Malware Analysis Report

2025-08-11 01:11

Sample ID 231006-1cewnagb3z
Target 49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0
SHA256 49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0
Tags
amadey mystic persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0

Threat Level: Known bad

The file 49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0 was found to be: Known bad.

Malicious Activity Summary

amadey mystic persistence stealer trojan

Detect Mystic stealer payload

Mystic

Amadey

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-06 21:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-06 21:30

Reported

2023-10-06 21:32

Platform

win10v2004-20230915-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe"

Signatures

Amadey

trojan amadey

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1792 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe
PID 1792 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe
PID 1792 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe
PID 2588 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe
PID 2588 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe
PID 2588 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe
PID 1184 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe
PID 1184 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe
PID 1184 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe
PID 3792 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe
PID 3792 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe
PID 3792 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe
PID 3792 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Mq6kc40.exe
PID 3792 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Mq6kc40.exe
PID 3792 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Mq6kc40.exe
PID 2588 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe
PID 2588 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe
PID 2588 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe
PID 5028 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 5028 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 5028 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 1792 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe
PID 1792 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe
PID 1792 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe
PID 4640 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 4640 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 4640 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 1352 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 4640 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 4640 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 4160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\CompPkgSrv.exe
PID 2744 wrote to memory of 4160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\CompPkgSrv.exe
PID 2744 wrote to memory of 4160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\CompPkgSrv.exe
PID 2744 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2744 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2744 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2744 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 3276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 3276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 3276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2744 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1372 wrote to memory of 3280 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3280 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3632 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3632 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 2488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 2488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3632 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3632 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3280 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe

"C:\Users\Admin\AppData\Local\Temp\49ae095c676bfdac9759afe8d997f081cdfd986f9035009fd1890448a2c43ce0.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Mq6kc40.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Mq6kc40.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3F08.tmp\3F09.tmp\3F19.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffda0f046f8,0x7ffda0f04708,0x7ffda0f04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffda0f046f8,0x7ffda0f04708,0x7ffda0f04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7013297718525279687,13719481500281840799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7013297718525279687,13719481500281840799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4828793731122018561,16951722537926042981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5676 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 15.201.240.157.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe

MD5 4b38417a168afbf0174b05850d0c4042
SHA1 f88251c7ddd699123db31e185a39202d6aa148fe
SHA256 301dfe37c468832f341471748bf7f4934ac10636673411608c274e2d762b7679
SHA512 11e226718ffb63eebf35877b733110745d6b39269bc9e6d06e2be3c427aaa616de08cb019fab76709917cf9b5d8755c4e31377a573bf7c9ae01f8bf5270eb066

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp0yP6If.exe

MD5 4b38417a168afbf0174b05850d0c4042
SHA1 f88251c7ddd699123db31e185a39202d6aa148fe
SHA256 301dfe37c468832f341471748bf7f4934ac10636673411608c274e2d762b7679
SHA512 11e226718ffb63eebf35877b733110745d6b39269bc9e6d06e2be3c427aaa616de08cb019fab76709917cf9b5d8755c4e31377a573bf7c9ae01f8bf5270eb066

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe

MD5 3b7a74316af64f63c5852405f2f706cf
SHA1 276879e979fd8e6f071b52bc102dca67ebb77c7b
SHA256 e34889a2353dffa42a7d30f9d2cdd10b650b753f0da1550b572fa02a41b51571
SHA512 17c762b3939a99bdba6d1fb3a9fc55020ef8bf17b81346b267c881ab5cf127b9be207cfe1e010752e9afda0d65dd0d3edade26402c7028a806d9f589a5d5398e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8nx5rN.exe

MD5 3b7a74316af64f63c5852405f2f706cf
SHA1 276879e979fd8e6f071b52bc102dca67ebb77c7b
SHA256 e34889a2353dffa42a7d30f9d2cdd10b650b753f0da1550b572fa02a41b51571
SHA512 17c762b3939a99bdba6d1fb3a9fc55020ef8bf17b81346b267c881ab5cf127b9be207cfe1e010752e9afda0d65dd0d3edade26402c7028a806d9f589a5d5398e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe

