Malware Analysis Report

2025-08-11 01:11

Sample ID 231006-zzq2rsac32
Target aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c
SHA256 aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c
Tags
amadey mystic persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c

Threat Level: Known bad

The file aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c was found to be: Known bad.

Malicious Activity Summary

amadey mystic persistence stealer trojan

Mystic

Detect Mystic stealer payload

Amadey

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-06 21:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-06 21:09

Reported

2023-10-06 21:12

Platform

win10v2004-20230915-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe"

Signatures

Amadey

trojan amadey

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4132 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe
PID 4132 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe
PID 4132 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe
PID 4428 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe
PID 4428 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe
PID 4428 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe
PID 4972 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe
PID 4972 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe
PID 4972 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe
PID 3924 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe
PID 3924 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe
PID 3924 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe
PID 3924 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3tY9Vz37.exe
PID 3924 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3tY9Vz37.exe
PID 3924 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3tY9Vz37.exe
PID 4428 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe
PID 4428 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe
PID 4428 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe
PID 4112 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4112 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4112 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4132 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe
PID 4132 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe
PID 4132 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe
PID 4944 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 4944 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 4944 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 4356 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe C:\Windows\system32\cmd.exe
PID 4356 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe C:\Windows\system32\cmd.exe
PID 4944 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 3316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 3316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 3316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 4336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 4336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4120 wrote to memory of 4336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4680 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 4496 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 4496 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4680 wrote to memory of 3180 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4680 wrote to memory of 3180 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3180 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3180 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 1204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 1204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 1204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 1204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 1204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5004 wrote to memory of 1204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe

"C:\Users\Admin\AppData\Local\Temp\aae6b76704621d94863aee0aa61725f22b4235da602551c4a349540c3d79449c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3tY9Vz37.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3tY9Vz37.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F6C4.tmp\F780.tmp\F781.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffdaf3546f8,0x7ffdaf354708,0x7ffdaf354718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffdaf3546f8,0x7ffdaf354708,0x7ffdaf354718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2664005996976839677,16004670353002686761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2664005996976839677,16004670353002686761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4274110462061854553,12561586365370260281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 126.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 15.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe

MD5 e3b97762535255d7279396c8a5cd0380
SHA1 b680c368df9c350e0b0930a5c702045922afb296
SHA256 d9851273b546ea8d956628f670e8151020094316ca64bb88c38ec4bcdf54be5e
SHA512 dc07ffd3bd196fc48954acb4ae4d7135293306c6847dd7e885793f4055be7db605e6a7a91a9e3d39d26439f22335e01a8dd9b02cbfabba1a82308e12bb1b06cd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SX4BC3jg.exe

MD5 e3b97762535255d7279396c8a5cd0380
SHA1 b680c368df9c350e0b0930a5c702045922afb296
SHA256 d9851273b546ea8d956628f670e8151020094316ca64bb88c38ec4bcdf54be5e
SHA512 dc07ffd3bd196fc48954acb4ae4d7135293306c6847dd7e885793f4055be7db605e6a7a91a9e3d39d26439f22335e01a8dd9b02cbfabba1a82308e12bb1b06cd

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe

MD5 7d31a47217cc014cd243a4ed8c745eff
SHA1 0064756da18942aa43d0c8512f3cd18589f81196
SHA256 939176373c5b6ab8369a91adfd2bb35828290a91f0eb4cfcaf4ad6909ce0aa15
SHA512 d8ecf4a6426c5f66b25d3075650ae6866b99d4a52f0cb81873e4fc0fa0edcfbf85debf53ebcede484fbaa7b9a367f7a6e6e65df63c4e5490058d551bac0cc429

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zk0MF4wT.exe

MD5 7d31a47217cc014cd243a4ed8c745eff
SHA1 0064756da18942aa43d0c8512f3cd18589f81196
SHA256 939176373c5b6ab8369a91adfd2bb35828290a91f0eb4cfcaf4ad6909ce0aa15
SHA512 d8ecf4a6426c5f66b25d3075650ae6866b99d4a52f0cb81873e4fc0fa0edcfbf85debf53ebcede484fbaa7b9a367f7a6e6e65df63c4e5490058d551bac0cc429

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe

MD5 f3aad2ab1d172c162459204010a93c0a
SHA1 c24871f9b9248caff6ed17b23d7b5ea57c6a85a2
SHA256 e9b3ca3825db55857985e439aba09bcb5c2eb8fd8aadc0546956650146ab1201
SHA512 cee2c17ff15edbe9a4cd4da84333f25a22fbe22f3a4a42e9f51d919cddb45252860b229fa7f1ca9fc551dd35eaf1ae61eacfc0ad067ee4c7829496901bebbdc1

