Malware Analysis Report

2025-04-13 12:23

Sample ID 250321-wb8ecst1d1
Target hookfor60.rar
SHA256 77f155b8f6e0aa230e69aab203d4cf3f2d4323a30c4e876bc9ca9f0cda11ae21
Tags
stealerium collection credential_access discovery persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

77f155b8f6e0aa230e69aab203d4cf3f2d4323a30c4e876bc9ca9f0cda11ae21

Threat Level: Known bad

The file hookfor60.rar was found to be: Known bad.

Malicious Activity Summary

stealerium collection credential_access discovery persistence privilege_escalation spyware stealer

Stealerium

Stealerium family

Uses browser remote debugging

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Browser Information Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Modifies data under HKEY_USERS

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious use of SendNotifyMessage

outlook_win_path

outlook_office_path

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-21 17:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-21 17:45

Reported

2025-03-21 18:01

Platform

win7-20241010-en

Max time kernel

840s

Max time network

846s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\hookfor60.rar"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\hookfor60.rar"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-21 17:45

Reported

2025-03-21 17:47

Platform

win10v2004-20250314-en

Max time kernel

60s

Max time network

61s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\hookfor60.rar"

Signatures

Stealerium

stealer stealerium

Stealerium family

stealerium

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\hookfor60.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\hookfor60.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\hookfor60.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\hookfor60.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A api.gofile.io N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A api.gofile.io N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\Desktop\hookfor60.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\Desktop\hookfor60.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870527984078511" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{14CF1427-F633-4AD4-AAB6-01FBC9B5EE15} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\hookfor60.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5596 wrote to memory of 972 N/A C:\Users\Admin\Desktop\hookfor60.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5596 wrote to memory of 972 N/A C:\Users\Admin\Desktop\hookfor60.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 4124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 4124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 972 wrote to memory of 5752 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\hookfor60.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\hookfor60.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\hookfor60.rar"

C:\Users\Admin\Desktop\hookfor60.exe

"C:\Users\Admin\Desktop\hookfor60.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa2a39dcf8,0x7ffa2a39dd04,0x7ffa2a39dd10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=1300,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2032 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2020,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2012 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2288,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2284 /prefetch:8

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3156 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4188,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=4184 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4556,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=4536 /prefetch:1

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\findstr.exe

findstr All

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5192,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5184 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5420,i,12617664622825836715,15081492641367421538,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5416 /prefetch:8

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging --edge-skip-compat-layer-relaunch

