Overview

overview

8

Static

static

3

rggffgg.exe

windows10-2004-x64

8

Resubmissions

09/08/2026, 12:15

260809-pe9m9sac978

09/08/2026, 12:12

260809-pdhhdsem3t8

Analysis

  • user interaction
    yes
  • max time kernel
    388s
  • max time network
    388s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 12:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    rggffgg.exe
  • Size 10.7MB
  • Sample260809-pe9m9sac97
  • SHA256 2cb4ffefb6723657e5ea37b38e7107d8822a7dfc7b9af79b20c0306adf907aac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistencepyinstallerspywareupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 61 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\rggffgg.exe
    "C:\Users\Admin\AppData\Local\Temp\rggffgg.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Windows\system32\schtasks.exe
      schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\rggffgg_task.xml /TN rggffgg /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5168
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
      2⤵
      • Executes dropped EXE
      PID:3108
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:560
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\ChilledWindows_2283680503.exe
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Users\Admin\AppData\Local\Temp\ChilledWindows_2283680503.exe
        C:\Users\Admin\AppData\Local\Temp\ChilledWindows_2283680503.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1068
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\HarounHaeder@Koteyka2_1779447495.exe
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Users\Admin\AppData\Local\Temp\HarounHaeder@Koteyka2_1779447495.exe
        C:\Users\Admin\AppData\Local\Temp\HarounHaeder@Koteyka2_1779447495.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:404
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\bad_apple_3760393869.exe
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Users\Admin\AppData\Local\Temp\bad_apple_3760393869.exe
        C:\Users\Admin\AppData\Local\Temp\bad_apple_3760393869.exe
        3⤵
        • Executes dropped EXE
        PID:6132
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\Navalny[Pass2000]_1375478998.exe
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Users\Admin\AppData\Local\Temp\Navalny[Pass2000]_1375478998.exe
        C:\Users\Admin\AppData\Local\Temp\Navalny[Pass2000]_1375478998.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4232
        • C:\Users\Admin\AppData\Local\Temp\winlocker.exe
          "C:\Users\Admin\AppData\Local\Temp\winlocker.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:6116
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "TASKKILL /F /IM "explorer.exe""
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4072
            • C:\Windows\SysWOW64\taskkill.exe
              TASKKILL /F /IM "explorer.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:392
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\РКНBLOCKBYUODNU_3370652654.exe
      2⤵
      • Executes a command shell one-liner
      PID:4248
      • C:\Users\Admin\AppData\Local\Temp\РКНBLOCKBYUODNU_3370652654.exe
        C:\Users\Admin\AppData\Local\Temp\РКНBLOCKBYUODNU_3370652654.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        PID:5788
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\RKNnus.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RKNnus.exe"
          4⤵
          • Executes dropped EXE
          PID:2348
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\RKNnus.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RKNnus.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:1668
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\StalinLocker_3207902372.exe
      2⤵
      • Executes a command shell one-liner
      PID:1592
      • C:\Users\Admin\AppData\Local\Temp\StalinLocker_3207902372.exe
        C:\Users\Admin\AppData\Local\Temp\StalinLocker_3207902372.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4032
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\NNlocker_2700294736.exe
      2⤵
      • Executes a command shell one-liner
      PID:4304
      • C:\Users\Admin\AppData\Local\Temp\NNlocker_2700294736.exe
        C:\Users\Admin\AppData\Local\Temp\NNlocker_2700294736.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2544
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CompressUnpublish.htm
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\CompressUnpublish.htm
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffc0d3ac188,0x7ffc0d3ac194,0x7ffc0d3ac1a0
        3⤵
          PID:452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,874631585054663205,9490224106156907357,524288 --field-trial-handle=2848,i,1680393225874788858,257270104283570615,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:3
          3⤵
          • System Time Discovery
          PID:5016
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,7828927536451819673,1695703675971634270,524288 --field-trial-handle=2848,i,1680393225874788858,257270104283570615,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:8
          3⤵
            PID:5104
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,14224429898234032723,3669256914635437460,262144 --field-trial-handle=2848,i,1680393225874788858,257270104283570615,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
            3⤵
              PID:3584
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,16656191047697819813,16481986926285228789,2097152 --field-trial-handle=2848,i,1680393225874788858,257270104283570615,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
              3⤵
                PID:3576
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,11578697290768683983,8691401773958922012,2097152 --field-trial-handle=2848,i,1680393225874788858,257270104283570615,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                3⤵
                  PID:4148
