asyncrat | hxxp://ser[.]nrovn[.]xyz/langla[.]exe

Resubmissions

19-10-2024 19:29

241019-x7c4rswdqp 10

19-10-2024 19:23

241019-x3x85swbpm 10

Analysis

max time kernel
54s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ser.nrovn.xyz/langla.exe

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ser.nrovn.xyz:6606

ser.nrovn.xyz:7707

ser.nrovn.xyz:8808

Mutex

nfMlxLKxWkbD

Attributes

delay
3
install
true
install_file
http.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 13905.crdownload	family_asyncrat

Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

langla.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation langla.exe
Executes dropped EXE 3 IoCs

Processes:

langla.exehttp.exelangla.exe

pid process

1848 langla.exe
5960 http.exe
6000 langla.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	langla.exe

pid	process
1848	langla.exe
5960	http.exe
6000	langla.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

timeout.exeschtasks.exehttp.exelangla.exelangla.execmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	http.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	langla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	langla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5820 timeout.exe

pid	process
5820	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

taskmgr.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings taskmgr.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 13905.crdownload:SmartScreen msedge.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

5844 schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskmgr.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 13905.crdownload:SmartScreen	msedge.exe

pid	process
5844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exelangla.exetaskmgr.exemsedge.exemsedge.exe

pid	process
5112	msedge.exe
5112	msedge.exe
1540	msedge.exe
1540	msedge.exe
2452	identity_helper.exe
2452	identity_helper.exe
1088	msedge.exe
1088	msedge.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
1848	langla.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
5020	msedge.exe
5020	msedge.exe
5348	msedge.exe
5348	msedge.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exemsedge.exe

pid	process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

langla.exehttp.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	1848	langla.exe
Token: SeDebugPrivilege	5960	http.exe
Token: SeDebugPrivilege	5960	http.exe
Token: SeDebugPrivilege	6080	taskmgr.exe
Token: SeSystemProfilePrivilege	6080	taskmgr.exe
Token: SeCreateGlobalPrivilege	6080	taskmgr.exe
Token: SeSecurityPrivilege	6080	taskmgr.exe
Token: SeTakeOwnershipPrivilege	6080	taskmgr.exe
Token: 33	6080	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6080	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exemsedge.exe

pid	process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exemsedge.exe

pid	process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1540 wrote to memory of 3192	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 3192	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 4728	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 5112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 5112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe
PID 1540 wrote to memory of 1112	1540	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ser.nrovn.xyz/langla.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0x100,0x104,0xd8,0x108,0x7ffe3d8746f8,0x7ffe3d874708,0x7ffe3d874718
2⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
2⤵
PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
2⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5652 /prefetch:8
2⤵
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
2⤵
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
2⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6436 /prefetch:8
2⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,12009335053157540729,10071417445646069619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1088

C:\Users\Admin\Downloads\langla.exe
"C:\Users\Admin\Downloads\langla.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"' & exit
3⤵
- System Location Discovery: System Language Discovery
PID:5720

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"'
4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB67F.tmp.bat""
3⤵
- System Location Discovery: System Language Discovery
PID:5744

C:\Windows\SysWOW64\timeout.exe
timeout 3
4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5820

C:\Users\Admin\AppData\Roaming\http.exe
"C:\Users\Admin\AppData\Roaming\http.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5936

C:\Users\Admin\Downloads\langla.exe
"C:\Users\Admin\Downloads\langla.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6000

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=hnaorh.exe hnaorh.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe3d8746f8,0x7ffe3d874708,0x7ffe3d874718
2⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4706495529373102600,2676109523579420263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4706495529373102600,2676109523579420263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4706495529373102600,2676109523579420263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
2⤵
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4706495529373102600,2676109523579420263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4706495529373102600,2676109523579420263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4706495529373102600,2676109523579420263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
2⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4706495529373102600,2676109523579420263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
2⤵
PID:2584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\langla.exe.log

Filesize
522B

MD5
acc9090417037dfa2a55b46ed86e32b8

SHA1
53fa6fb25fb3e88c24d2027aca6ae492b2800a4d

SHA256
2412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b

SHA512
d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93a1e03984b4fc27c9ad84bcde837743

