Analysis Overview
SHA256
77f155b8f6e0aa230e69aab203d4cf3f2d4323a30c4e876bc9ca9f0cda11ae21
Threat Level: Known bad
The file hookfor60.rar was found to be: Known bad.
Malicious Activity Summary
Stealerium
Stealerium family
Uses browser remote debugging
Executes dropped EXE
Checks computer location settings
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Event Triggered Execution: Netsh Helper DLL
Enumerates physical storage devices
Browser Information Discovery
System Network Configuration Discovery: Wi-Fi Discovery
Modifies data under HKEY_USERS
Suspicious behavior: GetForegroundWindowSpam
Modifies registry class
Enumerates system info in registry
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Checks SCSI registry key(s)
Suspicious use of SendNotifyMessage
outlook_win_path
outlook_office_path
Checks processor information in registry
Suspicious use of FindShellTrayWindow
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-03-21 17:45
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2025-03-21 17:45
Reported
2025-03-21 18:01
Platform
win7-20241010-en
Max time kernel
840s
Max time network
846s
Command Line
Signatures
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeRestorePrivilege | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: 35 | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Processes
C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\hookfor60.rar"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2025-03-21 17:45
Reported
2025-03-21 17:47
Platform
win10v2004-20250314-en
Max time kernel
60s
Max time network
61s
Command Line
Signatures
Stealerium
Stealerium family
Uses browser remote debugging
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | api.gofile.io | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | api.gofile.io | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | icanhazip.com | N/A | N/A |
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 | C:\Windows\system32\taskmgr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName | C:\Windows\system32\taskmgr.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870527984078511" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{14CF1427-F633-4AD4-AAB6-01FBC9B5EE15} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\Desktop\hookfor60.exe | N/A |
Processes
C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\hookfor60.rar"
C:\Users\Admin\Desktop\hookfor60.exe
"C:\Users\Admin\Desktop\hookfor60.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa2a39dcf8,0x7ffa2a39dd04,0x7ffa2a39dd10
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=1300,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2032 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2020,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2012 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2288,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2284 /prefetch:8
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3156 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3228 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4188,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=4184 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4556,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=4536 /prefetch:1
C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\findstr.exe
findstr All
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5192,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5184 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5420,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5416 /prefetch:8
