Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    990s
  • max time network
    995s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 12:38

General

  • Target

    Downloads.zip

  • Size

    833KB

  • MD5

    753fb2666923b1b8c9e7564181c24e84

  • SHA1

    5e819566d2a4686ae47491ab270352bdc2fe66d1

  • SHA256

    aeb237ec5d02a178db6279cffe4e39904f9e1da9e94d7f1b36d32ed14ab55171

  • SHA512

    715493c23bdb285a9aef8538b1c3040c687d197782888ee0418b5b0a49ff32008bd1d2c90e537822fcb258f8a136ec02e2b408ff438f97a3c8a538d70e4afb97

  • SSDEEP

    12288:hL+bTfjAoXG2s8mMxMWXhcqAdiG3k6s8yqwexgeOiX1vT1Re1pRtE4mpEE1e7j:hiLvfsae+4evPeeeDd1U1ntEfpEE8

Score
9/10

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Contacts a large (581) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 61 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloads.zip
    1⤵
      PID:2216
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1160
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\Downloads\" -an -ai#7zMap26400:116:7zEvent8466
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3504
      • C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe
        "C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4524
      • C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe
        "C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4768
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa73d046f8,0x7ffa73d04708,0x7ffa73d04718
          2⤵
            PID:4668
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
            2⤵
              PID:4604
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2196
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
              2⤵
                PID:1048
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                2⤵
                  PID:4444
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                  2⤵
                    PID:768
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
                    2⤵
                      PID:1864
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                      2⤵
                        PID:864
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
                        2⤵
                          PID:4460
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                          2⤵
                            PID:2936
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
                            2⤵
                              PID:1120
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
                              2⤵
                                PID:4924
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
                                2⤵
                                  PID:4724
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
                                  2⤵
                                    PID:4896
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4160 /prefetch:8
                                    2⤵
                                      PID:3804
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
                                      2⤵
                                        PID:4392
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
                                        2⤵
                                          PID:3544
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
                                          2⤵
                                            PID:1284
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4560
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4032 /prefetch:8
                                            2⤵
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2724
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
                                            2⤵
                                              PID:4764
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                                              2⤵
                                                PID:2404
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                                                2⤵
                                                  PID:412
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                                                  2⤵
                                                    PID:560
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2924 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4140
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
                                                    2⤵
                                                      PID:1556
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7088 /prefetch:8
                                                      2⤵
                                                        PID:2140
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                                                        2⤵
                                                          PID:4632
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                                                          2⤵
                                                            PID:3884
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                                                            2⤵
                                                              PID:4824
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
                                                              2⤵
                                                                PID:3324
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                                                2⤵
                                                                  PID:7164
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                                                                  2⤵
                                                                    PID:5008
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
                                                                    2⤵
                                                                      PID:7380
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
                                                                      2⤵
                                                                        PID:7388
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:2940
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:3604
                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                        1⤵
                                                                          PID:432
                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                          C:\Windows\system32\AUDIODG.EXE 0x514 0x2d8
                                                                          1⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4936
                                                                        • C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe
                                                                          "C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:8080

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Aura_protected-Deobfuscated.exe.log

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          35a68f06cc0349e8a8d57037875edbf2

                                                                          SHA1

                                                                          58fd73d2f7060522f12243c13078141cdced93ca

                                                                          SHA256

                                                                          3cf2d7b2914819574e570795093541d752389b0c53f7bab2a6f7cb84e2cd683c

                                                                          SHA512

                                                                          81092997f3e75681cfaf8d01eb59e96237e3cc194af2a51aa41c532ac82145c46b7e73032c234889965322d65b1182dfb72fa9c70168350d6a85b84ef09e6954

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          bf009481892dd0d1c49db97428428ede

                                                                          SHA1

                                                                          aee4e7e213f6332c1629a701b42335eb1a035c66

                                                                          SHA256

                                                                          18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

                                                                          SHA512

                                                                          d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                                          Filesize

