aeb237ec5d02a178db6279cffe4e39904f9e1da9e94d7f1b36d32ed14ab55171

Analysis

max time kernel
990s
max time network
995s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads.zip
Size

833KB
MD5

753fb2666923b1b8c9e7564181c24e84
SHA1

5e819566d2a4686ae47491ab270352bdc2fe66d1
SHA256

aeb237ec5d02a178db6279cffe4e39904f9e1da9e94d7f1b36d32ed14ab55171
SHA512

715493c23bdb285a9aef8538b1c3040c687d197782888ee0418b5b0a49ff32008bd1d2c90e537822fcb258f8a136ec02e2b408ff438f97a3c8a538d70e4afb97
SSDEEP

12288:hL+bTfjAoXG2s8mMxMWXhcqAdiG3k6s8yqwexgeOiX1vT1Re1pRtE4mpEE1e7j:hiLvfsae+4evPeeeDd1U1ntEfpEE8

Score

9^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (581) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
4524	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
8080	Aura_protected-Deobfuscated.exe

Loads dropped DLL 18 IoCs

pid	Process
4524	Aura_protected-Deobfuscated.exe
4524	Aura_protected-Deobfuscated.exe
4524	Aura_protected-Deobfuscated.exe
4524	Aura_protected-Deobfuscated.exe
4524	Aura_protected-Deobfuscated.exe
4524	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
8080	Aura_protected-Deobfuscated.exe
8080	Aura_protected-Deobfuscated.exe
8080	Aura_protected-Deobfuscated.exe
8080	Aura_protected-Deobfuscated.exe
8080	Aura_protected-Deobfuscated.exe
8080	Aura_protected-Deobfuscated.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Aura_protected-Deobfuscated.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Aura_protected-Deobfuscated.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Downloads"	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Aura_protected-Deobfuscated.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{43CB05B0-8B0D-4DAE-97C8-0636B394E528}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Aura_protected-Deobfuscated.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Aura_protected-Deobfuscated.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "5"	Aura_protected-Deobfuscated.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e8005398e082303024b98265d99428e115f0000	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Aura_protected-Deobfuscated.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Aura_protected-Deobfuscated.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Aura_protected-Deobfuscated.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Aura_protected-Deobfuscated.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
3912	msedge.exe
3912	msedge.exe
4560	identity_helper.exe
4560	identity_helper.exe
2724	msedge.exe
2724	msedge.exe
4140	msedge.exe
4140	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4768	Aura_protected-Deobfuscated.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	3504	7zG.exe
Token: 35	3504	7zG.exe
Token: SeSecurityPrivilege	3504	7zG.exe
Token: SeSecurityPrivilege	3504	7zG.exe
Token: SeDebugPrivilege	4524	Aura_protected-Deobfuscated.exe
Token: SeDebugPrivilege	4768	Aura_protected-Deobfuscated.exe
Token: 33	4936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4936	AUDIODG.EXE
Token: SeDebugPrivilege	8080	Aura_protected-Deobfuscated.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3504	7zG.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4524	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe
4768	Aura_protected-Deobfuscated.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4668	3912	msedge.exe	103
PID 3912 wrote to memory of 4668	3912	msedge.exe	103
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 4604	3912	msedge.exe	104
PID 3912 wrote to memory of 2196	3912	msedge.exe	105
PID 3912 wrote to memory of 2196	3912	msedge.exe	105
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106
PID 3912 wrote to memory of 1048	3912	msedge.exe	106

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloads.zip
1⤵
PID:2216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1160

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\Downloads\" -an -ai#7zMap26400:116:7zEvent8466
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3504

C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe
"C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe
"C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa73d046f8,0x7ffa73d04708,0x7ffa73d04718
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4032 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:7380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:7388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8677485017518701183,1142297056877595157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x2d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe
"C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:8080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Aura_protected-Deobfuscated.exe.log

Filesize
1KB

MD5
35a68f06cc0349e8a8d57037875edbf2

SHA1
58fd73d2f7060522f12243c13078141cdced93ca

SHA256
3cf2d7b2914819574e570795093541d752389b0c53f7bab2a6f7cb84e2cd683c

SHA512
81092997f3e75681cfaf8d01eb59e96237e3cc194af2a51aa41c532ac82145c46b7e73032c234889965322d65b1182dfb72fa9c70168350d6a85b84ef09e6954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
24KB

MD5
59b2a08dbe983864b1282169ed44d587

SHA1
55a4b388951aa496c790ed2c264c6ea8bdcdf49f

SHA256
643254f9ea3311ad024ae0ed83c78be1c62776024fae5bb4bb129ba552f775c2

SHA512
912fe26ddee336dd8df63609131ae9de79cefee3355c31eee1928d170d939c7f78465835fa600e3e090e9ee37263fc501477f65c5e669823c20b072375f32d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
30KB