C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging --edge-skip-compat-layer-relaunch
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x208,0x238,0x23c,0x210,0x250,0x7ffa2a15f208,0x7ffa2a15f214,0x7ffa2a15f220
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2440,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2436 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2456,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2448 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2388,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2380 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3476 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3484 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5460,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5456 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5512,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5508 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5940,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5936 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6044,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=6056 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6044,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=6056 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.179.228:443 | www.google.com | tcp |
| GB | 142.250.179.228:443 | www.google.com | tcp |
| GB | 142.250.179.228:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | ogads-pa.googleapis.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.179.234:443 | ogads-pa.googleapis.com | udp |
| GB | 142.250.179.238:443 | apis.google.com | udp |
| GB | 142.250.179.234:443 | ogads-pa.googleapis.com | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 216.58.212.206:443 | play.google.com | udp |
| GB | 216.58.212.206:443 | play.google.com | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.200.46:443 | clients2.google.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | icanhazip.com | udp |
| US | 104.16.184.241:80 | icanhazip.com | tcp |
| US | 8.8.8.8:53 | edge.microsoft.com | udp |
| US | 8.8.8.8:53 | edge.microsoft.com | udp |
| US | 8.8.8.8:53 | ntp.msn.com | udp |
| US | 8.8.8.8:53 | ntp.msn.com | udp |
| US | 8.8.8.8:53 | edge.microsoft.com | udp |
| US | 8.8.8.8:53 | edge.microsoft.com | udp |
| US | 204.79.197.203:443 | ntp.msn.com | tcp |
| US | 150.171.27.11:80 | edge.microsoft.com | tcp |
| US | 150.171.28.11:443 | edge.microsoft.com | tcp |
| US | 8.8.8.8:53 | api.edgeoffer.microsoft.com | udp |
| US | 8.8.8.8:53 | api.edgeoffer.microsoft.com | udp |
| US | 8.8.8.8:53 | copilot.microsoft.com | udp |
| US | 8.8.8.8:53 | copilot.microsoft.com | udp |
| IE | 94.245.104.56:443 | api.edgeoffer.microsoft.com | tcp |
| GB | 95.100.153.183:443 | copilot.microsoft.com | tcp |
| IE | 94.245.104.56:443 | api.edgeoffer.microsoft.com | tcp |
| GB | 95.100.153.183:443 | copilot.microsoft.com | tcp |
| US | 204.79.197.203:443 | ntp.msn.com | tcp |
| US | 204.79.197.203:443 | ntp.msn.com | tcp |
| IE | 94.245.104.56:443 | api.edgeoffer.microsoft.com | tcp |
| US | 8.8.8.8:53 | img-s-msn-com.akamaized.net | udp |
| US | 8.8.8.8:53 | img-s-msn-com.akamaized.net | udp |
| US | 8.8.8.8:53 | sb.scorecardresearch.com | udp |
| US | 8.8.8.8:53 | sb.scorecardresearch.com | udp |
| US | 8.8.8.8:53 | th.bing.com | udp |
| US | 8.8.8.8:53 | th.bing.com | udp |
| US | 8.8.8.8:53 | c.msn.com | udp |
| US | 8.8.8.8:53 | c.msn.com | udp |
| US | 8.8.8.8:53 | assets.msn.com | udp |