MD5 6fd2cfe566a3269318188a7427eb1872
SHA1 72a7f543833759c5de5b54ce59c4123af6a000f8
SHA256 d7a22e73e78f06e74ea4612f782697bbdccdd849e3ea38614d8ad2c7855d09af
SHA512 a09d65a736577c65f4ec4e913d94dcc5c52cc8ff2a7700c976c480c9de2758727f88fd9bf38cebb6172c88def5d83400fd5d11641112f2b6e71e8c405dc37da4

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cb2Na6Ca.exe

MD5 6fd2cfe566a3269318188a7427eb1872
SHA1 72a7f543833759c5de5b54ce59c4123af6a000f8
SHA256 d7a22e73e78f06e74ea4612f782697bbdccdd849e3ea38614d8ad2c7855d09af
SHA512 a09d65a736577c65f4ec4e913d94dcc5c52cc8ff2a7700c976c480c9de2758727f88fd9bf38cebb6172c88def5d83400fd5d11641112f2b6e71e8c405dc37da4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe

MD5 49c01a26b80d69d780045d7a7d9acaf3
SHA1 ac81c5f059fd1dc37e11d2f7e09e011d6c78cafb
SHA256 562a2a95e510cf89d6ca64a65df57b91e3da8b6b97975c9e4cc7d5c987f0002b
SHA512 3217c2ff035b812b45f77a1c07052a5a6a624c52e22e15fdfc8ab23e7e9b5ad3effcb158f76bd0ee30b9a2005844cb1cb2598819c1ed3887d119c7b4de20f9da

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iV3Nm5Lm.exe

MD5 49c01a26b80d69d780045d7a7d9acaf3
SHA1 ac81c5f059fd1dc37e11d2f7e09e011d6c78cafb
SHA256 562a2a95e510cf89d6ca64a65df57b91e3da8b6b97975c9e4cc7d5c987f0002b
SHA512 3217c2ff035b812b45f77a1c07052a5a6a624c52e22e15fdfc8ab23e7e9b5ad3effcb158f76bd0ee30b9a2005844cb1cb2598819c1ed3887d119c7b4de20f9da

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1TS95QP1.exe

MD5 ff96189a7f44286fec40c3c5d52c8c10
SHA1 ae43b720a57e9431291f69bd647115c5cae2f4c3
SHA256 56113f6c52790bc58c218be08491d3bd8ffcecc39fb69e71da16ac0e47b8e62e
SHA512 bc9758c8b65beb6ffc52678ea453553e7786b25cc77889f33fe9f6380ba2e8ffbc661fdb04eb7e3d9c3eb6c89e0971a4183d50e25e0339c5df8059e97335efd4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Mq6kc40.exe

MD5 2b0034d896717efdd4a92b8e8286aef5
SHA1 0870da0caea9cbba911821d92084b087cae7beed
SHA256 0c85b594f4e1764df0712647c16e3403083c37296ab8dee5faaf57d92f69cfec
SHA512 cf4035ce2c9c874f730ed17ae19cd6785d62a4c54ab14bb735de5835d77330d520fb8ce3cc725fbba77239f8b26ec9d208b56d78311b2ed7377701b15062b6a3

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Mq6kc40.exe

MD5 2b0034d896717efdd4a92b8e8286aef5
SHA1 0870da0caea9cbba911821d92084b087cae7beed
SHA256 0c85b594f4e1764df0712647c16e3403083c37296ab8dee5faaf57d92f69cfec
SHA512 cf4035ce2c9c874f730ed17ae19cd6785d62a4c54ab14bb735de5835d77330d520fb8ce3cc725fbba77239f8b26ec9d208b56d78311b2ed7377701b15062b6a3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe

MD5 66b936a84a6e8b4b1e180bfd0fa42371
SHA1 ab03c60dac75338fb7a6331bcc2b6ecedd7786e7
SHA256 5b267054bfe85a550cd3558a87325b2bb8dbdbee224192814789155d3c104424
SHA512 45e12b14f25781a84dea27dd02a54314299d71049bcdc98c14aedfe89c10ba42bb87623711ae1a514c11e6a577c22f67751e40850eeb3e81bf107fb08d66b2a7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5lc16Sk.exe

MD5 66b936a84a6e8b4b1e180bfd0fa42371
SHA1 ab03c60dac75338fb7a6331bcc2b6ecedd7786e7
SHA256 5b267054bfe85a550cd3558a87325b2bb8dbdbee224192814789155d3c104424
SHA512 45e12b14f25781a84dea27dd02a54314299d71049bcdc98c14aedfe89c10ba42bb87623711ae1a514c11e6a577c22f67751e40850eeb3e81bf107fb08d66b2a7

