67d1d7881e51d02af2ff5726bee7ea59a5b561cc9f9b91a4b1eaf5052e9c80b6

Analysis

max time kernel
688s
max time network
698s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
22/03/2025, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O.v.0.1.2.co-op_02.rar
Size

358.0MB
MD5

c4f6bba19690b8eca8416aceab8eb6c4
SHA1

37cedee608cb68fff0d37c37924c3575ce292f7f
SHA256

67d1d7881e51d02af2ff5726bee7ea59a5b561cc9f9b91a4b1eaf5052e9c80b6
SHA512

81a4d7f0fb50d7c61159e99880b71cb6e0082f34382dc7c8f98607d2d3a8fe31e0efb63ba402790549da76ef7ffcc47d18a1e6527b9e32aab3704badfff07c01
SSDEEP

6291456:77N8CpCR0cxfYCyGXXvPp215QUvvLtXRnZbk6yULGbjWr2M/RZYiDewvto:7q0CR0CfY9GPPpOQsvL5/wULGb6lXYio

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
3484	REPO.exe
4064	REPO.exe
5648	REPO.exe
228	REPO.exe
4876	REPO.exe
5388	REPO.exe
4336	REPO.exe
1592	REPO.exe
6852	REPO.exe
1180	REPO.exe
6440	REPO.exe
6352	REPO.exe
3972	REPO.exe
7040	REPO.exe

Loads dropped DLL 42 IoCs

pid	Process
3484	REPO.exe
3484	REPO.exe
3484	REPO.exe
4064	REPO.exe
4064	REPO.exe
4064	REPO.exe
5648	REPO.exe
5648	REPO.exe
5648	REPO.exe
228	REPO.exe
228	REPO.exe
228	REPO.exe
4876	REPO.exe
4876	REPO.exe
4876	REPO.exe
5388	REPO.exe
5388	REPO.exe
5388	REPO.exe
4336	REPO.exe
4336	REPO.exe
4336	REPO.exe
1592	REPO.exe
1592	REPO.exe
1592	REPO.exe
6852	REPO.exe
6852	REPO.exe
6852	REPO.exe
1180	REPO.exe
1180	REPO.exe
1180	REPO.exe
6440	REPO.exe
6440	REPO.exe
6440	REPO.exe
6352	REPO.exe
6352	REPO.exe
6352	REPO.exe
3972	REPO.exe
3972	REPO.exe
3972	REPO.exe
7040	REPO.exe
7040	REPO.exe
7040	REPO.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_614919112\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1572310710\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\bnpl_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1572310710\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\wallet\super_coupon.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\wallet-icon.svg	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6256_247137155\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1572310710\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-ec\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\Tokenized-Card\tokenized-card.html	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1572310710\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1572310710\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6256_1851586103\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-mobile-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-hub\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6256_147022055\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1377646463\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-shared-components\it\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871567790997004"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{E08AFBCD-DFF1-428A-B761-FF4189C6A176}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{11494547-6F40-4EF3-B170-B257D5301C79}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{BE9A556E-710F-4AA5-BD32-3712C8451D93}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{E1B0727E-1D1F-4D81-BBD2-8182E431E4AE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\R.E.P.O.v.0.1.2.co-op_02.rar:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6004	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
5948	chrome.exe
5948	chrome.exe
3484	REPO.exe
3484	REPO.exe
4064	REPO.exe
4064	REPO.exe
6256	msedge.exe
6256	msedge.exe
5648	REPO.exe
5648	REPO.exe
228	REPO.exe
228	REPO.exe
4876	REPO.exe
4876	REPO.exe
5388	REPO.exe
5388	REPO.exe
4336	REPO.exe
4336	REPO.exe
1592	REPO.exe
1592	REPO.exe
6852	REPO.exe
6852	REPO.exe
1180	REPO.exe
1180	REPO.exe
6440	REPO.exe
6440	REPO.exe
6352	REPO.exe
6352	REPO.exe
3972	REPO.exe
3972	REPO.exe
1460	msedge.exe
1460	msedge.exe
3144	msedge.exe
3144	msedge.exe
7040	REPO.exe
7040	REPO.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3896	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
6256	msedge.exe
6256	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3896	7zFM.exe
Token: 35	3896	7zFM.exe
Token: SeSecurityPrivilege	3896	7zFM.exe
Token: SeSecurityPrivilege	3896	7zFM.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3896	7zFM.exe
3896	7zFM.exe
3896	7zFM.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4992	MiniSearchHost.exe
4636	OpenWith.exe
4636	OpenWith.exe
4636	OpenWith.exe
2964	OpenWith.exe
6556	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 3104	1864	chrome.exe	87
PID 1864 wrote to memory of 3104	1864	chrome.exe	87
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 5968	1864	chrome.exe	88
PID 1864 wrote to memory of 4592	1864	chrome.exe	89
PID 1864 wrote to memory of 4592	1864	chrome.exe	89
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90
PID 1864 wrote to memory of 5064	1864	chrome.exe	90

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\R.E.P.O.v.0.1.2.co-op_02.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3896

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa86c7dcf8,0x7ffa86c7dd04,0x7ffa86c7dd10
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --subproc-heap-profiling --field-trial-handle=2268,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --field-trial-handle=2392,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4132,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4176 /prefetch:9
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4540,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=5244,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=5452,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5472,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=3656,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=3672,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3524 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=3492,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3536 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4268,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5560,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5240,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5796,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6004,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5744,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6240,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3796,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=6544,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6188 /prefetch:12
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=6516,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7064,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=7180,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=7008,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6948,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=7292,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=7336,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=7092,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3680 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7552,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6480,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6028,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6088,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=7244,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7628 /prefetch:14
  2⤵
  - NTFS ADS
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --field-trial-handle=4536,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7728 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=3880,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=3512,i,3925204359911335774,15961339358434356289,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:1168

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1032

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c start "link" "http://freetp.org/6564-.html"
  2⤵
  PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freetp.org/6564-.html
    3⤵
    PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://freetp.org/6564-.html
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:4624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa6faef208,0x7ffa6faef214,0x7ffa6faef220
        5⤵
        
        PID:3352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1984,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
        5⤵
        
        PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2108,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
        5⤵
        
        PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
        5⤵
        
        PID:2624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:1656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
        5⤵
        
        PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4792,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3632,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
        5⤵
        
        PID:572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5020,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
        5⤵
        
        PID:4980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5040,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
        5⤵
        
        PID:5312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5300,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
        5⤵
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5764,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
        5⤵
        
        PID:3340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5844,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
        5⤵
        
        PID:4748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
        5⤵
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6040,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
        5⤵
        
        PID:5756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6476,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
        5⤵
        
        PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6600,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
        5⤵
        
        PID:4068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6844,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6516,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:2776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6516,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:3412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7384,i,16373576639095001007,4225959025958414136,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:14
        5⤵
        
        PID:5516
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        6⤵
        
        PID:4748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:6256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x26c,0x7ffa6faef208,0x7ffa6faef214,0x7ffa6faef220
        6⤵
        
        PID:6300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1704,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
        6⤵
        