| US | 8.8.8.8:53 | assets.msn.com | udp |
| US | 8.8.8.8:53 | c.bing.com | udp |
| US | 8.8.8.8:53 | c.bing.com | udp |
| IE | 13.74.129.1:443 | c.msn.com | tcp |
| US | 150.171.28.10:443 | c.bing.com | tcp |
| GB | 2.18.190.175:443 | assets.msn.com | tcp |
| GB | 2.18.190.175:443 | assets.msn.com | tcp |
| GB | 2.18.190.175:443 | assets.msn.com | tcp |
| GB | 95.100.153.157:443 | www.bing.com | tcp |
| GB | 95.100.153.143:443 | www.bing.com | tcp |
| PT | 3.160.132.128:443 | sb.scorecardresearch.com | tcp |
| US | 2.16.55.202:443 | img-s-msn-com.akamaized.net | tcp |
| GB | 2.18.190.175:443 | assets.msn.com | udp |
| US | 8.8.8.8:53 | browser.events.data.msn.com | udp |
| US | 8.8.8.8:53 | browser.events.data.msn.com | udp |
| US | 13.89.178.26:443 | browser.events.data.msn.com | tcp |
| GB | 2.18.190.175:443 | assets.msn.com | udp |
| US | 13.89.178.26:443 | browser.events.data.msn.com | tcp |
| US | 150.171.28.10:443 | c.bing.com | tcp |
| US | 2.16.55.202:443 | img-s-msn-com.akamaized.net | tcp |
| US | 2.16.55.202:443 | img-s-msn-com.akamaized.net | tcp |
| US | 2.16.55.202:443 | img-s-msn-com.akamaized.net | tcp |
| US | 2.16.55.202:443 | img-s-msn-com.akamaized.net | tcp |
| US | 2.16.55.202:443 | img-s-msn-com.akamaized.net | tcp |
| US | 2.16.55.202:443 | img-s-msn-com.akamaized.net | udp |
| GB | 2.18.190.175:443 | assets.msn.com | udp |
| IE | 13.74.129.1:443 | c.msn.com | tcp |
| US | 8.8.8.8:53 | srtb.msn.com | udp |
| US | 8.8.8.8:53 | srtb.msn.com | udp |
| US | 204.79.197.203:443 | srtb.msn.com | tcp |
| US | 204.79.197.203:443 | srtb.msn.com | tcp |
| GB | 95.100.153.143:443 | www.bing.com | tcp |
| GB | 95.100.153.143:443 | www.bing.com | tcp |
| GB | 95.100.153.143:443 | www.bing.com | tcp |
| GB | 95.100.153.143:443 | www.bing.com | tcp |
| GB | 95.100.153.157:443 | www.bing.com | udp |
| US | 204.79.197.203:443 | srtb.msn.com | tcp |
| US | 8.8.8.8:53 | r.bing.com | udp |
| US | 8.8.8.8:53 | r.bing.com | udp |
| US | 8.8.8.8:53 | r.msftstatic.com | udp |
| US | 8.8.8.8:53 | r.msftstatic.com | udp |
| US | 204.79.197.219:443 | r.msftstatic.com | tcp |
| GB | 95.100.153.131:443 | r.bing.com | tcp |
| GB | 95.100.153.131:443 | r.bing.com | tcp |
| US | 204.79.197.219:443 | r.msftstatic.com | tcp |
| GB | 2.18.190.175:443 | assets.msn.com | udp |
| US | 8.8.8.8:53 | ecn.dev.virtualearth.net | udp |
| US | 8.8.8.8:53 | ecn.dev.virtualearth.net | udp |
| GB | 23.192.24.182:443 | ecn.dev.virtualearth.net | tcp |
| US | 8.8.8.8:53 | evcs-ocsp.ws.symantec.com | udp |
| GB | 104.78.173.45:80 | evcs-ocsp.ws.symantec.com | tcp |
| US | 8.8.8.8:53 | evcs-crl.ws.symantec.com | udp |
| GB | 104.78.173.45:80 | evcs-crl.ws.symantec.com | tcp |
| GB | 95.100.153.131:443 | www.bing.com | tcp |
| US | 104.16.184.241:80 | icanhazip.com | tcp |
| N/A | 127.0.0.1:9222 | tcp | |
| N/A | 127.0.0.1:9222 | tcp | |
| US | 150.171.28.11:443 | edge.microsoft.com | tcp |
| US | 8.8.8.8:53 | edgeassetservice.azureedge.net | udp |
| US | 8.8.8.8:53 | edgeassetservice.azureedge.net | udp |
| US | 13.107.246.64:443 | edgeassetservice.azureedge.net | tcp |
| US | 8.8.8.8:53 | edge.microsoft.com | udp |
| US | 8.8.8.8:53 | edge.microsoft.com | udp |
| US | 150.171.28.11:443 | edge.microsoft.com | tcp |
| US | 8.8.8.8:53 | api.gofile.io | udp |
| FR | 51.91.7.6:443 | api.gofile.io | tcp |
| US | 8.8.8.8:53 | store-eu-par-3.gofile.io | udp |
| FR | 195.154.100.94:443 | store-eu-par-3.gofile.io | tcp |
| N/A | 127.0.0.1:9222 | tcp | |
| N/A | 127.0.0.1:9222 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 13.89.178.26:443 | browser.events.data.msn.com | tcp |