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 66b936a84a6e8b4b1e180bfd0fa42371
SHA1 ab03c60dac75338fb7a6331bcc2b6ecedd7786e7
SHA256 5b267054bfe85a550cd3558a87325b2bb8dbdbee224192814789155d3c104424
SHA512 45e12b14f25781a84dea27dd02a54314299d71049bcdc98c14aedfe89c10ba42bb87623711ae1a514c11e6a577c22f67751e40850eeb3e81bf107fb08d66b2a7

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 66b936a84a6e8b4b1e180bfd0fa42371
SHA1 ab03c60dac75338fb7a6331bcc2b6ecedd7786e7
SHA256 5b267054bfe85a550cd3558a87325b2bb8dbdbee224192814789155d3c104424
SHA512 45e12b14f25781a84dea27dd02a54314299d71049bcdc98c14aedfe89c10ba42bb87623711ae1a514c11e6a577c22f67751e40850eeb3e81bf107fb08d66b2a7

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 66b936a84a6e8b4b1e180bfd0fa42371
SHA1 ab03c60dac75338fb7a6331bcc2b6ecedd7786e7
SHA256 5b267054bfe85a550cd3558a87325b2bb8dbdbee224192814789155d3c104424
SHA512 45e12b14f25781a84dea27dd02a54314299d71049bcdc98c14aedfe89c10ba42bb87623711ae1a514c11e6a577c22f67751e40850eeb3e81bf107fb08d66b2a7

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe

MD5 666e2d66e77761599b5e689908055ef3
SHA1 cd8295781622c9d46571f2a1bc23fbda73de0a5a
SHA256 1805e2bc11250b994e0b1e950a80f13dde33a9eba9a4045b5db3bfa26cd360ae
SHA512 50e4da09aa258cb2c3ae1d27aeebe61e6f4e275e6417ceabc4a6d7947b1715778833e8371a2b0bb5920a8cf177aa6efedd9f58e453e64848e2079239ed93a2ab

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6kN57kN.exe

MD5 666e2d66e77761599b5e689908055ef3
SHA1 cd8295781622c9d46571f2a1bc23fbda73de0a5a
SHA256 1805e2bc11250b994e0b1e950a80f13dde33a9eba9a4045b5db3bfa26cd360ae
SHA512 50e4da09aa258cb2c3ae1d27aeebe61e6f4e275e6417ceabc4a6d7947b1715778833e8371a2b0bb5920a8cf177aa6efedd9f58e453e64848e2079239ed93a2ab

C:\Users\Admin\AppData\Local\Temp\3F08.tmp\3F09.tmp\3F19.bat

MD5 5a115a88ca30a9f57fdbb545490c2043
SHA1 67e90f37fc4c1ada2745052c612818588a5595f4
SHA256 52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA512 17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 451fddf78747a5a4ebf64cabb4ac94e7
SHA1 6925bd970418494447d800e213bfd85368ac8dc9
SHA256 64d12f59d409aa1b03f0b2924e0b2419b65c231de9e04fce15cc3a76e1b9894d
SHA512 edb85a2a94c207815360820731d55f6b4710161551c74008df0c2ae10596e1886c8a9e11d43ddf121878ae35ac9f06fc66b4c325b01ed4e7bf4d3841b27e0864

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

\??\pipe\LOCAL\crashpad_3280_TVPLCUUUMFSVBJDS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_3632_LBWAJPUJWMHMUDJK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2ae20ec2d93c18b98d52b57bc5932a65
SHA1 6d057c9f03628390b5e6fde47ae2f450e3abd770
SHA256 2b18a1a2d9f73aa254ecb65b2f04333d1cb1f0a9f2128dfa1d6e3009d6c07dd7
SHA512 4c9568a53c554182087a4c5e851b3f36a4e6b41840110b4e5e2513739c584e6f98342fd81b4f106ee6bab5b23b8ec9ed1dd6ba7d8fc08bb4bae64e49ca0e1f39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a6b57c5cdc5b56a29d27ee3aaf502eb6
SHA1 c82d866fd01b716924513b8dbc02f4d3505dea2d
SHA256 e94d30a03cbfd167305abc41870fee21a06a3904e6b050f342ec34dc21055699
SHA512 4dfe32ec58a44643230d51fcf6af6639c532b348798f5c5b33ddf7dfefe1b17fdd3f9768cf14df27a290d6e5205dda204cf0cdfbe9e45753edf5e61a8178ad00

