Malware Analysis Report

2025-08-11 01:11

Sample ID 231006-z78xjsac56
Target 40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59
SHA256 40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59
Tags
amadey mystic persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59

Threat Level: Known bad

The file 40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59 was found to be: Known bad.

Malicious Activity Summary

amadey mystic persistence stealer trojan

Amadey

Detect Mystic stealer payload

Mystic

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Creates scheduled task(s)

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-06 21:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-06 21:22

Reported

2023-10-06 21:25

Platform

win10v2004-20230915-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe"

Signatures

Amadey

trojan amadey

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3872 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe
PID 3872 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe
PID 3872 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe
PID 4828 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe
PID 4828 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe
PID 4828 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe
PID 2340 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe
PID 2340 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe
PID 2340 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe
PID 1524 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe
PID 1524 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe
PID 1524 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe
PID 1524 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3eH5lK72.exe
PID 1524 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3eH5lK72.exe
PID 1524 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3eH5lK72.exe
PID 4828 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe
PID 4828 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe
PID 4828 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe
PID 3148 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 3148 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 3148 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 3872 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe
PID 3872 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe
PID 3872 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe
PID 2468 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\schtasks.exe
PID 396 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe C:\Windows\system32\cmd.exe
PID 396 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe C:\Windows\system32\cmd.exe
PID 2468 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4852 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4852 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4852 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 3996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 3996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 3996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4852 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 904 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 904 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 904 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 904 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3752 wrote to memory of 532 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3752 wrote to memory of 532 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1972 wrote to memory of 5108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe

"C:\Users\Admin\AppData\Local\Temp\40ddf9cdccfbc713c3a01e64546d89c257c11c58d9d1ef70021a5ff9d3ee3b59.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3eH5lK72.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3eH5lK72.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5222.tmp\5233.tmp\5234.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffb8a2c46f8,0x7ffb8a2c4708,0x7ffb8a2c4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb8a2c46f8,0x7ffb8a2c4708,0x7ffb8a2c4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2069756225142534361,8025771302038809830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2069756225142534361,8025771302038809830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,2469053584571649347,5906647078505284852,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3264 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 8.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe

MD5 ffeeec62aa9d7b4ac793a03199d6a18e
SHA1 c85390404e1dd8460482b06428f375d1c11e064c
SHA256 6048fa06c366f872cc4ba614c8e95f86aab91301d76c8c83c2ce8fc5f9c8e207
SHA512 916cd4f8978be084ca7466c7c4b5c9135e85cb74c10ce44f95fc246c3afacb6f8499fb48cba4d6b851db358aeb753e4bfbc88ee46024853b99f20c5e08352986

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tI7fS7ll.exe

MD5 ffeeec62aa9d7b4ac793a03199d6a18e
SHA1 c85390404e1dd8460482b06428f375d1c11e064c
SHA256 6048fa06c366f872cc4ba614c8e95f86aab91301d76c8c83c2ce8fc5f9c8e207
SHA512 916cd4f8978be084ca7466c7c4b5c9135e85cb74c10ce44f95fc246c3afacb6f8499fb48cba4d6b851db358aeb753e4bfbc88ee46024853b99f20c5e08352986

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe

MD5 14b61ab82d65563b086d860d94f8d0f7
SHA1 d21614d93fca7a7604b038f9b5b01074e63beebc
SHA256 4d37dbc5bc640a48ef878244c9f03c0a4a1c0246484b87e55644b3e66a93b7a9
SHA512 3b25e2d807e4a1ad1160ac4a1b3a9e4b365d4f985eadbe040a762a78f2f268e41e2bd8664f1f8665685e824e3bc1ee13102692d5a2f18291f21e342b80602c98

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gj0sz0LC.exe

MD5 14b61ab82d65563b086d860d94f8d0f7
SHA1 d21614d93fca7a7604b038f9b5b01074e63beebc
SHA256 4d37dbc5bc640a48ef878244c9f03c0a4a1c0246484b87e55644b3e66a93b7a9
SHA512 3b25e2d807e4a1ad1160ac4a1b3a9e4b365d4f985eadbe040a762a78f2f268e41e2bd8664f1f8665685e824e3bc1ee13102692d5a2f18291f21e342b80602c98

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe

MD5 ad3d9e997ce051f2b1da834991c937dc
SHA1 6da7c1df45da6a3bda3cd877eded5445c3b33eee
SHA256 0e3d3a1d94d6896313079574098e414143975f9b9abcd14be8b8183615571707
SHA512 8ff20cfc98fadf78fb2953205f7269c2b237b9804347ea284b0cadc97085d2732a822ad526f749fab689075c16a630386f014bfcdb69f7d73c0ad0d2d7347efa