                                                                          24KB

                                                                          MD5

                                                                          59b2a08dbe983864b1282169ed44d587

                                                                          SHA1

                                                                          55a4b388951aa496c790ed2c264c6ea8bdcdf49f

                                                                          SHA256

                                                                          643254f9ea3311ad024ae0ed83c78be1c62776024fae5bb4bb129ba552f775c2

                                                                          SHA512

                                                                          912fe26ddee336dd8df63609131ae9de79cefee3355c31eee1928d170d939c7f78465835fa600e3e090e9ee37263fc501477f65c5e669823c20b072375f32d8b

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                          Filesize

                                                                          30KB

                                                                          MD5

                                                                          e8c79a8e6a2b23349122d3de7053c805

                                                                          SHA1

                                                                          0b5d050a141d6dc2874f466436da8eb3ce92fcce

                                                                          SHA256

                                                                          298048cb203648006a6493beaa3e95a2565593bec59a76f0b7f16ac2413f2bea

                                                                          SHA512

                                                                          67fcf182d217c64a74c1e5614cdf3f142413ad893402a79e8ed8d443a0f4a6fedfe62e870d5a2fe6daa80bc7bec521144fc15d55e61d839cedb06dda7aebe762

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                                                          Filesize

                                                                          16KB

                                                                          MD5

                                                                          91dada384946e538ccfa80a0b96f5687

                                                                          SHA1

                                                                          5fa1395001c1aceb8c5bf24e3e5c4c11605adeb2

                                                                          SHA256

                                                                          df79b3140e6d55373a896b2f65f29fc04b585812dc63a967cf5f2f3659bb8144

                                                                          SHA512

                                                                          95e4adf21e88e754f6ce4dc3087b65255c8a5b7bd85cf36baed9e18915c240f8ed6fffc51a899759791b651c6d6bfe4b9767dc61f92b5cc7035b0b466834d700

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                          Filesize

                                                                          26KB

                                                                          MD5

                                                                          1568d67347b49eca6e7bfbc7e76a250d

                                                                          SHA1

                                                                          31519369a4a1bdb5fdc1136b83e4f667e47c583d

                                                                          SHA256

                                                                          b151ddffd3e18b768b64c12cce91b3cb2e46288ff76dc8a42cbfef4d033318a4

                                                                          SHA512

                                                                          c29e66af004083781beee25c3c4f0c2377c51ae60ed9803e6a2463416391fcc78450257dc35644d808f0e6f17494333c3d0424a90c20997daf036049a0093a0f

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                          Filesize

                                                                          64KB

                                                                          MD5

                                                                          8ebd96994a4e6b3fdb5397e39a2cf6aa

                                                                          SHA1

                                                                          6b01d01c679ad6e24af81ff367ec7b2b7709276d

                                                                          SHA256

                                                                          bcfb5e3b81bf192d5a5b2dafe45c5fdbd4df763cdbcdde26a0a129936d7a4dff

                                                                          SHA512

                                                                          fc755011b0344eed2a3da3889ee79077e271d3fb9a1b2c174b1fb99c8944aab20ac0039dacf8466ee0061443a6ab584f48b83e330c0d9fc694967dba81b42a44

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                                                          Filesize

                                                                          212KB

                                                                          MD5

                                                                          544bbd7a89a06c9bbdffb1a685b8d63e

                                                                          SHA1

                                                                          446d460ba9e91895da6b3973877637e796ee77cd

                                                                          SHA256

                                                                          ef5ab21b15ec4cec46a4496be95bf51fb8c7bb9e0154b00cb72c84cb2b5c43bb

                                                                          SHA512

                                                                          d644566108ccd320f3e01ec75bee3383acd7872e99a08ddb2d2d6ce38babc6fec40546880d5782b81d25cefb08b3180896dcbd9f6650764ca5045dcf83e82653

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                                                          Filesize

