blackguard | hxxps://gofile[.]io/d/iWSIOl

Analysis

max time kernel
308s
max time network
310s
platform
windows11-21h2_x64
resource
win11-20250314-de
resource tags

arch:x64arch:x86image:win11-20250314-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
23/03/2025, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/iWSIOl

Score

10^/10

blackguard defense_evasion discovery persistence privilege_escalation stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Blackguard family
blackguard

Downloads MZ/PE file 1 IoCs

flow	pid	Process
141	4664	firefox.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
6496	7z2409-x64.exe
6860	7zFM.exe
4936	7zG.exe
688	7zG.exe
6604	REPO.exe

Loads dropped DLL 5 IoCs

pid	Process
4936	7zG.exe
688	7zG.exe
6604	REPO.exe
6604	REPO.exe
6604	REPO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
25	api.gofile.io
27	api.gofile.io
24	api.gofile.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Dictionaries\en-US-10-1.bdic	msedge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2409-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1215555644\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1760231394\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1760231394\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-mobile-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_125043691\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-shared-components\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Tokenized-Card\tokenized-card.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1215555644\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_91217386\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_91217386\shoppingfre.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_91217386\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_91217386\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1215555644\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Notification\notification.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-ec\ko\strings.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133872036988199101"	msedge.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{26DA934A-A22D-4A41-964A-2C89CE549EC4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	7zFM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0000000001000000ffffffff	7zFM.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\REPO-SteamRIP.com.rar:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5908	msedge.exe
5908	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5740	OpenWith.exe
6860	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	6496	7z2409-x64.exe
Token: SeDebugPrivilege	6496	7z2409-x64.exe
Token: SeDebugPrivilege	6496	7z2409-x64.exe
Token: SeDebugPrivilege	6496	7z2409-x64.exe
Token: SeDebugPrivilege	6496	7z2409-x64.exe
Token: SeRestorePrivilege	6860	7zFM.exe
Token: 35	6860	7zFM.exe
Token: SeRestorePrivilege	4936	7zG.exe
Token: 35	4936	7zG.exe
Token: SeSecurityPrivilege	4936	7zG.exe
Token: SeSecurityPrivilege	4936	7zG.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeSecurityPrivilege	6860	7zFM.exe
Token: SeTakeOwnershipPrivilege	6860	7zFM.exe
Token: SeRestorePrivilege	688	7zG.exe
Token: 35	688	7zG.exe
Token: SeSecurityPrivilege	688	7zG.exe
Token: SeSecurityPrivilege	688	7zG.exe
Token: SeSecurityPrivilege	6860	7zFM.exe
Token: SeTakeOwnershipPrivilege	6860	7zFM.exe
Token: SeSecurityPrivilege	6860	7zFM.exe
Token: SeTakeOwnershipPrivilege	6860	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
5740	OpenWith.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
6496	7z2409-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6060 wrote to memory of 2780	6060	msedge.exe	78
PID 6060 wrote to memory of 2780	6060	msedge.exe	78
PID 6060 wrote to memory of 5136	6060	msedge.exe	79
PID 6060 wrote to memory of 5136	6060	msedge.exe	79
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 1220	6060	msedge.exe	80
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81
PID 6060 wrote to memory of 384	6060	msedge.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/iWSIOl
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x270,0x7ffc1575f208,0x7ffc1575f214,0x7ffc1575f220
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4828,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=de --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3712,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4808,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5084,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5196,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5992,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=de --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6672,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6680,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5852,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6568,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  - NTFS ADS
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5420,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6516,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=3552,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7308,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:14
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7136,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6484,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6732,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:6944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5656,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3048,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1032,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6828,i,6413363556970739698,4219475365645608590,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5740
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\REPO-SteamRIP.com\REPO-SteamRIP.com.rar"
  2⤵
  PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\REPO-SteamRIP.com\REPO-SteamRIP.com.rar
    3⤵
    - Downloads MZ/PE file
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Checks processor information in registry
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27097 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {3e82a00f-1faa-4458-bc8d-4b3921cfe6ad} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {f918b91a-e85a-438c-93aa-ea4f20a877cc} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 27323 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3900 -initialChannelId {36d74511-98d7-480d-8d71-90892263c140} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:6112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27323 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4160 -initialChannelId {f1bed80b-705d-4176-84fd-0314a7056a95} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2592 -prefsLen 34822 -prefMapHandle 2812 -prefMapSize 270279 -jsInitHandle 2964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1608 -initialChannelId {a82e5d8a-a262-4b22-8e1a-5a653ad49817} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1992
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5248 -prefsLen 35010 -prefMapHandle 5252 -prefMapSize 270279 -ipcHandle 5384 -initialChannelId {4b063a3b-a96d-4a60-84e0-07f03de6cadb} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6660
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32952 -prefMapHandle 5048 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5040 -initialChannelId {9b7babb2-338f-420c-9048-d2694188ee92} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1724 -prefsLen 32952 -prefMapHandle 1728 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5832 -initialChannelId {92a879db-a811-4f59-9a0a-3e3de81ec200} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6004 -prefsLen 32952 -prefMapHandle 6008 -prefMapSize 270279 -jsInitHandle 6012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6020 -initialChannelId {ab8018f6-6d91-4d56-a852-5e74868d85ca} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2948 -prefsLen 35102 -prefMapHandle 2952 -prefMapSize 270279 -jsInitHandle 2956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3312 -initialChannelId {fe4c3cfa-82c3-4b14-b758-c67b76bad966} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 33111 -prefMapHandle 6008 -prefMapSize 270279 -jsInitHandle 3096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6852 -initialChannelId {8d6e09cc-64c7-4f13-93e0-13d40b65340c} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:6652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3308 -prefsLen 33111 -prefMapHandle 3184 -prefMapSize 270279 -jsInitHandle 3180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {daa5e6c3-6bf8-441f-9041-ccf45f3221d3} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      Checks processor information in registry
      PID:3040
  - - C:\Users\Admin\Downloads\7z2409-x64.exe
      "C:\Users\Admin\Downloads\7z2409-x64.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\REPO-SteamRIP.com(1).rar"
1⤵
PID:3468
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\REPO-SteamRIP.com(1).rar
  2⤵
  - Checks processor information in registry
  PID:4564