| US | 13.89.178.26:443 | browser.events.data.msn.com | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
C:\Users\Admin\Desktop\hookfor60.exe
| MD5 | bca8ad2dbd078176ef0164b00698ab7c |
| SHA1 | 2e80050fd87166236940cfa4ceb75e1fbaa74141 |
| SHA256 | d29d20f04ab9f6a8f29071dd5486a6b790f4083aa6f438fea1c23029e6973173 |
| SHA512 | c949afe2fae15eb21e28b0f49747d8aa11a0f8cd62a83c1dc8b014439463df2e52f6e4f4cc2ace273273df9d637322808f288bf5c5cd35357399198e1abe403f |
memory/5596-4-0x00007FFA2F2F3000-0x00007FFA2F2F5000-memory.dmp
memory/5596-5-0x00000143A1950000-0x00000143A1F66000-memory.dmp
memory/5596-6-0x00007FFA2F2F0000-0x00007FFA2FDB1000-memory.dmp
memory/5596-30-0x00000143BC9B0000-0x00000143BCA62000-memory.dmp
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | 6d64b62a42f76d01fe2131140d2ae1b5 |
| SHA1 | 8305c7d086e120582632371bf8e09136a89fbf0e |
| SHA256 | f0f43a4a2a84aa5695628611e322f8b12ac756a92c3fb32cb4e1f9d802b1d5f5 |
| SHA512 | 72908ece3ed4c10068ebfbd20ac22d377ee09a230b30c470d5e7587470ce8a60ca8b4dc03b66b7fc4171e309d63aba058fca8a348f3e1a827e2a7c7eeff005d8 |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | ff6eaa78e4903328b8e2173f96779d5a |
| SHA1 | c8d213fa5bfa96379e2a08b8c1dfd649f541cac9 |
| SHA256 | 4aef196e9b905bfbbeb4dbc1e4e93ffd3a522eff9ce80d7d9cf54745057f2de5 |
| SHA512 | 80cf4ecb4897feb786664bccd9542296c7100bd38e170dfee554b936dbef9d045eeb624aaf3accc00719a73a59034fd573336d6c0d2cfaffb82a2e10237ec98c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 6be420883dbb08cf0447ebba1168f4ce |
| SHA1 | 3310795746a63a12d05fc184a01559118a12c8f8 |
| SHA256 | d69176102870ac044aafa333bd1834b6ddbe5db9473a7aa785d42aed262466f8 |
| SHA512 | 38088d9f54d34f034079d08a2f30ec9c8470303ca3c00bb1769b3466e7c9599bf7b39181f641c6aca7070f9a40ea59fd9bf6ec6619a3a56fc94797a1187d9003 |
\??\pipe\crashpad_972_YOGEJAWGZIQDUDDA
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | c4d20b4d9bdce177f79f4bb111365e92 |
| SHA1 | 313b467a3038f531d3946960c0e38dc14a54c000 |
| SHA256 | ce85f039fa8c8422eb767bc1a0ec25d8629faa5220b524639bbca3022042710d |
| SHA512 | 2c5cd53655baa37478a89ff650efb12ff50a3a2542897d93a9ca149095b73b017282536e155cadf48dcb83e874be46354cedd40454115184e803145f789d89bc |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | 94b5c819c5d338ca21c502f198128306 |
| SHA1 | d84ddb15172d9c7fee3dc3019be83720ff46a478 |
| SHA256 | 4e51aea0de2ff1ab77b12398efed3dfef65949259562b22fef1089b18557dd3f |
| SHA512 | 8b99a65dd42677223e35f620a5036d6ce1071efb418d890ab111b91a7a6f521b4c4332ed3bf3c342a6fbb82d2d3064dae0107734123a92bc7312d0ec9fde84d6 |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | 55c8073ef4728b06860b7398e7ae8f14 |
| SHA1 | 2beb9d3cde6a9c9fd1d6d6c2e730368a8ee1f486 |
| SHA256 | bfff5088a56cb1bfbac45a2433327462f003c34433258f4435de51ab305e38ef |
| SHA512 | 5aaeea524350abc9b604a0ad6c7eadb094d6c84502ba070896d645bbdc9918a1d3d89f68449c9d594988c58ba5f745f3cf4418613f773d05559db1ca9dee3350 |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | 5078201f7ca4c2289e4b8258987a4a3f |
| SHA1 | c20377207e3fe7659825f312f0c38375347c50b0 |
| SHA256 | df51724d348247b19fd67a4c1b4a87b1eab6b34f82e20a7998b6524b7b303d8d |
| SHA512 | 2132281a16b3ea14dfc0f58bd2ff6a8ebb8073b9817227ad60026371aab39c5cb6ff5bc08bf2af52c65d69f3e8fe93e15d8986717673f46e682765b5cda713cc |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | 0f69c0ee637fc26a5425edb6d1fc3c6b |
| SHA1 | 5f83c9d58998b3c8ec86540b6dd5afdaea10d6e9 |
| SHA256 | feda73ef5237920a40541b7fe535cdc735549dc82b4243754790809213f56985 |