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VI7sF7Ad.exe

MD5 ad3d9e997ce051f2b1da834991c937dc
SHA1 6da7c1df45da6a3bda3cd877eded5445c3b33eee
SHA256 0e3d3a1d94d6896313079574098e414143975f9b9abcd14be8b8183615571707
SHA512 8ff20cfc98fadf78fb2953205f7269c2b237b9804347ea284b0cadc97085d2732a822ad526f749fab689075c16a630386f014bfcdb69f7d73c0ad0d2d7347efa

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe

MD5 4f1f48422f2b6d2a216cd185b59c3977
SHA1 76a00372bffc7d6e9ae6d9298f716e22ae15257a
SHA256 d61ddc0fc9e7526e5ca1ce01ca71576d3626233c24e092ea03c102451cb30dd2
SHA512 3cca2718e54ff5389ef46ef9174fae3dc3e7bfa883fbac7255a8da0d0fdfd213b75ec96b4264fca7724bbe8537f859ba62e73a4ee37f626e6d05efdbd78db78a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uz2LV9td.exe

MD5 4f1f48422f2b6d2a216cd185b59c3977
SHA1 76a00372bffc7d6e9ae6d9298f716e22ae15257a
SHA256 d61ddc0fc9e7526e5ca1ce01ca71576d3626233c24e092ea03c102451cb30dd2
SHA512 3cca2718e54ff5389ef46ef9174fae3dc3e7bfa883fbac7255a8da0d0fdfd213b75ec96b4264fca7724bbe8537f859ba62e73a4ee37f626e6d05efdbd78db78a

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1rH77ye1.exe

MD5 c749a20dba44cee4515c8ab1d0e386b9
SHA1 906f23eb3d60d49e3a6ed9ed3a91face9234a250
SHA256 e8093509232fa7fa56eb67285f140ed6eb909ab17a100c27fea87728e1cdb69e
SHA512 da2ed0646f8b28b5bb12f00fae5f3965127507a8ee0aa844226bfc34eb1b0392118922fc4f3b29f56c606f225d517601ff769fe9158069bf510bbef4089e235b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3eH5lK72.exe

MD5 5505d5079f5209733149fb989f4b4216
SHA1 c2b327b1e8305bce1b0564a421fcf269367699fe
SHA256 5d8d3c19ef29e9558041c19e8113be9c2339d2f445912508c0642fe46c3535c8
SHA512 3dfe382af1f31b7f76018adcf6ca4f71ef6216df339f40f6ca9ecf388a743729f400d025441ff1ee144a330e078f33b23e226cd812c58a891230b389f8344298

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3eH5lK72.exe

MD5 5505d5079f5209733149fb989f4b4216
SHA1 c2b327b1e8305bce1b0564a421fcf269367699fe
SHA256 5d8d3c19ef29e9558041c19e8113be9c2339d2f445912508c0642fe46c3535c8
SHA512 3dfe382af1f31b7f76018adcf6ca4f71ef6216df339f40f6ca9ecf388a743729f400d025441ff1ee144a330e078f33b23e226cd812c58a891230b389f8344298

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe

MD5 fb061e8f84fb9d5581a84d81475d97d9
SHA1 e2b35d3ff0241ed1a73117680a00c93b416efe43
SHA256 d9f62e96c3bfde46a9740f3f3f4fa61dbf2b1dde5b3aa9b8147eccb5afbf787a
SHA512 d02718ad25a950c4282c2b72e1af275963fa8de8d94398ea0b561f494f23c3240ef7e52e9420d41af1f9813de2ab640feaabe54ff0bdfa3bc7e7caf573aba224

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5xa46UZ.exe

MD5 fb061e8f84fb9d5581a84d81475d97d9
SHA1 e2b35d3ff0241ed1a73117680a00c93b416efe43
SHA256 d9f62e96c3bfde46a9740f3f3f4fa61dbf2b1dde5b3aa9b8147eccb5afbf787a
SHA512 d02718ad25a950c4282c2b72e1af275963fa8de8d94398ea0b561f494f23c3240ef7e52e9420d41af1f9813de2ab640feaabe54ff0bdfa3bc7e7caf573aba224

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 fb061e8f84fb9d5581a84d81475d97d9
SHA1 e2b35d3ff0241ed1a73117680a00c93b416efe43
SHA256 d9f62e96c3bfde46a9740f3f3f4fa61dbf2b1dde5b3aa9b8147eccb5afbf787a
SHA512 d02718ad25a950c4282c2b72e1af275963fa8de8d94398ea0b561f494f23c3240ef7e52e9420d41af1f9813de2ab640feaabe54ff0bdfa3bc7e7caf573aba224

