meduza | hxxps://www[.]mediafire[.]com/folder/nliuafcwkyryt/a

Resubmissions

06/10/2024, 16:59

241006-vhq8zsvdkr 10

06/10/2024, 16:52

241006-vdsk9avbmp 3

Analysis

max time kernel
286s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/nliuafcwkyryt/a

Score

10^/10

meduza collection discovery spyware stealer

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 7 IoCs

resource	yara_rule
behavioral1/memory/2544-1280-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/2544-1275-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/5324-1302-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/5304-1311-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/2552-1317-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/4416-1324-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/5752-1331-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	Aura.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	Aura.exe

Executes dropped EXE 10 IoCs

pid	Process
2544	Aura.exe
2352	Aura.exe
5324	Aura.exe
5320	Aura.exe
5304	Aura.exe
2552	Aura.exe
4048	Aura.exe
4416	Aura.exe
2256	Aura.exe
5752	Aura.exe

Loads dropped DLL 6 IoCs

pid	Process
2188	Aura.exe
2352	Aura.exe
5320	Aura.exe
1116	Aura.exe
4048	Aura.exe
2256	Aura.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 10 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
493	api.ipify.org
494	api.ipify.org
502	api.ipify.org

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2544	2188	Aura.exe	157
PID 2352 set thread context of 5324	2352	Aura.exe	159
PID 5320 set thread context of 5304	5320	Aura.exe	161
PID 1116 set thread context of 2552	1116	Aura.exe	168
PID 4048 set thread context of 4416	4048	Aura.exe	170
PID 2256 set thread context of 5752	2256	Aura.exe	172

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5256	cmd.exe
3932	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Aura\Aura\Aura.exe:a.dll	Aura.exe
File opened for modification	C:\Users\Admin\Downloads\Aura\Aura\Aura.exe:a.dll	Aura.exe
File opened for modification	C:\Users\Admin\Downloads\Aura\Aura\Aura.exe:a.dll	Aura.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe:a.dll	Aura.exe
File opened for modification	C:\Users\Admin\Downloads\Aura\Aura\Aura.exe:a.dll	Aura.exe
File opened for modification	C:\Users\Admin\Downloads\Aura\Aura\Aura.exe:a.dll	Aura.exe
File opened for modification	C:\Users\Admin\Downloads\Aura\Aura\Aura.exe:a.dll	Aura.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3932	PING.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
2208	msedge.exe
2208	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
2528	msedge.exe
2528	msedge.exe
2544	Aura.exe
2544	Aura.exe
2552	Aura.exe
2552	Aura.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	Aura.exe
Token: SeImpersonatePrivilege	2544	Aura.exe
Token: SeDebugPrivilege	5324	Aura.exe
Token: SeImpersonatePrivilege	5324	Aura.exe
Token: SeDebugPrivilege	5304	Aura.exe
Token: SeImpersonatePrivilege	5304	Aura.exe
Token: SeDebugPrivilege	2552	Aura.exe
Token: SeImpersonatePrivilege	2552	Aura.exe
Token: SeDebugPrivilege	4416	Aura.exe
Token: SeImpersonatePrivilege	4416	Aura.exe
Token: SeDebugPrivilege	5752	Aura.exe
Token: SeImpersonatePrivilege	5752	Aura.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe
2960	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1672	2208	msedge.exe	82
PID 2208 wrote to memory of 1672	2208	msedge.exe	82
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3844	2208	msedge.exe	83
PID 2208 wrote to memory of 3452	2208	msedge.exe	84
PID 2208 wrote to memory of 3452	2208	msedge.exe	84
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85
PID 2208 wrote to memory of 8	2208	msedge.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aura.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/nliuafcwkyryt/a
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f8b46f8,0x7ff85f8b4708,0x7ff85f8b4718
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7720 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7688 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8096 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7568 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13858907375405033418,2453041801946284960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2960
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Unconfirmed 585342.crdownload
  2⤵
  PID:2924