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6860
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\REPO-SteamRIP.com\" -ad -an -ai#7zMap12318:96:7zEvent8819
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\" -ad -an -ai#7zMap16480:132:7zEvent3288
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\REPO.exe
  "C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\REPO.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
967KB

MD5
4eaae49d718451ec5442d4c8ef42b88b

SHA1
bbac4f5d69a0a778db567e6978d4dabf2d763167

SHA256
dc4fdcd96efe7b41e123c4cba19059162b08449627d908570b534e7d6ec7bf58

SHA512
41595b67c8506c054c28ce2b5dec9d304651449464c6e1eb092a049d49326594584900cff4e9b8210ca3ad8a23e9c22d8df1ae8af15f44a69f784cc546fcced3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Program Files\7-Zip\Lang\de.txt

Filesize
9KB

MD5
1e30a705da680aaeceaec26dcf2981de

SHA1
965c8ed225fb3a914f63164e0df2d5a24255c3d0

SHA256
895f76bfa4b1165e4c5a11bdab70a774e7d05d4bbdaec0230f29dcc85d5d3563

SHA512
ff96e6578a1ee38db309e72a33f5de7960edcc260ca1f5d899a822c78595cc761fedbdcdd10050378c02d8a36718d76c18c6796498e2574501011f9d988da701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c50c5371ecfe45ba3e7f3a8097c51ae3

SHA1
46b0f0270773246e817153eee20f1f593c2a471e

SHA256
1acd245a4f8d33d350c38dfe8af1b1ab7826c07ba276faf813314e3ff1e4144d

SHA512
f6923998922302ce18bc117a37e401edb308f7f4c17244055c148db91e1ada19a898cb327dfa7159ccb7367d8c5b78118db7e834ba4ce0ede5f599b1020de854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000010.log

Filesize
21KB

MD5
871cc14a06eb4f62115e536272e6aa70

SHA1
b22a9e1c7f1dbec3caec77f127b7a6d941d03ec7

SHA256
4b700f385259e76a8f514221f40a3603ba96c874cb43496a8f819d2b3b0b759d

SHA512
7d51cd948d0bfc2ff0b7ffe0c177e38ffc4154d516040b1fae7773106a40a36065ce6510536191243f1d42b2c35df022ab04c346e4d5490dd2aa26574514a973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
332B

MD5
50c63372653179737b5d7b59dbe3dfee

SHA1
fe6bec05f96d019f2dcb8b074dffae4542eea293

SHA256
f22b17bee642e807e5c5e894b40c34a9dc07a25e1cf532e6edb8cf97c07d877a

SHA512
1101be34306fd68bbd1568659bb735e770de302bd5d957f99c7b21deb2147ae9538bf3d7346b90de91958403db22b3c8c195505a47fe40eed8415eb1e991cbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
335B

MD5
e5c265f18ff2da568315a88165ac828e

SHA1
7102a0e934cf3dac34eb91caa0d28617acd7f0c3

SHA256
ca829c77663f5beb104223dae1a1c85b6ff4c920a73fbc59d59a0a01242e0267

SHA512
6af1b0490dbb71a034135d737c6fecfaba74fe17996a53c9db71b5cb47705f02328921a107c57e0caffd254554ccf6045a515f2ca9048871d68b533d4c532fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
04d1c133b603eb9f881a76be1e40fc42

SHA1
42e30e3c56de9b67e061ed5392da84d1e4dec83b

SHA256
ffcea9af27f27d4007bf28929120deff295e7980b5ca8bf791c78b2aa8504872

SHA512
8e4a5900b99f785c939dcbb15a9a7bc17b77e876adad08e4e91884733479a4fcb069118232fae5210f7fb793b744168dc2b11eef8be2274980ba728786973832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ce6c.TMP

Filesize
2KB

MD5
4c182eee764232993a3ec2b01c86c42f

SHA1
63baf3c941b970b59be78e258de4c271fcca44ad

SHA256
d0a702ea98da846cf939457398eccf21a0d0eb978783fc8c069a424cb0cb6b36

SHA512
8afbc7f6c3100f6e4bd73aafb57596e7ef450a436bedefc7d99088eff7cda89e134d21ce47f593d057fd733e941a08bab72e87f42552a7f1dc09cbe3b7b8623b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
108KB

MD5
dce75467df0d1956229077ff11781290

SHA1
88713a6f6bad24702c17c5a326612b536d1bad7c

SHA256
c228c531fd131a1e69706522f0c4117efdd16442666071043bae4fb75b7e72a6

SHA512
da96a8c6350621cc048cb2dee991e4cadf6b84d107630e0958eea7d034fb9c586f466539e6500e75f750a5ab2365a9209747a63172e6128235e3b1e18369c91a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
07c2e7b8ca1200bc5aa38b705cc7c23f