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ay9Yz4ke.exe

MD5 f3aad2ab1d172c162459204010a93c0a
SHA1 c24871f9b9248caff6ed17b23d7b5ea57c6a85a2
SHA256 e9b3ca3825db55857985e439aba09bcb5c2eb8fd8aadc0546956650146ab1201
SHA512 cee2c17ff15edbe9a4cd4da84333f25a22fbe22f3a4a42e9f51d919cddb45252860b229fa7f1ca9fc551dd35eaf1ae61eacfc0ad067ee4c7829496901bebbdc1

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe

MD5 94558343a7043974034364a5ee545bc1
SHA1 93715a979c9d3a256e43972c3312daa724554125
SHA256 bdb8d24706002de4141850d74cecfc9cd85a9906ef3c4cf9f6dc5138c010ec14
SHA512 8261f44d2611d381b667ffb39bb58c9d5ea739d1df660e400dc7c4767a0b5ce55c9125e1f37ccc3932820eb87ce8cfe89f13ef2e32b15f6ac7587d2fdcbee9b6

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Wl9uj0ti.exe

MD5 94558343a7043974034364a5ee545bc1
SHA1 93715a979c9d3a256e43972c3312daa724554125
SHA256 bdb8d24706002de4141850d74cecfc9cd85a9906ef3c4cf9f6dc5138c010ec14
SHA512 8261f44d2611d381b667ffb39bb58c9d5ea739d1df660e400dc7c4767a0b5ce55c9125e1f37ccc3932820eb87ce8cfe89f13ef2e32b15f6ac7587d2fdcbee9b6

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dw27cQ0.exe

MD5 c749a20dba44cee4515c8ab1d0e386b9
SHA1 906f23eb3d60d49e3a6ed9ed3a91face9234a250
SHA256 e8093509232fa7fa56eb67285f140ed6eb909ab17a100c27fea87728e1cdb69e
SHA512 da2ed0646f8b28b5bb12f00fae5f3965127507a8ee0aa844226bfc34eb1b0392118922fc4f3b29f56c606f225d517601ff769fe9158069bf510bbef4089e235b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3tY9Vz37.exe

MD5 883a2ece25ee35e078fbca308cb6d54e
SHA1 7db95d1f437e345214f0d9b7aedf51c9d8abe133
SHA256 163be834c531d1f6168d26e50a506d3e8bdc0ba36daba33b96f400969d76b06c
SHA512 914ef216abad196e5cbc584503ea585149f557cc96305393803f6c920bf7c2c963a52d9f556c0e1b5bf42741ed6bbadc9fdd21e3b9252d7f0c142d26a2f21b05

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3tY9Vz37.exe

MD5 883a2ece25ee35e078fbca308cb6d54e
SHA1 7db95d1f437e345214f0d9b7aedf51c9d8abe133
SHA256 163be834c531d1f6168d26e50a506d3e8bdc0ba36daba33b96f400969d76b06c
SHA512 914ef216abad196e5cbc584503ea585149f557cc96305393803f6c920bf7c2c963a52d9f556c0e1b5bf42741ed6bbadc9fdd21e3b9252d7f0c142d26a2f21b05

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe

MD5 6fb498ee0a37fd29dce3a064590c4364
SHA1 71540c7c0a90433a405317b8cc751e50c29f8173
SHA256 ee246eeb813b1902c1ed170fc43eeb33d977fdb19524fd72fef9065437a85ccb
SHA512 664388c42efb14ccb94b8c2e238eceb00eebb003d783c8a5daac6b3687973b7a9060227b0fcaf1734b88273c06b7f306e002821519f5900f2ce7762b44394e2b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5wK53QE.exe

MD5 6fb498ee0a37fd29dce3a064590c4364
SHA1 71540c7c0a90433a405317b8cc751e50c29f8173
SHA256 ee246eeb813b1902c1ed170fc43eeb33d977fdb19524fd72fef9065437a85ccb
SHA512 664388c42efb14ccb94b8c2e238eceb00eebb003d783c8a5daac6b3687973b7a9060227b0fcaf1734b88273c06b7f306e002821519f5900f2ce7762b44394e2b

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 6fb498ee0a37fd29dce3a064590c4364
SHA1 71540c7c0a90433a405317b8cc751e50c29f8173
SHA256 ee246eeb813b1902c1ed170fc43eeb33d977fdb19524fd72fef9065437a85ccb
SHA512 664388c42efb14ccb94b8c2e238eceb00eebb003d783c8a5daac6b3687973b7a9060227b0fcaf1734b88273c06b7f306e002821519f5900f2ce7762b44394e2b