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x208,0x238,0x23c,0x210,0x250,0x7ffa2a15f208,0x7ffa2a15f214,0x7ffa2a15f220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2440,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2436 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2456,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2448 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2388,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2380 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5460,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5456 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5512,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5508 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5940,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5936 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6044,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=6056 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6044,i,15557781160161151947,12860267798919522705,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=6056 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
GB 142.250.179.228:443 www.google.com tcp
GB 142.250.179.228:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.179.234:443 ogads-pa.googleapis.com udp
GB 142.250.179.238:443 apis.google.com udp
GB 142.250.179.234:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com udp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.200.46:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 204.79.197.203:443 ntp.msn.com tcp
US 150.171.27.11:80 edge.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
GB 95.100.153.183:443 copilot.microsoft.com tcp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
GB 95.100.153.183:443 copilot.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 c.bing.com udp
US 8.8.8.8:53 c.bing.com udp
IE 13.74.129.1:443 c.msn.com tcp
US 150.171.28.10:443 c.bing.com tcp
GB 2.18.190.175:443 assets.msn.com tcp
GB 2.18.190.175:443 assets.msn.com tcp
GB 2.18.190.175:443 assets.msn.com tcp
GB 95.100.153.157:443 www.bing.com tcp
GB 95.100.153.143:443 www.bing.com tcp
PT 3.160.132.128:443 sb.scorecardresearch.com tcp
US 2.16.55.202:443 img-s-msn-com.akamaized.net tcp
GB 2.18.190.175:443 assets.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 13.89.178.26:443 browser.events.data.msn.com tcp
GB 2.18.190.175:443 assets.msn.com udp
US 13.89.178.26:443 browser.events.data.msn.com tcp
US 150.171.28.10:443 c.bing.com tcp
US 2.16.55.202:443 img-s-msn-com.akamaized.net tcp
US 2.16.55.202:443 img-s-msn-com.akamaized.net tcp
US 2.16.55.202:443 img-s-msn-com.akamaized.net tcp
US 2.16.55.202:443 img-s-msn-com.akamaized.net tcp
US 2.16.55.202:443 img-s-msn-com.akamaized.net tcp
US 2.16.55.202:443 img-s-msn-com.akamaized.net udp
GB 2.18.190.175:443 assets.msn.com udp
IE 13.74.129.1:443 c.msn.com tcp
US 8.8.8.8:53 srtb.msn.com udp
US 8.8.8.8:53 srtb.msn.com udp
US 204.79.197.203:443 srtb.msn.com tcp
US 204.79.197.203:443 srtb.msn.com tcp
GB 95.100.153.143:443 www.bing.com tcp
GB 95.100.153.143:443 www.bing.com tcp
GB 95.100.153.143:443 www.bing.com tcp
GB 95.100.153.143:443 www.bing.com tcp
GB 95.100.153.157:443 www.bing.com udp
US 204.79.197.203:443 srtb.msn.com tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.msftstatic.com udp
US 8.8.8.8:53 r.msftstatic.com udp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 95.100.153.131:443 r.bing.com tcp
GB 95.100.153.131:443 r.bing.com tcp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 2.18.190.175:443 assets.msn.com udp
US 8.8.8.8:53 ecn.dev.virtualearth.net udp
US 8.8.8.8:53 ecn.dev.virtualearth.net udp
GB 23.192.24.182:443 ecn.dev.virtualearth.net tcp
US 8.8.8.8:53 evcs-ocsp.ws.symantec.com udp
GB 104.78.173.45:80 evcs-ocsp.ws.symantec.com tcp
US 8.8.8.8:53 evcs-crl.ws.symantec.com udp
GB 104.78.173.45:80 evcs-crl.ws.symantec.com tcp
GB 95.100.153.131:443 www.bing.com tcp
US 104.16.184.241:80 icanhazip.com tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 api.gofile.io udp
FR 51.91.7.6:443 api.gofile.io tcp
US 8.8.8.8:53 store-eu-par-3.gofile.io udp
FR 195.154.100.94:443 store-eu-par-3.gofile.io tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 13.89.178.26:443 browser.events.data.msn.com tcp
US 13.89.178.26:443 browser.events.data.msn.com tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\Desktop\hookfor60.exe

MD5 bca8ad2dbd078176ef0164b00698ab7c
SHA1 2e80050fd87166236940cfa4ceb75e1fbaa74141
SHA256 d29d20f04ab9f6a8f29071dd5486a6b790f4083aa6f438fea1c23029e6973173
SHA512 c949afe2fae15eb21e28b0f49747d8aa11a0f8cd62a83c1dc8b014439463df2e52f6e4f4cc2ace273273df9d637322808f288bf5c5cd35357399198e1abe403f

memory/5596-4-0x00007FFA2F2F3000-0x00007FFA2F2F5000-memory.dmp

memory/5596-5-0x00000143A1950000-0x00000143A1F66000-memory.dmp

memory/5596-6-0x00007FFA2F2F0000-0x00007FFA2FDB1000-memory.dmp

memory/5596-30-0x00000143BC9B0000-0x00000143BCA62000-memory.dmp

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 6d64b62a42f76d01fe2131140d2ae1b5
SHA1 8305c7d086e120582632371bf8e09136a89fbf0e
SHA256 f0f43a4a2a84aa5695628611e322f8b12ac756a92c3fb32cb4e1f9d802b1d5f5
SHA512 72908ece3ed4c10068ebfbd20ac22d377ee09a230b30c470d5e7587470ce8a60ca8b4dc03b66b7fc4171e309d63aba058fca8a348f3e1a827e2a7c7eeff005d8