SHA1
506ea2492efadbb6b3420104acca0488813b1be6

SHA256
5cd5ce79e78ed8ee584f577b8fa6c343ed8631e33a9d703e635dbcbc09c9af92

SHA512
14fddb51b84c03e139a2dcbee9f503d029ec072f0c062f68fd67b07eb8017e244e619a57772032380fa52761a9226408502d5aabeea38ec3ed50c6eb9fad3df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a6b5e0bc57259290a6ea430ac9c49846

SHA1
1fb62ac64d3e230cf9dd4b9976502bd595f15d1e

SHA256
2a727e8c19dc9886b84981ba2ae022ba9f8b45f51c6d9d0c569b4966171c4e54

SHA512
2cfe62277ee98b7034a25a2bfea088c8a0878572fb0b9c8fdfe1eb5ff4fd3ea8c9acb954fcf9405d281fbec01efd427e29ba9e9acd33ba634d5ae5a5104fbabd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
89bc56c63ffb0d0938fb027eb24b77f3

SHA1
862b7e5532e5057c569d50cd31e0ab05182600e6

SHA256
956f8f50a8b04a69a2fc5d4a01343367f012a37519238dce3e7ac458b8a495cd

SHA512
6a2ad9f1990ecc0546cd90597573583ea3b93fd1ea051d9c439e47e4bf1741d7b74fb3ea878141be6da8e164e19a2fa8c2c9760a6eadca68c4ead95cace8949b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
aa9be712b30c5648be063d98a736eaef

SHA1
c0b45b02a58c29e54b15264d0afce0ee0cb0f802

SHA256
26eb0c616f08bc0db59f44ce60b80f7f6b47ce937022d9ac67166a84ccf3801f

SHA512
41ecdc302304cf58a0311a7ad75812ca7797cf31b40fa1666dd18099d2ce7d0cc6d69a47783226450ba65f8fcaa514e9874c8f9248bff6809e376f5fc9522c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
fb8fac7874f135d6ef449c3b238f223c

SHA1
aa415c26507314183e6293587196e60781966e1d

SHA256
fa1e2432ebaa35a0adec25b2a9913ffa2dac19810b83c324c8c0cbd4b099f8d7

SHA512
287b52f849aa0b6ecbe51620b137c899d4f63854a3daa461433c507a310263597537c37f6d0e68c90b42d8b39bcb3b2ea9a0ec0fefb0a6abaced2ef1d0d56cad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
9bdff4cfcf988f42da48636ef53d5e77

SHA1
5ab0140f275358f8951155fe9f37edcb4dad647c

SHA256
2db47a2c616c9b0ba5727b5f53ec040ef0d94cb1ae43f9fc1047003f1f8154d8

SHA512
707aaa52bda0d5e69a2c834e29686c3797ce00a63102ce956136645288da7d391a51af3c6b25cb0b39bc8b68c5e24451dfd7c1fdb44f1c25eb685957f79132fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
6b0e4f94b0c5d21918d0bca50cc07fbe

SHA1
c149c08c09c406eaf9cbece0656e3b59a954e727

SHA256
204ed4050ae3db148a615c2f96ae4362f2a7e08f376bb0b54570271240c13d58

SHA512
bee9a7bf334925f0dc5c29164470352fa8d3edb0607724a8f1510712fd88beddbdfc74a92e343d7a54fb858208068d69750aee0c3d759b109187981c3cdce554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
25d8e2f85eb39a4becb2f34c513a1525

SHA1
816aa7dfc62476903432f654e753f7b659d5b769

SHA256
d41fefbf75fa1a2925a86a3e998aee3b4ad8784b3d2fa1b17f9c8e6d377b9caf

SHA512
43154ff1fd575c8cad7b18f2470383aca8ed03b86993dda353923ae32a42afabdabe8d92a934724cbbf75a9fb9bcd15c206718fef617e0fa9ac74654c9c72b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe58244c.TMP

Filesize
2KB

MD5
d8d04d3c32fca07920f6f26845d6c406

SHA1
d52f37da8980d4f1007d87cd2d33fe034775206a

SHA256
674c2fa44c88fa0dbaf42d1663be511efcef4797459af3a1ced2a0a6ce5821be

SHA512
539501485f3dab507a5abc602a16daf7c4b9e242ba39ec20d9d59f6763d7930e7365cf4f0ec6e159a29548bb368012918cd5d629f3346caec7b97892147d1003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
561c7185a9f5cf70d39851dadff1df2c

SHA1
bd65baeb7429a87069bf7918bc295b51de7daef4

SHA256
089645ff049c633bfbe7e03d9cc618f7849edc6426fd49debf9f5cb091a69e62

SHA512
1b0007560b82dd6adac2d2559fa8d6fb04176ab9af478915c962ed8e0d3e17ca5d9a176c3ab40892fb2e44807a071313422516b3f6938edcfbceae6a817b837a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
25KB

MD5
58df9530d1ae86472675f53be7976bc9

SHA1
b57630b7680869cfcb1918a5350eea8f49c0bb5e

SHA256
6613183fa718760645dc749d05d2303a5999afb56309ed5c50e37cfe10c46431

SHA512
76c951d6199b5034423789fee00abc3ccd1cd4e9517961f738c86dce94b19f4b308b036243f81688bb67d86be187290c3001fd9e8e4fd6db7eb155ec7fec354d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\06b8c856-d707-4ad1-a57c-f33ee0f9ce11.tmp