                                                                          52KB

                                                                          MD5

                                                                          60b08087668454b90a2bf90bf964ef44

                                                                          SHA1

                                                                          05e49827a847954ff4609649b524f9443e8e0b43

                                                                          SHA256

                                                                          0246f91847a57f5adb77eaecd28a2a9e1e10b893ad118300bef0fda17356c27a

                                                                          SHA512

                                                                          c9ff8efcbcec522270e127656014a8e553f7a3963f95ef095e41cd851c32a9a1dc7fd31f94f47be4ea814cbc3fa4028c00d21bfa257223a1bc1c9387b7a303d5

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                                                          Filesize

                                                                          36KB

                                                                          MD5

                                                                          120b7b3291b329d1dcf39b85874b0a12

                                                                          SHA1

                                                                          5895412b32d1674e363c5a846281c110da781b86

                                                                          SHA256

                                                                          f3879e333ecc29a6f21b71c107186dfe6e4c9ccbdfbfcf0ea2ca3f34c9349e95

                                                                          SHA512

                                                                          48187e1b6941fce46ce7c115f5d6b12b9c9e245cd5ee4a1d85c549db949476d5c479e122dce6004dbda3c4d7c3ad607b2f5d963259f0b5423882079b993f3d09

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

                                                                          Filesize

                                                                          18KB

                                                                          MD5

                                                                          ee842127684d9d042df8f72398ffae12

                                                                          SHA1

                                                                          1c31fd59f7adbae21a8d1819ce43f371d3923840

                                                                          SHA256

                                                                          20ccf88cf91b801a424ea870dac3a7282d9e771f67fd5fc0ff75985735882961

                                                                          SHA512

                                                                          de618297d4e4c1143a5029ce53176449fa2c96b0deaeed133a69154fe4688ed79f9d1551ab114b2e14a4ce553d7349fc4e9867351859c4c96febe68e56e5faf1

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          67be0dce93099be627afbe14db9ace97

                                                                          SHA1

                                                                          34a175a737c72cf493e8df9426008b7abb1cfefd

                                                                          SHA256

                                                                          8436fa2728617340a4c53a2077deacee0c9141d8929210174a81b58ef1c4f6d8

                                                                          SHA512

                                                                          0e51e2eb2e5837c7457d54723d23262b2fa65955ce88cdecd5de91b315acf32b597f290c2c1f96c828ae9364ea2bc81df1eb957cc41d088ccbf17139a3f66ef2

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                          Filesize

                                                                          111B

                                                                          MD5

                                                                          807419ca9a4734feaf8d8563a003b048

                                                                          SHA1

                                                                          a723c7d60a65886ffa068711f1e900ccc85922a6

                                                                          SHA256

                                                                          aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                                                          SHA512

                                                                          f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                          Filesize

                                                                          111B

                                                                          MD5

                                                                          285252a2f6327d41eab203dc2f402c67

                                                                          SHA1

                                                                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                          SHA256

                                                                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                          SHA512

                                                                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          6de9b773cb57a99f67668447aa1a2978

                                                                          SHA1

                                                                          8817d6f64a1405dbc5b54e924fc9fd0cfbf32bba

                                                                          SHA256

                                                                          d22e9cc71ef66fa854ed377e37ed6a52c476c04137af0a56e2537eeee6623cf9

                                                                          SHA512

                                                                          c73a7bf45657bf934905dfc902c2594a061ffc1b77becd25e5d7dc8cb9763e3499ad02b157044572c71c71331254a72993a21bd0f84a1160a361e590b1a32d79

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          cc616510d6dbd6a781b13e9c6bace951

                                                                          SHA1

                                                                          130eab5fcd39ea8b38fec05da08851cb8aa4952e

                                                                          SHA256

                                                                          09014cf59db7711bc9d7d0a1ae6cc8664e9de043f36cdbcc29799b91235559a8

                                                                          SHA512

                                                                          f2c663c41a1c261627b99ef92c614ca31c64807fb700834192d47691cb12ae3741c79072a55faf1dc3dd35b93c5a2c775c7de21412779b9f383e25a2568aff75