        PID:6552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
        6⤵
        
        PID:6560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2428,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
        6⤵
        
        PID:6584
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4348,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
        6⤵
        
        PID:6920
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4348,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
        6⤵
        
        PID:6928
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4424,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        6⤵
        
        PID:7048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4580,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
        6⤵
        
        PID:6632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4568,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
        6⤵
        
        PID:6636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4556,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
        6⤵
        
        PID:6664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
        6⤵
        
        PID:1328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5152,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
        6⤵
        
        PID:6204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4780,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        6⤵
        
        PID:5356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5228,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
        6⤵
        
        PID:2736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5140,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
        6⤵
        
        PID:5552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
        6⤵
        
        PID:6148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5812,i,6013796040691109109,18392002510249095797,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
        6⤵
        
        PID:5636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:1460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffa6faef208,0x7ffa6faef214,0x7ffa6faef220
        7⤵
        
        PID:864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1760,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
        7⤵
        
        PID:3828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
        7⤵
        
        PID:6164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2400,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
        7⤵
        
        PID:6400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4324,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
        7⤵
        
        PID:5568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4324,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
        7⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4328,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
        7⤵
        
        PID:4248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4836,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
        7⤵
        
        PID:6664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4556,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
        7⤵
        
        PID:7012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4792,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
        7⤵
        
        PID:6996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5400,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
        7⤵
        
        PID:6688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
        7⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6744,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
        7⤵
        
        PID:3680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6684,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
        7⤵
        
        PID:6200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
        7⤵
        
        PID:6728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5320,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
        7⤵
        
        PID:6416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:14
        7⤵
        
        PID:3432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5240,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
        7⤵
        
        PID:6660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6104,i,5349535128852864260,6956512046231017819,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:10
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3144

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6572

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5820

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3972

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:7124

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5660

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:5556

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5648

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5388

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2376

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6852

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1180

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2964

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\dlllist.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6004

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6352

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3972

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
PID:5540

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6556

C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:7040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\18e73b72-8f4b-4c22-88eb-9f58b00d28ce.tmp

Filesize
13KB

MD5
1491be79b69271e89e047cbbe30122ca

SHA1
e1409b47a8c1a48676b53298e430b3a33b323dbe

SHA256
3e034e50995dc8088ee5486d44e429c477b4ef9496be9b5682081aead7e0a6af

SHA512
a2539191a0292eae395c1d59c8778761e9aeafab82cc97e72234cbd83c2f27a0e60bc3ecf473fb175834b9eb568e7a76e4e5b8029f114aba241f93eabe65c471

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6b9514b338605f9898b7db7387e43927

SHA1
724a99b099ba0c6ef610199e9be5eabd13e287d1

SHA256
f3e61ccd3cb7856eca85a301025a3ccc1f8f0cf7388b772a57fe871f752859b3

SHA512
8371533a031a4d1cdf4da5d4d4b23012263a6ca935abbe24f79a087658820b9b776aaefccc5c65a7b8639d80d4e9a896e60fe84c8d28d22918243a64af7b2f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
215KB

MD5
e8518e1e0da2abd8a5d7f28760858c87

SHA1
d29d89b8a11ed64e67cbf726e2207f58bc87eead

SHA256
8b2c561b597399246b97f4f8d602f0354a979cbe4eea435d9dc65539f49cea64

SHA512
1c15b65bd6b998254cc6f3cbef179c266663f7b1c842229f79ff31ba30043837c398d85296fb20d3a576d9331fee9483ca0cbd06270da2d6db009bc454aee0c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

Filesize
78KB

MD5
f19e8c212994acc0edc8c82ff01306d4

SHA1
269dfd4b546fb768269f481edf6d1685440384d3

SHA256
d0942ab5e215cdc9b83e6250edb8f9a74b6919caa5011d44322a875c4a6d8a5d

SHA512
ff8c5129869dd3ea0c49ae60b72dbd02d587c55c845d1b8edb80116fd23f75a67a6ee6f5f60d6a4f25fab654d86e11ac7c93a27aee775094c4068691a4dc4a8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055

Filesize
20KB

MD5
26d2e70456bc3783b62a5a71b6f4f744

SHA1
e60a13f6ff48857c83a6c15e2691c338c3910498

SHA256
f60554bfa3d07fed3f8e2e00cefda7fae2e2caa15c5367ece5d6543c23a57a86

SHA512
ca40e4b6ee168daae35395301c6a37e893236be5fdfbb7b8d86af343e02f39749696e3590eba861940849180761d62a1fcd35d90a847c1cbd95791d28ff839ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000079

Filesize
853KB

MD5
65f3cb03833d7cb5872491f06435f385

SHA1
4d0dcab27a49c8e3e5d6f28ca70c96a77b135179

SHA256
155b3edc5751852061fb66a5d60e34b1332700ff8dd20dcb9604f08a0003f81b

SHA512
6954fdda898149cbec6044d307d251d31f10c68c0c72c5c4249b959d4ea8b8218080ebab173a470ed693856c5a528df643f23975a479e8c3a16803acc9b1d370

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f3156669766545acdbe9d3528736df6e

SHA1
5d3c2834a064f93dbf73022dccab0dc96305941c

SHA256
8b710d6eb6b2354d998f5b9d2826ea8d4775c5c4bb435c6a2c7e44acc5be11b5

SHA512
0e4861fdf4d7c786c514df66c4c4426c2a97b30130d09f94620c96c5fb8f806acb84d9cf272b6def237ab32ed751b0c0373e0051d7efe73d91bab0c5a465b743

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
02433952e51833c87355972662542bd2

SHA1
a525752bc4614a49991da0486dc8eee6455e5307

SHA256
400ec85e0b908688e20d29382b910dbc28100dd4b84cde22000e845047683d59

SHA512
f7ec7494e27a98e5381ac359489b39edf5fc8af1d3f26c9876f5bf338565d31d9d6893fdc8d75543d07d87a05b7f472c7e1499b86c91aad23ed2e7b12b93ef8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_shortlink.ffreefull.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
23KB

MD5
7a7907a141fd010d7dac0d3e5723b3f4

SHA1
de97826c826aeab1d06eaf2b12be0a2a34dac846

SHA256
ac8d203aeaeb2d0b67874500b89fc3bbbf81af91b3b62d8ed6314c62f32ca37d

SHA512
68b137ea372901b616c3defb7bf1be5f73d799a1f118db9a8bf1e65fec99969e976eb150e2e88f301d6981955633ebda3121fc953410746bbbf8de33fff8f068

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
23KB

MD5
757a299aa721839bb43d5f4fd3a9869d

SHA1
82e4180fae34a2c19c01e752679262e66b9bab8c

SHA256
c0ba67aa4687ef01ddc3505f31de9a469eb8fffeee9621caab6df9869e8c16f5

SHA512
76c2ea8a5985cc62912758486b6264079771816a0c3d67e9d971c3dacdb0fc80a38b563a9a8aad716fc6a1f258eadfad6346b47feb03bd0ebcf7417085bbcc3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
2e29260dee737168f05fe5da0b453a3a