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 fb061e8f84fb9d5581a84d81475d97d9
SHA1 e2b35d3ff0241ed1a73117680a00c93b416efe43
SHA256 d9f62e96c3bfde46a9740f3f3f4fa61dbf2b1dde5b3aa9b8147eccb5afbf787a
SHA512 d02718ad25a950c4282c2b72e1af275963fa8de8d94398ea0b561f494f23c3240ef7e52e9420d41af1f9813de2ab640feaabe54ff0bdfa3bc7e7caf573aba224

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 fb061e8f84fb9d5581a84d81475d97d9
SHA1 e2b35d3ff0241ed1a73117680a00c93b416efe43
SHA256 d9f62e96c3bfde46a9740f3f3f4fa61dbf2b1dde5b3aa9b8147eccb5afbf787a
SHA512 d02718ad25a950c4282c2b72e1af275963fa8de8d94398ea0b561f494f23c3240ef7e52e9420d41af1f9813de2ab640feaabe54ff0bdfa3bc7e7caf573aba224

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe

MD5 ec870b37faf24d6eeea70ec1cc585b98
SHA1 eb121ae551d1e679af1dbde73709317ef93e3ba0
SHA256 193a2c9569c3d94760e6e3ea9eb828fdfb89aef2238181b314679185000ccd5d
SHA512 b0d88a3312d044edaaf5055c5d870471ea653df59ed2f609e4ea203b7ed3a75140df164e4d2a87794faf61e9314253937dff8c5953c4f1fcb5719c6c3ad8a37b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pE34vH.exe

MD5 ec870b37faf24d6eeea70ec1cc585b98
SHA1 eb121ae551d1e679af1dbde73709317ef93e3ba0
SHA256 193a2c9569c3d94760e6e3ea9eb828fdfb89aef2238181b314679185000ccd5d
SHA512 b0d88a3312d044edaaf5055c5d870471ea653df59ed2f609e4ea203b7ed3a75140df164e4d2a87794faf61e9314253937dff8c5953c4f1fcb5719c6c3ad8a37b

C:\Users\Admin\AppData\Local\Temp\5222.tmp\5233.tmp\5234.bat

MD5 5a115a88ca30a9f57fdbb545490c2043
SHA1 67e90f37fc4c1ada2745052c612818588a5595f4
SHA256 52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA512 17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3478c18dc45d5448e5beefe152c81321
SHA1 a00c4c477bbd5117dec462cd6d1899ec7a676c07
SHA256 d2191cbeb51c49cbcd6f0ef24c8f93227b56680c95c762843137ac5d5f3f2e23
SHA512 8473bb9429b1baf1ca4ac2f03f2fdecc89313624558cf9d3f58bebb58a8f394c950c34bdc7b606228090477f9c867b0d19a00c0e2f76355c613dafd73d69599c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

\??\pipe\LOCAL\crashpad_3752_TGTONJEAHGGMHSSB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_1972_OGYAEDCUTUKAYTOY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8e4da3fbef3428bbc6a3dd0b8eefcae9
SHA1 0d266ee814e1ea759f551ab89fed3f728e3e9850
SHA256 865ca6482e3fed72ae344903000eede18ec0eaa65b9d65e4e96b0cc3724309f1
SHA512 269a59652c03ca2b24b0b47e782af64e16d774778053331eb47b93990b4945f67b084fdaf2a4d6d450c8f9c2387b1fa807e963b045df903769d1ea43e6f8f2e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ca494f4ea516fbc204e9374a5494d8f9
SHA1 1ac6979af815a19341d3e10adf3f7a030b20ad04
SHA256 ee98e245da8d0a44d0f7a48769c9643e352f64caa3dd3785c35ac8247b230108
SHA512 1298e6e7fe2935182cd3447934b81e25ca21c9994b6c384e24c3689879b8d62a5afaa77f66580f67e7c123454c748d528cccd534e76a5c197d4d661f589212c9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b05d61446b74e01b50889f8a8d81c5a8
SHA1 f6f283942f493b00e5307545cd6bc4c7523b2185
SHA256 adcfbdb4d164fa318baa7d8bd460c94a45f71c8a1f38ff5a7f2a1f4eccaf47fc
SHA512 87c5d271ffbb3f473663df5ec4a8392965356be2cb85ebe412a5c8a5420dac38bb5276fc847e66b1679376f17699f1fb136c818c697f32876568094a541f3a64

