,9947232012609038525,17166506442070563676,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,15592932624323256371,9752966774847553014,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,12747401704450970971,4135940442016325358,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11915985993416908139,8105768725986193626,524288 --field-trial-handle=2580,i,4173480694033078638,16918144045362254050,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
  2⤵
  PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5972

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe
  llama-cli -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:1528
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-server.exe
  llama-server.exe
  2⤵
  PID:4004
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe
  llama-cli.exe -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:5732
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe
  llama-cli -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:5764
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe
  llama-cli -hf ggml-org/Qwen3.5-0.8B-GGUFllama-cli -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:1408
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  2⤵
  PID:480
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  2⤵
  PID:3696
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe help all
  2⤵
  PID:5164
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  llama.exe download -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:1812
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  llama.exe download -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:5864
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  llama.exe download -hf ggml-org/Qwen3.5-0.8B-GGUFllama.exe download -hf ggml-org/Qwen3.5-0.8B-GGUFllama.exe download -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:5892
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  llama.exe download ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:2012
- C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
  llama.exe download -hf ggml-org/Qwen3.5-0.8B-GGUF
  2⤵
  PID:5572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:256

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-server.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-server.exe"
1⤵
PID:5812

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-server.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-server.exe"
1⤵
PID:1408

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:4564

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:4460

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:3696

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:1144

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:6004

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:4484

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:5036

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:4360

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:1632

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:2840

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:3848

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:3196

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe"
1⤵
PID:1236

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-server.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-server.exe"
1⤵
PID:2956

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:4328

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-gemma3-cli.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-gemma3-cli.exe"
1⤵
PID:2084

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-quantize.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-quantize.exe"
1⤵
PID:1320

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-mtmd-cli.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-mtmd-cli.exe"
1⤵
PID:3216

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama-cli.exe"
1⤵
PID:5916

C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe
"C:\Users\Admin\Downloads\llama-b10819-bin-win-cuda-12.4-x64\llama.exe"
1⤵
PID:4196