| SHA512 | 1061ce3d19dc713a4301cfeed84ab070822b8d3780a92cb269af5f969487a52bf99d770437e22d20e4b44c3db4709a12d98c5c0479eaeab99b434f797e099c11 |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt
| MD5 | 1f0ca2fd872f0428f7066665a2f64ee6 |
| SHA1 | 413ffe75e9db7ef5196b3e9c931e8f4c280bb6c4 |
| SHA256 | f863e12ef2957bede6734ba2c6bd69f5fb95508d1941516752564135bb203d43 |
| SHA512 | 474d3d62a84c001c70f061761d9f5a3cada047ceb291be4e90ae1d928b39f23c21ebdc6050bc1eaf3ee4dae7e469f1181344c500b337a2f2b799b0ad315d91bc |
memory/5596-164-0x00007FFA2F2F3000-0x00007FFA2F2F5000-memory.dmp
memory/5596-177-0x00000143BC4E0000-0x00000143BC5E2000-memory.dmp
memory/5596-178-0x00007FFA2F2F0000-0x00007FFA2FDB1000-memory.dmp
memory/5596-182-0x00000143BCD20000-0x00000143BCD42000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 12a2e353b7d9e0daf6f4f0bc954bfa14 |
| SHA1 | c5f4965fadae578d9a4617bcbc0ada14a76e7f1e |
| SHA256 | f53ead91efb45478dcc333486cdc23e3a0846465632bcd40e62e9e5d8311a565 |
| SHA512 | d6cee697dcaab189371235d7ea85c10a26aa47b5174123dce0c561114196d406d971b3e29b9ac91b095d35d57e63282003ff439f44d8e4a297ac4e0d30ea7e54 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | df2d1721cd4e4eff7049314710dc7c11 |
| SHA1 | f5aed0158b2c0a00302f743841188881d811637a |
| SHA256 | ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93 |
| SHA512 | 11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4 |
memory/1520-260-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-259-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-258-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-264-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-270-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-269-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-268-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-267-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-266-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
memory/1520-265-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\Browsers\Microsoft Edge\Cookies.txt
| MD5 | 5da226f1e0557b30850bbc4b5212f66f |
| SHA1 | 55e0d3b134ac80756207a161e3477c337f9eb087 |
| SHA256 | 4e7da53cd5a61ab7b6da5b991d66473e3766d710a3325c1d8ad53720579f66a8 |
| SHA512 | 643ff10c9dcfaa5db2b0ec5fbadb8a3b9b70cd1a351b9d218f92c78b8107b5bc48d5418fc5ba85006057693b397cebbaa973f46278b6dd12786cb718fb6039b4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
| MD5 | 34aa3bf56fef27727a90753c64d908a3 |
| SHA1 | 3b2188b900caf01bcd8e9e45091ea92708f70f37 |
| SHA256 | 026cf2782a86ff7db9fff2bebc6393810f12ff097e3dd1a963bee0d2f16b835e |
| SHA512 | d101b94cd10b021fef66211122fd02570dee69af8e71dc2d3a61716111c76178dcdee369e40bde8d419b1b11b0a66606d2505faa4e0b4fc1bbd9cd5191b888b3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Apps.txt
| MD5 | 55ad871f29723a2bfe87ff753b6c638e |
| SHA1 | 0b12d8e7aedbd3bc39b1462b0126ec95ba7bd66a |
| SHA256 | 9887fb8928b293f5844ffc6bde44a7d260d329bb03f54222a1d30bf2da55d9e8 |
| SHA512 | d7b86884762c440a6e68e4c76e4f44f16e32d3e1b5a5a23c38e9b6a7930190290115b431c3b413e214482cb9ea1ed794f487ebaa1afffdfaf58d12dc62f7167c |
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Apps.txt
| MD5 | 9bcc8204303a0739409d05cd163b2988 |
| SHA1 | 58a6d77d0523b803dd3dfa49c41b1a52ebc69bfb |
| SHA256 | 6ac159c85be9c2ba405150485615b09c2b0b223269cadb748f248b7331077d4f |
| SHA512 | 800214ac83b7e76e666507009c67e432ba8f2e555909c29893f88fe51719dcdd3a29482e6900d526ee5ee228cc78526e176143eec4d3ef7cc71993a736760adf |
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
| MD5 | 5d91f864245c421495372a6b9ca25969 |