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          5KB

                                                                          MD5

                                                                          03a52f3e1d5fd1795becf217c1891aa5

                                                                          SHA1

                                                                          54139e9433c7d7d5ac984dd916b2fd9d5ad501f4

                                                                          SHA256

                                                                          42b453988f75cb0c038303a9b6e72bc9d4d1df4d86a7806c281a9dc9db7ad01c

                                                                          SHA512

                                                                          7925bec76a385bb97a815fa852b7f491c5354dcc7089b3612f1189bab6861092e8f18d4aac6940b335f7d0e25e31e934ab107d6f6a7c6e3b7d284f78758534cc

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          5KB

                                                                          MD5

                                                                          b9ef95dcc7e493272521417251798f56

                                                                          SHA1

                                                                          f036755db221c78aac4b145e18e1dedb103bff39

                                                                          SHA256

                                                                          4d7378b269e66f38b227043338a12f0870d0a985145a00988371819db15ee80a

                                                                          SHA512

                                                                          e2ebd0cc3ae88bcabea52109f832a79627f013786110b5b2c89ace27175334a51aed1e1aeb9cd2019156fad8c519437a4773b0c4e60dc6127c3813b3f770271a

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          7KB

                                                                          MD5

                                                                          cd9b5486601f6fba2e7794a02976264f

                                                                          SHA1

                                                                          7ba43e4424afc014945cc8c070fd2e2edad8289f

                                                                          SHA256

                                                                          f0278cfa6bb28ff5968f5507625ee5c6a28f4a7f004fa6afee2ff40ae91df3eb

                                                                          SHA512

                                                                          df1ebbd9e2af1d8da91f2f7954bf313e2cd6bb9775606f497318a8c20acee92d221009de7c92ea4c33ff086c2f1daa63ccf05dae706eb662c79177afb416c373

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          7KB

                                                                          MD5

                                                                          7831c7299ab56e58d402a796b72d5914

                                                                          SHA1

                                                                          c7f7fd65f58145abb63996729bcdfba37e27945b

                                                                          SHA256

                                                                          4c5e75b1e8688921116813ed4dd94ea9de32ed8d0bf65bdf89a9a6b0ac0d7268

                                                                          SHA512

                                                                          384d625e9d9a2c5aa02ea8e4e74c49790ebb425cbf0f1faf5d5a317056eb0819bb8a60637934ada79643041788f14ca661fc1e04ee7dbee539964e52cdb7f68c

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          7KB

                                                                          MD5

                                                                          554309ef775ecc52e4d9eeac4634a234

                                                                          SHA1

                                                                          946ff5bca90215c0e8091e88be9a52366afe82ca

                                                                          SHA256

                                                                          45be2eef26113586d950f4e35fcb3351e9a9f4ebf03d1e959bb1aa65592620b1

                                                                          SHA512

                                                                          d3d0f42c8183f6190f51a63f8961564a686bf113431ac9ccfa430bb899468146ca13e8e7826682c9ae43fb7d51515a29262255e5d5742d4a73c4444626c39b88

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                          Filesize

                                                                          24KB

                                                                          MD5

                                                                          25ac77f8c7c7b76b93c8346e41b89a95

                                                                          SHA1

                                                                          5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

                                                                          SHA256

                                                                          8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

                                                                          SHA512

                                                                          df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          e0c5c9c463da12884b250b0d393e4a6a

                                                                          SHA1

                                                                          516d0f46a0119c78f646854431e4b582e59f5845

                                                                          SHA256

                                                                          84b7a6f670183b9c61a60dab68a515d4de1367f915be73436f48084e519c0d5b

                                                                          SHA512

                                                                          8c5bc69e77424481a8cae131bc2b2a5c5df6470c87b63546dbe33539eb48e7602cf033f480b74aeecc5deeb63f760836c2312f67d5eb7aff8e38b6d2129a55fb