C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
"C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:2188
- C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
  "C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5256
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3932

C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
"C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:2352
- C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
  "C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5324

C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
"C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:5320
- C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
  "C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5304

C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe"
1⤵
- NTFS ADS
PID:4468

C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
"C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:1116
- C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
  "C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2552

C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
"C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:4048
- C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
  "C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4416

C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
"C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:2256
- C:\Users\Admin\Downloads\Aura\Aura\Aura.exe
  "C:\Users\Admin\Downloads\Aura\Aura\Aura.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
84KB

MD5
cdec9a8cf46875a543636e36afc59798

SHA1
53ee6d478e853c54c7b134fce00a9d980f888267

SHA256
a30ff578bb4ac5a6abbe80d5e838be5aee127f76c04d22fe0f9f12927cddfec4

SHA512
eba2b8de3fed8f0568cbc89f331f9a640fe5608e967be69ff5d6401080b846f494d9b34e1e369591ead5318514ccc5ddda1e8f0a1d64705e6d2b10360ded5ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
72KB

MD5
f37bd9d6e6004f9951c0177483c3f810

SHA1
44253d3dd5fc184d4da02e9221d7386e2ece9ab4

SHA256
fa712deb1825f7e2b882604fa6e48c53fe4053eb7609990f0dfda91d55be8490

SHA512
280e5216670e3befd1832727859a4dd3a9cc7c958acda3d87d2371d9dfdb7a5be63b5b2d941a3df9c34cfd765e5dc447e89c7b8563f5597bf0443c134572088d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
109KB

MD5
641e3d5c1ba512ebfc987f18955b43f7

SHA1
04571464a96086150b91edc03a577a6f39121e02

SHA256
5e15511f56d11b8f02ec1425ae6983762d97aca97eac807643de94e8c652427f

SHA512
7d11bfd6fbae7548e4a179b7473e266b3c7322ef656412f10af99eeb16735436849e9a925020113bc383bef960d54c817d0de0540f2394d5ca3b4d5459b65c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
72KB

MD5
3c8aa5cdefe5f7820691760ca2293cf4

SHA1
9a5e8a92bbfec460926851b449166a5f81ba05a0

SHA256
3eb9564708d6479dfd40462c4c0c58cbf737a7261155f3f2d7d1160d4c1edd51

SHA512
41baddb6d5865bf252f1ed08a37d6544b068ad19d02765685ca17d7144095e9d8ac6d278918f08c988917bf1f659fbdef9542db11dff3331e9c5943e09ddff0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
19KB

MD5
4a16f187304032b0f4ce790c8028b3ad

SHA1
9cd01d66eed91a7efa273d2e1df7ef9908d15cdc

SHA256
641067fca9fbe6daa4838507c4776c14217999c8ca800f5b968841db84fc431b

SHA512
1bf96f3798ca57789cfc9ebffd30d28f3e68d5a02f48be8c4945341fa05f9a0b12bbcf1312c278622adef358b6804b0d0fc38db07585194bfad824edaca1febf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
077503c16eb62844d1324892bc7f771d

SHA1
cbbefca0ff7d63681c3f7e59be8b43ba113ad6a6

SHA256
fed06c2ca3cbe7695c6a7012fa0a18aaf729cd71d31f676cc75bc0221972e84c

SHA512
f8228dfdaeff2820f555f233b5af63681b844cc20560e4583265f99753eb219ea670956fea8cdaf85dcc8d97ed79b989dbf685670423ffc2b12879439e425717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
eb676e857ea6090f673dca4600f1dc96

SHA1
540daa9fd77bf5375066fe0a3da107558e49a1f7

SHA256
3b79306bf4c8c289d6b6089dd23e99345887644d7a263d49031252220778d709

SHA512
9f61b0a2cc3e6685a1d8681649f8231624b5faf0810841e1406903f42f90e6f08772fd0c2ba910b06000140f8a435dc3b38545adb9aaf9844449ce6d002a4b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fe97dc0e7312824ad7df2189a21861fd