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 ff6eaa78e4903328b8e2173f96779d5a
SHA1 c8d213fa5bfa96379e2a08b8c1dfd649f541cac9
SHA256 4aef196e9b905bfbbeb4dbc1e4e93ffd3a522eff9ce80d7d9cf54745057f2de5
SHA512 80cf4ecb4897feb786664bccd9542296c7100bd38e170dfee554b936dbef9d045eeb624aaf3accc00719a73a59034fd573336d6c0d2cfaffb82a2e10237ec98c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6be420883dbb08cf0447ebba1168f4ce
SHA1 3310795746a63a12d05fc184a01559118a12c8f8
SHA256 d69176102870ac044aafa333bd1834b6ddbe5db9473a7aa785d42aed262466f8
SHA512 38088d9f54d34f034079d08a2f30ec9c8470303ca3c00bb1769b3466e7c9599bf7b39181f641c6aca7070f9a40ea59fd9bf6ec6619a3a56fc94797a1187d9003

\??\pipe\crashpad_972_YOGEJAWGZIQDUDDA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 c4d20b4d9bdce177f79f4bb111365e92
SHA1 313b467a3038f531d3946960c0e38dc14a54c000
SHA256 ce85f039fa8c8422eb767bc1a0ec25d8629faa5220b524639bbca3022042710d
SHA512 2c5cd53655baa37478a89ff650efb12ff50a3a2542897d93a9ca149095b73b017282536e155cadf48dcb83e874be46354cedd40454115184e803145f789d89bc

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 94b5c819c5d338ca21c502f198128306
SHA1 d84ddb15172d9c7fee3dc3019be83720ff46a478
SHA256 4e51aea0de2ff1ab77b12398efed3dfef65949259562b22fef1089b18557dd3f
SHA512 8b99a65dd42677223e35f620a5036d6ce1071efb418d890ab111b91a7a6f521b4c4332ed3bf3c342a6fbb82d2d3064dae0107734123a92bc7312d0ec9fde84d6

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 55c8073ef4728b06860b7398e7ae8f14
SHA1 2beb9d3cde6a9c9fd1d6d6c2e730368a8ee1f486
SHA256 bfff5088a56cb1bfbac45a2433327462f003c34433258f4435de51ab305e38ef
SHA512 5aaeea524350abc9b604a0ad6c7eadb094d6c84502ba070896d645bbdc9918a1d3d89f68449c9d594988c58ba5f745f3cf4418613f773d05559db1ca9dee3350

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 5078201f7ca4c2289e4b8258987a4a3f
SHA1 c20377207e3fe7659825f312f0c38375347c50b0
SHA256 df51724d348247b19fd67a4c1b4a87b1eab6b34f82e20a7998b6524b7b303d8d
SHA512 2132281a16b3ea14dfc0f58bd2ff6a8ebb8073b9817227ad60026371aab39c5cb6ff5bc08bf2af52c65d69f3e8fe93e15d8986717673f46e682765b5cda713cc

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 0f69c0ee637fc26a5425edb6d1fc3c6b
SHA1 5f83c9d58998b3c8ec86540b6dd5afdaea10d6e9
SHA256 feda73ef5237920a40541b7fe535cdc735549dc82b4243754790809213f56985
SHA512 1061ce3d19dc713a4301cfeed84ab070822b8d3780a92cb269af5f969487a52bf99d770437e22d20e4b44c3db4709a12d98c5c0479eaeab99b434f797e099c11

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Process.txt

MD5 1f0ca2fd872f0428f7066665a2f64ee6
SHA1 413ffe75e9db7ef5196b3e9c931e8f4c280bb6c4
SHA256 f863e12ef2957bede6734ba2c6bd69f5fb95508d1941516752564135bb203d43
SHA512 474d3d62a84c001c70f061761d9f5a3cada047ceb291be4e90ae1d928b39f23c21ebdc6050bc1eaf3ee4dae7e469f1181344c500b337a2f2b799b0ad315d91bc