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          0e22b644f93cf8b8c4241ba5d15cee96

                                                                          SHA1

                                                                          8d08105aa6d5a90495e10ed1c4039ae87841f19b

                                                                          SHA256

                                                                          f356a4dc46edbc57ef020dbbd7c72f219c4d6c37d0a07a4b4685c2f30f7fb4e1

                                                                          SHA512

                                                                          588b58d9a843d51c239420ac74f7483896a71a41abc29cdd84a8deb629de750361f5496a67ca64384df4a7729d54134e8768c77efdd900ec0fc74f67df62eed9

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590db2.TMP

                                                                          Filesize

                                                                          868B

                                                                          MD5

                                                                          eab86f82f2560788f1f8f6bab38d350c

                                                                          SHA1

                                                                          8ee47e860ab172add7a9768d57b4c5f93df89411

                                                                          SHA256

                                                                          b45bd328c0c9a931337bdf48b3246677d6a058efa69d5afc7d0b829d450ef4d7

                                                                          SHA512

                                                                          da3073d3edd97c17f3dfb26347bee3f703bf96a9799bbea35c4f21c3f8f53d382935d0c40cd19b08f60752b12f5e7ebf2244d44e68a3c91335987894015e45ab

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                          Filesize

                                                                          16B

                                                                          MD5

                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                          SHA1

                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                          SHA256

                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                          SHA512

                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          43051dcf9c1cfdf9f8b0a889c583b21a

                                                                          SHA1

                                                                          8d9df8e3c60231de8e57c48d4bb3e7cb6bd294e0

                                                                          SHA256

                                                                          2e9b14159a3a1d27d1abd9ffa52d5534b462cfe7f717ce8546e34eb78b2d311b

                                                                          SHA512

                                                                          1d6f990148391a903c3e434abd92412fbb97a0710d782917df850b9436505a053ea42e7d6351fe660636fd5b46dfe89b4370f7548e76dd9cd6603d048b8fc8ed

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          468408a30920e024e10c8bbbf52ae19c

                                                                          SHA1

                                                                          c6426965440950a3282874a68169897f44b1f5e7

                                                                          SHA256

                                                                          ce2b8124f3a4af11280c7fffe07b17b392f1da8462e845581ffd72e2d740b0b9

                                                                          SHA512

                                                                          f856de2e342d3ddd5761a3d89508c5c4121bfcc9130d38881e632d32b12c3b19e1549427ace0d2dbc2eb75759be3ae595c2c80495193e0cc93325b112749cade

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          1de0b9dce68549ea8564244c75d10ed2

                                                                          SHA1

                                                                          12732e1202c9f9fe0bcb3e59a560e66e7b69bf11

                                                                          SHA256

                                                                          d2f04ab7e55092d767469d13e513f8d247fe2a664cfe12304f71ef295a179289

                                                                          SHA512

                                                                          56eaa4a5e4388564fc1c79720ff5d6afb5bf141b95649e68b26524dad567a89297ef6f3610d834354187f925f571b3ef43d3eaa77cee39f82f6558f35477bdb2