SHA1
7561ac6f2ef7adb7d9c249e0160d561acc60188e

SHA256
710df1eef2ae6e43f1481949a2ee0c3447a369c1fab693fec470bce0358bab1e

SHA512
ead3d1d6c5128936d8eb2eecf2e6d17fa1c2df9b220d17a2e777cb359ef64b44aa95bffa5c3acebce0ad10cb494fa2b083ade2cc3ad2475956e102bfd4e85d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
17d3cb0ef5cce51c7e5f2cee7c8d1e1a

SHA1
d0efc3c4ec7c80ef836dacd90ce9209273d55d79

SHA256
2088ea9fc0e97367b2e42a7a15c0ad34d6b28bf10c6a276d7870f0fb327df5f3

SHA512
88e8db75b7a8e73ac73988c967aa2c8a89522332f572e4ea96a6ed2f6e569d2e8963df3f9f4380d2d28f224a9b0991b4c5981bb436f12d3e965efee83e5e031b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
449b7b226e5076ccb3c9cc6b298378d8

SHA1
204d67c52702b3977e87fff6db06f6cecabb95b4

SHA256
ab6f7b0c0ae5350421d681761b2a386004499d681132f6de44cbe784bb84e383

SHA512
9532bb477d00955f1501652609b6dca9b960c3be7011b732b8eb07cb51c0dfe5cfb63164de3d78b7277f373f7e7f3e01c7b982ce4a94de0950763349c1103114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
6004c90f97be54ba6f20a3b460097f89

SHA1
2b40493028e28565977d9de9c15a5b79f58cdb9a

SHA256
efdb10bea0215fb7a4fc3641654e1e0d3a782c4d81d90322df66e52ad4ac9aa4

SHA512
0243f815556e915ece6a8586528316c0ef8f7e1ce59df156a443707a9dd36f2b8fdad4b10c1c3692058f608bb3847e9ad4c31822e76b7f39ea17bf3ac39fd110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
da4d1d2c93f7bd30d918393a326ab103

SHA1
ccb7aee9158cdbde1af0258300dccddb029ee70c

SHA256
6fcf8351b450cecff0aff94bf8d3b35fb3c94170de3fa43399e1d18c45446b5e

SHA512
171b80babfb8a2e373ed4ce974a2f32ade7917549f88bd10ddfeeca01d1e1ae1678c4717688285e145b97a00245aa3f414e84004d0a889972e45fdedf6f3a262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
76a18243bbed11d393306f1971b78dd2

SHA1
d1fb544dc5ce555d9ced4250a32530e60eb3578b

SHA256
5591915e6d62162575c14ac14937ba2988981d7fbd81147e8fa54908a37229f0

SHA512
394b1a73eb4299f5a8ec916caf2833dd69ba662f9ec6b67947e840162aa306cc32ccdf008c2033830c35c22b1ccea623fca65ca66a057c66792bd15eddfd558a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
4986e23a110103b6c0c9866fed3f3e00

SHA1
b6c459eececcdeee896db95307f8578be0f7bf8c

SHA256
6ad3b4180fdd842695989bd5e63e319357c271ecded68d554bcba8a60e7a0c66

SHA512
f283027e776d48a595ffef004aab0f2d4630404f06f3f8dd8ae8aebbabb2274c23fea175ec958dc321bade46043019f7979b83271a7fce8cf7e5d558123ac71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
44KB

MD5
7e543fa6e209a7122e828983ca48ab8d

SHA1
ca6045b89896b2d63da00983a5d48db5fa8bd991

SHA256
d8331c3c3f90c4ea38a1df30b87a1f5f092677446939270e899dd7cfb44394f1

SHA512
30a047e36385e171417455efde982452c4b02569af37d37c75dac612aa9df8bbc39a19d0feb3b1049184a06da255092530cceca8a8d346637c732b053ac4f6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
0c47d05f0e6a29d101eb3090d0a7af39

SHA1
66d78f8d64751725236e1def41122abf115c13ca

SHA256
012fbe8eb1bed46a20f5eb34af85e23656a84f63ff848429bde52057d2635858

SHA512
7671e2e3eaee80c9e190f5ac0c6c6e47b12596b8c532f22ccfc7bad29a773843f369612590872cb46e3ae42215b21656cf19f33815043c18734d3ff6d1b692f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
793B