SHA1
4e96d0c12fc54ce5aa5aa0395f6c38797d75bd03

SHA256
242f7467e1c30229addccbdf8d05eaeca5f880e263d2ae3021ad54191d1cbf74

SHA512
6f3b76437544398fe4ce37b632a4e740459e063347cc4dff48176b6eb6be7123c632fb0bec439a7e3fa153968802c5679c2c32d2bfb1c41e6194f60c32daf597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
b5abc13c9013cb7ad392b5f23f52d67a

SHA1
4aac549843b0c81955e370d462b782d8a93264f1

SHA256
72d047c9b4468a6b7cceef606682e0a83d4d39494d8100bcef50b4e3fe438b2e

SHA512
bbfb55a2a56528522f11ec1e0474862e952a167b7ddb8f9f257ccc3268cb3f49d71d0a98f1d67a681b9fc6025e0974070d609cd2d970940cc140825e823d634a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
89e0f345569c0b394ea1e1897f211673

SHA1
a644c76c683c2f39ff893d6b61f298a7ea9ac959

SHA256
57404268ee51e97f25f040a49ac0c34aa0a60a218185255b943bab0e39dedc93

SHA512
cc102257ee19812c5137ccbacf0bbcb3f677d92e162250a995516dbce264d175187664718fa48c38757030b8af59ac54e0e7b954fc7049dc633e3fa3064a01f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
1c16d8f7243097bb607e406c01031321

SHA1
4b2febc0dbefe45ec6bf4ac04db2c12b93b91d6e

SHA256
22caa7aca3343ff1f1af008d90f2477dcbcfa0d2fce835571de7157b2bca84de

SHA512
73a82cd222d07703d74ea2fe3bbc7ea513435c98f8d2767f819c70f7b799fbd81643c08e391525632d3fa992e59ba0c0d736fe349ad9c255cfc07fdd3645d83a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
54516ce113a149bef6b90d8dfff5bab3

SHA1
6ddb91b6bed14e8c55f85f4f02a632333500b6ae

SHA256
c5dce42470f5631e37e9987fe840236ab2166d67afb56647ea48fe34e5be3498

SHA512
2697598217dceeaffab1c15b1aa22ad9c2444fc6b1dbfa062fc16d1df7fc2edddaebe64a7acdc5c7627d52a1d9b440a6b7c562715642333587ecc8bf06695258

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d4a1857ccdb77f9537e706db9f1ad99f

SHA1
addb0de9e456702e84d2662880874c2def2a0a46

SHA256
a198dafa8f70b08f21036ca79068ee934255deaf0c5991295444ec906439bcd9

SHA512
6234311b4ef68c3ad9f3e7e40eaf981c9ccb9ac64d0c8e5e7c3703a428ba4c96f42804d35b53e9cc0562188fc705a91709be6d0d8d92c99d6797dfd2c3c7c0b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d7c2500a3d4a9b67e9b2afc849e470be

SHA1
7bd9bccb68e141211ffb4bd86d6e7862bcf03638

SHA256
acd70a07d5d9f333837124deb43cb9423ea06786b00a4027076a59be783a0591

SHA512
84953c181f0401dcb67095671d747590f2bd5e134f4dae8b0b8bc99a66523f2b1d48eb21228f01e5a679ce261fbf1df44d38e95cd7dcaf47d6c9531fe17a569a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e296df79f67a08396c6cd586236e53f0

SHA1
0d0a365bb2d36e4edfc777cc1213334f75b50105

SHA256
564242792ddc1c13aa019265d3d55a68e743acbf5c0e85007732532fb6fbdb31

SHA512
001fcae5b4c4f4896d55e4a4b594b4bf11dbc1e4424beccb1eb288216e223dd786bf91bc4d0cf1224970d1133c08c879f7fede278bfb4b056f8493941f44ba44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
ea0573370f142605232d5046a83005bf

SHA1
51bf53fcf3c8613f00cff4c85e83ce30f166e73f

SHA256
435b0ba7c402442a1e07783845cf148a684d8a4e454e634dc66c97eb1f298074

SHA512
6d408646d09a9b031b249c719eaf4be82c29c0f65f1ba8dbf3b33cd7d83c08e71a166d708aa7d3d16af1654b49698f6d0ab900b81b6a1ab635dbeaa480933410

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1c8c6b763aa95c1180132bad47992cca

SHA1
e663937b6f9d8b3712d16284e37cab80a11b65d1

SHA256
8670d1d40db1dee2982656195b880b04287b50d6e0334d1527c12298e8a09ac5

SHA512
0eb7643deb872381ae05666fe7aaf5ead171544ab24c5675ce11b0c130f7e36e01a0d3eb7cb2bfa9436eee57a7afeb8e115b9c21a215e2b638cbdd6305d21dee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2fba98dec0ba28243f5c86cc22c01ed6

SHA1
f8305f4e2ce1e7b56cc05a6daff48c227961ac8b

SHA256
a8a8374321d59a0efbb8c703a828266e6dd01e013dae5ce04ed1a2b5fcc380e0

SHA512
2845377b65455aa30964d44594138e5a2c141ed7a7954096ce0f2ea97b5df872c394031fa76eeab91976a8c3eb413520d6f8bcf57cd5ec7aba81a6c996a4a9b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
97cef770abd3ea30e4a44492de166eae

SHA1
c4795d9206bd124f7944001b1cec57f1704fb2d8

SHA256
19a1ebbc495be222b262576eb9895bdb56ff9e778676406ad05f35aebee7c297

SHA512
257eba57ca848674342ab7a98f7feb53a6865f10edcc19faaa817eba43c399c26e0fa459684cb76ff5743a2839d4923f670a549b25e5d43ce100ca399026bf56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
9decc67bdf087237a6884ebf3f400ea1

SHA1
3e66b97b7aaa9a7b530eebbcad52b92cd7f714f5

SHA256
0beb4ec603a723e7b59ae57b310266026e0d5e913dbef2b7cfd8a39d4010920a

SHA512
c59e671d14a0a580c0cd36f5c45d755090c0a845f46b5328d90360b7f83299c758ba4deef8ea13e43b4be60bdd8d089c4987002ba52fed0fb32abee663761b64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8d767e38e62bc76ab50f9b571e32e031

SHA1
22e72cca25ead4e1a630842694b39f8795b68e0b

SHA256
a0dab189c98e1201fa7d1f01386eb994994d5ed288db8f417c9fe182eecd7e78

SHA512
df57e946d93346683f5233bc4fb31a7b3a8b97c5b4f306bcd0576c05031ed26dba16bae1d489ebd1e136c7256e53fa389e9432e456661b587335e67a5be29c51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
88f6f0892f38149861dae312012bb06a

SHA1
b478590a510de6e65e37cbf450afb6fbbfe41367

SHA256
16ef2a078009f94b5ec434770755e3d96524f72b5a612d7f751354869c961fcc

SHA512
2dfeb9a48e043f251b8f27beb34b3410b7d5ce9c86aadf2ada27b319bdc1c6785ee557e8630a647037fc97a11ddd1942f18e93ae6b2672b5a802b5e47851e437