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                  3⤵
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5296
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc0d3ac188,0x7ffc0d3ac194,0x7ffc0d3ac1a0
                    4⤵
                      PID:5252
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,16369896129681344721,16184372330782840971,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
                      4⤵
                      • System Time Discovery
                      PID:3940
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,12804078016700258594,826900908637507487,262144 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
                      4⤵
                        PID:1632
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,11803149383011293,15963896615172346510,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
                        4⤵
                          PID:4968
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,3835708469059847513,13821348093895148044,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
                          4⤵
                            PID:5584
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,3835708469059847513,13821348093895148044,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
                            4⤵
                              PID:3492
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,5627796297060678152,8417437711427201812,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
                              4⤵
                                PID:2196
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,14058462946019674303,8897913766567953374,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
                                4⤵
                                  PID:6064
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,7419968228353797278,8186428354243109869,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
                                  4⤵
                                    PID:1236
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3100,i,16372464193815348484,4550246176559777371,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:8
                                    4⤵
                                      PID:2436
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,5258814572168423305,13921285933827279139,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
                                      4⤵
                                        PID:208
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2980,i,1131886469802557171,74533668032774794,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
                                        4⤵
                                          PID:3480
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,11576331065162346954,783456184908474630,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
                                          4⤵
                                            PID:1020
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,2848187863093240992,332600036883266191,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
                                            4⤵
                                              PID:6024
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,12580723675263235613,12941520968158306841,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
                                              4⤵
                                                PID:1612
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4956,i,17884896339881627062,14233340454883616413,262144 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1552
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,2308473021545331918,4647293618995995174,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:8
                                                4⤵
                                                  PID:704
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,15334084635363796398,17216100201784570246,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:8
                                                  4⤵
                                                    PID:4340
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,11388578937034125280,8551529549957755035,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
                                                    4⤵
                                                      PID:1196
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,2544834300035015011,969811100194462551,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8
                                                      4⤵
                                                        PID:4796
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13924194832540208095,2067162058448720287,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
                                                        4⤵
                                                          PID:3756
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,4814625150783969043,15554209348002337441,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
                                                          4⤵
                                                            PID:5436
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,16889426961224610138,2841646831978136153,524288 --field-trial-handle=2288,i,2922779765005541657,10992298461868000694,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
                                                            4⤵
                                                              PID:3860
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:6132
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:4868
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                            1⤵
                                                              PID:2352