MD5
4e05d125b2ca4507ed6ca16b39662dab

SHA1
3a02f8e6c32e0d0d252b2e5d36663e782ccd74da

SHA256
ff6c67990b8cc7661fe5efde032cca9ca03351206668c0d315502a6c6121bae1

SHA512
c95ea7fab89740de302feba821249103462d886ba52bd8747ba6a68a73114c94e7142c4cb9f00c9a5d53e49d2f4f2f224d36aaa01eb368364084727b3ffa28d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83e82f49b915fa73d2214cb0101f8f32

SHA1
b89757d61bace90ad2c94d707577a8add8e2643a

SHA256
84fe746e1d32b0390b08285a8f8c0ec7eea4592d8231e35194d43b1fb024c1bd

SHA512
6f1b27c8057ed0e456dafc83a9c028e50a62859e57bd5d19d1ac8fd3b76ce6072c4afcae4a20dedd82a1f7e69c6ba2624f164687f1257c99271d2094105ad4c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e731c9746a7950e1ba93e9c93a97982a

SHA1
7dbcd4cf2193ee5cc69f797c9e0e5583114d6a57

SHA256
49dc1099c0e77eabab779faa5fab7e4db1fa132dfc2b76877df028c7d8af881e

SHA512
63625bce0aff1d487a3a623739b1ccc837e8a5e3bce31eeadc337cbe897670a73f7d5b2fe866d3f91e003457fa05cf9cc5517905a4d050720935fc2e60c3236d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b309d72001db1505ae1cb276aeaa317d

SHA1
5c7d1b61159b4b69daf1cc9f14df7cb082ca0b1b

SHA256
1856277e0ceba1398ee28d8fcfcd0f3f7cdf00980d3f92eb450040baeea1c368

SHA512
e7da5d626d86103f6e86e6a72fa920b46d9bd688615aec7b846cd12a95f61c3a00d6c9afb26adc1ff740b950ecaff4c37fd13f958214be35072f081b9a4f0588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
829a4453d6c818a31891ac6ec47eb9a7

SHA1
5c8149284d9fab1d55c933bebe8d3b5f56f349ec

SHA256
afae5786009f37be1310855c926b842fa650b377fbbe37d430e097af253669f1

SHA512
c97dc195e5de1872b0e209ccf0a6f18a7602a54924dc0fe8938b6620697fd31160adee2ef9f54e065fec26c15b326c084f83ab6509dea704bb1f8baf6cc2b974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90bbbe7cdf4acea86cdb370f35af1710

SHA1
25e5056c4be73eabc8aeec2da144a438de4ccd6a

SHA256
57f8aad5637d46e40d7755c0eef3b1a75e67d572158bc01d74859461256fb0f2

SHA512
5e42ba24976607a4ade763c169718375fcc9c8a036df8725c9ade55624dd30c95120b033acca6658d7645d6527fd2763039ad5f3787d53b9527d0625536585ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
5a714624f353aeb90397597ead115a16

SHA1
d4623309b1b572e961908b738e19bf76daa1c7ff

SHA256
ca647bb2063b2b6f98996b37d1e59c707bab2973215f65252197b704a5df1faa

SHA512
cf2f9f53c385ab196a6d2b7a94db00370af6cea8eba405d19e0470face5d317dc1bb5bd253c0ca6a8f255a4773217980593d4c3d42244f474a19859bdee7ac48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13373839409111481

Filesize
461B

MD5
f1dc7459dcaff36a074a66c185a909bf

SHA1
72dfc3c62baf88391017cd3cd21a5b7fbdc03476

SHA256
33b24b9723490750f26dadafce0a05313cb0cd3aa14bbeb43b373c3851574f15

SHA512
7b51a43ad86b981ec90f8f91487abdd118e4260a9ec059045e051ab841e001d3ed9f515efa94f9f2ee13a42090d497c00a489dc68d9808aa1010e3a0b2b43393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13373839409345481

Filesize
933B

MD5
95134cc8e6490b92845a84c8061fcaec

SHA1
b22cc22d05dc6c917720f25aceb5499863c8429c

SHA256
49123e77357c3510473eda2300ab22c0bfc804307884d174ca9b35ea18811f1f

SHA512
5fbc05e0096dd5a451e7ad1d210acb66876c0de690312dc902f782a39115f7f2412d5aa27a51ce2e972b2e7429e400e9cfd842a594d8785f7555d28effcc0a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
00c81891fbcec0e5cbf358f1556da783