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
ecc5c03b986498d672f0479797a8c8e7

SHA1
80ede2e7867a7fce6511ac811a53604de0af0504

SHA256
d05304adaf444c494438f1622e34d35c9857f37576d8e985f9ebafeedae6d9f4

SHA512
7af2409cf8618d9cc1af50fc38f21d6fa6a87fb27bcf248a54e5661098b18209953c3488e6449f9ea40fd5c6978ba11be96920a52dd31705cac5c96e4165e1b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b7bbdf9981c61e3b5a251597431f2b69

SHA1
8c564f08fb340e0f651ae8aeef3d4b0c8138eb93

SHA256
361522a195eb9f76e4de4c1eba1f39a854cc7f319870310845386af6cf47b1e0

SHA512
2174de3d60fe894133ab8a4f8e1d0c1ab2a703417f745ddf53038c3e5d6b7a723fb44ecf1c83581f5fbef4463b0e66bc08ac36a29e9ca3aaef534ee6b5c067e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b0740.TMP

Filesize
48B

MD5
e13bd7df5d42b80f945fa7f5570095ee

SHA1
df2d15a336f4a53a51c20972de5e5a50050be8c6

SHA256
ba91369ea67d5daf84089de2630e2df7a261f6d3c123650490b7d1494111d83a

SHA512
463bc39d8ae40769e8e2a4c8293b623b74a319b2c591241c75dfade094039d731b93814f06df6a1b83a66983e64a98c14eb2e8e55059bc945328c2be7549ea2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
79B

MD5
f9bc52a6cb5944572a85e6445ba7a4da

SHA1
622220acdab94cdb173a273aa8ab538d98123075

SHA256
d5e47c30b4909c8bfd9f3aa510f933076aacf823155f23bf758deb994d8efd3a

SHA512
09ce16756e34661531fdb1d171933999c1017214c8151ef74afaa47527a224d7fdce37190d8e44d73792297329616389866adef6c1892e5d1d3188ea071ab3db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5c1ff3.TMP

Filesize
143B

MD5
23c61aaf1dde67cae2652fec0450fd68

SHA1
811ec055b2ddbd27ddfbc97be3fa9fec37813997

SHA256
69b263d51088966f18bdb67bf70c4c4721ad2bcf5cd2a92fd13a54061f3dd3fa

SHA512
3ba26adb932d7bfc30cd1ab4c150e4dcfba5fe469b60e076c0de010bc2e226f829cf6231c9d9ed86f0b4a3531f90c7d21380fc4314d1b16cbe21ad281691fb74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
8d3b91d08f67049d4d6e0b995b757466

SHA1
00fd29ced811469ab113721f4fe288ea1a859dc2

SHA256
dd43cc70d703e77e77dc842ad01d56e3bf2f5e08c2d93215c259ff1af0ca7997

SHA512
4fe666076c4ed79b7bc134f9c252fae259a9f54e357e752f8bccff1b41b3d7912377ed0eb753711c47baa3d461dd08cf11913294796e0cca713d21fac903e52a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
155KB

MD5
700067fb7ee9d9d3fad294435cafbcb3

SHA1
f11d4e9648e6f9b64076b093dac3dbae643f0d0d

SHA256
b3ac9c9225bf998bf7838671642c24349cbf61e2e19958ab9dd66ffa85de0a3a

SHA512
5dd7d7c73455ba5adba77880dd49efaefa7e6c5af23aef7fe59a09848c3adb1c1586dcb712277ae0cdac214f6b6c49f7b2977afbc19c76320d88e4082463fc4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
155KB

MD5
489990173182235290e2cdc304dcd134

SHA1
37268ae2d62b4afc3a27794779da7b45b01e9b0d

SHA256
505b1bcaed2f6df352ec5c6e431faafbcb76fdd3bd34500d33f6b68d19667eac

SHA512
a793bce82b666b597fca55dd47e500c54ea5f1a14af5f93008ddf1b23802bb33b81e2cf1be2125fe66903dfd23d940a82a5007c6bff447d4b6c7278235d176a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
156KB

MD5
7104d62fb01f6d75210897cc6a910717

SHA1
c87d25c2f2c809de8a81f0dfbac5037f6109d496

SHA256
f83300c166c455a41ca0ffce3602df3194c81e234ce9e6c9882631825d1bf3e9

SHA512
49a6d21700a068ade6ddf3ee530d814008cdafd15169cc5be189522fadfeb5bf114aea3746dc6aa395103e89253d7789fc7ba63b490127f50e323e9e1fe5c293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
618f6958b011c7b8313f003941d4a7b6

SHA1
17e7cf6cf75395b41a31517534674a2701f1dc49

SHA256
71f3de862be8ca00f26da8b18eb32d85b01c9bb9576983f6f4e35eceecad689d

SHA512
64426fddfb028714fa150e0d9e63e9f313b6767307b7879bc32e94a1b736231e532aadc0a215b8d133d555a25e62cde710e159d366f662ffacd8d22811ef2db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
80a6ba3fc4128465c2e530ba96d88d8e

SHA1
64e5e92047c3be581919a593e9384a50b5e152e1

SHA256
95f66b37fe10ec6e48725a016991c6023028b2a59bab4594d91e46e2a0762ddd

SHA512
63657ed59f013b0c959468a990b2d752d0344c22b1319d41c61babb0c848e835c13302d26fedf0b7c8d82b47ad18ebee69804049a342f992235f92d939636295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88167945-2959-4b0a-b0ed-025b591a3778.tmp

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e7d780fa01660458070ea04376a07b9d

SHA1
3a291f7c1c3ccd6b510c220bb65136c8e1f7a45c

SHA256
26c287335d72c6a901c4f7c0a7b9604b09fd997aad913a9184300a1096d4f76d

SHA512
5b6948a55059983442b36d445f73107409ce4f61aa43ffa6c3877ed83e96d861b2dcf10ef373ce6c1cb8adbdefb540bc69c32774230f0c7d09d7de0c751dc031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
31d29af7ba7f5e7637d78e3da4fe7dad

SHA1
9b3fb03db5b190c02ee83ade39b8d4c267f30966

SHA256
4f6b387a0d2b02bd95072da23088dddec5b27664f6670f3076bbee8ec899e8a7

SHA512
146949f2bedcab93057c6ef77abacf6a7a406205e06700e6a8908f7f141f3d6a176a5c11eae93d60b2749580be7b114d662ae42c45f1829f45969fe7fafcb776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5bbf4509d12b003d18ff41d3f5f1364d

SHA1
3219a10d9634c99c05d36e133d3bfa3172a9d032

SHA256
122f311a693a54fb28c31b6e4b83a0a4d5d6cf9e4260857f52606278d5219701

SHA512
923fca93789644994e16974dd792e30802a0520df9696bab776ccfea4ed361af998822985654a4e30f54a7c74721d5f613d3214644a6e929399ee88a7fdb6f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5e6cc2.TMP