MD5
e8c79a8e6a2b23349122d3de7053c805

SHA1
0b5d050a141d6dc2874f466436da8eb3ce92fcce

SHA256
298048cb203648006a6493beaa3e95a2565593bec59a76f0b7f16ac2413f2bea

SHA512
67fcf182d217c64a74c1e5614cdf3f142413ad893402a79e8ed8d443a0f4a6fedfe62e870d5a2fe6daa80bc7bec521144fc15d55e61d839cedb06dda7aebe762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
16KB

MD5
91dada384946e538ccfa80a0b96f5687

SHA1
5fa1395001c1aceb8c5bf24e3e5c4c11605adeb2

SHA256
df79b3140e6d55373a896b2f65f29fc04b585812dc63a967cf5f2f3659bb8144

SHA512
95e4adf21e88e754f6ce4dc3087b65255c8a5b7bd85cf36baed9e18915c240f8ed6fffc51a899759791b651c6d6bfe4b9767dc61f92b5cc7035b0b466834d700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
26KB

MD5
1568d67347b49eca6e7bfbc7e76a250d

SHA1
31519369a4a1bdb5fdc1136b83e4f667e47c583d

SHA256
b151ddffd3e18b768b64c12cce91b3cb2e46288ff76dc8a42cbfef4d033318a4

SHA512
c29e66af004083781beee25c3c4f0c2377c51ae60ed9803e6a2463416391fcc78450257dc35644d808f0e6f17494333c3d0424a90c20997daf036049a0093a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
64KB

MD5
8ebd96994a4e6b3fdb5397e39a2cf6aa

SHA1
6b01d01c679ad6e24af81ff367ec7b2b7709276d

SHA256
bcfb5e3b81bf192d5a5b2dafe45c5fdbd4df763cdbcdde26a0a129936d7a4dff

SHA512
fc755011b0344eed2a3da3889ee79077e271d3fb9a1b2c174b1fb99c8944aab20ac0039dacf8466ee0061443a6ab584f48b83e330c0d9fc694967dba81b42a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
212KB

MD5
544bbd7a89a06c9bbdffb1a685b8d63e

SHA1
446d460ba9e91895da6b3973877637e796ee77cd

SHA256
ef5ab21b15ec4cec46a4496be95bf51fb8c7bb9e0154b00cb72c84cb2b5c43bb

SHA512
d644566108ccd320f3e01ec75bee3383acd7872e99a08ddb2d2d6ce38babc6fec40546880d5782b81d25cefb08b3180896dcbd9f6650764ca5045dcf83e82653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
52KB

MD5
60b08087668454b90a2bf90bf964ef44

SHA1
05e49827a847954ff4609649b524f9443e8e0b43

SHA256
0246f91847a57f5adb77eaecd28a2a9e1e10b893ad118300bef0fda17356c27a

SHA512
c9ff8efcbcec522270e127656014a8e553f7a3963f95ef095e41cd851c32a9a1dc7fd31f94f47be4ea814cbc3fa4028c00d21bfa257223a1bc1c9387b7a303d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
36KB

MD5
120b7b3291b329d1dcf39b85874b0a12

SHA1
5895412b32d1674e363c5a846281c110da781b86

SHA256
f3879e333ecc29a6f21b71c107186dfe6e4c9ccbdfbfcf0ea2ca3f34c9349e95

SHA512
48187e1b6941fce46ce7c115f5d6b12b9c9e245cd5ee4a1d85c549db949476d5c479e122dce6004dbda3c4d7c3ad607b2f5d963259f0b5423882079b993f3d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
18KB

MD5
ee842127684d9d042df8f72398ffae12

SHA1
1c31fd59f7adbae21a8d1819ce43f371d3923840

SHA256
20ccf88cf91b801a424ea870dac3a7282d9e771f67fd5fc0ff75985735882961

SHA512
de618297d4e4c1143a5029ce53176449fa2c96b0deaeed133a69154fe4688ed79f9d1551ab114b2e14a4ce553d7349fc4e9867351859c4c96febe68e56e5faf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
67be0dce93099be627afbe14db9ace97

SHA1
34a175a737c72cf493e8df9426008b7abb1cfefd

SHA256
8436fa2728617340a4c53a2077deacee0c9141d8929210174a81b58ef1c4f6d8

SHA512
0e51e2eb2e5837c7457d54723d23262b2fa65955ce88cdecd5de91b315acf32b597f290c2c1f96c828ae9364ea2bc81df1eb957cc41d088ccbf17139a3f66ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6de9b773cb57a99f67668447aa1a2978

