hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

24-02-2024 23:16

240224-29fd5ahd4w 10

24-02-2024 22:21

24-02-2024 22:06

24-02-2024 22:03

24-02-2024 21:54

24-02-2024 21:50

Analysis

max time kernel
245s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

hoex.exe

pid process

5088 hoex.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

satan.exe

description pid process target process

PID 4612 set thread context of 1864 4612 satan.exe satan.exe

pid	process
5088	hoex.exe

description	pid	process	target process
PID 4612 set thread context of 1864	4612	satan.exe	satan.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exesatan.exe

pid	process
2184	msedge.exe
2184	msedge.exe
2732	msedge.exe
2732	msedge.exe
2472	identity_helper.exe
2472	identity_helper.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
2936	msedge.exe
2936	msedge.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe
4612	satan.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2732 msedge.exe
2732 msedge.exe
2732 msedge.exe
2732 msedge.exe
2732 msedge.exe
2732 msedge.exe
2732 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2732 wrote to memory of 3256	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3256	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 2184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 2184	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3020	2732	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f38a46f8,0x7ff8f38a4708,0x7ff8f38a4718
2⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
2⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
2⤵
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1700 /prefetch:8
2⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,12645484300165562877,16695761758402935680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5032

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\satan.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\satan.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\satan.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\satan.exe"
2⤵
PID:1864

C:\Users\Admin\AppData\Roaming\Lygu\hoex.exe
"C:\Users\Admin\AppData\Roaming\Lygu\hoex.exe"
3⤵
- Executes dropped EXE
PID:5088

C:\Users\Admin\AppData\Roaming\Lygu\hoex.exe
"C:\Users\Admin\AppData\Roaming\Lygu\hoex.exe"
4⤵
PID:976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_d8c6e887.bat"
3⤵
PID:4728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e189354a800c436e6cec7c07e6c0feea

SHA1
5c84fbda33c9276736ff3cb01d30ff34b032f781

SHA256
826adca1e688de79a3ec5b91c75990927fb2a33ae717f474608c68336053f427

SHA512
ceb069a5e83a634503e253846fa17b8bf7aaa539c3353ce61251633d69068e24c5eadd1b496f43058790d2b513e65d2c0b0213730813d0b58bb82a00596e05e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b9e3e150cfe464e9ebf0a6db1aa5e7a2

SHA1
3cb184e2781c07ac000661bf82e3857a83601813

SHA256
2325a6292907263d1fb089a09f22fbcc6bad56f4961d427efdef1abaef097bcc

SHA512
f5eb1e76eb9441cf5000d8d4db9296077b61714ead5012779c084b37f4bba07614055738f5dce69b13b25975d9b7c03eab049b7685eee09b23fd8d4a7d71a039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
f58fa5650237c178ac4061b496366629

SHA1
e597d9881676f5fdfc22b8435b1605f85790122b

SHA256
59dd32d1481b9c8aba0c58175b10d245e4c8309d2ebdd6e7e60744cccca4d371

SHA512
defd074a62695b50a4d0237b28b95d3543202cd82e79636e4e3de0b21355f50879a9b4def2181b9659a04c74eca2a25672b96e902bcfc396e6e3ff46e02b62f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
573B

MD5
ec360c67d7ab674fd38034e971b8c213

SHA1
20880ff8b4282a0eb7620c577a57419d613b88de

SHA256
c6513e129439350e72c738b6a83d0117e098c74c79abcf272c1a1cc9b2c8b24f

SHA512
e43e294168ffc608405331f803fd7c0041db617eaa3b496030d00ecc4ee3786dbb4096c55131107e3f60d2a1eec433ab186dc7d8041c824022e24ac7ded22276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
496B

MD5
c14622ac093e9a56252ae5e4c89a70e6

SHA1
23d7f54a7bd60a7382389900e1c18f0e3e1676eb

SHA256
6bc082035c85ab8ef7afe77c7642162b4c141e08276e2bacecfacc73f4194e3c

SHA512
30139dbf0ac3e3534093b124ed159855a7c394b8ea4d1021b07552347d154bbbfa3d0395dff6681b27e88823e6378607cb4dc1e5580c7013efb21655c1116bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
12c30785acadfcee618e554d0acc413b

SHA1
51c9b418558e8187e043ad3fee2d6cb0a2a4e5ce

SHA256
9619eb6ae018b3119a2e96ecfb60b36a776533772cdeb9f39c739cc61729e45b

SHA512
027741d7782b093dc5f099d582edc58dab7c24f3dc37134893e11fa1c056b1ae555b3e373ab0826bbb5b0bbb2b8a201f0a39edcf88f498c3220087b59f967081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6f792e802b71ebc0f199d748c919cf7e

SHA1
b1e5a2aef5254b68727d0b8e9abe4ab2f4813581

SHA256
2a7ae9df81e92770c9dee950d7a32288d4b0e751e27f7a0193a27708721080db

SHA512
eda93e07acea591bfc83eb5bd40215051f40362ba8f3602b92ecac31f0ceb2830c7bc3d35e5f764da8d33b31a2ac49b377e45698c7fc373b48bd34b2d8f63945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0a16578351c026b0a2a3e747a3a90253