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  2
                                                                  T1059

                                                                  PowerShell

                                                                  1
                                                                  T1059.001

                                                                  Windows Command Shell

                                                                  1
                                                                  T1059.003

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Scheduled Task

                                                                  1
                                                                  T1053.005

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Scheduled Task

                                                                  1
                                                                  T1053.005

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Scheduled Task

                                                                  1
                                                                  T1053.005

                                                                  Defense Evasion

                                                                  Modify Registry

                                                                  2
                                                                  T1112

                                                                  Credential Access

                                                                  Discovery

                                                                  Browser Information Discovery

                                                                  1
                                                                  T1217

                                                                  Peripheral Device Discovery

                                                                  2
                                                                  T1120

                                                                  Query Registry

                                                                  6
                                                                  T1012

                                                                  System Information Discovery

                                                                  6
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  System Time Discovery

                                                                  1
                                                                  T1124

                                                                  Lateral Movement

                                                                  Collection

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_1440664026\manifest.json
                                                                  • Size 118B
                                                                  • SHA256 a50a524184b2420fa2d050e10c7ecc90ff3ddddbc1d39dd7f6ee65aea7e89904
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_185222532\manifest.json
                                                                  • Size 76B
                                                                  • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_1936126734\manifest.json
                                                                  • Size 165B
                                                                  • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_2138702977\manifest.json
                                                                  • Size 78B
                                                                  • SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_298321021\manifest.json
                                                                  • Size 69B
                                                                  • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_453025761\manifest.json
                                                                  • Size 53B
                                                                  • SHA256 551c5f7ed9a2139eab8089f6fd9724b0b38d226b369209cb2ac295b3884571d3
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  hyph-as.hyb
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_612915754\hyph-as.hyb
                                                                  • Size 703B
                                                                  • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  hyph-hi.hyb
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_612915754\hyph-hi.hyb
                                                                  • Size 687B
                                                                  • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  hyph-nb.hyb
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_612915754\hyph-nb.hyb
                                                                  • Size 141KB
                                                                  • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_612915754\manifest.json
                                                                  • Size 82B
                                                                  • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5296_741246143\manifest.json
                                                                  • Size 141B
                                                                  • SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  powershell.exe.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                  • Size 2KB
                                                                  • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                  • Size 135B
                                                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  protocols.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                  • Size 3KB
                                                                  • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 1c8e3dda413deb0056300d64212636a6785cc542fbbae4383b4383d4cf0ebbc4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  BookmarkMergedSurfaceOrdering
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                  • Size 6B
                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  BrowsingTopicsState
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                  • Size 414B
                                                                  • SHA256 e46f4c6935cc55d35ece27971251995eecd976f3feea430422b5b5faf03ddbaa
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  data_0
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
                                                                  • Size 44KB
                                                                  • SHA256 c211e4dcddc361747b45558eb31813b4a59567263e1b22efdc98f81decdc5b5f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data_1
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
                                                                  • Size 264KB
                                                                  • SHA256 b1881ba328781f56c03ec6008d696a4167bab757e0154f695da24b44ea32540f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data_3
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
                                                                  • Size 8.0MB
                                                                  • SHA256 4eee188a0e2fea1166828ef031084118d601d41e63a5a954f0975ac6834eb549
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 4ba6b1e2e851f646e829cf91476793ac55145b8ae1c0fe7a9beec420dd9b5242
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  data_1
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                  • Size 264KB
                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                  Submit Download