Filesize
22KB

MD5
dfc155ff512aa487390774d88bb78e20

SHA1
2104cf07bb3e576c4c7000aec6d3c6d33112644f

SHA256
30158682b65e7ba218476374cafa6c702a0302571b0bad6bc77b4ce42b455af0

SHA512
2dedeadc5a46864161a18903d35b7931323dc89ab644adca818ee55091c472d9fe405ef37586bc44872eb88be137baa8ad98c0d379847c936539152d59f5780d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
0345a03a0b6885ecc47ed4b8790eea64

SHA1
83ba740e2090039d98f93565b42688ffb03b0226

SHA256
aacb54f5c04cba47be1deff65f03d4ece206016a649578f529a3db20dacd823a

SHA512
01e9922360f25a30c89ed78d7f4ffd86c3db1d63febd47675198f22fae6aa670fb3e21295536b5b3688e0524263fde2038a5496e41e0f0c1ac7150ea3a2162e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
329b8eb70621621b2e0cd339cee4c50a

SHA1
7da8ce5021774a91eb103d17254be52c65cbb01e

SHA256
0b429ef0f87581f73545abaa88e0bb74c94f1a38e1e5000158251742923d0e65

SHA512
f7a92a6c08285d1f7b62904d7c3f62dec4c245ac0e25aad8c9a39247cc7f4a3caf2186fc4507ca07a04c6499a32ea1ebeb2a38fdfaa3d3e2087a202f8d33be5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18345.18340.4\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8923b9d13d8cda16017c4df4687a114c

SHA1
05d6ddfe9dabd8d1042657f22eb973b98cca8e59

SHA256
90f4e87ef8631e455dd0bb6fd63c414d3f233a742da2dd77357a665425aac097

SHA512
dd8ec87db4ca6aa1b9e7a6e4c70ec217cae19cf98e1cb615fd5a345dc128a06a5d0d409006a4a376c7a17fa7984d23cc0760b1f46e631e29d3e471cdfbcd3486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
5ac9f7ae1d16763cfcde4953c701daf6

SHA1
3816762162a213b19444590ad47b3d65499a83f0

SHA256
deb58704b1c8f301189b99945e521621933751e28296aeb803967cb035807a03

SHA512
e4f432ad8df64eb5c2ede4d6457ee29509d42f655fa05bbaa7db83e62fdd87b46469020a08a445fcc657c1ab6ca7f8c5d10be3ac7f39f263d1f5307ecdd21ec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
8948e19bd9fe3bd9e58280731e7bdbba

SHA1
cb0c85d7e7e6154031730d33d09e15a09e804127

SHA256
7569beb92672b7bb01652e0b4b149e06dddd7707df047ba3665747b854f136a2

SHA512
b0eae68cbaf3a6e81e80aa930fa2a6775b121224015e2f69a03aa5a24736c65b18029b592133b3759309e77e128a94f1b1c3b984661ea4512efa28648c488fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
59edde02a5746666de6523764838ad6d

SHA1
fdddbdf48ac8ebad59b3fe10a95a887e428a1a1d

SHA256
85a5a4b8e31660b54d8459c81d35c0a60bc172749eba585bc0bafd492c60cea9

SHA512
8500de058062030261edba9bb5bf2514ad85fe580f905ac884b7fd5616b7ba92216241268471a9bcb6ed6f76aa9292b44f55c3780e010d2bc14fea0d32063c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
890c99df055bca0a8c2c40ac7f8fd991

SHA1
3cb112862e35703a6558b95e5fa750cd20eddfdf

SHA256
55b8f3cc3d8d67659a6aa4f77ee77c13e9257d327b35f1abc88cfc49f5c7b81b

SHA512
37cb4e68839f7351e6a460295efda2018233b9337a1b7671b131c11d526b5d4bcf4c059a66045382130a6c47e4649e1883e25f77d6cfad193746a86c4cdca3f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
638ca5426b6b6d539bead88bee1358e0

SHA1
8b3b2c7ca11cfb445a63f2ef38f17a458080a373

SHA256
127de33571c42ba9bad110d24254ca822e51feca2594cb9ac1effee4779afeeb

SHA512
f750239f89ba8fd03e04866926f8704ca35ad369ecd8035026a89d296f27a6ed5972b40ab1dc40182e6955c98b1eebde041688e08f6787b46d3057f70f43fd95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe586fbc.TMP

Filesize
392B

MD5
a442cd77ba2b616ae8315d7133ac9194

SHA1
75ca3dd5da28b1e2dd740374f2bbff25e8e2fa2d

SHA256
c647aa21b6ab882ca377ba09f52b74fc66b5f9922b9e9c8f52f002d84edba0d6

SHA512
1a9b8b282ce4e5c7b10e36aeddd79c0c7b83cf3ae433e2184e99b72a806fd7b6bb6d2696e5d4bbbebf97131a85d28a19e3eb44871080aaef127a1ec8d1724a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.23.1\typosquatting_list.pb

Filesize
638KB

MD5
6f17b5112d39e352edf896dbdbebe1e3

SHA1
de5baac67eaaff91682e5c1d119ddf15109d2281

SHA256
c9c1879905a2d980879e4b56290bff015574d6acea6b1c9091b69ec0bc90f082

SHA512
bd2afaea9c10c808ecdce4ddea5bab390119c03f8bb39003cc1d36dce4c1c54d11c0061ee72af8fe71c0c630971ac54f50cc8eac80f03cf50b4ac114c8871e5f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pm60e3dc.default-release\activity-stream.discovery_stream.json