| SHA1 | 00782ab12c1fe9f03fa67025a65a5f3fb5e4d8e9 |
| SHA256 | 399709f3c8200e0145bb552ddede77060ded1d1c83e29e739408408355fe2e4f |
| SHA512 | 06ba33b9e129741f499bb3fe4f5aeb1046ae475aa991d5e520cbc782063cce31a45ca74ae12e2f33e5dc17355addafec436d94b8472172059b243ece2435ff12 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
| MD5 | 3b2127904debdab063663df8a4b2a2b4 |
| SHA1 | 8e24dbe9620269c7703b50d421ab2c3a65c070dc |
| SHA256 | 9af413b448e21979526ec8e57a2503476f83691ecc81c6387d7f824e036226fe |
| SHA512 | 96bbdb003fdde9748f21a8a62b255c1748d54bd47c7eedfb83dec309e4b55a1d77447d76c26afc6849f3232e326b4c5aeea9eaab0be329fb6101d0ae226d4498 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
| MD5 | 40e2018187b61af5be8caf035fb72882 |
| SHA1 | 72a0b7bcb454b6b727bf90da35879b3e9a70621e |
| SHA256 | b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5 |
| SHA512 | a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
| MD5 | 3fd11ff447c1ee23538dc4d9724427a3 |
| SHA1 | 1335e6f71cc4e3cf7025233523b4760f8893e9c9 |
| SHA256 | 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed |
| SHA512 | 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824 |
memory/5596-722-0x00000143BCCE0000-0x00000143BCD24000-memory.dmp
memory/5596-723-0x00000143BCD70000-0x00000143BCD8A000-memory.dmp
C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\Browsers\Firefox\Bookmarks.txt
| MD5 | 70e1643c50773124c0e1dbf69c8be193 |
| SHA1 | 0e2e6fd8d0b49dddf9ea59013a425d586cb4730c |
| SHA256 | 4fe3f09cb4d635df136ea45a11c05f74200fc6e855a75f9a27c0a0d32a2f632a |
| SHA512 | 664e5d9263c0137f841daeb3dff00010ffeb7291ed08ccf6d0483200cd6d6bd3c9d31ea7e67a9de6aac591397060d8f01e8469bbad67d8e2f1c3900ef24c3679 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0b2ebe006007433c81a76c739e48f749 |
| SHA1 | 95e978b5c977f7207a471f008a4cddab8e20f0e3 |
| SHA256 | d1dadb255e658c6525a034158101630ce17d11b018db02b149f5a09ca8936388 |
| SHA512 | db9cdfe3fbd94fe41a024c9635fe34fbf2a267f10dad617a16282826d63ad9acf6d11dc146fa02de27a2f4659709e8db3702c6d75c77a777801c2d8448d89f6c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | b0d20a92417341122982528857a5ebec |
| SHA1 | d0dbdbbd0eabce88f956dfd69733812476630a65 |
| SHA256 | 2c1874786522edfa04bd05447d4729ecbda4c7b31e72a5227dbc85e22cbf0bef |
| SHA512 | 34db8dbe6c8b5aacccdb9474ad89c25db1ff5ec56bd7abdcc079b906c8ceda986df3a56cb94d7f66a5e6dea86233b92b0a7338fb758ad0ea0719cb3447bec07b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | 6ff981642bd2a4777dab0140d19396b5 |
| SHA1 | c0d0c77844122f902d49357ccddaea2baf6c557a |
| SHA256 | 98bed085d3f6af0b804bc56832723da7c938e1d2dcbf91d611a09c458d16a21b |
| SHA512 | 04603c3a08ab1f494480ec3884d54d1d055ba0a64f8be8eaf01133f8419fc896de0537f471666139f8b2e32fa2b6abc15da025f330d502fddf97241b44a51797 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
| MD5 | 20d4b8fa017a12a108c87f540836e250 |
| SHA1 | 1ac617fac131262b6d3ce1f52f5907e31d5f6f00 |
| SHA256 | 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d |
| SHA512 | 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99d9cfc8-60b3-40f5-86fb-3174ad33a7bc\index-dir\the-real-index
| MD5 | a2204d0b6beb24105b6833188b3dff36 |
| SHA1 | 393f9b0c5656c3d8ff97163c061cab21ac3a5b33 |
| SHA256 | 9b2b1099d8a9ae1fd737ba59cd05cb9b1a4e66da06fa79b5e70c4aeb60c954dc |
| SHA512 | 6f91e5b77b5fa00b086d3ad6d951bc735ad300a9ffdce039b0e22bf6a03419f2611320f62ee5ef1ed0fda73fb653c686536403cc261bbc854b3032883b762d1c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\60a0e63a-ce94-41f1-a278-3c3e42a645b2\index-dir\the-real-index