                                                                  SiteList-Enterprise.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
                                                                  • Size 343B
                                                                  • SHA256 ecce6ec09313fa273614fd39d9561a02aeb8d344c999c959f116888f56cde856
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
                                                                  • Size 319B
                                                                  • SHA256 4f444030ef945869badcdb4b85c8101f99ed644a59aa33b7bd26ee4a4449daaa
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  History
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                                                  • Size 204KB
                                                                  • SHA256 480d659230cd86e8ce1f18aa26086e3633447af3f62d42b13066b8820add4ea2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  History-journal
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
                                                                  • Size 8KB
                                                                  • SHA256 d2dbc35cfb65692a11c9de93ca02528257ff1f1a5e37d5cad2ef565ce4573e18
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                                  • Size 331B
                                                                  • SHA256 6af0a4a58ad7a48a787deb6dca9cfa5cbbe94f6137cbd5b93b69e9e5a329bc94
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Cookies
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                                                                  • Size 20KB
                                                                  • SHA256 21ed54d7f406e672790d61feafbdefde5f5b7dfb3674a5787b8c6ba7997475b9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 1KB
                                                                  • SHA256 d575b255917982fcf1bbefe2630d614e07dd6ff5281f67adebbf604fe68506da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 2KB
                                                                  • SHA256 c8cc1393f41cc001246877fea1a957d218c587a3895f88495d498ea8b4af564e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Reporting and NEL
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
                                                                  • Size 36KB
                                                                  • SHA256 07a7610e85bc3482fd11b180781e9c4dbd65237bd58adb3d203cdb1655a1795f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  SCT Auditing Pending Reports
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Sdch Dictionaries
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                  • Size 40B
                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  TransportSecurity
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                  • Size 188B
                                                                  • SHA256 ff252e27fb09d9c4b1322d550bcfb07be69717ff7ce66e261a2c4b0f27847cc4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 15KB
                                                                  • SHA256 ece110dba7e9d81d774e4e65c188506271b3bdf2b78c6288ee3528b4d63884be
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Secure Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                  • Size 35KB
                                                                  • SHA256 34a01298617762f297060b2af41121138b75aa21025b33db62392c6e8252c9f9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
                                                                  • Size 335B
                                                                  • SHA256 88d1337ac18987d602a9ff7d84f4e8415b2851721c5d49a6f6029e18c7eb5c05
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                                  • Size 350B
                                                                  • SHA256 b5afc06c40d18d1d18a808f8a0b3047de6ce62ff45707f3aa33f2acee79c75e5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                  • Size 323B
                                                                  • SHA256 46b4970fbd116a5a123bb54cadcf96b783014497030485637b1e1f05caed2ca8
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  sync_diagnostic.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                  • Size 24KB
                                                                  • SHA256 fcbac096b745a6f08d2d3a32729d403605380593662b48ba1ea4b1aff18e3e25
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Web Data
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                  • Size 224KB
                                                                  • SHA256 4a2ed36253b0db393801faad81e83dd3505de1db06ac23562a36c7cf19aa45cc
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  default_cloud_config.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
                                                                  • Size 13KB
                                                                  • SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  000003.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
                                                                  • Size 10KB
                                                                  • SHA256 05c172a6b925c2ee5b1c9872947e7edf319d8d93f01ab4ed4b2ff61df2922833
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
                                                                  • Size 319B
                                                                  • SHA256 df2491ee5ebf84d30f038518ffd20f94b7cac7beb9cf891e5ae2629a7e8027af
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  000003.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
                                                                  • Size 1KB
                                                                  • SHA256 813943675d1e1a7c0fcf9ccbb89fff24be90fdb5d910cb641ac535c09cde1adf
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
                                                                  • Size 337B
                                                                  • SHA256 22f131d5b85db545400420c021695d42bfd806ed2b96afa266df1c34addfd180
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  data.txt
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.19\data.txt
                                                                  • Size 150KB
                                                                  • SHA256 e589f794c343744314bb92dc03cb87b0aabe1a0e4df61bd77327638125d6e1a3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  office_endpoints_list.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                  • Size 9KB
                                                                  • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data_1
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
                                                                  • Size 264KB
                                                                  • SHA256 34f0fa8b88e62a231c4a52167d0eb7f3db486d9d95a2241aa96958347ecfb17a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Last Version
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                  • Size 14B
                                                                  • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 24KB
                                                                  • SHA256 41ec7412825b702acd19c155fb720c746810e97b52db92f956ef168a0dfa07c8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 25KB
                                                                  • SHA256 871fbe01e1a90acb1fc25ce5b5dd88d9bfdfa153c0408fc0c01d06af60fe6f55
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 26KB
                                                                  • SHA256 56dfbd1adae69fcd6190186f34b8e807359ea4a91d15d95a810560cafe132dca
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 30KB
                                                                  • SHA256 d50d88396f3a92eda2665a367a908ad820ec2753af4983c1fa757398684dd267
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 30KB
                                                                  • SHA256 5fa2267d8da4a5faf4af849cffef74b916fa9a049a1f426829fc8a41564524f4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 24KB
                                                                  • SHA256 8e4c83deebeaa2991627d13431ae96683a69d9419591e075de94892d6b4e1e27
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 24KB
                                                                  • SHA256 0e3a2e49cea4790c32c62d39c141de5c45c0b2060a65f0dfac2c5219b71c84e5