memory/5596-164-0x00007FFA2F2F3000-0x00007FFA2F2F5000-memory.dmp

memory/5596-177-0x00000143BC4E0000-0x00000143BC5E2000-memory.dmp

memory/5596-178-0x00007FFA2F2F0000-0x00007FFA2FDB1000-memory.dmp

memory/5596-182-0x00000143BCD20000-0x00000143BCD42000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 12a2e353b7d9e0daf6f4f0bc954bfa14
SHA1 c5f4965fadae578d9a4617bcbc0ada14a76e7f1e
SHA256 f53ead91efb45478dcc333486cdc23e3a0846465632bcd40e62e9e5d8311a565
SHA512 d6cee697dcaab189371235d7ea85c10a26aa47b5174123dce0c561114196d406d971b3e29b9ac91b095d35d57e63282003ff439f44d8e4a297ac4e0d30ea7e54

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 df2d1721cd4e4eff7049314710dc7c11
SHA1 f5aed0158b2c0a00302f743841188881d811637a
SHA256 ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93
SHA512 11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

memory/1520-260-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-259-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-258-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-264-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-270-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-269-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-268-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-267-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-266-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

memory/1520-265-0x000001CED1BF0000-0x000001CED1BF1000-memory.dmp

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\Browsers\Microsoft Edge\Cookies.txt

MD5 5da226f1e0557b30850bbc4b5212f66f
SHA1 55e0d3b134ac80756207a161e3477c337f9eb087
SHA256 4e7da53cd5a61ab7b6da5b991d66473e3766d710a3325c1d8ad53720579f66a8
SHA512 643ff10c9dcfaa5db2b0ec5fbadb8a3b9b70cd1a351b9d218f92c78b8107b5bc48d5418fc5ba85006057693b397cebbaa973f46278b6dd12786cb718fb6039b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

MD5 34aa3bf56fef27727a90753c64d908a3
SHA1 3b2188b900caf01bcd8e9e45091ea92708f70f37
SHA256 026cf2782a86ff7db9fff2bebc6393810f12ff097e3dd1a963bee0d2f16b835e
SHA512 d101b94cd10b021fef66211122fd02570dee69af8e71dc2d3a61716111c76178dcdee369e40bde8d419b1b11b0a66606d2505faa4e0b4fc1bbd9cd5191b888b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Apps.txt

MD5 55ad871f29723a2bfe87ff753b6c638e
SHA1 0b12d8e7aedbd3bc39b1462b0126ec95ba7bd66a
SHA256 9887fb8928b293f5844ffc6bde44a7d260d329bb03f54222a1d30bf2da55d9e8
SHA512 d7b86884762c440a6e68e4c76e4f44f16e32d3e1b5a5a23c38e9b6a7930190290115b431c3b413e214482cb9ea1ed794f487ebaa1afffdfaf58d12dc62f7167c

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\System\Apps.txt

MD5 9bcc8204303a0739409d05cd163b2988
SHA1 58a6d77d0523b803dd3dfa49c41b1a52ebc69bfb
SHA256 6ac159c85be9c2ba405150485615b09c2b0b223269cadb748f248b7331077d4f
SHA512 800214ac83b7e76e666507009c67e432ba8f2e555909c29893f88fe51719dcdd3a29482e6900d526ee5ee228cc78526e176143eec4d3ef7cc71993a736760adf

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

MD5 5d91f864245c421495372a6b9ca25969
SHA1 00782ab12c1fe9f03fa67025a65a5f3fb5e4d8e9
SHA256 399709f3c8200e0145bb552ddede77060ded1d1c83e29e739408408355fe2e4f
SHA512 06ba33b9e129741f499bb3fe4f5aeb1046ae475aa991d5e520cbc782063cce31a45ca74ae12e2f33e5dc17355addafec436d94b8472172059b243ece2435ff12

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

MD5 3b2127904debdab063663df8a4b2a2b4
SHA1 8e24dbe9620269c7703b50d421ab2c3a65c070dc
SHA256 9af413b448e21979526ec8e57a2503476f83691ecc81c6387d7f824e036226fe
SHA512 96bbdb003fdde9748f21a8a62b255c1748d54bd47c7eedfb83dec309e4b55a1d77447d76c26afc6849f3232e326b4c5aeea9eaab0be329fb6101d0ae226d4498