Filesize
16KB

MD5
dbaf2bf4df5e2de67e910aafd4f111fe

SHA1
bc3c63bd3407219e1b045be52afd6cefc9d1f761

SHA256
4201a19577ca2df72987a0e72f30a488ce0f46409cf9134be010f35007d28ee8

SHA512
fc93975f28f9d42ed2391b8beb42dd209a50c1289d5d1701a775b003727ca00f5b8e984053f842c05692bb199a3277984f1d55d8d03f4738b3ad43e0ed7d8e54

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pm60e3dc.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
685428a16f741e802a5af268d6180ac8

SHA1
1dcc09a2145bb938dd5736145e596665205c8df8

SHA256
d7e812d76305283c5bf34b9c0411a52abcf8cffd84b79c8a6044f23d932c0697

SHA512
a4473146c6e99254fcc27cd530370f76785825f4daf05fd75605922ac67878e561f61e655a425d1096b37f0ed1a4182391cfa06954ff27920d5ca0a4b7724538

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\AlternateServices.bin

Filesize
6KB

MD5
965ccf227bd2f9b156b72fb5a50d58e0

SHA1
ecce0303807638d7c64342a48f43e701df554423

SHA256
c7b4047e990c9192eb026ef8309c09829b19fe106340637079c4fd0d655d7716

SHA512
a3d819b428e4158edacaece0a0d38b1bf85fdbf14ed4b5972f03338e84852d528d005ecc5ffacd247195db7ca23c8c7d06f71fc7364946e7c3f01b2ac88f0eeb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
b82a22b1ebbc0e8a2767e60006b9ae39

SHA1
34308af0640fd0b6c68ea780a125a6ee40382cd1

SHA256
a268639c36e631eb1b39abaef54393e7c6a842d9149ed3416dd20ecbedec77b7

SHA512
1e3e2cb7ebdab570f3a483002482384bce46d3cbba033cf4e74b8160573773a155e1ab4d01d17207078476ea1e8904c3e9c82ccba9501db251f88dcdc5eab757

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
71KB

MD5
480adc5d9187a19affea5f3ef6d2c7e3

SHA1
74d97ba2ceed0c4cc5fe865d81f91defef12b925

SHA256
661a2f35f5d2ce74f006bc88e6864a13a0e31c908f56015fd843ccb5a85fea08

SHA512
05f09eee45cee5a2071c0f4c84f419a146450a4f809e091e425f65ddbd2392df8068e9af08ab3be19d1361aca3d2c853abd5ff5fcc7e268ad65a69f5535c4a30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
58d8cad32653120856541b117cf716ca

SHA1
e891b5421d7f5a47ab98ef15b2299b3689e44df4

SHA256
6e03ad387a8ee72f27e6164588585b2da608992cd7259faa4230b030e25706b3

SHA512
293e7d077e4e3d3c3e0fd53d88361b9dbdb07aa179a97f0b856fb430f00e4bb7a9d3b7aa7a64181d6e4db3c155a5661473d7c414a07a0e6d60bc9b5fa843c00c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
4df9c3edade14a76de0d3ef7e24cac77

SHA1
d21f14ba160bd0356ed332d20e130b068e7a4e22

SHA256
d450134b420d7784a27a6bd067304bf3da3d131dfcfa460c8de862d765bfc7a0

SHA512
d3ee2ed2f4f63650ea4a2b3e837ad527663a1a2b2c1c380be060f084d50df6830ff7f6561b792be32a4c3dd3f31750e9a6e872a2b7052cd83dca64bfc09c5687

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\182dc757-f995-4433-8f23-6e6a674d3207

Filesize
2KB

MD5
fc3983ac195e6c8c870755e6c0ec7213

SHA1
ff403c88e98cf23bffe54f47caee2a2e045a23ca

SHA256
b0f16919220a9997a76251a687c78180e36a21719613a42f499b19d828e86ac9

SHA512
650e562aec192c992c86cab7a6c8b1aeebbaa3754e665fd5045ac8eb6c789bb516b0ab52deea9f5a5a6e0c5e7651b188ff278757cf65182975c003c821ba1d83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\5b8e3bcd-1d95-42b8-8443-eb78a0443192

Filesize
886B

MD5
be96c00dbcb251d7b8f153be0ddebc95

SHA1
6ce45da6701682618584af8547b6645d24bef85b

SHA256
296d24c81318c1c0368f039c131f6cd17c568feedc58b3c0b592bf883cb98ca4

SHA512
4c5fc97df763484d6cc5dec1b3f42f12b70b11c2eaee36c15e96695ef095b887ba00035806612c05e391f55690f89f848ed139aa0743f6548c24b33014a4e840

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\6dab2182-1a94-43bf-8a37-460260c8bc9c

Filesize
235B

MD5
031d9ca68bd6ae35ba885eab97c0130a

SHA1
b88eba4b65e6d59e5f6e60c846146d7a853f3280

SHA256
71ba77987da731ffe7189b2f1270c859782622f4aad2929f6bd83768689df9b7

SHA512
b54cc52874f8b459743dfc62f6571f0ee2736e2ef39db1de8896d2ccf82601c2b3971d64618d066b48ca9b6e809d7584982921d477d57838059b2e019541756d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\700c9c16-98ec-47c2-b5b8-88fc69c4788e