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8e4da3fbef3428bbc6a3dd0b8eefcae9
SHA1 0d266ee814e1ea759f551ab89fed3f728e3e9850
SHA256 865ca6482e3fed72ae344903000eede18ec0eaa65b9d65e4e96b0cc3724309f1
SHA512 269a59652c03ca2b24b0b47e782af64e16d774778053331eb47b93990b4945f67b084fdaf2a4d6d450c8f9c2387b1fa807e963b045df903769d1ea43e6f8f2e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a7a91d2cbf4856c3b0125438fc891699
SHA1 69ae2b034e805a86d8ee551b4bc844dca861c79b
SHA256 81507634994f14c0db49f9a6f69ad222d28138286584dfa67e5cf42a976d9904
SHA512 4dbde072a099b270d856b447efbca92a56c707eece4e55b91e5fd6c0fcb7b8eb3a11eab344dc09345f1d450abd42c7fd5223d04510526174d12ec5f1b7ac4643

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d555d038867542dfb2fb0575a0d3174e
SHA1 1a5868d6df0b5de26cf3fc7310b628ce0a3726f0
SHA256 044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e
SHA512 d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9d2d17fd5b6f8816ab38dd048bd37b69
SHA1 06f48b4a50e2c2736e87d78521c02dc8f68b38ca
SHA256 b8c8f03cdb8d11c31c6954618e091270659c73cc69702e9398c437b413a14213
SHA512 f254aa370f049a31a56143a40c780c613f7ce68d1c42be749880f0380856a380b3fcce9f8b60cabdf046efb1897d78d4d35b4785e2c585f39ecedd94e565e677

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b040.TMP

MD5 eb22ea719bd7a39fbb2c9c5f12979649
SHA1 7823b0d481ea61c3661eec35710eeb4936ca5f70
SHA256 ad75fa74257044dc742c82663e5edda37a956d258d37b0f7d0fc901a42fed7b0
SHA512 b8df465f793d9d1053efa905fb984c371c17f7a0b85de312cdfd17427ef86db9699d42f49357198a4e99d8db30ab05756cc65153300a23d838296277cf646f09

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 db323d54813918e82093e70b0be7ec25
SHA1 07885c98aa7d2f52d5525e76cecb6395b5d231ca
SHA256 5b62088f7691d3cc26dc376136050bbd8c0f1df037027f6ea8b2104db9b08395
SHA512 2a5ff04b0eee5b1c6b333ab7f651bb1f85890a9befb54e2b0a289d1ba15a4b1e46a054857b8c4c0556d2184d969d2b4092e8bba18dd0ca028f21c27a4330382e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fecefde98eb4c402d133f4dea963544f
SHA1 fa12f14c9d91a9bb82f11595045784f40a6c76e1
SHA256 b28eced1a94e8061e3e6227303ccb23322fa473e248332732eed7eb250695795
SHA512 a474a8b5e42235e8de30ac1d8539e3df350d88e9f68d28c398531ee2d9d9eafef65bf730de5370f989f02053e7daee71630858343826f2d74e9bb38eb949a4d4

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 fb061e8f84fb9d5581a84d81475d97d9
SHA1 e2b35d3ff0241ed1a73117680a00c93b416efe43
SHA256 d9f62e96c3bfde46a9740f3f3f4fa61dbf2b1dde5b3aa9b8147eccb5afbf787a
SHA512 d02718ad25a950c4282c2b72e1af275963fa8de8d94398ea0b561f494f23c3240ef7e52e9420d41af1f9813de2ab640feaabe54ff0bdfa3bc7e7caf573aba224

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 38ea568de0302e2adf9091b0930bcd99
SHA1 d3a634c486a0f095dea0c6bbdbd1aac582ca4cf6
SHA256 a03657353a8ef4efa705cb70db2ab13033eb649cbb81c1b809a2a36033916393
SHA512 4a08e89959bda6ecbbc68095b3c8e6a8718a3cb638da3750dddd29afc4341e8e6c255ae8d60d7670444375fa5d6e86d57868411fbaab1f31a296ecd3fe771518

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 81ebd9a1dafd455afd33da85426ab919
SHA1 24b4e5b64d28567dffec3faa4beed769754780e5
SHA256 5bf2978a5cc636ea85b2fabf5e152492ae9dc00efcd6d49e49c2412a5c21cb67
SHA512 5887e331298ed057e1ed53f4ec72937bebce804b7c41a7884e75b5007554a9e525365a81e309926fabe865aeb2c3b7e9a3ed04b7553c6419480ab18019695559

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 fb061e8f84fb9d5581a84d81475d97d9
SHA1 e2b35d3ff0241ed1a73117680a00c93b416efe43
SHA256 d9f62e96c3bfde46a9740f3f3f4fa61dbf2b1dde5b3aa9b8147eccb5afbf787a
SHA512 d02718ad25a950c4282c2b72e1af275963fa8de8d94398ea0b561f494f23c3240ef7e52e9420d41af1f9813de2ab640feaabe54ff0bdfa3bc7e7caf573aba224