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

MD5 40e2018187b61af5be8caf035fb72882
SHA1 72a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256 b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512 a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

memory/5596-722-0x00000143BCCE0000-0x00000143BCD24000-memory.dmp

memory/5596-723-0x00000143BCD70000-0x00000143BCD8A000-memory.dmp

C:\Users\Admin\AppData\Local\069e79ae33960ff35e5dcb762b051f6a\Admin@LYFGOYQN_en-US\Browsers\Firefox\Bookmarks.txt

MD5 70e1643c50773124c0e1dbf69c8be193
SHA1 0e2e6fd8d0b49dddf9ea59013a425d586cb4730c
SHA256 4fe3f09cb4d635df136ea45a11c05f74200fc6e855a75f9a27c0a0d32a2f632a
SHA512 664e5d9263c0137f841daeb3dff00010ffeb7291ed08ccf6d0483200cd6d6bd3c9d31ea7e67a9de6aac591397060d8f01e8469bbad67d8e2f1c3900ef24c3679

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0b2ebe006007433c81a76c739e48f749
SHA1 95e978b5c977f7207a471f008a4cddab8e20f0e3
SHA256 d1dadb255e658c6525a034158101630ce17d11b018db02b149f5a09ca8936388
SHA512 db9cdfe3fbd94fe41a024c9635fe34fbf2a267f10dad617a16282826d63ad9acf6d11dc146fa02de27a2f4659709e8db3702c6d75c77a777801c2d8448d89f6c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b0d20a92417341122982528857a5ebec
SHA1 d0dbdbbd0eabce88f956dfd69733812476630a65
SHA256 2c1874786522edfa04bd05447d4729ecbda4c7b31e72a5227dbc85e22cbf0bef
SHA512 34db8dbe6c8b5aacccdb9474ad89c25db1ff5ec56bd7abdcc079b906c8ceda986df3a56cb94d7f66a5e6dea86233b92b0a7338fb758ad0ea0719cb3447bec07b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 6ff981642bd2a4777dab0140d19396b5
SHA1 c0d0c77844122f902d49357ccddaea2baf6c557a
SHA256 98bed085d3f6af0b804bc56832723da7c938e1d2dcbf91d611a09c458d16a21b
SHA512 04603c3a08ab1f494480ec3884d54d1d055ba0a64f8be8eaf01133f8419fc896de0537f471666139f8b2e32fa2b6abc15da025f330d502fddf97241b44a51797

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99d9cfc8-60b3-40f5-86fb-3174ad33a7bc\index-dir\the-real-index

MD5 a2204d0b6beb24105b6833188b3dff36
SHA1 393f9b0c5656c3d8ff97163c061cab21ac3a5b33
SHA256 9b2b1099d8a9ae1fd737ba59cd05cb9b1a4e66da06fa79b5e70c4aeb60c954dc
SHA512 6f91e5b77b5fa00b086d3ad6d951bc735ad300a9ffdce039b0e22bf6a03419f2611320f62ee5ef1ed0fda73fb653c686536403cc261bbc854b3032883b762d1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\60a0e63a-ce94-41f1-a278-3c3e42a645b2\index-dir\the-real-index

MD5 51e810f7ffb24d497918f5b40b66281a
SHA1 dd2ef1ffde627454737ee9810dca8115a0be457f
SHA256 d72d80a52d6e7cf2e6be02eb22ed58ac96c2d525a9b16daa60875980e5faee65
SHA512 26657a41296cd548284d456fae97af91adf094969f27c262958a7ba5408bf9a7ad5d3fcfc8113c992db93ace516254d8bbdc9ea2da97b0a5a258994b89981d2e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\60a0e63a-ce94-41f1-a278-3c3e42a645b2\index-dir\the-real-index~RFe585b4a.TMP