SHA1
0866b7bf0e4b7ccedcf8abfa84e41795ec132c95

SHA256
e3f6ff36e6763020dc608510a05bd40546b190d06323e1b74d331a05bf612c17

SHA512
78a69ecffc80aafbe2fe03f18dcd021d2d3ba81e069d5109f9f10dde25ca25d4052a84e7e1e3d08ec2f13d4893788dbd67806720ff1751bed7c91c4605ad18fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
cc6352e988a0a87ec95e4e59c6ca9915

SHA1
109dec3edbc714d7d86b0a13d84fe0c0b616ecbb

SHA256
5d8c1a2c0822ec601abc163d377abc1f95198c9894372940cda6c20eca240162

SHA512
8334c064f3ed4c204756d0f749b1edafd29115fc30f9a11a2bea4a304cb2ab9c9c0e388b72f117477b7626eced62e696e0b9994692ff7bb0c9463f58e3144359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
48KB

MD5
130acc6bed5a36565e9bba0b76285252

SHA1
906c116bac2f7e7b4f7e8f5c12f7fae742b4d0ce

SHA256
fb224cf42a6ac0f0ab780c5ad8211071feccaeef804988963cb56b9709e44fa0

SHA512
ee5f8ec999bbb6c1f077494a263ed3568abf66a83d3d5cc0e2549403991152fd2d9f3144e03a6f959501e4122b1df6636b1f9f45661938d9c409bae7086fed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
168KB

MD5
6343f83df3473da63a69c254b16088c8

SHA1
c19d25fb56535141a6cd05ff5e8f1846a07d03dd

SHA256
c80fb40b60253d2849c244c9d223d24abbbd649516cd0c91996b3b43e82246be

SHA512
f0809a8085fa025e39052be4cb18175a8a7813ec35510e0735632ba31c87817c4103150825e6ea57b9158b0d6e041104dddb5ad10e13b2df677649eac5455dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
19KB

MD5
a7e13b782d9214ed2115748cc309fb68

SHA1
23bf31f2f5d72273933a876f7b3fea1fa191ba21

SHA256
a4160c39fc665bd611b8f975ef09620e68cb0eb864965ce32d1f54414a73d993

SHA512
a50f0dae01699cd4ee8e576d07590cc324c365c846a6927a803ec84ed6efc4eb19dcefcaa94ddd0eb0420ed96ae69d92d510549cfacbe845ea20bc7a53592276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
a63d0d2d62d413528487a3ebf2920ae9

SHA1
0bd9c58b81adaaa87a9da1d5c3af9554df796327

SHA256
62c1b5ead91ec91f882ea756f8613b51ffbb4db328a1642c2c3b67e050396e0a

SHA512
177315b2f840c90ecdf40e4d433fb40e1f3906c241c23c18684f6267f16639ed5f6aaa50e800ab0d91f25ac474c9d3ae63c73a66079392335c767dc051aafab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
4e53de353770597ce291f09a19372276

SHA1
e43299c849b8a2e61d64cc608afc07fa6d5586f3

SHA256
0bc59d91ea698084266d43124e8c9311c3dca273e972f63d24158dcd86e27f49

SHA512
11ad3a61832853a4121c53537d69543aa325bd33f91213511411146c7640bcc65fdf8173f3aee11d1cfe4b2747237940fb66b40e69ebe82adc5eb5fa9075e7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
b5564ca2a2bd0283e2de869705dc9873

SHA1
b996c1d649c7e5757a94707b1fe1c76fe76b8566

SHA256
3da109c83db3719bb34d31752af1756b2bd1ccd4bcc8ac03107be474613c9dd3

SHA512
6e43331cf1d1d3f59f8371324904d8091b68adb43615218bb868bc72a81dfb6c295257c8adf51d204d7cfecb4933aee475ab4f9bc93c03baef717f2932b0bbac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
ef54cfdd8acd333002c1475fdba0c23c