                                                                        • C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

                                                                          Filesize

                                                                          719KB

                                                                          MD5

                                                                          3386ad81408434f9ed016b9e53dbace9

                                                                          SHA1

                                                                          c0213ff91de115282db35d4d9eeeffcef41cd6e3

                                                                          SHA256

                                                                          e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

                                                                          SHA512

                                                                          05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

                                                                        • C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

                                                                          Filesize

                                                                          719KB

                                                                          MD5

                                                                          3386ad81408434f9ed016b9e53dbace9

                                                                          SHA1

                                                                          c0213ff91de115282db35d4d9eeeffcef41cd6e3

                                                                          SHA256

                                                                          e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

                                                                          SHA512

                                                                          05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

                                                                        • C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

                                                                          Filesize

                                                                          719KB

                                                                          MD5

                                                                          3386ad81408434f9ed016b9e53dbace9

                                                                          SHA1

                                                                          c0213ff91de115282db35d4d9eeeffcef41cd6e3

                                                                          SHA256

                                                                          e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

                                                                          SHA512

                                                                          05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

                                                                        • C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

                                                                          Filesize

                                                                          719KB

                                                                          MD5

                                                                          3386ad81408434f9ed016b9e53dbace9

                                                                          SHA1

                                                                          c0213ff91de115282db35d4d9eeeffcef41cd6e3

                                                                          SHA256

                                                                          e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

                                                                          SHA512

                                                                          05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

                                                                        • C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

                                                                          Filesize

                                                                          88KB

                                                                          MD5

                                                                          9f6ce7ff934fb2e786ced3516705efad

                                                                          SHA1

                                                                          6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

                                                                          SHA256

                                                                          59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

                                                                          SHA512

                                                                          d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

                                                                        • C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

                                                                          Filesize

                                                                          88KB

                                                                          MD5

                                                                          9f6ce7ff934fb2e786ced3516705efad

                                                                          SHA1

                                                                          6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

                                                                          SHA256

                                                                          59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

                                                                          SHA512

                                                                          d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

                                                                        • C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

                                                                          Filesize

                                                                          88KB

                                                                          MD5

                                                                          9f6ce7ff934fb2e786ced3516705efad

                                                                          SHA1

                                                                          6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

                                                                          SHA256

                                                                          59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

                                                                          SHA512

                                                                          d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

                                                                        • C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

                                                                          Filesize

                                                                          88KB

                                                                          MD5

                                                                          9f6ce7ff934fb2e786ced3516705efad

                                                                          SHA1

                                                                          6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

                                                                          SHA256

                                                                          59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

                                                                          SHA512

                                                                          d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

                                                                        • C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

                                                                          Filesize

                                                                          88KB

                                                                          MD5

                                                                          9f6ce7ff934fb2e786ced3516705efad

                                                                          SHA1

                                                                          6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

                                                                          SHA256

                                                                          59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

                                                                          SHA512

                                                                          d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

                                                                        • C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

                                                                          Filesize

                                                                          88KB

                                                                          MD5

                                                                          9f6ce7ff934fb2e786ced3516705efad

                                                                          SHA1

                                                                          6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

                                                                          SHA256

                                                                          59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

                                                                          SHA512

                                                                          d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

                                                                        • C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

                                                                          Filesize

                                                                          88KB

                                                                          MD5

                                                                          9f6ce7ff934fb2e786ced3516705efad

                                                                          SHA1

                                                                          6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

                                                                          SHA256

                                                                          59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

                                                                          SHA512

                                                                          d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

                                                                        • C:\Users\Admin\Documents\Downloads\Configuration.json

                                                                          Filesize

                                                                          50B

                                                                          MD5

                                                                          f02de144619935ec7a7ca8e525b72809

                                                                          SHA1

                                                                          6634430896cad76891f43866f1cc943d2ac7dc42

                                                                          SHA256

                                                                          7d4388a93452f34a0a37c08f43528f3be6af2f94b02bbe2d3bb68275c32b515e

                                                                          SHA512

                                                                          48a037fd3b43512e8f7b60ec0f07df8f1ccf3f589e7e6f09c08550a8c5fabcb131b4fff2a3ed28d4e11820b9d078aadb6a1be8334abf057c3782c5d75d67011c