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b522bda2792229a36f9289b3eb0d61c7586ab3c3fa8ded6cf3e699bce606718a
MD5 6a689c29af1ef458e9adfce173ccb7c2
SHA1 6c05dfa43c35e02c0e318c330422188adcfe5768
SHA512 6ee2cfc59f62ef5308f140b159ffdfda89fd1de8f4c3910a9c304fc0951ef28d2abe2e5701d63cda0e0bb7112af593599631823c3c7cb4663d09874ca48dc04d
TLSH
T1C9E0268905CCC36EF340B4478279578CE2E03B0AD3CC6A2E270984897182080A38AFA2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a7e2dd515b2364b60f13a727bcdfec7ae34576024b835042f967c39ec802e445
MD5 22192458b46077a16a6bc1906f0e365d
SHA1 85f1f78d6f8e6ff05a1ea776b3f85c940a973bf5
SHA512 ecdb17e75b08a7f4dd160121ad8d9208e3e4205d984b42a6a027f66ad6b0c6fa707b76e41e83d41056e156a5187f7f738bc232f921a166c71d71df7c24f71e44
TLSH
T19EE07D8A09E9C66EB2107DC781F8678C82C03B0AD3CC7A2E1F00858875D5D48B7D3AA0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a49d75899650cacc5ed0ec925838327e58f2af9e62bfef8070b359c444fc1570
MD5 61a3fd4ef346a01375fb2c1ac55e4ac9
SHA1 d335639abc096d7d9ca4d0a34e931f57b1afe88b
SHA512 78a48e0a86884cc4f593c3e79b78565a2fa51cbc7c82e2f624339d805919bf629967251b727ea5ee179778b44bf4af02ec39a989b3320592097e9faa694db457
TLSH
T1FF4143BC23AD28CAD766ACF324F78598B2F1A64A650F7F42C9A92DB9CDD5F1410C0153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a2fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a2fd.TMP
Size 1KB
SHA256 137b87561acd51beee83dc813f1061039ffd990f106baf938687c7d3be20a107
MD5 0e179cb6ddbf35db7a45a4bcbe88fbb6
SHA1 724cd09270241e5424fba2722b27e33ce80ca981
SHA512 783db09b40ea19e9c59ec71a303fd33a006dfedcbd1c387d648b64f326ab553388f13b28f575525d3f3fb6407b901f584001b715f10af3f7a590b3da4499e0c3
TLSH
T1D34151BC23AD24CAD362ACF324F74588B2F0A64A650F7F02C9692DB9CCD5F1410C0013
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1c8b6589953856f60f4bb583ebea7cb06ff7dfefc04048bfd9fadce60999ee6c
MD5 1e4094567b2b1d2a2e595cabff60082f
SHA1 cf7692171ef5a140ff28d3f9128a08f41c375cba
SHA512 82a0944ed159c4c00e08e1d5ef78fb3e3d7de80d905db5aee59ffb073359a4d93327d4c4e3c5a244f4dc5d443415608d2d27cb00af4c624e467ca865a9144121
TLSH
T11A31AEF747B4957E9B1196F0FA086E1FCE6D0421435C78AA85E06D2793F3471E081B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 556bc603c20634956bd069ae3ac3b76e67420a1d66122c3665bfd16dc16bded9
MD5 bd165a063d902899806fa81ce7e47f04
SHA1 5e78f7844fcf7e0c3bb06d197bad0ba9809048df
SHA512 e8f74393ff5f06259089c55fd4b74dd1cf94b9d6eb8da5df465f5539533ca67b6de1660dd40b3e83bdecef02d1f1984037728ea636cb7ed0da5d7a9896189dad
TLSH
T161319CF747B4967E9B1196F0FA086E1FCE2D0421435C78AA85E06E2793F3461E081B9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1d4800d47e99c5e648d9ae8f48c6cc44dba0f13307d72fd60f4ca4fdcf79a78f
MD5 c46468f281ef41e0db776b204247cd69
SHA1 e3a342ed408b527979024326f5cc61b2d37a2b6d
SHA512 f429807038f90430a04d65179d52a4f579370f2b31969943461ce04897b779ebcf05ed5ebff2d5a079c1dacedff686e7ed5c44cd4f809d002aba561e44cde73f
SSDEEP 192:sxRzrOn/fZsAQDde5lSjzoD8pi/g6+WNIYCnyIOpGeAIgDAJ:sxRzyn/fZsAQc5lOi/5IAN8w
TLSH