Filesize
3KB

MD5
7a3113e88d5cb92ba793e4f69bd8f19e

SHA1
17f83b285b68a1ed035c2370282b2ea0869992d0

SHA256
98a76e1c1701d5d5c7b4238278aafb2a789943fc0b979cf2004bb6f0d155ce6b

SHA512
95c33c105e6eb5ee055a55647d87910fe6ef6e9f7146ab9b3f4c2ce165eb1e3db289766827c818a9ab4e2427dfb54c777b38e250e4f8dcc84e9fe0cd7328403a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
14KB

MD5
f5d850a900b2671089d3026925c49ae3

SHA1
ef122af01167b99a128e44a3bd8cec6230d35eb3

SHA256
592f642f3fce27ead4b61a191ee9d0b967ac89f03aae07868f6430ddcd1e9845

SHA512
a889d6458e2989c27f8804ffae20f10603bd478354e40b2a7254964febe2f0f900c12db2f09ed98ace25711e3703a44a19cf1919ac5bea64fe9face6ada03907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
88ddce6d43240a748800767b20196664

SHA1
74a4d851067063a78d659f670147dfb511cb95f7

SHA256
9b6d6add1416dd9e3982da72845af767a68e70c84c90eb04d22e1d62245b5919

SHA512
7443b0c68224c544c78c1e0009611736ea8b24747bfcf8e9d0e4df955b8b9c31088a86a2308cdc5b8db5cbbc471097d524c1d06e3c2ee43b906f4da36bcb30ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
415KB

MD5
3fc3338aa803aa2565db961f8475b23b

SHA1
86cc8a894c4aa4ca0a16ea321e44e1a9423191e9

SHA256
0e48733e502e07fc67fbd10d5595f91c77afc4d5183d833e38a5741dfe349ccd

SHA512
cfddafafc154a81004d9b8d601391258655d164d8ebbeb0ebf25ae24b0f097adf4829e300ce0f0aa7d17b5d807d6451feae1d5ee35678c46ea21593a851cc63e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
417KB

MD5
fe7a6691d57394ab8a5dfd95197266a7

SHA1
1428189bc932de41d2e0550025930f29123482c6

SHA256
4ff2c329a890f36a5b04af32ab648186e8db09cdf84b9481ad4eaac8b888ee79

SHA512
ded27e009bb93c3148255441d7095da846d9b55219cb5ae30d17ee5518d5ae76a1fbe3c84d9172c4f22f35a584e31baf84ebe97aea4b09a664df5129e9af8434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
414KB

MD5
c3fb98f0f2f3c295ff1217b53244ad5e

SHA1
1187679e92edf03e355a18b3d57a5e42d2bde814

SHA256
09d2d81ddd305f3d2684ae46e6c96526436c76ab6d41454a66b02bb5d6c3b4c0

SHA512
624772bf1d1173373522534ffe115a9e4d3a951b2457432b5908fa6b73e0506ae0fdb20b7954a88ac54f89920d8f098a51a5387f26ef837f5782f597e344ff91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
1cefc837fd94dd100f8d988d26ac189c

SHA1
345d63e8f514936b6aec89b2d8901999728609c5

SHA256
d640cc3b01f7e0bb7f8160e4f630cd43c5f8b9bd6271e7b17a57bb1599497a11

SHA512
f30b376120d33b85526b2c4045a71eda5d3ed5363e46b2ba98eb68d414d696ecd0d0b98a1ca4518efc38a426d6ca418ec548bbb73fd991a8e541814cdd576767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7b3d8453-9a68-43c0-a152-567f9ecefa74\index-dir\the-real-index

Filesize
72B

MD5
62e5e0096df1d93402fdca4504b0868f

SHA1
7845568af07258db71f4557fdf033b49fcc24dd9

SHA256
2998e86c73039229a71acf1d8216f14aebbab2428fb457d06e4ef319a83f198e

SHA512
637005b8e860987b70da73ee6d65dc0f3f41a65a94cc5f8ebc66a9827c5bc90652b6d5e5e669cf22f4e18c6447f9a8da40693aef6bd2607e8e931f26e02b78bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7b3d8453-9a68-43c0-a152-567f9ecefa74\index-dir\the-real-index

Filesize
72B

MD5
eb038a5a95ddae5a6aaf5b41939e8407

SHA1
ec3e184603e53bb573947ca0df6ac062e30cd20f

SHA256
1ef2c14923f89530271123e507c40b73c5c355187bdae9c39e3eeaf91681f0e1

SHA512
016bc2ee70bf72833430de1f913fdbd9740740b50821ea9bd84ca99dca0ca6614ba732365a13bf98f9b3f60441d0fac248c7852e8077ecb76840fe2a89c775f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869a8234-9c3c-4e6a-819a-fd76eaf16b2c\index-dir\the-real-index

Filesize
96B

MD5
c7169036382b84e535f2af126b84801a

SHA1
998f0814d7c5750e1d1ee16aabdf54ea1df00e99

SHA256
1a405a2323535d93a909cdc057c5928341f3e61bff599d46f8293efe07fe49ad

SHA512
3b83fe4475c064bedf4c89caca22e899ec2d55f1662baefcab0e262d047ee92f4f2442b36aff36a17e857a8a2dfbc00cb729493f62371a19c49df38ee38979cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869a8234-9c3c-4e6a-819a-fd76eaf16b2c\index-dir\the-real-index

Filesize
72B

MD5
93e9bf67df818aeba43ea4b4af0092ad

SHA1
1cff749de50e08301694d457ac22bc98469c135f

SHA256
a49be372617f93d9daffe58d06189c1bf0e6daf86109d624da032f98db3386fc

SHA512
330117f7fd58e95250c2db87234c4d6aa66d388f53d38cb60e256a2305cfab673a51c67055eae6a98b836c2541b6e40664c5b93aa8b1750277169fa9265b9464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869a8234-9c3c-4e6a-819a-fd76eaf16b2c\index-dir\the-real-index~RFe604318.TMP

Filesize
48B

MD5
6308340d348419e2a1979acd3b6289bc

SHA1
a7df31ff81c5b74c032717d02600902555fcc33e

SHA256
f3e23a1a83c28f4b43e39c6e1d5685c6c0f8d0426e5e0c1da9121d7af64bf420

SHA512
e0c604a5b1707c92a14d754aeab0cea81f94ab6255a519308af82e482631c7e7c963d7d924d54e59c3a344a408469121368d29e70d8302c6765ce3999d82cf39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
5abad0417439a0cecafdb9e9610bb4f8

SHA1
45fa02d0a556c7bae2902a076b1a34c57b0cde60

SHA256
299094b512c444133762c4201e846f086314f772f84252601eeebc7df94b6efe

SHA512
2b036e174fb480d4b9f79b8efe640ed8f328506f6ecd85eda81c111d47788cb37208cc5249bc77dc4e8dccf99b538b21077e60a7ce42aa0a8e5f049f7336100d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
7bf9854b91d1e310dc475540d53c0cae