SHA1
ab275962434768bbacffc03fcc9798e4e78a7b6b

SHA256
36d27ed37f37762d01723f963ceb4ab1b3e75f10cacb4b1c54365764279c51d1

SHA512
a74902030368740f2600f1f1990d6487e898cafee43f6716d3577b8cf7e77232f52a527d57ab12276050c66e1ef105d4fd0dbcf103cd6906b9b2ba7660440ae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8160d5d517c95ed6508f5c2d5cb53189

SHA1
7bd5764a564cc1a4c10528e4ddadf8890b0ed049

SHA256
68757f95afbc52b7d11b9988c0eef53357abbf429689d5995f074f949cc918d2

SHA512
432606581d11d256e9118716b83ad29e2fc7bf29f4b86dcf0a7c07409063c7209b44db627edaa1d8960691859bb08f92f1610c750731e4d55cc38bd0a34f6957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
30f476721622101987af4a9b343fe442

SHA1
337908d11ec604cc28b57ef3ee90b8681e3b982f

SHA256
e29efdce139dbd0c570dbd301ff2d7cda04e4348ed325de5ed792281aacc8d52

SHA512
b84aa08a5d66306efe47916959269e13ea3ba505397bd750407a5713afb118217a571345fea1621c86a3a2184cab7ce91b6f513a40f2c445bbb8a6a179179a61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bd98765501b89eed438f08e0d118c630

SHA1
7af169905efead47cca20e9cb1ceb3eb62aab441

SHA256
172274d196244f82b0c6e0977f00dd2e167b7cedbb3679ebc5784ec9f0080ea0

SHA512
541d362339599dde9db7a448e7f2ca9f09a1fcd1082044d9cd7d527b687d2877a8584160b728ea07fdef204a552e6e947a438f4aa98cc57f5a9553cf5c7df2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
f5d4f4c7d1e63eec0c549f5506728ebb

SHA1
fde99b7e3681ad3f5ab3f229760ef2c427653fc8

SHA256
3d1c711f6529f78835b8a868954bd6c0db4f5569a4fc1355d33d58e405323b37

SHA512
5c65eaad237d2339f71440c37cb241375e4579f4411516f36b5c6032b4abdb8762a56db4838791bb253f44b70f0f5fe7a1f35d8eaac27d3892aa489e3800e0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
ef3fb78b3445971d76ffda90a1a35ac0

SHA1
7a6a4ba9841b752aec1e0a892bed97c134218072

SHA256
5d68aacf9ff9db2b2a53f3bcaae954af727bfc4c6a024997f120c051e3e967b6

SHA512
9c573e56717a027b0ddf1b0bdfa44d435b345e9d08ef5f93b68fd4cced3709db3816bc4b46d70d76dd6e757595e50f536a2b3c59453b2b30fbce02f6734e1033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
a1bf17440ffadb5f747577ee69e686c2

SHA1
57bf78e635dc09495f901b72c2ed4797a235c583

SHA256
0877d40fe2f82da18a6c023b497fe65e36213153ddc53f2b25e963318e31d667

SHA512
bb4b0383868044c7b3c23e9cf68eb0c9d7eb608e7ba99dc100a90725f005b6539675fa5f850cbee3f9c6615f6140ac00ac2f2edf8caf813ca3b4fc45b6dba81a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
0a499bd4bfc998850d6b331a457c38be

SHA1
104cec2c9069106b61e0fc66f6549c23552b8ea0

SHA256
f3b4a47cece99a2ce95cd97a036495e3b9fcbe367d28d8dcd861e9bd740bd608

SHA512
99818b47f5da917a9a3e3905cf9c2f6bd9d724f463eaa5ac3d609c487846095fe36f34d03070797ac0479d1e9005b00e7a6f15c08bc923c203409808d09ca551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
6ef57b5ddb94dc9e14ca9ae597cdfaa2