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 6fb498ee0a37fd29dce3a064590c4364
SHA1 71540c7c0a90433a405317b8cc751e50c29f8173
SHA256 ee246eeb813b1902c1ed170fc43eeb33d977fdb19524fd72fef9065437a85ccb
SHA512 664388c42efb14ccb94b8c2e238eceb00eebb003d783c8a5daac6b3687973b7a9060227b0fcaf1734b88273c06b7f306e002821519f5900f2ce7762b44394e2b

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 6fb498ee0a37fd29dce3a064590c4364
SHA1 71540c7c0a90433a405317b8cc751e50c29f8173
SHA256 ee246eeb813b1902c1ed170fc43eeb33d977fdb19524fd72fef9065437a85ccb
SHA512 664388c42efb14ccb94b8c2e238eceb00eebb003d783c8a5daac6b3687973b7a9060227b0fcaf1734b88273c06b7f306e002821519f5900f2ce7762b44394e2b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe

MD5 4298ad7624f1faf9a80a1c0f1cb6ef83
SHA1 f5c40f44fcbce4d1360bf667a27a71f246efaf02
SHA256 257bd7e90471a7fbfc8a0527fc997cf8667dc3707eb7c2e96e26e7f3b1efe7c3
SHA512 dc39d5a53d5e7a5520fa4d0f4d0d6185073acef0354228faf96f5eadb4ff26c56abaacba678cd39171355e27dc395e252e7dc73251fe882eb0749d6c02a2c5f4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LC40BQ.exe

MD5 4298ad7624f1faf9a80a1c0f1cb6ef83
SHA1 f5c40f44fcbce4d1360bf667a27a71f246efaf02
SHA256 257bd7e90471a7fbfc8a0527fc997cf8667dc3707eb7c2e96e26e7f3b1efe7c3
SHA512 dc39d5a53d5e7a5520fa4d0f4d0d6185073acef0354228faf96f5eadb4ff26c56abaacba678cd39171355e27dc395e252e7dc73251fe882eb0749d6c02a2c5f4

C:\Users\Admin\AppData\Local\Temp\F6C4.tmp\F780.tmp\F781.bat

MD5 5a115a88ca30a9f57fdbb545490c2043
SHA1 67e90f37fc4c1ada2745052c612818588a5595f4
SHA256 52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA512 17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0987267c265b2de204ac19d29250d6cd
SHA1 247b7b1e917d9ad2aa903a497758ae75ae145692
SHA256 474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264
SHA512 3b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

\??\pipe\LOCAL\crashpad_3180_NUUDFZHJCTGWOPBC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

\??\pipe\LOCAL\crashpad_5004_GLNEOPCKWGAVHXPV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b4da5e5d2bbcb3a02447fc26b8540509
SHA1 2724eec448440ab19708d7ba8ad66a57090803cf
SHA256 b7bf548aef9e962e0ce84c88cc035d2974ca2be0a57fc1a459a0d4b350ed0635
SHA512 5957042dd18b223dc06b260fca2f4b54feeb9540c2582fa3623f5d629a8775bf4a9affd5aa15d1a40a006f390540cf215f8de5bbdedae1059b5cba75023c6100

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dcb903571b0b63aefaeb8942721c7e3d
SHA1 3c1ba7005391b6e5dc965acac59fd2fb43c9ff09
SHA256 3a67f56abdd6682ff1a967fef0752fb168e4c7cf2ed69cccad610eaf5e08f8b4
SHA512 850988a0aeea95cac626a7343e65e0a4052c3b28f2fa1cb1ff938db0996a066ac86547ff4e8c8b2388eca193e296a07ffd5977a6935e28ceddad7668d871984a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b4da5e5d2bbcb3a02447fc26b8540509
SHA1 2724eec448440ab19708d7ba8ad66a57090803cf
SHA256 b7bf548aef9e962e0ce84c88cc035d2974ca2be0a57fc1a459a0d4b350ed0635
SHA512 5957042dd18b223dc06b260fca2f4b54feeb9540c2582fa3623f5d629a8775bf4a9affd5aa15d1a40a006f390540cf215f8de5bbdedae1059b5cba75023c6100