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data_1
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                  • Size 264KB
                                                                  • SHA256 210ef9be78da93cdd70ffaeaaecd38c383c13b345ca27d5f12554ec1d5181fdb
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  keys.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
                                                                  • Size 8KB
                                                                  • SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  typosquatting_list.pb
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\typosquatting_list.pb
                                                                  • Size 927KB
                                                                  • SHA256 8da21018e6a6063f029ab8f81ef3de28adbd1740594d43934a231e9bc8458496
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Variations
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                                                                  • Size 86B
                                                                  • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  well_known_domains.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
                                                                  • Size 572KB
                                                                  • SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ranked_dicts
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
                                                                  • Size 865KB
                                                                  • SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 1KB
                                                                  • SHA256 50f5a7510fa1d2fa636a5a0caa964c3e16a9fa2d5f082aa074191037c2a606f1
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 1KB
                                                                  • SHA256 438e61f5f8ba161456807902af99a76be4dc54d292bde18373dea2793dcd0adc
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 1KB
                                                                  • SHA256 6782fe309558818e59163f076bd5f163666313be88d5ca546c9b00b903d28f5f
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 1KB
                                                                  • SHA256 caa0d6f576d781e494fa18bbb30d7a3f69b465880d462c29672053cff700204f
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 2KB
                                                                  • SHA256 9c37f90e35145a97e5c9acf3218ee95b818eab65e76f4f558b1ba4d77e27988c
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 2KB
                                                                  • SHA256 8f133560a2dac0417839d141143a755cad5ad2d6a3ca3a44f8df78f6ce9f5c3d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 1KB
                                                                  • SHA256 d372c202642bb0cf48423c85539727bbf4a34b500d39eacf6aef8643572ddd0e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 1KB
                                                                  • SHA256 a2586557848400ea5d90fb99d3b3e8f000917d1df149121c0ba07abb1ea0a4bb
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 1KB
                                                                  • SHA256 5634c19a60795a8a50103d5694b94a5ea74657534bd7e7b9f49e4379c00b7964
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                  • Size 153KB
                                                                  • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                  • Size 132B
                                                                  • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                  • Size 2KB
                                                                  • SHA256 efab0e748399e4e64cd8dfa41d79413920e8534ae3f82a9388d13f0ccf2811ee
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
                                                                  • Size 2KB
                                                                  • SHA256 212909f7e6d3808abd035df520fb751dcd5994f1927409df2019375a28ca6b51
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  WMSDKNS.XML.bak
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.XML.bak
                                                                  • Size 9KB
                                                                  • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 64B
                                                                  • SHA256 2aed929b84cc293687adcff261f734d3309f5d4040b7b9e9793da579c30e18bd
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  StartupProfileData-NonInteractive
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  • Size 64B
                                                                  • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  ChilledWindows_2283680503.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ChilledWindows_2283680503.exe
                                                                  • Size 4.4MB
                                                                  • SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  HarounHaeder@Koteyka2_1779447495.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\HarounHaeder@Koteyka2_1779447495.exe
                                                                  • Size 762KB
                                                                  • SHA256 8855299560183b57556d9714a2b958cdc6190fcdfb270633da2a47dfeee20015
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  RKNnus.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\RKNnus.exe
                                                                  • Size 27.4MB
                                                                  • SHA256 7399964a41df074287240196d84cd1923a77327912fe5d6217cc3e7162da6656
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  __PSScriptPolicyTest_0crg5uld.kzq.ps1
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0crg5uld.kzq.ps1
                                                                  • Size 60B
                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  dc1594af-d87b-4ff0-8ac7-8c02d8c44d1c.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\dc1594af-d87b-4ff0-8ac7-8c02d8c44d1c.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  rggffgg_task.xml
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\rggffgg_task.xml
                                                                  • Size 1KB
                                                                  • SHA256 5794725662d69b17ef83f7671b1f45b506d2667c8ffe8a1c0ff154a1fdbfa79c
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  winlocker.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\winlocker.exe
                                                                  • Size 3.1MB
                                                                  • SHA256 43eef3b68ebaab3efbe15eb3046281e380aa78003a0eda8757a9e44f6a59ec7f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  rggffgg.exe
                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
                                                                  • Size 10.7MB
                                                                  • SHA256 2cb4ffefb6723657e5ea37b38e7107d8822a7dfc7b9af79b20c0306adf907aac
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  memory/404-1215-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-967-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-737-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-736-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-769-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-798-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-855-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-842-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-699-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-875-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-882-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-786-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-1200-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-747-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-896-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-1174-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-1164-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-917-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-1157-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/404-921-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                  Download