SHA1
a10e4ae077a2848ddf08659d1ead3c6e98fdea6d

SHA256
6271190f4d9630729eb7c7d21532955b11ccb3460330c0ee8907e084b949ef84

SHA512
4a389cad852e08339f58a4f977384244b9832f948e199bc210fe1409808c2072e96c3177f7fd4cef17ac4e918d5e6f988e6086dca92f26cb884edd0bd887a808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
ce42386d4da525c1ba2b55c42fb1a1e3

SHA1
e50ec71d0452f3b7c06ea01325bc09ab4484da91

SHA256
e4cda7bc62b2323e0ac228e503a9e6d5dccac5458673d27374a0cfebaa485c6a

SHA512
cbcf642e7225401e9af4f12c35e68555ac81b1a3d991fd9f827d6bcec22d8282c3eebcc48c40738e928deedfa84c76fc67dd5d21028bf56b11bc5183bb4c500e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3d91d58a11d15db28d0094cda7635e8f

SHA1
01c947af4450332790f6f5ae33e35953e0422df4

SHA256
fcea417b6741dddccab0faace6b34fd2c5ef4983c7bfd47e8e8f5d7fe2eb9f03

SHA512
5843dc05b09f5bf230dbcf8628fb3f81d6e674412f89d363216390b470afa97c37e7b3961fd9d651a21265237a752322390420f8761a85188e2a9411926b9cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f7ffe37a4bd1289b14db819e194d6d35

SHA1
a7bd43f768b539468204e5971978756f6a623aee

SHA256
d7719cc30c1109e2ca07f15330a5e0059dde72b84f3eae49946aa4f5ab2f2810

SHA512
bd53b5cd5244c6f339fe6b16a843a3ec016aa521194925d9be051e87ba08be2429e90a739b663f7029ad040c41551a3c4bd985f8682dbfcf89037171e9a953fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c303880e84bbdfc60d4a301e7de69b88

SHA1
5ea647b2875391c80053516409272690446ed4f7

SHA256
0dbecc639c7dfbfc03d747e8bc9daac558c819a21ab71325f3204c7c4ca946ea

SHA512
9d7fe39efdbb41f22f66530bdda2483c0566478afb267e1ec6f0a4a9441aa85de0c202e415dab73f722485b99683dce00958c4d7ec2f3c82f0d6eb16fb2485c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3964d9c5e1ed4854d046299754d11fd8

SHA1
1e5c25e843ed6054bc48237f06613aaf17d1c1f2

SHA256
7c58f95e35d07cea236f9064c70775bd245754a19902d968ff97dce2b5a6fced

SHA512
797def7f257c6a1a699869ad20e4b6e4b83620d44aa0dc70a7171286fbd8d2572066a76201aa963bc89283ade847986dfe444ee7091fff43e6cadda954b042e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
de5df940fe3baa267b7b763aea5ab4af

SHA1
93930ed353b6194717bad6666eb224849a834826

SHA256
49a0dfb48fb951da7edb0bc45806e7b51c91dd8bd19d9623c3a6fba1e33182cc

SHA512
5c063497e4c1dd945f168ba8e2217d47081fd33d436913af0a9c14e8b40d9990810ce534c880fc14cba1fcb0e3aee95541acfdf7bc1fb55e5448fdb549bfa54c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d784.TMP

Filesize
1KB

MD5
35795bcd272b41ac40b1e4fea7a7698d

SHA1
0c2e2608b4aedf6b5b018c87abfbbae76c49ddd5

SHA256
a6d706eb25ac937ee5cd65f3c2aa02ea38b93b0e02287f649a1de61c900cca6e

SHA512
f7c1e474c1a5448d8b156bd06e31152443c228f5c6c4940f7135b3c88a371a7f821a1b8154f90bc049ae743ca191028d4a0fa6e2e9e15bc8f2bd1976217c4379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
4e1d1bf5ffe3a2fd5b25f03171bb11a1