                                                                        • C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

                                                                          Filesize

                                                                          129KB

                                                                          MD5

                                                                          ea87f37e78fb9af4bf805f6e958f68f4

                                                                          SHA1

                                                                          89662fed195d7b9d65ab7ba8605a3cd953f2b06a

                                                                          SHA256

                                                                          de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

                                                                          SHA512

                                                                          c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

                                                                        • C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

                                                                          Filesize

                                                                          129KB

                                                                          MD5

                                                                          ea87f37e78fb9af4bf805f6e958f68f4

                                                                          SHA1

                                                                          89662fed195d7b9d65ab7ba8605a3cd953f2b06a

                                                                          SHA256

                                                                          de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

                                                                          SHA512

                                                                          c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

                                                                        • C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

                                                                          Filesize

                                                                          129KB

                                                                          MD5

                                                                          ea87f37e78fb9af4bf805f6e958f68f4

                                                                          SHA1

                                                                          89662fed195d7b9d65ab7ba8605a3cd953f2b06a

                                                                          SHA256

                                                                          de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

                                                                          SHA512

                                                                          c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

                                                                        • C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

                                                                          Filesize

                                                                          129KB

                                                                          MD5

                                                                          ea87f37e78fb9af4bf805f6e958f68f4

                                                                          SHA1

                                                                          89662fed195d7b9d65ab7ba8605a3cd953f2b06a

                                                                          SHA256

                                                                          de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

                                                                          SHA512

                                                                          c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

                                                                        • C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

                                                                          Filesize

                                                                          129KB

                                                                          MD5

                                                                          ea87f37e78fb9af4bf805f6e958f68f4

                                                                          SHA1

                                                                          89662fed195d7b9d65ab7ba8605a3cd953f2b06a

                                                                          SHA256

                                                                          de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

                                                                          SHA512

                                                                          c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

                                                                        • C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

                                                                          Filesize

                                                                          129KB

                                                                          MD5

                                                                          ea87f37e78fb9af4bf805f6e958f68f4

                                                                          SHA1

                                                                          89662fed195d7b9d65ab7ba8605a3cd953f2b06a

                                                                          SHA256

                                                                          de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

                                                                          SHA512

                                                                          c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

                                                                        • C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

                                                                          Filesize

                                                                          129KB

                                                                          MD5

                                                                          ea87f37e78fb9af4bf805f6e958f68f4

                                                                          SHA1

                                                                          89662fed195d7b9d65ab7ba8605a3cd953f2b06a

                                                                          SHA256

                                                                          de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

                                                                          SHA512

                                                                          c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

                                                                        • C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

                                                                          Filesize

                                                                          685KB

                                                                          MD5

                                                                          081d9558bbb7adce142da153b2d5577a

                                                                          SHA1

                                                                          7d0ad03fbda1c24f883116b940717e596073ae96

                                                                          SHA256

                                                                          b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                                                                          SHA512

                                                                          2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                                                                        • C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

                                                                          Filesize

                                                                          685KB

                                                                          MD5

                                                                          081d9558bbb7adce142da153b2d5577a

                                                                          SHA1

                                                                          7d0ad03fbda1c24f883116b940717e596073ae96

                                                                          SHA256

                                                                          b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                                                                          SHA512

                                                                          2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                                                                        • C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

                                                                          Filesize

                                                                          685KB

                                                                          MD5

                                                                          081d9558bbb7adce142da153b2d5577a

                                                                          SHA1

                                                                          7d0ad03fbda1c24f883116b940717e596073ae96

                                                                          SHA256

                                                                          b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                                                                          SHA512

                                                                          2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                                                                        • C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

                                                                          Filesize

                                                                          685KB

                                                                          MD5

                                                                          081d9558bbb7adce142da153b2d5577a

                                                                          SHA1

                                                                          7d0ad03fbda1c24f883116b940717e596073ae96

                                                                          SHA256

                                                                          b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                                                                          SHA512

                                                                          2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                                                                        • C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

                                                                          Filesize

                                                                          685KB

                                                                          MD5

                                                                          081d9558bbb7adce142da153b2d5577a

                                                                          SHA1

                                                                          7d0ad03fbda1c24f883116b940717e596073ae96

                                                                          SHA256

                                                                          b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                                                                          SHA512

                                                                          2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                                                                        • C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

                                                                          Filesize

                                                                          685KB

                                                                          MD5

                                                                          081d9558bbb7adce142da153b2d5577a

                                                                          SHA1

                                                                          7d0ad03fbda1c24f883116b940717e596073ae96

                                                                          SHA256

                                                                          b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                                                                          SHA512