Filesize
16KB

MD5
c5734b40b9803b3d1c8c2694a582efd6

SHA1
9baa3d9df72ed7a0652f4fce7ab0462548bdd85d

SHA256
c1708de14d542d998b734560cae3210bb32fb00430a65007c0f677e2d3348777

SHA512
7c6dcf19081c33c83066c893fb043cc990a284fbb9caf51f137fd1f08c10e28cf1a878a5a9cf1dce7b8d4f0135b1777ff0c8dd02ac17b73217957c1ef6cffc97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\dec37f87-1dad-4ad1-8087-f452f3a40b59

Filesize
235B

MD5
26f1016eacbd6b90d2d389850a158253

SHA1
a8c37b9a12cdc4892f26ea3f7c11fe072082eda2

SHA256
e8265ef2d8d0f79804ef5b9f92e377b19231b07f93f9f2d2fa06c9085be0cb96

SHA512
c91bb0fc169d79067a8222c92751d3167beaea0ccc996c54136f802807b090e93031fb755033f8e6270086dedaaee8e8d972d720bc9500beaa884d81e8d81c80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\edc336a9-3b68-4918-b71b-27069efb7935

Filesize
883B

MD5
315cec76fff1b77161eadbd704437cca

SHA1
55f27d78c40c026fb9d02efd1645fa83ae87647e

SHA256
12ae4526715c705effed5dc1a2cbf338568754915d05a4fff9a4356220e0f270

SHA512
059926bbb517d79b431309cacdf2f27600e3f758addd60a4c880695d04f843a008041a52a0fb0b9ed6437334658a51aca8294a433985670761b018fe24adede8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs-1.js

Filesize
8KB

MD5
9266f6f3300dbe5e1ada0ca2aa9c355d

SHA1
922149f1c0fd3bb08297fb80d2b1db345a60e147

SHA256
04330874df6e06c5b6bb3214dcb91d486333fa3455287ddee91d972212283a72

SHA512
ba001bb24014cae625f15515371bae3fae74787c38ecf895ca277ece7daba694ea231a31963e6010228f4dce0e39481b56ac27623c11ab0457748906d73bfa22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs.js

Filesize
6KB

MD5
51c4db9d012b63bb0e6ff9d739b9186b

SHA1
db9cfd1343eeed9b5e01db5d0ae104e54182a737

SHA256
87f8768c623f9d9cdf837c2cad327c100080de8daef83f062b12f783f34f6431

SHA512
28a378424b2ae2fea1fdd2f48f94bccc7bbfd6634f6371fed55eaafce7f8593358788590a4c6cd277ce14b4a773e47cf1aefb0ffb84af045d8617845d90d8247

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs.js

Filesize
7KB

MD5
aa22aab2ce1899b48729f58f8b5e9bef

SHA1
d5d8bc47db9ca7cefe330f666ab1d326c02d9fc0

SHA256
f6440b630f2fd7712b0be67029ad3dca54744800d291706f1ee4ffa896d071c9

SHA512
945c42108412987980a07bff2d56a748f9a98af0a502cbd89ef630d81649f8875772f7d2f144c8ab8921e0c8d0c83345b4d0d3281ee43bbc2a54df5537a6303b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs.js

Filesize
7KB

MD5
7ecd93db92a7b23c1e388585664dca75

SHA1
d282e587176595c8d1d4ede139fcfad4102d3d45

SHA256
8776a34125bf592fcead4e628abce6af7fb8209c3a42760d17b2d89f4b249ca5

SHA512
afb8f5200c3038123d1b486e6fc2c1ce53c647cd6184c5aacc334a3d03771b6a728b5eef6f5376eef8632647b2a66b668f7057c0c207ed0b7f6f89f2c4270942

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs.js

Filesize
6KB

MD5
5cfd3008182a67de4acfc33347c2c6fd

SHA1
9c1839384b76e233b9f309917bf6fdf266e28391

SHA256
5a1c9228feea6a5ed0ada30260150cc686b983a1bf7795fe5038a23d3153cb7a

SHA512
ce26502b258434ca313102705efecbc28cfe80dba7007e0201bb0efd7b6f939b653c12606f4edeb910659cf9e359ed81668ccff91aa195097a83adb5eee9fe7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs.js

Filesize
6KB

MD5
79cd83172f27797d96cb861a6c05c9a8

SHA1
0084892c2b0dd96e4bae74cd20daa6d7eaf46398

SHA256
be692a43ebec54aa73f895d0a12a5c752caca175feb9c650beb96543799627ed

SHA512
585a5b9dc4b98037f8d4a92697e8a3fc834a817f8c0e40200b9a2593503512e9ee1c6989a86f21a6fbb7189a306e3e31591ad3cfd33a42677caf7fb7ed9c545d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
80d16fd0849cb0712dd2278046b32a92

SHA1
fc4da0f9356241c411cfba869337438e3cc13598

SHA256
a7c34e5bbdde51cb5d02e5d4cb4f44e0c57e6bac7e84650f23bd08b6a2699c42

SHA512
04a65cc426243f831ecf5ab5985959c4fefe93623bfe4a9be5d902d3fd431dd2b9757a29718c1bc58634b70c871ffe709ca604d9bfa49bbcd001b1ba66c15f1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
ca2c889dfa0d7f20cacf8f70d2c59884

SHA1
47341c5a7cb21bc714a78f9c1536820e8cbcb1a1

SHA256
d223326cd7ecb806c3fa997291f5e1876e728a334f92ce4fbc963e4d11d984b9

SHA512
9482d8df920d4e1369ed3723cc48f31d2c41f08610e760645623cac8209b328fb51d45d651269c7682568f779a23fb19ca21e036d504e94f7f1fa8fe3e1cb780