SHA1
86965ef6690f1a256cd12ff4870ba0a6a7a38dc9

SHA256
e115f782f0942430724fab3d49e7f1fa150aedb1052ab59c1e27f548818b0dc6

SHA512
f1ea330cfdd5c47aa9f7ae489dae93925f541c034ee1eb05039c59f5c17b831628d2cc8beed0394433a5c5e80a55c0ef06ac283304c78e91cda2ce1c755cf34c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2df6b9de86fd5ea5279a13e938a3c37a

SHA1
c93a5f8f5468bbcf03a0d66252c1cced105578d8

SHA256
fc8f6b228efc9efc8db1a352dee6c5d3a5038b7fbb980b19e648e80a7b7a7386

SHA512
ffb9f3137d848e3eddcd6cb4bb74be1ac20e206139bcde055ddbcd58dc537e8bcef97c2779045c6869ba665c79e55ee8e80e8c98bc5dc81690a875736667987c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ccbb563c25890931026b8487bf7f9a34

SHA1
20bd74973a0c0545484736496bba9b614f0c12e7

SHA256
8a1cb5c3c87980bf95fd5b1b8322af1fe3a575f0ae871bf6da94cf4dd2edf32f

SHA512
9d4d676e9c3a3a259564567948e5bd502f883e97f660189f1924858acf9d10a915cf29127d5e5cbe6082d66b9dba6bc394760041bca80eb9f41ba586439d4e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
29782d3f9132441b14d6dabede430438

SHA1
e04b6c2ae109fb7434f31f412df083e4778184a4

SHA256
f03ea61c704d2c1dd94bad06cb2380f2e42f24489e7966570f7b16f639c22f8d

SHA512
9a7f8e353051bb45f98237069863a0751c795ca89e31be3b4995fa04350a901205e752d39e1040adc1da89ee153b804daff720f030467b9b9b2a897d7361b7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
00a75033890d72bf0dc1a6c20117a1de

SHA1
8150c98fe20bd308e96f75ef9866605b8c212167

SHA256
c2961a4faa1910d3d82a79710703e1f75593651c2a57da82337cdaf24e468f12

SHA512
cbfb961fa4fb25d6a8aaf456a92a749b1b3a31791832a411e1364ea6b6f0ffe2fafe799a4abf7749c45f9219d5ce46ee97fd5256d1eb55e990848e528957dfc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
379a84782f9fdef2a356df592fcd1d9f

SHA1
5618c296b5c9dc56585d67bf6c2223d397e3a29c

SHA256
4bddbfc77d9582a40259d6c4577ef26dfeb670a353094cad6e992d90d5f6e371

SHA512
dbb74691e94086e67bb60617f1b3c5f684ad8d3f125678626161244b29bfb31f879875d2403577aa472ad3c962ff3d50b633c66c14e8ca31564dc52ed4030efe

Download Submit
C:\Users\Admin\Downloads\Aura\Aura\Aura.exe

Filesize
1.7MB

MD5
b2a046d842ca1552593269558d052ff5

SHA1
7d1eba1939214aef12ad53f3d0eb8cc6ce27a0d0

SHA256
fe424aa5c66338c5cd9b0b2e59211222831a373133d71955976f37ce6ad1408e

SHA512
e5379f3602fbabef5131701c5b3c6bb97855db5cca163202abdd6b92e022237218046ca2ab214077077e12c4b9bf3a3dc8d191d46a66462d8e9ecae6e774d80c