MD5 ceb3d64473c80c7e2388e11715c312ba
SHA1 cdee608eafbf003ab2a355bedcda68ad3403ff40
SHA256 ac47b8ed5af1c4845e5c4d9499d527dcfee88967ff258091346876033daea03e
SHA512 2a7fa41a7ea7ad0049e5394c9bc8c359cf67cb1437ad05075cede0580053f099147aaed54f2c681db7b74e8579cb2dbf861e48f72ccf62cdc04f014dbf2ca33e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ddf9bd8-4fcd-46bc-934c-7de2385b9545\index-dir\the-real-index

MD5 f61b7603478ad1792905bffbca8f2341
SHA1 981e174b4ae0dae41f852bf7ce9115ad3766217e
SHA256 3136c3b287da753accea1379fe9e1b3d9919872153439d0b10beca14d3be4857
SHA512 7d139e6a8ad03c3b773cd84c563169d7501c429bce3e69632d97932cd71e1f659108f23fb29d786912643cddfd10548ac412c216f231b3a0e10c9159b2b2cf40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ddf9bd8-4fcd-46bc-934c-7de2385b9545\index-dir\the-real-index

MD5 1703ea89dca0baa4076b0847c804ac18
SHA1 5dd348419c658be2e4466dcd8428405ee3f0211d
SHA256 1fb4fa4c418d28eb0e8875cff4f9c8d0d12b3f6856dc36ba1c4b6b7f7a6267b0
SHA512 d137e0cea8721f1b1d47a26badb02e8ae110c50350d6e538676e1f2c318f8b89066918be4145c81f678b7d183b2347e797f70dfe1e3de1548cd44451b2695bf9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 06a1fa4fa29e3acf65c304306a542c32
SHA1 442de34172054a03d27e4befbe54e576141b900b
SHA256 061dbc7b019decae4aa9e44bff70a5ddbabea0a63b7adec4d00c756631b6a4b1
SHA512 e163808e390b433d88bb27ee62526d360ec56f972395af0a9d648c7a2474553dae303409197632fe388f8ec0fd921031e2edd858c92a547c374362319738372f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5865d9.TMP

MD5 0f10c71439d56f4e52e98d8d5dce14a8
SHA1 f623523a7f5e39b3a3d099a992c630a1f13a14fa
SHA256 fb772dcca233ef3f4ee7faed8fd275f3e0c13a0a7ab07d10ca077b04c9935c82
SHA512 ad9a50e95333771164e747c9196be204b47dbe70fc9cd2e8055d35c0ea3205f102bb9e4bf63f7aa28b1344a8ea5f2533df6bf50b06b2f23239f115f20d0032c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672850e0-716b-4785-b971-03b7429b7632\index-dir\the-real-index~RFe5869f0.TMP

MD5 3b7a7542e32daeb7025205740aa3b4b5
SHA1 54eb3932065665ce7e6a2c1eb2f581d17260c4a1
SHA256 f7c8ffe8f8b9fcb55dc6580d6c5b50b7915cc57d663288c1c3b466d1aad5806c
SHA512 e97214b3b778ae50cdbb7424dfe9b3237cf6b212d8b43529a020694d27bb92fdc33d0ac10ac11da875f9bf521b6baf446ae09e0005c1358af0438cbdc58614d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672850e0-716b-4785-b971-03b7429b7632\index-dir\the-real-index

MD5 cc437a5cda145d863af5b2f2fd8890c0
SHA1 58462e179b60112f0177f01ba43e9ac21a6b28ce
SHA256 3bc8670497bf918069066bba8edaf34203bac936e2548919c8c6abf8df6faf4c
SHA512 8297b34c096299ee943e5ecb523275b3c0bffca25fefe74b1fcd651a3a1260ff9fa5ff2b64272c6c583ea6dd72e716054e0d08765e06b27281706ed5d5591b28

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

MD5 e6a5899fef805202518eeaf5c4ac9ca4
SHA1 2b6c6512bb2bf3c8e068b7c3c07f1b4229abbdfa
SHA256 8cde5ce9d99c4b3c7985894eb57325a16a1bd68c7da4d0aef3745127ac48997c
SHA512 cf531b524f7e9bb03ddc4c4163f9385dc0883dbabdf35811f56db1b2c0a7d16129194fb2a535e878da6e24ded1ce420c918dc6a654e65d6025776048a5546253