T14832A7155E28A93B8CCBE21DFA55BF53D2F9503261911E48B7FC961C44EBADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6571a29fa287dc1ba9dee0355b47e0bb87fc59d7a094282c36cc4ac75a8d0a79
MD5 ac29b122db029af6618f991a733aff02
SHA1 606cf732fcb5720fdaf40c1164dcbf518548b5b2
SHA512 b8ab00b76ee11ebae31bb9c02388a9f6137726f038b3c1a570309e550bd85f3508df2d76d2e24dd5d921bc975a9cf53dcab1c9b0e9b61a7b54a1226093055bed
SSDEEP 192:sxRYrbn/fZssQDde5lSjzoD8pi/g6+WNIYCnyIOpGeAIgIJ:sxRYPn/fZssQc5lOi/5IAN8s
TLSH
T18F32A7165E28A93B8CC7E21DFA55BF53D2FD5032A1905E48B7FC9A1C44EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b7ee6c85980a8f601bf0fe5bc3bb80a1732b3e244ec80ecca1a2751d88a69929
MD5 df2b2c5065a7187a73093eefed59ff0e
SHA1 01160dad963d3ac7ccb63cfec44e28f70826ffd5
SHA512 5cb96152ba897515a16ff4f754541926ac2f9c8d66b6e0d1ca2b67deb1516160d2e43ed7a8c5b0f7bb272cd8dd0a9dda87e4b5e29a9125dff3732e62a009aecb
SSDEEP 192:sxRzrOn/fZsAHDde5lSjzoD8pi/g6+WNIYCwGIOpGeAIgDiJ:sxRzyn/fZsAHc5lOi/5IPN86
TLSH
T19042B715AA28A93B8CCBE21DFB557F53D2F9503261911E48B7FC9A1C44EBADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 8b962fea6dda621e765fabca714b5cf800f21705ead4f896ee67e0dd844dcb84
MD5 47ece8c07f2c6856ed1019e8838cb286
SHA1 63642bbb74f340ce01425809b755d8fd66b4cd51
SHA512 deb209bc98777be2e1f38493dffcd5413de966a6223b2352576a5d0c56178256a6b211baf7ff58930273a3ed9806e0d143a3b4cfbc7db8eebca082ef23ee66f6
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvhroZS/:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vm
TLSH
T123B2DA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\64a30f55-4532-4593-b4f7-6810a682e973\index-dir\the-real-index
Size 72B
SHA256 89fd4234dbe96a440aff5edb674e33bbb65af54d7a0267593fdad888dbd440fb
MD5 4cf17ab395dfa477485ae0b5436154b3
SHA1 7242576e63a690410d5ce69b52009de87437b086
SHA512 0a8d0cd4c5f1526f1c7800f2bd6d9ae23548ac8d5c5b122b8fa3af868c39448b25faebaaa49b44f811f3289a38e836eecf88fa7a7fea4a01aeb50967f0dbb50d
TLSH
T1C4A0022616C6899AEC451271519762C8121B88584C24AB1365DC5059C8D6044E185121
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dcd26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\64a30f55-4532-4593-b4f7-6810a682e973\index-dir\the-real-index~RFe5dcd26.TMP
Size 96B
SHA256 7d4d26fa0c1a80eef5c02b45824d85fd0f02abfc5d116c3afe51fe1d7a17977f
MD5 9225ef8b8ce048d462513b416eb99df7
SHA1 356a5d6e624890028b9a73698f9b68e545c7e594
SHA512 2f1bbf83c6e2d8066ee66cc636509e2fad3e9b235a78c9a0a46c683402aef0c6a1e036cfad89620617e99a301749b0b1aa6c3e637ef08a1d2aeaa062543ccdb7
TLSH
T1BDB0022662C12D91CC0657B23083836C31AB9C250125D65B61F9556FF8629986585409
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 8afaa8a96d3db5b6b0a3a9045d45885301f02dfe1f82e9ba58dcf098107d0aa7
MD5 4588258f78e4feec35b08416246ba2a3
SHA1 4d06aa4fdb6bbd3f24eb339e2ea77223e839be70
SHA512 0f881bdf0ce6e267eda220cbd635810ea13a3456cf27c6096cede6af16d863bb54b4aae6ea527365c07cb1b68e1e585c0c45c888b9ddcb703f830276f12782bf
TLSH
T17BE0C0F33DFA2AA4EC6F87C5647248DA0400F97CC508AE5F145FE28750B1355245FC62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 90a7001b065566195d8ae68bd3bda17c85bed62886b412eb01be380386debd79