| MD5 | 51e810f7ffb24d497918f5b40b66281a |
| SHA1 | dd2ef1ffde627454737ee9810dca8115a0be457f |
| SHA256 | d72d80a52d6e7cf2e6be02eb22ed58ac96c2d525a9b16daa60875980e5faee65 |
| SHA512 | 26657a41296cd548284d456fae97af91adf094969f27c262958a7ba5408bf9a7ad5d3fcfc8113c992db93ace516254d8bbdc9ea2da97b0a5a258994b89981d2e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\60a0e63a-ce94-41f1-a278-3c3e42a645b2\index-dir\the-real-index~RFe585b4a.TMP
| MD5 | ceb3d64473c80c7e2388e11715c312ba |
| SHA1 | cdee608eafbf003ab2a355bedcda68ad3403ff40 |
| SHA256 | ac47b8ed5af1c4845e5c4d9499d527dcfee88967ff258091346876033daea03e |
| SHA512 | 2a7fa41a7ea7ad0049e5394c9bc8c359cf67cb1437ad05075cede0580053f099147aaed54f2c681db7b74e8579cb2dbf861e48f72ccf62cdc04f014dbf2ca33e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ddf9bd8-4fcd-46bc-934c-7de2385b9545\index-dir\the-real-index
| MD5 | f61b7603478ad1792905bffbca8f2341 |
| SHA1 | 981e174b4ae0dae41f852bf7ce9115ad3766217e |
| SHA256 | 3136c3b287da753accea1379fe9e1b3d9919872153439d0b10beca14d3be4857 |
| SHA512 | 7d139e6a8ad03c3b773cd84c563169d7501c429bce3e69632d97932cd71e1f659108f23fb29d786912643cddfd10548ac412c216f231b3a0e10c9159b2b2cf40 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ddf9bd8-4fcd-46bc-934c-7de2385b9545\index-dir\the-real-index
| MD5 | 1703ea89dca0baa4076b0847c804ac18 |
| SHA1 | 5dd348419c658be2e4466dcd8428405ee3f0211d |
| SHA256 | 1fb4fa4c418d28eb0e8875cff4f9c8d0d12b3f6856dc36ba1c4b6b7f7a6267b0 |
| SHA512 | d137e0cea8721f1b1d47a26badb02e8ae110c50350d6e538676e1f2c318f8b89066918be4145c81f678b7d183b2347e797f70dfe1e3de1548cd44451b2695bf9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 06a1fa4fa29e3acf65c304306a542c32 |
| SHA1 | 442de34172054a03d27e4befbe54e576141b900b |
| SHA256 | 061dbc7b019decae4aa9e44bff70a5ddbabea0a63b7adec4d00c756631b6a4b1 |
| SHA512 | e163808e390b433d88bb27ee62526d360ec56f972395af0a9d648c7a2474553dae303409197632fe388f8ec0fd921031e2edd858c92a547c374362319738372f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5865d9.TMP
| MD5 | 0f10c71439d56f4e52e98d8d5dce14a8 |
| SHA1 | f623523a7f5e39b3a3d099a992c630a1f13a14fa |
| SHA256 | fb772dcca233ef3f4ee7faed8fd275f3e0c13a0a7ab07d10ca077b04c9935c82 |
| SHA512 | ad9a50e95333771164e747c9196be204b47dbe70fc9cd2e8055d35c0ea3205f102bb9e4bf63f7aa28b1344a8ea5f2533df6bf50b06b2f23239f115f20d0032c5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672850e0-716b-4785-b971-03b7429b7632\index-dir\the-real-index~RFe5869f0.TMP
| MD5 | 3b7a7542e32daeb7025205740aa3b4b5 |
| SHA1 | 54eb3932065665ce7e6a2c1eb2f581d17260c4a1 |
| SHA256 | f7c8ffe8f8b9fcb55dc6580d6c5b50b7915cc57d663288c1c3b466d1aad5806c |
| SHA512 | e97214b3b778ae50cdbb7424dfe9b3237cf6b212d8b43529a020694d27bb92fdc33d0ac10ac11da875f9bf521b6baf446ae09e0005c1358af0438cbdc58614d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672850e0-716b-4785-b971-03b7429b7632\index-dir\the-real-index
| MD5 | cc437a5cda145d863af5b2f2fd8890c0 |
| SHA1 | 58462e179b60112f0177f01ba43e9ac21a6b28ce |
| SHA256 | 3bc8670497bf918069066bba8edaf34203bac936e2548919c8c6abf8df6faf4c |
| SHA512 | 8297b34c096299ee943e5ecb523275b3c0bffca25fefe74b1fcd651a3a1260ff9fa5ff2b64272c6c583ea6dd72e716054e0d08765e06b27281706ed5d5591b28 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
| MD5 | e6a5899fef805202518eeaf5c4ac9ca4 |
| SHA1 | 2b6c6512bb2bf3c8e068b7c3c07f1b4229abbdfa |
| SHA256 | 8cde5ce9d99c4b3c7985894eb57325a16a1bd68c7da4d0aef3745127ac48997c |
| SHA512 | cf531b524f7e9bb03ddc4c4163f9385dc0883dbabdf35811f56db1b2c0a7d16129194fb2a535e878da6e24ded1ce420c918dc6a654e65d6025776048a5546253 |