SHA1
486fab5f1de223bd168fc95d025012c5120317a0

SHA256
8cf8af6483b921a4b0e5b346e6a8eaa7f85c9e538613b3a0728bcb21e3494301

SHA512
9f9d7a9ec82b6217ccfadddccade90ba2c8d27c48baf3ed8f8a4c351169e07753e229ea66426b1a8016cd711a6e13e474c171252df9317b6b4e531d7054504f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe604318.TMP

Filesize
2KB

MD5
ba0d01196bf78dbb4ea1c039022d0722

SHA1
0bdbb6dada83141462e7013af0abb8694feae01e

SHA256
05397f2384d3865d890de904b3063180a7042a2694f219ef66198e14f960b6d6

SHA512
67822e8bad322c5263efcf143296f9cd0edd0e79350f8a57a49321cea0998dc4a9bf04a2cb4acc90324554bcd06e57d257502069cab5a71a2d755fb8dad27a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
7594b7ac52a1a1b7451a2de46fe83d7e

SHA1
b18426a27c2f5d7393913285b1a5237e4cedf57a

SHA256
c39f1bece06a05669a9d44f29a3129e95728568710b7d79570f2260a105768ef

SHA512
e010557a0a5b1105fbfbc09f809ab1d1d8afde168d12df950668b9e3a6f227895d59cdedc905232d430fa2aa62eff2f0988dd351a03101ecdacdfb0ec64ae4b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
747e847e37b72137d0e3f5c63c6981e3

SHA1
b45380ef4c9fe9e1d0e163d761c8a857258df6ca

SHA256
14c4f3e11b730964fd58541e2751db512054969537d2039241300142aea4113e

SHA512
16e7cafd59f14cd6a5ce3fd6b46b77b715857a3c91cd68d7eebbae9be44b1769abcd3fca48e09f92025bc93e263edfa580af905d5c0158782768ebfbb0427ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
433d7f748552134f165bf78bddff51c4

SHA1
ce6cb04110a8c736531b344186a3853179e6d2c9

SHA256
da6a613ae57e87695aeb253171b619e7e1c231d46131048cf9105117a017996e

SHA512
b0369b3e9d25bdf6f8dfba0514747da8c715c4be4528b13b1aa5f10784d50732941082a7805c0fed3471912502052fb5a9540a22a6669b7362a345d811418b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
69b9e15cc24d63864024d4d8b418f925

SHA1
99ab62628df5e27f1ebdda49511b877e5be1d14f

SHA256
f63f6f909cf05700278420617bc71effdbec2c43ee4556c5768665053ed557a4

SHA512
be963c48506797a84fd180545bacacce1c6489bc1245839d92ac63bf69a9ae73d5de6d09b1cd18ff4b05e26628832a5f3cbef631a2cf0aa06101185ec9d74558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ad723e09df331ae6d1c13808d0109f64

SHA1
737dfdc00cd91468f20e2138a644d1f6dabaa7a6

SHA256
47726e1922bf226fa7d78d3d49387eb930cc01e50feebe0611c976a48e1edfc3

SHA512
b6ad02b4f152aed49a55f36ed8a44f709f2f628e166827bbd1150229c1666796048adfab5ba672b2d09bbdae1f58618525853e9ad8d4206ecd1b0b46efe48aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6042f9.TMP

Filesize
72B

MD5
85c7d4c64330c509a9d2c00e56b21c36

SHA1
0fed44ff8b8c892f3e5c7ac12c20466d8c532375

SHA256
940921772ce1704d3cd176c45e580600944a9cad9ee133d04a0688f05e1efa8c

SHA512
1b7c9a65d5abcbeaaa7be2a2310bd2e43b1521648c3aaff683c2da8625db5805c9b6b6b524dbab7ae3259feecaa3b30a89fd45e15f54ba8acb3b8d9052eb2434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
ba6338de287d2336fe972b733c20eca0

SHA1
8e09aaf6f3ac2af69237c4afef5429d4ce1b9bb4

SHA256
ca54bb8d79087e0aae5b1423dbe37d799a1fc9ae865395c0f0d0f637a450ca74

SHA512
ae08206313c1c6e9767b81cf93fb6899b8b349fb5484ad43d803936558a05342670e7e8c16dcafd0e0a29b0fcad912c162008f8bdac57fd35988177039b1c99e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
76B

MD5
86e8df9402e31831fdeea8584ed0df7d

SHA1
96db055429c26c47c9ddc5a2d438b9e6b08248ce

SHA256
43529ca3caceab090b0ca329c7aed4090070d63d8725b94b59ec89283a4635a7

SHA512
afc7f2b6ecf3c2ec44cc60c14d7ab96cc51931b8e475af465d822132a2d8605f8c63f81b7c77e197406e39a253cfd499014274addc8d59932cb0a89080c1a40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5e4f76.TMP

Filesize
140B

MD5
0b543f8763454607da3f2f1e7dde105b

SHA1
443515c7d9b49d7797920bc5acc754e8f5db4c57

SHA256
3eb751cddd633d1d7f736a873b73aa3124a496be973385d5607a98f34669d3a4

SHA512
6dddc6e2b8583463cf58f93434e52f35995cb6faec390652e924ba7c8feec8edf380768cda868777ac0ee8c5d14400ad33cb4186cf1c7187890be107cd316c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b48eede5-8103-4b1e-a0f1-bb74d73c1f1e.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
7a3ccee1921cec44bb8d91ba394c3946

SHA1
0c26dc3e1dd1496fa6ea530b348446f4a9cfd9b2

SHA256
e3022696d1504ee23b31ce0d916bb806e3c6265f0a457fc865187bc589236fd1

SHA512
3fc11da3019b1020a6a63789828a700e191302c80ac96436167bd847a0714cfabfa7cf223cbeba5aeca32f56c581b93f00bd55894f74f2a11a35e7fd306ce093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
7d75e1f0c7c63fe6360e30f624dacade

SHA1
16019b2973b373b5ac0f440158174a31f9eee23b

SHA256
4fd68163a7f41e341f8ea599901787a73f5cc755219d88fe7900390c0eb122f2

SHA512
0f28354763144d85490ed358efbb9f777de06178ad6797bc0db0f512d624cf04de469c76f190ae93d822341332aa2a19e1ec9b187bcc0f637f2eb3ec6b4eb426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
471e481858545b9d13afa57707a113a3

SHA1
bc7fb4ecef1202ed014e58dada4a8e5860538901

SHA256
e958693c9d9e93db749abf2b28a4c056ec751dc64e780e8d1aeae6d42a49a90c

SHA512
ec9fafa60182c8d35a05f90a54a3b22ec35a06cca7f39eb39551a8c36b1b8ad8bdea20bf764b739fd2b3b07abdedabbdcba6ad7fd408eee722b0ca0740f2570e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
0fe7a2dd7562d7109e2b21ec67811eec

SHA1
9fc0f3e0487ba3bab17b97438c359451b29316b4

SHA256
6c2d6fff49a884d190ab87cf85a513102d0c0f51b3324e673375fc0337211685

SHA512
b50ed0b88f6252b748f800ed0926dcee64b2742955d2c422cb1228c4ba701bb66a9568a49b987684b12dda9ea973e3edda5914cd6a57ccf3e54656930928973d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\f_000009