SHA1
dd65266a30f64169fd3bbf433603415fc4bdf2c5

SHA256
e26a2f68fb83f89e16fcd504dcae828463387d2cd3d064c58b6324feac197017

SHA512
6ad0655179f8741f4b95159bc3147c4c7cc998b4341c1a853aee5c62c69b97a733d4e879421156d8abc68ca30df417e0e1422366b17cb82feda3bd7fb97a4858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
581995d51f0343d300aec3a3555bdfff

SHA1
9165c4892dcf5d2d36a1ad1b12d6043b53164c23

SHA256
1aa56a2ec0fb4e93c2d9ae06f7bb5f3e10ad3ff9f219083f9f1aca63c7f923b7

SHA512
a58fab08019dc46ba44d280e96d9e220338b4b01478fd7010a4fe01b80482b0d4f0564f69028e51d61ecb2bce040f8423c5830bf7f7dc71ede9569dc9aba5168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587f0e.TMP
Filesize
874B

MD5
0418b7510736ecfe570b42177fcc2db2

SHA1
2cbe62e5f30450cae513d5ad1fef0339a3dd8954

SHA256
2c0ac38747748ca666226ae72e1fcec674faafb7cadf56a4de745e0b1a36778a

SHA512
6dcc660d295f24e144a43d76142de8ac55044bbf3e086fdc43b2899cce02b8c70d08901e050f3b69cdccff45114fc32a27fda06ae33ff471c6ee28ef4619fccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c0018a293cfe326353fe09f923cc86cd

SHA1
a2064dad13bb44618be93949f1332f043dd32b58

SHA256
66ed96cbc039eeab149b74f04f8e2cf20a0796b808db2561f7c90862d72f33d6

SHA512
280adbff51ce20918fb822eff0c5d39aeb97f42cfb89189cc1f26d38234c342e5344f4fdf714351431bc84308e4d36516e662cd837af0e91f684f76ced682f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
3596ac215bd3685ac71dedf501834975

SHA1
8077c6829281016d8dc09f1766201e7a79e9105d

SHA256
7f48d11db79d34afe6c8bc73ad260f89512b5dc42659fc7cb50b0b1516d7c5f6

SHA512
cd2909ab066fe6f46be588f1ffce0e211612c1d9e0d542d749822e8efd5cf728a98259aae95a0c7f423c6c9c6cb2155785b79eb6d84bcb9a07184cecd6ba6d58

Download Submit
C:\Users\Admin\AppData\Roaming\Lygu\hoex.exe
Filesize
67KB

MD5
305466d30e4bd8d8025a49ed32b8ba35

SHA1
5fd2395ddaf51bd68218971f2d4c0c11281ce365

SHA256
cd3b58584ee3ba07250488c9011e08305d171e7105bc2a880d809faff1d5dde0

SHA512
bb1b3b9710187049906527a9714ad2d06593a079411584c4c952bf7ffa1e1001619e59cdbd8f7407f931970769a138999ecf9917c195af5251222a12988a1a3f

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip
Filesize
198.8MB

MD5
af60ad5b6cafd14d7ebce530813e68a0

SHA1
ad81b87e7e9bbc21eb93aca7638d827498e78076

SHA256
b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

SHA512
81314363d5d461264ed5fdf8a7976f97bceb5081c374b4ee6bbea5d8ce3386822d089d031234ddd67c5077a1cc1ed3f6b16139253fbb1b3d34d3985f9b97aba3

Download Submit
\??\pipe\LOCAL\crashpad_2732_XOMVTJPUOCRNNGYS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/976-347-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/976-356-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/976-352-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1864-339-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1864-338-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1864-345-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1864-336-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3084-355-0x0000024FD20F0000-0x0000024FD2107000-memory.dmp

Filesize
92KB

Download
memory/3084-362-0x0000024FD20F0000-0x0000024FD2107000-memory.dmp

Filesize
92KB

Download
memory/3096-358-0x000001ABAB1B0000-0x000001ABAB1C7000-memory.dmp

Filesize
92KB

Download
memory/3168-360-0x000001CCBD120000-0x000001CCBD137000-memory.dmp

Filesize
92KB

Download
memory/3796-373-0x000001CDEE340000-0x000001CDEE357000-memory.dmp

Filesize
92KB

Download
memory/5088-354-0x00000000009B0000-0x0000000000B51000-memory.dmp

Filesize
1.6MB

Download
memory/5088-353-0x0000000000170000-0x0000000000200000-memory.dmp

Filesize
576KB

Download
memory/5088-357-0x0000000000B60000-0x0000000000C0C000-memory.dmp

Filesize
688KB

Download
memory/5088-359-0x0000000000D10000-0x0000000000D32000-memory.dmp

Filesize
136KB

Download
memory/5088-351-0x00000000006E0000-0x00000000009A9000-memory.dmp

Filesize
2.8MB

Download
memory/5088-349-0x0000000000410000-0x00000000004CE000-memory.dmp

Filesize
760KB

Download
memory/5088-361-0x0000000000D40000-0x0000000000D6B000-memory.dmp

Filesize
172KB

Download
memory/5088-365-0x0000000000D70000-0x0000000000E0E000-memory.dmp

Filesize
632KB

Download