SHA1
7bdfb989e4b86ffdc6440110625e1d0f1d5d7af8

SHA256
1f919d7888d338c4e4b9e2503b3a0977044a35bdc26a1c6354ffdce67d0941a5

SHA512
2f52f92dfb1a4f3c432474b632bf858658c2545e1e37115548959386d52f7908a733a4ec07ce943b5a05156e769226cfce3d3a65f5f7311f041407246d622f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
42942e97b3726111dedc6c1766981059

SHA1
a60a8b95edcf0acc912c728c3dc29bfdb2b16871

SHA256
5a014c485628742b6e55190910ed19cbf80d3aa109000e22ff71396912498f91

SHA512
8e2dea244e2f9825f40da5cceffee9574178786882cec38e120de4067ae0b2a453e2f3727dd3870898b05b98242976921ee987064d14ee0df840e18d6678afb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
d8adc2b02279ca8666f051ddf4169707

SHA1
4f6e76e0c300cae09fa0bf5371c1f18cc0b53855

SHA256
bd09dab3581ac02fffbe2ce79b4b7197b9bf2ef9f3b02e314b9bf004580e8227

SHA512
1e01ebdcd566cd4d2932a25dcb4817b8a8e082f97eef3f70822d0f16780d140bc384707ddc463485efca2927abad1f0cf8c196a8091a6885d08d222b119b1e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
3KB

MD5
06c7b17a97840cb2cbcfb5885a222238

SHA1
41fa2897bdc777eb9eca9fa610055e4245798cb0

SHA256
0a5909f169cc1607619c314dfab0c89576227a9de025c7ffa8d7da73361fb486

SHA512
dfd49dfff6237fd45d99ccfbdcb93ad8ee04dc5c64739b15761b2f33ada7020436810eba5904e0422e907b305d14cbab610d9b4443418da0d405f61670e12211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
7bfd0278000b0f59677b5d11510fb0d4

SHA1
4a65f3fcf79581fd1b9a7aefbdd995acb0e595f5

SHA256
0de4b6163865bd8c158155935047e47a47b23ac3df01ab624b88e74f52063109

SHA512
a2e543738ab80245055d5ea7c522e244297dbb73310ee18f350b77b3fd9f1196db2331593b8cdb955a0f4c28e68e0a3ba6630310a6ab4bda47a579e56bd672a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
51f2df31d8a6e215671e257aeb4c9d68

SHA1
8bf9f71dddbf01e7b95e66ff87dea3774a620844

SHA256
00a658e970de431001264e766da186fc48e0ad5f3c9c45e781fd38984c9889fc

SHA512
8fbe1c903594e4dc48653c0d948fd006ffd00c489066bdb54bbf3799f03bca878f222e96d2d5ba258d2ef2c35e1ad03fd2a7f615e263193ea5395932b2d8277b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
665a64d781bb29441011e0112233cc54

SHA1
a95f0ee47e656bd9d78c48242581d9dd38740eda

SHA256
b85e1383597541ab0575e9313eac11b77b00b91c6abe9cd781a20a29baeb8cb8

SHA512
fed2537be79519ad12d9f08ec2746d5ede0a71e95ff38a15d790f8e58a36680090612efdae0bdb9d439f1e7546f494847e1e7f9a0b38b942cfa8c0f642eeab14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
33742cb682184611329e05fcd8fd35cd

SHA1
bf2684a40ea9f0c08e7a45888fc36cdb06961df0

SHA256
56624047bcd24f4b527fcfa5c465c51a9a7cf6f2cd1d5acc2bea069f4b46da72

SHA512
2f8e9538472281287be580fc6f4412597f72dc036b5c35a343adac24c312a9bb5841acdb4d61f6b2c27d4e790114c9deb6b11a19ec05826deea7385993d2b1d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a1e680114162f0045966bb92f3cd1ae8

SHA1
e283339438e957a14b8f833cb57bcdca3a526074

SHA256
bf5b2b8a87233fdb9c78a2b0b9d3da4fb0fd9c2fdc583a4ca7eb771863db478d

SHA512
66d07e4e95bd20c9cd053d33a09a99436bb5e2e2985dfb259524af2b63f00ad8132a860865583aafdfb832da175ce0077e7a246afdb548144c2fc3ef901d1390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
b84f780e442603b84fe8264d40075573