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2ae20ec2d93c18b98d52b57bc5932a65
SHA1 6d057c9f03628390b5e6fde47ae2f450e3abd770
SHA256 2b18a1a2d9f73aa254ecb65b2f04333d1cb1f0a9f2128dfa1d6e3009d6c07dd7
SHA512 4c9568a53c554182087a4c5e851b3f36a4e6b41840110b4e5e2513739c584e6f98342fd81b4f106ee6bab5b23b8ec9ed1dd6ba7d8fc08bb4bae64e49ca0e1f39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 de69ac0785c71c56d1eef81fa44e2263
SHA1 d06bb27fd39487d1127b94bcd00947489f93478d
SHA256 fa4961472cf88ea323fe5de1db1eb523ee7a9e46809a4fa36d43e060fadaeb41
SHA512 bbca99f5557741d65ceed885ae47c3ea8c9646cded760fd29552d8cebef7d4df81833d47dce66a2c4de392ea5f872ef9d5f86efd98de4ef7e960e41023437425

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e6c62b253c4e3b59a69aa4e11edb52bc
SHA1 5ba0a82482ef1fadcf98f4ac02eae2d4a0abec0d
SHA256 4dd32abc9c3e76c96a05dff6d66b0a05ecd59ebe8075962777220c278885b1c0
SHA512 b44b663d1df8b5a2683889e3506d71744e8a48686debae252a1e9ea95e7cf7b6491a2ebd00bfd8bc5b9184e5563f7f1c0140ad6d5888b431cabdad0f24c4c4bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 10b061cee5e39449a994da835360fa2a
SHA1 fbc833ece64ebf059a93827b7a3e99d79c451ad2
SHA256 21cbd158593c7916e989a8d6201ff7c1057ebb1f40660986d639b0da9a874533
SHA512 8db0e56ae3fe4af65b6bedda1f1e01d4efdf87f0302e8d4f9810abe990a36476f49c8c068190d2582b1fa0130c03a88ea7d3ba6be72f93e2038e1325bc467390

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ce709109ebeab5aaff4fcb0b2c74fa87
SHA1 9badd0200b10672d34e6068366a9378bfdafe386
SHA256 5e31e6e060e34beb3b959320eb87137839eb56fe88ea7f9d8c0b13833d917379
SHA512 712185f9d0502959d95468922cab9153f133a9e494a9ba3dca3f6e7be8ae6ce3db3609758b81713dc942796502d45aba37cb70f24c1c2ec2d5a833118fc0cc89

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590d25.TMP

MD5 e087526c6e5da14f91a2a5e06e3646d3
SHA1 aeb7321b493d133f358cdd8f660bbf8590451942
SHA256 217d38f657d62f387b42a0d4093fbd848c3740d1ef89ebc488b27f86a90ab57a
SHA512 61ff3f74a2931069b1b829b41b32bf5098fb7b1b99eaebc36fa4a45fbddcd3161fcf04ab8d8adbb0d9e63dc395c7585dbe375fa7daf7cf1d8c9015d38aa3918b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f7267d4c69f56cb1026eb40eec68d2d4
SHA1 ab3617ed1af657a5a402014c6720199f96a2ca77
SHA256 77539f6ccb26045acfcba1ad3c0f4bde87980ca8fd751c2d07270fdc065f19ed
SHA512 828a4e9c6982628009a12cd63339bd68a50dac1599a20730e5a5f6647601afc64b7b515c696cbcda85ed5c9dbde4fcec8f15c3505ec09ede03721e7add7e7a04

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f36e3643232547912d0c1c7bf6411bce
SHA1 06d2195966afafafe84c1df29e07a19c3aeda3eb
SHA256 f7a5dc606b07611a37d823129ad26bfabafcad02225547b99fb2465ed0816393
SHA512 21dbbd00798a14e7ec166008e9d190a8573f02f9179735f461efcf70c458e3e234cb36e04c01d35a86f28db30c3bd038c3e4d65a86a2269f4e338400253daffe