                                                                          2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                                                                        • C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

                                                                          Filesize

                                                                          685KB

                                                                          MD5

                                                                          081d9558bbb7adce142da153b2d5577a

                                                                          SHA1

                                                                          7d0ad03fbda1c24f883116b940717e596073ae96

                                                                          SHA256

                                                                          b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                                                                          SHA512

                                                                          2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                                                                        • C:\Users\Admin\Documents\Downloads\Results\2023. September 15., Friday - 06.56.20\NordVPN Free.txt

                                                                          Filesize

                                                                          4KB

                                                                          MD5

                                                                          2f43fabd25ca3852b1e63b0970a9b5e4

                                                                          SHA1

                                                                          3417bb79b7b005bb966914938c981fdc75f7d5b2

                                                                          SHA256

                                                                          d68923f0ebe24f16031f9a998cf95ee473c0ed420d40710dda6433fce7552b5b

                                                                          SHA512

                                                                          8c09c1b9fd6c18fabc46480f987c4d7c6833a3d9e0380073d22cd64f70420045fb7dceb3a40a8b80b5198848185d3d471d3a14ec2a2806e93700fbe31f7eddb0

                                                                        • C:\Users\Admin\Downloads\proxies.txt

                                                                          Filesize

                                                                          11KB

                                                                          MD5

                                                                          ffcf04e04acc27643bd230be9e826c47

                                                                          SHA1

                                                                          e800c5ddcb0f2229cfccfbea3a9963686319ac89

                                                                          SHA256

                                                                          a86ef90e8bf795211b2d4271b0add230a77f127c733bbc6067445f15662870a7

                                                                          SHA512

                                                                          dff2aa87d7d415dcb1ed96b95b80178c0fd7dcadfbbe5a1296adcef6019c5a5357155a0d2379c073baf5ef43b76d0779912d559f3805a33e20fe1498c5ac8661

                                                                        • memory/4524-12-0x0000000074AD0000-0x0000000075280000-memory.dmp

                                                                          Filesize

                                                                          7.7MB

                                                                        • memory/4524-31-0x00000000062E0000-0x0000000006884000-memory.dmp

                                                                          Filesize

                                                                          5.6MB

                                                                        • memory/4524-17-0x0000000005840000-0x00000000058F0000-memory.dmp

                                                                          Filesize

                                                                          704KB

                                                                        • memory/4524-30-0x0000000074AD0000-0x0000000075280000-memory.dmp

                                                                          Filesize

                                                                          7.7MB

                                                                        • memory/4524-21-0x0000000005790000-0x00000000057B6000-memory.dmp

                                                                          Filesize

                                                                          152KB

                                                                        • memory/4524-23-0x00000000057F0000-0x0000000005812000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                        • memory/4524-29-0x0000000005740000-0x0000000005750000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4524-13-0x0000000000CC0000-0x0000000000D7A000-memory.dmp

                                                                          Filesize

                                                                          744KB

                                                                        • memory/4524-27-0x00000000057C0000-0x00000000057DC000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                        • memory/4524-32-0x0000000005740000-0x0000000005750000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4524-34-0x0000000074AD0000-0x0000000075280000-memory.dmp

                                                                          Filesize

                                                                          7.7MB

                                                                        • memory/4524-28-0x0000000005C90000-0x0000000005D22000-memory.dmp

                                                                          Filesize

                                                                          584KB

                                                                        • memory/4768-37-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                          Filesize

                                                                          7.7MB

                                                                        • memory/4768-44-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4768-45-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                          Filesize

                                                                          7.7MB

                                                                        • memory/4768-682-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4768-635-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/8080-767-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                          Filesize

                                                                          7.7MB

                                                                        • memory/8080-773-0x00000000050B0000-0x00000000050C0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/8080-800-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                          Filesize

                                                                          7.7MB

                                                                        • memory/8080-814-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                          Filesize

                                                                          7.7MB