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.8MB

MD5
0c819b68129631b2f9035784eed27c4f

SHA1
4ab50379331ce00e72dd43f19d3038bfc07272f5

SHA256
3f272cbf40d5ddbb6210ee567dc9a01b87a7c9ab60439e7b2c1975e5cf05e54e

SHA512
097b957bca0313131106c2e1a57576babfeb9877fd4192c517a2d87eb56e6b45623d9391ee880e7a11a9f0cd6c3280b48ef76cb9f003eec75cb3b526acf5bd6c

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\Custom.dll

Filesize
2.1MB

MD5
782156fe045e36aa35a1089ed5521b08

SHA1
fb8a0e981a63dcf82fa591ba752df78f71dabb04

SHA256
8a529cd02209d5677eab00abc9f0b89f6d5f32b25ed241811afc9e8ac030ea5e

SHA512
74f1c4eb692647fb5a633a9ad7b18940dc9832b41ed7d9b553769b066027da12026f0ad379868b65067cfb055a8b5070ef1d4e17272d1436d53e87d1176b12ec

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\EmbedRuntime\MonoPosixHelper.dll

Filesize
595KB

MD5
284d6215de59574ab47cf219331d5271

SHA1
530da0a2f650e07e9fd1343044a168a9a4ef7825

SHA256
076aef59235bcc9c3b55f618f5dc6b9f7f25087e2899cd3908e9f9c13cb9224a

SHA512
8e2c9376f96f1ada7e5b7261f15169e3801f0ff0c7372d76739407114574cec5c127d85753c721c83ec7c8386efda3d770a91429d817c7138d980aeafbca6255

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll

Filesize
7.5MB

MD5
7b2d0b872c6ec70b6000afb83331e350

SHA1
ece9d4cb1500f03a3a115fe8f2a288be582de58a

SHA256
56bb92ebec6eb09f8fa03f76edb98c6130fd62799d0b39106ba797ad6f782ccf

SHA512
a85bb0531c9016098b4abb9bf8ac089a182be9ef6bc520467cd7f52f672a131b1f92ba2e86903a1c3d3429946d2e1048de37f14134ccfd4f78945d5fbccebd2a

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\etc\mono\2.0\machine.config

Filesize
28KB

MD5
5b791b8493c4e9a55d8c5ee522ce1cef

SHA1
3fbcec786ac4b6e81b6d2f2ab288cf67dd6760f4

SHA256
e91782a27fa39fc6c1d6ee8b08529f5d35052310d0006034b878eb04b8f2af30

SHA512
40c5d52de86c42512cc5c4863d14c1a374e95057de73bef11f7cb60f5445994ff5b979099f721e71853569dd5efbc373efba22107fca4a1e9a479589d4a10386

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\etc\mono\2.0\settings.map

Filesize
2KB

MD5
22c818a23169e12bd3c8587b6394c731

SHA1
dd2be2dbccd34736719301aee92429d4258ea5a0

SHA256
49c6160f9d54af4270a3b4e997fc4a8301f79b9e2070118fa46ddbcbbc44f9a2

SHA512
c1352e817e01277413a1790a94a4f979dc1b8333874fef28d735441c034c97bf8ce501fd9cd04c47d25541a0c1d54fcd4dd3bee9ac3e8fbde83ada9a1d2662d7

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\etc\mono\browscap.ini

Filesize
304KB

MD5
378be809df7d15aac75a175693e25fbb

SHA1
2d5454e161de8a5b65910f27bd70d9d0ad8fa476

SHA256
4ddd50f31fb968f30bedefc253a46dc3f2890192d05cdaa9e0a64a056eee807e

SHA512
d0d181e806cbd2c016eb0a8786f7d9db877463eaac0195db4e891be111c9ed87491a1abcfa0d9ed7c2743e004e1f4a3f4789333d0b535e63358c672ae833c363

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\MonoBleedingEdge\etc\mono\config

Filesize
3KB

MD5
67611b783439b35abfe05a97413bba46

SHA1
52795ffda8b88701793acc05e87897bdba99a633

SHA256
5776169973a26a387b8b3e5c0f2301a7ab9a6dd7c7d3efa22a96abc47fbf8662

SHA512
046dc9fe5cb46bea23668eb0d9742d32ddad30a6ee85c20839b68cb022f9e2ae6a38b87b9e267edb152b29420e3d169348cd9d3bcd4a7c7d82b3d50ac24b4748

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\OnlineFix.ini

Filesize
738B

MD5
2f5c0d3bf1fbac83c22c9c90281d1570

SHA1
8ec76b66740f7da489d0fe3c07b9cba5efa65c7e

SHA256
e64ea8c96ffb67a63e25b0390010ee55e850dacb5dda2a420147205d2cd1dece

SHA512
04a13052622057fdde0334b184add2cf9a0515e42747d463db22bc8858e1e367bbca0e3a0096d5726b187193016696a00e136bafdf4b86c6dac3c0080735ac51

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\OnlineFix.url

Filesize
46B

MD5
59bf167dc52a52f6e45f418f8c73ffa1

SHA1
fa006950a6a971e89d4a1c23070d458a30463999

SHA256
3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e

SHA512
00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\OnlineFix64.dll

Filesize
11.3MB

MD5
1dc3a9fd539541dfd04ba19b0e65a1bb

SHA1
2a0ab8d86a16546ee040d866dc8e7acc9888a12c

SHA256
316eba6541ee72195e949c04597a37309869f683b96561f558c231d796974b10

SHA512
0110d961a7d4ac14f075fdabb1c5366c73c76397b3b3f34df72991dd2cf14ced18a0293d49f48b2bb1eaac5206945aa4e7acac48fcd0c7380cc13a14558cfe50