Filesize
17KB

MD5
41d25e55aef3dda7e09a6c89a2ee8287

SHA1
30200d9e985aff89b596d91443cde449b35b9a27

SHA256
55c9f796625d38846fa159cbf116ec21010098830a09036fc10c43192f6fd080

SHA512
0b127da0c8c90b868131feee08fee6715723cc43a5eedbac7a48942e938975db289a565aeabf6b9b5e39db0f30fe7cd569cfd1b3b2a1d02b8a5f52ea0066899a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
fd9874bd4416e5d75b9e70ed003e9e1c

SHA1
12827141008064e2f1d6fa16e5bb8cb0f8c82e5d

SHA256
af0606379eae8080aa389748f8836eb2654c38229365e14ef6fed63d858f2fcb

SHA512
d21bebf0b2a8d8900e592e9d34108a5cc9580d2bd2509aa42a4e09843a9ae546f447c55578c474138752af2dcd731ed3a9d722562dfb48488729b91e05635ef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
62KB

MD5
090da10e8192a73d900e15b91ab5a9e1

SHA1
70f9681eb7cbe04d345bd11631b2194c702b06bb

SHA256
bf7e2181673fe5d46b4f3bd7a5d3bce4284a1b04fdeb38c0d567cbcc93f775e8

SHA512
017a11af4ef48f96bd8dfe4f0abda85a22ed7e4499af932c7e1594685d10ad99db815483a11d024714015862de66876507eb86f015e7076f62bd7e5516aa17a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
29a431a2b2730e609e78257df748280a

SHA1
513bbf1b1d97f2df86472fa8e22620fda7fa93b8

SHA256
c5ca7a082560e76cde59a6b51b4d0ce1dcf5fcb36abd86fb40ac24d6634855b4

SHA512
b3df0f089b2094f0d6b232546ded4872cf4fc7297b85bea0fa2d1dd6dae2ef42c4dadda5f20f725e5283bfd5832e0e4d93f6fe4d3263de8676f8ebcf2cbbee4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
58995763803a5f5e5f937c44d5bc030a

SHA1
bf8dee8e35de06d4cffe69941df7013653aec52b

SHA256
645b9af46b433f766272dc5638e9a14ec659497730e80321f4b4d59b5297bb00

SHA512
ff2025350747806176c6c50c182eb3803fccb146f510437d39fe1225992aac3913133a01d0f786b58925807c325f430b73453d23e65a9960c173bb73e11b260a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
65KB

MD5
febd6d9b683adfd166913ef96bd9974b

SHA1
d73849cb865fc7d1b76fbac4574727aeb239ab6c

SHA256
0fe2b9ebba39485919a7f2581a72e29acc4964d55d9aefa0b5195bb44881acb9

SHA512
2672128e537bc317c2ae15140e8dd447a993c3f7a2fbbc50a7dc63a6cd9b393c4709dbcf703ff1736c15b097cca56115d189b5533316cd99227bd56617db8290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
b2877964edf282196ce1ce0d0ff2aef2

SHA1
4380d79c12abc9473ca259ded251830560ddd8dc

SHA256
f69993266b3f028dde9c4902e7881102675ce7bfc00d1d1f6bb719166dffd0aa

SHA512
77ead6465beb7dbfaded76e2106ef68fc3a4851b261d962c994580e6956a4dfa686178b8e888e329625cef838bd44687060bde431dab4d8f20840dc84475690e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.22.1\typosquatting_list.pb

Filesize
638KB

MD5
1990075c3abcb86ed86f835866bc3530

SHA1
0a5ef83c48a1b313ae145d47fcef24ac9f903394

SHA256
436c76ecaac7055725852c8112888d6c161698525a56bd2b5ed47ee1c5b2a0ee

SHA512
27cd8b9b5ac90ea02f6dac0a75eacd966e59a5420d0628c942680f512b18138b53488616b8f38792d3c2d22cf94bd46f5fc22d09e4d1e9576c7b4d09ddcc36b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\0617fe99-dc10-466b-a77c-3ac7162d4aad.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
e4502e12eddb65147ccb0c39021d5c54

SHA1
e0c340c26168e569ed1b09955e386922b9c76fc0

SHA256
ca1d08100dade9a95b1f93a37ac07587d9dca6866a8cb87436aadd5d29c86d6c

SHA512
9619f8745eaa0f18f6372258d3e7e068c0347fb1effa578bff7d173d6ee49507610316036c712834f8e336a01e95ba8d6ba8270ae1a439481877cc37b51405fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE83F827B9\R.E.P.O.v.0.1.2.co-op_02\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE83F827B9\R.E.P.O.v.0.1.2.co-op_02\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\FreeTP\.hashe

Filesize
4B

MD5
ff95c0a45cee4a85972a9ff0e7873738

SHA1
ee0c874506f46f323adc31745da00a79d355ab63

SHA256
7a8a304de4e8dd9b92b7c3671061f596dcb4d6487085936b7a49bfb2dc991ca9

SHA512
1608c92933e5d7471a7e4c72a9162f8a14107ddc1a86e4f796ff4b1c524c005247487890bdc9c6bd6ca705fcb0a4af4c8e735d64f91d90865b76d8705fe7db15

Download Submit
C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit
C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\SteamFix.ini

Filesize
348B

MD5
0fdad1c531e24377de0f33ca8a480a14

SHA1
3d42e104c9908696537664506d2860b412698c9a

SHA256
fac57717bfe66d895125c275c3de76fc611447f496c21d420bf05d22bc1efca8

SHA512
ed15af2e47dd46b4efc5fcffb735bf8b31922f4388e4b624b1eee2dc68f7a9decf5cee05d64bf1469aa98ef5b503f7c1edde74c8c9a9333262755d347b5733c0

Download Submit
C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\SteamFix64.dll

Filesize
1.3MB

MD5
e17dce61f18ab57929879600c678caaf

SHA1
e94e94f1c08c0460a995baf8a5d9258afe0b7fbf

SHA256
fc230947f9b2647a5581a6ae91415464e60bc70c3948cdf4945c5c592bcd6eba

SHA512
561c61f1a4d2e907887dad3cf932f4dd6552c04debbe8afb4e13aa3f78137737787bb305c8e1a088cef3348dd5795c15e0489df20c7db607e4810ce11d058e20

Download Submit
C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\UnityPlayer.dll

Filesize
29.5MB

MD5
b33d91200048e718c7207367f49d60fe

SHA1
cc95b2632f33ec9a533852df3402c58ef3faf0c1

SHA256
4b34672318371b54be9d89c9482a91ab3d26ae5d209935b8ad5919e00ec4f1d9

SHA512
edc94d2deab48e3aa57566904ebafc7082d63f14901c36067783deb10538e74124cdbadc72d40ec3c9db09c9e1cd27b18bdfd1969545e2607d34d5d12ec1d220