                                                                  memory/560-48-0x0000017AC4B60000-0x0000017AC4D7C000-memory.dmp
                                                                  Download

                                                                  memory/1068-394-0x0000000023790000-0x00000000237C8000-memory.dmp
                                                                  Download

                                                                  memory/1068-381-0x0000000000A70000-0x0000000000ED4000-memory.dmp
                                                                  Download

                                                                  memory/1068-392-0x000000001BAF0000-0x000000001BAF8000-memory.dmp
                                                                  Download

                                                                  memory/1068-395-0x000000001F110000-0x000000001F11E000-memory.dmp
                                                                  Download

                                                                  memory/1480-15-0x0000022BF7800000-0x0000022BF7822000-memory.dmp
                                                                  Download

                                                                  memory/1668-1168-0x00007FFC13340000-0x00007FFC135AC000-memory.dmp
                                                                  Download

                                                                  memory/1668-1163-0x0000000068B40000-0x0000000068B7C000-memory.dmp
                                                                  Download

                                                                  memory/1668-1162-0x000000006A880000-0x000000006A8A7000-memory.dmp
                                                                  Download

                                                                  memory/1668-1161-0x00007FFC13340000-0x00007FFC135AC000-memory.dmp
                                                                  Download

                                                                  memory/2544-1516-0x00000000051C0000-0x0000000005252000-memory.dmp
                                                                  Download

                                                                  memory/2544-1515-0x0000000005770000-0x0000000005D14000-memory.dmp
                                                                  Download

                                                                  memory/2544-1514-0x0000000005120000-0x00000000051BC000-memory.dmp
                                                                  Download

                                                                  memory/2544-1517-0x00000000050A0000-0x00000000050AA000-memory.dmp
                                                                  Download

                                                                  memory/2544-1505-0x0000000000820000-0x000000000082C000-memory.dmp
                                                                  Download

                                                                  memory/2544-1518-0x0000000005350000-0x00000000053A6000-memory.dmp
                                                                  Download

                                                                  memory/4032-1190-0x0000000000AB0000-0x0000000000E90000-memory.dmp
                                                                  Download

                                                                  memory/5252-38-0x000001EA7BEA0000-0x000001EA7C0BC000-memory.dmp
                                                                  Download

                                                                  memory/5552-28-0x000001784EA70000-0x000001784EC8C000-memory.dmp
                                                                  Download

                                                                  memory/6116-1205-0x0000000000400000-0x0000000000AAB000-memory.dmp
                                                                  Download

                                                                  memory/6116-857-0x00000000048F0000-0x000000000491A000-memory.dmp
                                                                  Download

                                                                  memory/6116-854-0x0000000004920000-0x00000000049A2000-memory.dmp
                                                                  Download

                                                                  memory/6116-853-0x0000000000400000-0x0000000000AAB000-memory.dmp
                                                                  Download

                                                                  memory/6116-840-0x0000000004920000-0x00000000049A2000-memory.dmp
                                                                  Download

                                                                  memory/6116-839-0x00000000048F0000-0x000000000491A000-memory.dmp
                                                                  Download

                                                                  memory/6116-893-0x0000000000400000-0x0000000000AAB000-memory.dmp
                                                                  Download

                                                                  memory/6116-914-0x0000000000400000-0x0000000000AAB000-memory.dmp
                                                                  Download

                                                                  memory/6116-918-0x0000000000400000-0x0000000000AAB000-memory.dmp
                                                                  Download

                                                                  memory/6116-836-0x0000000000400000-0x0000000000AAB000-memory.dmp
                                                                  Download