MD5 c998104ce4c4d561be3b23035a2e1902
SHA1 ab950a9a9b107e48d342f6c0e99705752d56aec7
SHA512 8df3bc2d730bfc9df409a54169dfccfdb2c301c449d88358fa65478423f7022596e31fd02aa71c450b3ce273644c890de601872ace404c7472c6a26318446e91
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrz8fnAHRu/G:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpk
TLSH
T10F912240313A1241383DB50C81B88C2E96C17472746EE56F3BA941B61F2BE47ADFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a179d177de7c24a752d21b294e8a4bcf29a5b6a6189f013dbda2171e76137778
MD5 6cee5e32290993fdd5199262fe0f1748
SHA1 412ac4269d6b78b63b691a6488713d25a1d0e97c
SHA512 160e7ec398d852e3795e991ad05eae0314c6ebeaf4aeaec384991e9f065eaef637dce394021a8270043c49880e91f9a4e1c5b704ce0b7e9bebac1fe2501dbf8f
SSDEEP 768:Irv+4UNbdf3UIkNfp8+p3bd66j+4BRv86aLIWpoO:IbsbF3ux8+p3Z6n4yfoO
TLSH
T13203AD72F8A8D9739CF2C744B1467A437FB8159386C00EE4D8DD6B5E419B1AE270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4047bdd8bb8a3b98b90aaa10b6c61b5a525134f65f97697f2db84db04acfeb97
MD5 d138285b024a6004be0214f7c79a76df
SHA1 74f118658dcc744649e80e34cb44f94ae9654e42
SHA512 9dcf3bc26239bc67133fc0b660c7c8a3d67dc11f4589d5d47fb2fab0c9ddfe26c7b68eaa22085e4cda769c79a2b371e61a6c12bdafba1900066728afef2793f7
SSDEEP 768:SC3zIkNfp8+p3bd66j+4BRv86aLIWpcTRoZ:SC3rx8+p3Z6n4yfcTRoZ
TLSH
T198F2AEB2E8A9DD738CF6C384B2463743AEF5545386C40E94D8DC6F1E018B5AE170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c2e4486747e7d4de4669cd7523906ffb936ac12140df7fb65f5d10d3aedbbc40
MD5 925efa16d01a1f85ddac0d64f56e4bde
SHA1 4c7781bf6f9c21214ec9160dd30e9925d9583fac
SHA512 16003e066db20154a91f7f7ebab92edb5e27ff77ba276bf4c1cb8f25c354823a9dc26d009c70eacbe459ae375a89e6b62d992e1103beed0c6c353a105e2c2e06
SSDEEP 768:1D3jIk3p8+p3bd66j+4BRv86aLIWpcTRoZ:1D3j8+p3Z6n4yfcTRoZ
TLSH
T187F2AEB2E8A9DD778CF6C345B2463743AEF4545386C40E94D8DD6F1E018B69E170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 47a43cc1f2c8607b2bb7f4203714002589691889022a4ab4ba4171df26a90df2
MD5 da3860bbdcee5ebe260008cdfbeab8d1
SHA1 3a532a788772551c546d36a58a9df55b1b703987
SHA512 5b342ec076d25edf21f7f7d51eb804dfbdb60289b7bddd645416041f632eb49247ff0533bdaed2774e26a7f6fa91344429968ede9e5877aae1b6b68079885a5c
SSDEEP 768:cy3fIkthp8+p3bd66j+4BRv86aLIWpcTRoZ:cy3Pf8+p3Z6n4yfcTRoZ
TLSH
T178F2ADB2E8A9DD779CF6C349B2863743AEF4445386C40E94D8DC6F1E019B5AE170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c2961f196e6cdfb280bd6eb34c2665f26f571a460547d096a01f4eac9627ac54
MD5 53496f2b44c58902c88956837e79c78f
SHA1 64af363f10b418d2ba3b3fe20c5fffc9f88bc987
SHA512 10a07356a0ecbcacc426b0ce2512cd0e9ee54d26a9944fa915a0005f8142b8295bb10e8f4c694f3cd79cfbb2e2c91ac590dc5fb211d8eb32aca209ea4f569cb5
SSDEEP 768:CR3KIktEp8+p3bd66j+4BRv86aLIWpcTRoZ:CR3QS8+p3Z6n4yfcTRoZ
TLSH
T1F5F2ADB2E8A9DD779CF6C349B2863743AEF4445386C40E94D8DC6F1E019B5AE170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 725fbffe4bc20a74e90102b849811e8931a99e9474557fbe3b7916a48bf0fdc5
MD5 426824001a881259b62e272104604992
SHA1 7f62152cf0cc0471403314109b20f563cc9a8b18