SHA1
56faf935b5fde94ea06b780f772f63ae76c0181e

SHA256
5b5045e72233c2dbd41422ed9b56ca6ff49886e5b3f3f308fdf79d0f7a769cc3

SHA512
e283b1e9e5aeba9077e83b6db4c644bbc0820dbed7fd306dd6bbe297a298767f8b614bef1224baa6d5baa20055f7fa7d2dee6dd843518a5e49205d6fd61a055c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12f6294ba9c1afc394e86e7f1134715b

SHA1
cece260c63ed5ebb90d2943c46f8d7d11a980eeb

SHA256
2398cb5cade0453f61cc7a194f4233ba1b399486196f75ecda47d63f87eb6602

SHA512
96c8569abdac03341c6a9ee273f2a1bdbcde23e1b89a3a6761df0789d02dcea3029b68b7c9a7665ed0ed700c0aa0e7a91ee51a9a2e294d2fa744411f40d6bc87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
71d75c8c9df6ac6ec49bb67c5c48018c

SHA1
5c31fc7cad1278ad375dbdd98df3b9fbc676efb2

SHA256
a836acb874405dee8e730c6c351c016dca045d5905069d8b8eee692b6bfb8161

SHA512
b109e68a97e35374d98c46ff8542bf42bff8fe28c966554c62e2c3e1ea8574d33bf13b9b12391582342c7f198611272a465aea217d148b945373744408b2539e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
44b9787a38bbc532656abb83b0929b5b

SHA1
3fc0757f87ee2773415dfd463bfb7a948471fff3

SHA256
0fb04b794a4b173a12ce2c4b561f19fc2b6dae648d3faa7bf69a071a783a855c

SHA512
d0d7f796e2969ed63c5e4d42d38b384ef38fca4985dd16023a7e5c28b5422c910b9c5773c82ccdc462d0f5e667fde467a872cbc3c404004e9b93ef0ea9af2233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
25fd5c861e2e36c58f25b68ac0f691ca

SHA1
74fab253eda31308f77af668de7c3de54f8261ad

SHA256
660b2c13981f04841bab60ee5964e2bd0826a0e28b1f9d41bf515a9eaf6f7ff7

SHA512
056d1fe11b0952f3c598800b3634b466e7841db5019d38c62fc5d336fe304877fb2c13344f3b4405c5dcdd7fdf189e17671b6ac2eecd06a10c4a907647f32506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
4738c100d226f4427243842da015e4cd

SHA1
6f7c5b87a27f7d9547ec8a7dcc5bece43e843a31

SHA256
3f964e32250aa1e10a1e5cc02b93f2953adad20da0d39031d83a6d4f5935d804

SHA512
a40c2f47a28f3a97fe76abb2b2eff01a92fc70b980fa359dced51c83f4a7f707b7d23e8f4b95ec39ebe399c0cad38a72c7614e5e53e46e60d199105f90e79f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB67F.tmp.bat

Filesize
148B

MD5
c3376e099d1c38aff50e8f2956279094

SHA1
9eeb5e30a880168e0519de3496b3d1d0999e37d8

SHA256
b1e928125a355c4e3bc7548f68a058275aca7df6f8af08ce9cdfac92fd08ba0f

SHA512
940bd1eff0515cfe5e14d9b29a9a67fc6b9f85cfeccddbb8c9e77c24254b11a288940d514230973754bcb03513dd0e38f1234f89f14a4c7eb38a300097e502fc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 13905.crdownload

Filesize
45KB

MD5
24fbdb6554fadafc115533272b8b6ea0

SHA1
8c874f8ba14f9d3e76cf73d27ae8806495f09519

SHA256
1954e0151deb50691b312e7e8463bd2e798f78ff0d030ce1ef889e0207cc03aa

SHA512
155853c0d8706b372ba9bc6bce5eb58e8bd332fd30900b26c4f3cc7d1e769259bc1c79eeca1ad72830cee06b79500cea12636b865bf8b571c4a790fbb1bbd7da

Download Submit
\??\pipe\LOCAL\crashpad_1540_NVDUCPPAMLTOZYMF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1848-61-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/1848-166-0x0000000004DF0000-0x0000000004E8C000-memory.dmp

Filesize
624KB

Download
memory/6080-188-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-183-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-185-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-186-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-187-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-189-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-177-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-184-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-179-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download
memory/6080-178-0x000001E124DD0000-0x000001E124DD1000-memory.dmp

Filesize
4KB

Download