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\SteamOverlay64.dll

Filesize
114KB

MD5
0a5429b888c75f6525e1100e32dd2b69

SHA1
8ae224580aa0838a7b1570c79d4d8f27a1b46d19

SHA256
f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df

SHA512
5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\UnityCrashHandler64.exe

Filesize
1.1MB

MD5
9fbd5305c2c2fc8458c9774d3dd815e4

SHA1
4bb449696116301c686f51135699302d62770a0c

SHA256
670e0fe0d0b8e5d42109b0b4dec606c6f8252b8c98af807e36b40117c07f269f

SHA512
2ea7aecd995bbb102d03766ffc4a5419a784fc69cdee263afebcde70d2db795f88b9c39f591c0b1fcee7ab52334766b50e8827204b39b9f9cc497dc6f854684e

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\UnityPlayer.dll

Filesize
29.5MB

MD5
b33d91200048e718c7207367f49d60fe

SHA1
cc95b2632f33ec9a533852df3402c58ef3faf0c1

SHA256
4b34672318371b54be9d89c9482a91ab3d26ae5d209935b8ad5919e00ec4f1d9

SHA512
edc94d2deab48e3aa57566904ebafc7082d63f14901c36067783deb10538e74124cdbadc72d40ec3c9db09c9e1cd27b18bdfd1969545e2607d34d5d12ec1d220

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\dlllist.txt

Filesize
139B

MD5
7dd443df8404c42b7db22908ad5132b9

SHA1
302f827ca20c8b4c7d71a466907c2421661429e1

SHA256
4b93c54c0d588197645352d11ebc066f6f8150a2826ed04c1525ae865ce00153

SHA512
a5be18614385400aadc57c2bd09760ac58a367b3bd1643b2e4aaa2db5426e5fe806a5428568fadc896243f65f7391c12f71b83475ed6db9ad175de6c3ab9f530

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\R.E.P.O\winmm.dll

Filesize
512KB

MD5
e59aac558d9f9c5d1312ac24d09c51d5

SHA1
2f11c4b00f5f92d4466348f9501aa657c9bf6fa7

SHA256
ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3

SHA512
1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\Read_Me_Instructions.txt

Filesize
1KB

MD5
a62b5c2e28d534162b6fe9ab6795aeba

SHA1
12a94a8d49108b4d6072a838ba5977ca686fefc9

SHA256
1a3623d7653b8b056d4c471412445ca22bc9e8708f6f64d062f4742cd654f570

SHA512
67c22fac03db4fe2e23ffee90489c573849a1e3e896c9573492d1de37579fe6839f6c433181a15de43d4dd0d6b95e8cbced6661d5c6890263b8f295a57da0ff7

Download Submit
C:\Users\Admin\Documents\REPO-SteamRIP.com\REPO-SteamRIP.com\STEAMRIP » Free Pre-installed Steam Games.url

Filesize
219B

MD5
bb3af69a2e7704bc210886920ff7681f

SHA1
42fa4a09d62cce1c0d70a63e0816135fd6b410e3

SHA256
4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76

SHA512
4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.JgSND32i.exe.part

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier

Filesize
579B

MD5
6a81ca6755c1b273ba20eeee7f2c772f

SHA1
a2094e7c659821864fa4154bd6c00db78e79f524

SHA256
623f808bff3d17e087e4c1ccc256b31e038ae018e52fbaab44d28d6020c6fcf7

SHA512
3c53d6018dd67c1bee991db1afd977c77ce28e403a5bfc346c38f46ed7433a2fb2b098fa4ba78f6d9a50cdee85a6f5c92cb63ee6b373bea57ca3ecce541c6329

Download Submit
C:\Users\Admin\Downloads\REPO-SteamRIP.com.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1204732387\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1204732387\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1215555644\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1760231394\manifest.json

Filesize
118B

MD5
d01e1d5ebdcf61086feac214e695849e

SHA1
a3227b3b93e537b420a3171f3bf0e3e14a4916ba

SHA256
c83077d307dd13be31ea3ca5ebb0d3e2f20f0943255d34414f02079bce634f8d

SHA512
a98b8a46871a45bc9df28b1b8bc7b45ba40586aa097a1e9a93c25a1697c97e0e8e25625eace1996955e79c85d8faea5560436018e6c80174d0c2df5d9624b1c9

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_717745580\manifest.json

Filesize
121B

MD5
7122b7d5c202d095d0f4b235e8a73ca5

SHA1
0cca47528a8b4fb3e3d9511d42f06dc8443317c2

SHA256
93b603f06d510b23b95b3cacd08c3f74c19dc1f36cd3848b56943f069c65e975

SHA512
ad6fba6e0710cc26149dcf7f63143891aad4ebba0cc45670d8885fade19dc1a50b542a15b10a7604b6b1be4b8e50fcd5514f40c59b83cc68bd10a15ab2a93c1a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_91217386\manifest.json

Filesize
145B

MD5
ba1024f290acf020c4a6130c00ed59e0

SHA1
01274f0befca8b6f4b5af1decc4ade0204761986

SHA256
551b8c76c19c654049d2d8043a79b8edb3c03e1b695cabf76b4076ed4921ae28

SHA512
e55b871dd3500f30d639089cc42a4edc3bd4d26d2c4fd151322a363fd8edec82d5345751953f9b581e40f22b6a8976faa0ea7ec9fd286f73f747120c87ea7157

Download Submit