SHA512 98ec5b7fed79c1f1bb48592defdbe8ee47a1d03e89b97708393882a1e7e25f27d059ea10016c8962abc41e27a525ca8c80ba98cdbf795d25c71e79ab0ea2718a
SSDEEP 768:qL3jIkNfp8+p3bd66j+4BRv86aLIWpcTRoZ:qL37x8+p3Z6n4yfcTRoZ
TLSH
T158F2AEB2E8A9DD778CF6C385B2463743AEF5545386C40E94D8DC6F1E018B6AE170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 859a88a36416efd8966a38adc94081533f36ff2f27b7a7b11d485f9434aa37c6
MD5 7dd0805f92312305f5f302a922cb640f
SHA1 4dad2d09e83db3399a5f72cbc05425a48f2d83de
SHA512 99812d2af950ddf2142cbdb7ac7f871ef098e5cc390d1f24b14f6ee63266652ad6d4a6bafbee70f0f9fcf264e7ab3c717b3234b31180f76bc12c77022d88e3cc
SSDEEP 768:GT3YIkthp8+p3bd66j+4BRv86aLIWpcTRoZ:GT36f8+p3Z6n4yfcTRoZ
TLSH
T10DF29DB2E8A9DD779CF6C349B2863743AEF4445386C40E94D8DC6F1E019B5AE170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 35ce98ba21fad436951806952ad064c8f3d072fd2d7bf781ed87d517aeb299d9
MD5 812f68916ab22e00e4edd0183d4ee1a4
SHA1 65e0e9796ce3783970be4fd20d6b47afc101d29e
SHA512 f3077d0fd95def7ecaba0b05fc214e397dcfb25b7a207da0494801bb514a0834b5a4ac2ba6a0c3d09ac7dad4ef40885f14b995df16b6770aa29e23c07d38e4ec
SSDEEP 768:Eu3zIktIp8+p3bd66j+4BRv86aLIWpcTRoZ:Eu3bW8+p3Z6n4yfcTRoZ
TLSH
T112F2ADB2E8A9DD779CF6C349B2863743AEF4445386C40E94D8DC6F1E019B5AE170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 426b06380bd901a35f12591923bb887ebad29a855dd8bdd8ef49f646f261ac0a
MD5 04e6ac4fa20c355ec57be263334607b7
SHA1 b798d24ead76de2a8952db4ba2cdfbff65b69515
SHA512 9158ddf75175b544df5d282b6202249af541407cde8dc6690d4430d0fafde7c0d0bab2ad47355b8569c026827e95124692525130d2cd348a627f5b8bcc279852
SSDEEP 768:Irv+4UNbdD3zcnNp8+p3bd66j+4BRv86aLIi52bwCl1:Ibsbp3SL8+p3Z6n4yz0ww
TLSH
T15303CE73F9A899339CF6C644B2867A437FF851A396C10AC0D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0a77dd4d0964106fa2db50c6fb0fc1d6ee5f6962d864c544b446fe6b3794c034
MD5 a542a0e3652dd2944d97c22110e54dc5
SHA1 5bd8eeee0b6e14a47fe7cf10a1d581de8af6ad15
SHA512 018fdf1023c348c12775bca4c4a872cef26b7ab984d3274c6608b05bfa81b4d0de088ae94772d798335d96d8b66c808f098b3720b89f423660a9f4c18872fcf1
SSDEEP 768:7rv+4UNbdD3PmkNNp8+p3bd66j+4BRv86aLITp2bwCl1:7bsbp3JL8+p3Z6n4yM0ww
TLSH
T1D803BE72E9A8A9339CF6C644B1477A437FF8519396C10ED0E8DD2B4E415A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3263110a-e76b-4d06-86c9-5e05170f85fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3263110a-e76b-4d06-86c9-5e05170f85fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/1420-389-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download

memory/1420-387-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download

memory/1420-393-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download

memory/1420-398-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download

memory/1420-396-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download

memory/1420-397-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download

memory/1420-395-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download

memory/1420-394-0x000001F533C60000-0x000001F533C61000-memory.dmp

Download