Download Submit
C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\winmm.dll

Filesize
21KB

MD5
93d2124fad54933b81f852507c9c3de5

SHA1
26426fc2fc6217675c887f515abe9674399552c1

SHA256
8c6649fb8f73ee2af7eb6b32b134e44ed5c506cc6d843b250efb515615d3548a

SHA512
2402a317203ca65f34870b111b6af4b79ef2f5918d1b9b163af88c29baa223c37dd9be6f40ca88e585f59a91535d3fd28b1d748079d0f2e8a46c4218f4916210

Download Submit
C:\Users\Admin\Desktop\R.E.P.O.v.0.1.2.co-op_02\winmm.txt

Filesize
32B

MD5
da253540ef094e2b9f3bcf830d260f2e

SHA1
5e510f6e61bb6e44d6cddfc6808ce8467bafa970

SHA256
92573d4e2965257e4c9488982d96a03898b5beda033bffc731f7ca3c5f1e09fe

SHA512
5d270c406a892804e61c391049794fcdb6c61823ceca352d2550bf22583baa2f26df3d1fcb135a60e8ecd6af8a48651261a7b375b5ebb046767e40b6bd72d272

Download Submit
C:\Users\Admin\Downloads\R.E.P.O.v.0.1.2.co-op_02.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1377646463\_metadata\verified_contents.json

Filesize
1KB

MD5
68e6b5733e04ab7bf19699a84d8abbc2

SHA1
1c11f06ca1ad3ed8116d356ab9164fd1d52b5cf0

SHA256
f095f969d6711f53f97747371c83d5d634eaef21c54cb1a6a1cc5b816d633709

SHA512
9dc5d824a55c969820d5d1fbb0ca7773361f044ae0c255e7c48d994e16ce169fceac3de180a3a544ebef32337ea535683115584d592370e5fe7d85c68b86c891

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1377646463\manifest.fingerprint

Filesize
66B

MD5
8294c363a7eb84b4fc2faa7f8608d584

SHA1
00df15e2d5167f81c86bca8930d749ebe2716f55

SHA256
c6602cb5c85369350d8351675f006fc58aea20b8abf922a2c64700070daaa694

SHA512
22ed0211822f6f60fe46184fb6e5e7fcb2b3a9d2e19f25fb6e84e1ca3a5d645183959309549cdb07c999b345cfdd9a1351f3474e03fb8d451b0f093d44844d7c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1377646463\sets.json

Filesize
9KB

MD5
eea4913a6625beb838b3e4e79999b627

SHA1
1b4966850f1b117041407413b70bfa925fd83703

SHA256
20ef4de871ece3c5f14867c4ae8465999c7a2cc1633525e752320e61f78a373c

SHA512
31b1429a5facd6787f6bb45216a4ab1c724c79438c18ebfa8c19ced83149c17783fd492a03197110a75aaf38486a9f58828ca30b58d41e0fe89dfe8bdfc8a004

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_1572310710\manifest.json

Filesize
145B

MD5
ba1024f290acf020c4a6130c00ed59e0

SHA1
01274f0befca8b6f4b5af1decc4ade0204761986

SHA256
551b8c76c19c654049d2d8043a79b8edb3c03e1b695cabf76b4076ed4921ae28

SHA512
e55b871dd3500f30d639089cc42a4edc3bd4d26d2c4fd151322a363fd8edec82d5345751953f9b581e40f22b6a8976faa0ea7ec9fd286f73f747120c87ea7157

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_2047373727\manifest.json

Filesize
121B

MD5
7122b7d5c202d095d0f4b235e8a73ca5

SHA1
0cca47528a8b4fb3e3d9511d42f06dc8443317c2

SHA256
93b603f06d510b23b95b3cacd08c3f74c19dc1f36cd3848b56943f069c65e975

SHA512
ad6fba6e0710cc26149dcf7f63143891aad4ebba0cc45670d8885fade19dc1a50b542a15b10a7604b6b1be4b8e50fcd5514f40c59b83cc68bd10a15ab2a93c1a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1460_614919112\manifest.json

Filesize
118B

MD5
3eaf87405bb6f4c2f66a0fa1e4683d3f

SHA1
2ddb6e2e3bacf7bfc4c807dfc328dc30a003896a

SHA256
94623a5a71617638408e7cbeaa3c23bf109e3c7f787717a625f24f7377b732cb

SHA512
d35568778a0bc22b4dd254145debd1f202474145ff7a9c9c372ffc22466c2fbca32cc7ffc5d6781c3f86076fc9d5df28f7278dbe2e406d0364a06368c6fc8a04

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6256_147022055\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6256_1851586103\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6256_1851586103\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6256_247137155\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
memory/228-2390-0x00007FFA703D0000-0x00007FFA70618000-memory.dmp

Filesize
2.3MB

Download
memory/228-2386-0x00007FFA703D0000-0x00007FFA70618000-memory.dmp

Filesize
2.3MB

Download
memory/228-2389-0x00007FFA703D0000-0x00007FFA70618000-memory.dmp

Filesize
2.3MB

Download
memory/1180-2889-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/1180-2888-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/1180-2903-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/1592-2853-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/1592-2854-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/1592-2857-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/3484-1638-0x00007FFA6FBC0000-0x00007FFA6FE08000-memory.dmp

Filesize
2.3MB

Download
memory/3484-1631-0x00007FFA6FBC0000-0x00007FFA6FE08000-memory.dmp

Filesize
2.3MB

Download
memory/3484-1630-0x00007FFA6FBC0000-0x00007FFA6FE08000-memory.dmp

Filesize
2.3MB

Download
memory/3972-3154-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/3972-3158-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/3972-3155-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/4064-1780-0x00007FFA727B0000-0x00007FFA729F8000-memory.dmp

Filesize
2.3MB

Download
memory/4064-1784-0x00007FFA727B0000-0x00007FFA729F8000-memory.dmp

Filesize
2.3MB

Download
memory/4336-2437-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/4336-2441-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/4336-2438-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/4876-2400-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/4876-2401-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/4876-2413-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/5388-2414-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/5388-2415-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/5388-2436-0x00007FFA704E0000-0x00007FFA70728000-memory.dmp

Filesize
2.3MB

Download
memory/5648-2347-0x00007FFA703D0000-0x00007FFA70618000-memory.dmp

Filesize
2.3MB

Download
memory/5648-2343-0x00007FFA703D0000-0x00007FFA70618000-memory.dmp

Filesize
2.3MB

Download
memory/5648-2344-0x00007FFA703D0000-0x00007FFA70618000-memory.dmp

Filesize
2.3MB

Download
memory/6352-3125-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6352-3147-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6352-3126-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6440-3066-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6440-2986-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6440-2985-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6852-2861-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6852-2858-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/6852-2862-0x00007FFA70F70000-0x00007FFA711B8000-memory.dmp

Filesize
2.3MB

Download
memory/7040-4428-0x00007FFA71330000-0x00007FFA71578000-memory.dmp

Filesize
2.3MB

Download
memory/7040-4429-0x00007FFA71330000-0x00007FFA71578000-memory.dmp

Filesize
2.3MB

Download
memory/7040-4432-0x00007FFA71330000-0x00007FFA71578000-memory.dmp

Filesize
2.3MB

Download