Download Submit
C:\Users\Admin\Downloads\Aura\Aura\Aura.exe:a.dll

Filesize
1.4MB

MD5
89063c77b1a1d722f87ae93a61653aa7

SHA1
486b62dd64053e3779b2aab70ddab0b752bc4258

SHA256
603cef91530cf80764891e02059a2f284265aeff918f6d138bb368a2a4b15312

SHA512
7f047c7a1397077b69ba99933a4e2af814aad77930914ae48ef677025e5e9ebdf882c319a05e0a286add18f5ce9863e905b115a78a13c153deb24dd0ab31e5f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 585342.crdownload

Filesize
1.3MB

MD5
de75b10badd151b398f3db7826a0694e

SHA1
80412ce2004de66afb4b926fafa7239680939e25

SHA256
04c230adb95868c8a49d7577692c3b65060f4b7e9d1ee476cbfca085a89eb8a1

SHA512
1eb8b1d40fe2e3485fecc0904c0609f9a6760fa650b3c9872e0d2ab58685c3e1f84d7e358cc4fd183389586f5f67bec0da5e9bc32a001ce816e15383a1a2833f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 585342.crdownload

Filesize
13.1MB

MD5
ab6c2fb047b9fe40f09b916972f878e8

SHA1
dafaf3d489089594ab4bd178f4ad4ff3c73924f9

SHA256
c412f9ff3126ae248067745897a1d78b5288ecff63f0e5d178920579864b9961

SHA512
1f8a394b6a7724365609138b157454d446877ff0defd17df24d04a07f256262352a8aee731e6753ed5515965a442b3364a9edd6d62e19f3d659af7a3f1f866f3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 585342.crdownload

Filesize
13.7MB

MD5
9192c3da694a667b1962143d8740634a

SHA1
f098fee5b8cf28d4d10c78adcd3776c2af2bce50

SHA256
e2a2197c34c2afdf4ffdf46d3eaad3f3b76c2dc077f940c430ceddc7b3f36192

SHA512
caa05ef19f5589018a73faaaf4538f6c84f4ed8bbb003e3fd3dc6a9a4a23b22a903d0cc1e6dc1af313902dfe326e98d3a0eb3e4cc9b69184e2dcc27893a431ee

Download Submit
memory/1116-1319-0x00007FF84D880000-0x00007FF84D9E4000-memory.dmp

Filesize
1.4MB

Download
memory/1116-1318-0x00007FF6A1200000-0x00007FF6A13B5000-memory.dmp

Filesize
1.7MB

Download
memory/2188-1277-0x00007FF7E5490000-0x00007FF7E5645000-memory.dmp

Filesize
1.7MB

Download
memory/2188-1278-0x00007FF84D880000-0x00007FF84D9E4000-memory.dmp

Filesize
1.4MB

Download
memory/2256-1333-0x00007FF84E140000-0x00007FF84E2A4000-memory.dmp

Filesize
1.4MB

Download
memory/2256-1332-0x00007FF6A1200000-0x00007FF6A13B5000-memory.dmp

Filesize
1.7MB

Download
memory/2352-1301-0x00007FF84E140000-0x00007FF84E2A4000-memory.dmp

Filesize
1.4MB

Download
memory/2352-1300-0x00007FF7E5490000-0x00007FF7E5645000-memory.dmp

Filesize
1.7MB

Download
memory/2544-1280-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/2544-1275-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/2552-1317-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/4048-1326-0x00007FF84E140000-0x00007FF84E2A4000-memory.dmp

Filesize
1.4MB

Download
memory/4048-1325-0x00007FF6A1200000-0x00007FF6A13B5000-memory.dmp

Filesize
1.7MB

Download
memory/4416-1324-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/4468-1312-0x00007FF638750000-0x00007FF638905000-memory.dmp

Filesize
1.7MB

Download
memory/5304-1311-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/5320-1309-0x00007FF7E5490000-0x00007FF7E5645000-memory.dmp

Filesize
1.7MB

Download
memory/5320-1310-0x00007FF84E140000-0x00007FF84E2A4000-memory.dmp

Filesize
1.4MB

Download
memory/5324-1302-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/5752-1331-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download