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7e743feceff2422aa845d108e09e0eeb
SHA1 406596b6f9cf463d9e9cac5a0fb38bd351d254e1
SHA256 54637c01576e4d00f9aea81ff648eeacf46284e5548d0425492b0573c1757c9d
SHA512 6a5615a0270e2a2b576061aefa43167b4e310aea562b7695ba03165bd97653c32c104752ed4c6ecf9eb3215864c89668a0deec8cfbe4cf55bb2d97b8019df9cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 abba7a54098153337d32f2f93d2d87be
SHA1 55a8de6a1332b09d9e8c17e29785c9450009775f
SHA256 efa8d21a5bfeec80208655c75ac58cec4c5e2b3e0bc15b2a589e00173165eb22
SHA512 4f6ec903ba22011bb9baa83bdc23a1b78c8ea40097f371ad35c579a31ede2c80e4505376a61fd432a13e5ee3a3281874e1f26b7f4127cfea17e1c6e39e719d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 4a078fb8a7c67594a6c2aa724e2ac684
SHA1 92bc5b49985c8588c60f6f85c50a516fae0332f4
SHA256 c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee
SHA512 188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f555f0036c7c3c83fbcd132d4e7cff2c
SHA1 023f3264e6a4f562456e3663370f8653ce8673bd
SHA256 b01818cfded6da92e89b6fa5120cbd1ad8d26576a6bb7777958143e607a8b17d
SHA512 62e6863ae7c6f6b28359c927ea7eca7d7da5653dfd10c5cd6922428983e8b6b2c6a50d4002f9c4d116d1e9de7859b947b804ee6eb435218c47b591cb58723694

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5861d2.TMP

MD5 550fd4f510ad92e13ddbdc7745fd5737
SHA1 e5f808735bf576be0b333259f5e47f017e9a5a4b
SHA256 7446b81ee6a9abbf7a5c1d3ee7ba4ab6ecb86e616c9666e09773ccaf547d3103
SHA512 4e70efe644d92b20a4bc34fe9cb7365685e7fea446daf1e74d570351e2874785f15d210857ff02e63ba15a86da6e4008eb5d7331d1f4a8275f48858094d82189

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 736bc7fe00cb56b51864d16f2e425e86
SHA1 8fe91c60bbdca61ff56954c2d3140f42dd37c37c
SHA256 5b8e5b109a209c9c778413d1c80c0cd1f9d1aa7b1d5111b570f22b8d25addc05
SHA512 b92316e05d21b5a0d0eb68546d869a1ccdcc7e96813cae076046071d77e6f82eb11d5b0f9222b5bbec6e9df2c9bebfa1504e3ede3793faa03717d248b2a4faf3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e358bc642c752b7dd48937cc00908901
SHA1 42d4d3c3a43e928ca63aaea69d9e45cc76a38f0d
SHA256 19689f24e327a5c5a29b05631234b2e402e5f8f2e14995c261b0e9bb3a6ac61e
SHA512 1952530625fa56376721d97ffe1c4d0237fe4b3defba2987ce46296d2ca00a4729238e0dbe423773053d73a72be6102d78041cfb9add6f45b54a38b783f0b059

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 6fb498ee0a37fd29dce3a064590c4364
SHA1 71540c7c0a90433a405317b8cc751e50c29f8173
SHA256 ee246eeb813b1902c1ed170fc43eeb33d977fdb19524fd72fef9065437a85ccb
SHA512 664388c42efb14ccb94b8c2e238eceb00eebb003d783c8a5daac6b3687973b7a9060227b0fcaf1734b88273c06b7f306e002821519f5900f2ce7762b44394e2b

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05a5ae88debb5471c0165812b4807634
SHA1 fc1f9fb451d2566d21f9f570c16a884707b06f5a
SHA256 028f92133ed1fb0fcea3361f6fa62df489cfbe1101540fa26180f6108fce1ca0
SHA512 4e2f8f2f9f589a8fa4142394bef65ca4ce8b6c275e4543efd507406d072bcbbd51021472cc560583625070e587dae340e55d68468437799efde0aaa4f79b4885

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3938e5a87bb470d78b3dd69fd5a4eba9
SHA1 2dac61f22fd5ad8787938dc3a046cfc98557661a
SHA256 dae529ba3a4d6c67eb1805035ecd6086ca77172185a05be815ff947f27b47606
SHA512 b540c942b6ef8c4b9d71676b3084f3968319f7e60cbe29090050c437f4373f1ae43cd5fd4d57006b97ea2a8dd31acb1ebcad4d30eb817f08fcdec4e412767a67

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 6fb498ee0a37fd29dce3a064590c4364
SHA1 71540c7c0a90433a405317b8cc751e50c29f8173
SHA256 ee246eeb813b1902c1ed170fc43eeb33d977fdb19524fd72fef9065437a85ccb
SHA512 664388c42efb14ccb94b8c2e238eceb00eebb003d783c8a5daac6b3687973b7a9060227b0fcaf1734b88273c06b7f306e002821519f5900f2ce7762b44394e2b