SHA1
8817d6f64a1405dbc5b54e924fc9fd0cfbf32bba

SHA256
d22e9cc71ef66fa854ed377e37ed6a52c476c04137af0a56e2537eeee6623cf9

SHA512
c73a7bf45657bf934905dfc902c2594a061ffc1b77becd25e5d7dc8cb9763e3499ad02b157044572c71c71331254a72993a21bd0f84a1160a361e590b1a32d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc616510d6dbd6a781b13e9c6bace951

SHA1
130eab5fcd39ea8b38fec05da08851cb8aa4952e

SHA256
09014cf59db7711bc9d7d0a1ae6cc8664e9de043f36cdbcc29799b91235559a8

SHA512
f2c663c41a1c261627b99ef92c614ca31c64807fb700834192d47691cb12ae3741c79072a55faf1dc3dd35b93c5a2c775c7de21412779b9f383e25a2568aff75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03a52f3e1d5fd1795becf217c1891aa5

SHA1
54139e9433c7d7d5ac984dd916b2fd9d5ad501f4

SHA256
42b453988f75cb0c038303a9b6e72bc9d4d1df4d86a7806c281a9dc9db7ad01c

SHA512
7925bec76a385bb97a815fa852b7f491c5354dcc7089b3612f1189bab6861092e8f18d4aac6940b335f7d0e25e31e934ab107d6f6a7c6e3b7d284f78758534cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9ef95dcc7e493272521417251798f56

SHA1
f036755db221c78aac4b145e18e1dedb103bff39

SHA256
4d7378b269e66f38b227043338a12f0870d0a985145a00988371819db15ee80a

SHA512
e2ebd0cc3ae88bcabea52109f832a79627f013786110b5b2c89ace27175334a51aed1e1aeb9cd2019156fad8c519437a4773b0c4e60dc6127c3813b3f770271a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cd9b5486601f6fba2e7794a02976264f

SHA1
7ba43e4424afc014945cc8c070fd2e2edad8289f

SHA256
f0278cfa6bb28ff5968f5507625ee5c6a28f4a7f004fa6afee2ff40ae91df3eb

SHA512
df1ebbd9e2af1d8da91f2f7954bf313e2cd6bb9775606f497318a8c20acee92d221009de7c92ea4c33ff086c2f1daa63ccf05dae706eb662c79177afb416c373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7831c7299ab56e58d402a796b72d5914

SHA1
c7f7fd65f58145abb63996729bcdfba37e27945b

SHA256
4c5e75b1e8688921116813ed4dd94ea9de32ed8d0bf65bdf89a9a6b0ac0d7268

SHA512
384d625e9d9a2c5aa02ea8e4e74c49790ebb425cbf0f1faf5d5a317056eb0819bb8a60637934ada79643041788f14ca661fc1e04ee7dbee539964e52cdb7f68c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
554309ef775ecc52e4d9eeac4634a234

SHA1
946ff5bca90215c0e8091e88be9a52366afe82ca

SHA256
45be2eef26113586d950f4e35fcb3351e9a9f4ebf03d1e959bb1aa65592620b1

SHA512
d3d0f42c8183f6190f51a63f8961564a686bf113431ac9ccfa430bb899468146ca13e8e7826682c9ae43fb7d51515a29262255e5d5742d4a73c4444626c39b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e0c5c9c463da12884b250b0d393e4a6a

SHA1
516d0f46a0119c78f646854431e4b582e59f5845

SHA256
84b7a6f670183b9c61a60dab68a515d4de1367f915be73436f48084e519c0d5b

SHA512
8c5bc69e77424481a8cae131bc2b2a5c5df6470c87b63546dbe33539eb48e7602cf033f480b74aeecc5deeb63f760836c2312f67d5eb7aff8e38b6d2129a55fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e22b644f93cf8b8c4241ba5d15cee96

SHA1
8d08105aa6d5a90495e10ed1c4039ae87841f19b

SHA256
f356a4dc46edbc57ef020dbbd7c72f219c4d6c37d0a07a4b4685c2f30f7fb4e1

SHA512
588b58d9a843d51c239420ac74f7483896a71a41abc29cdd84a8deb629de750361f5496a67ca64384df4a7729d54134e8768c77efdd900ec0fc74f67df62eed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590db2.TMP

Filesize
868B

MD5
eab86f82f2560788f1f8f6bab38d350c

SHA1
8ee47e860ab172add7a9768d57b4c5f93df89411

SHA256
b45bd328c0c9a931337bdf48b3246677d6a058efa69d5afc7d0b829d450ef4d7

SHA512
da3073d3edd97c17f3dfb26347bee3f703bf96a9799bbea35c4f21c3f8f53d382935d0c40cd19b08f60752b12f5e7ebf2244d44e68a3c91335987894015e45ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
43051dcf9c1cfdf9f8b0a889c583b21a

SHA1
8d9df8e3c60231de8e57c48d4bb3e7cb6bd294e0

SHA256
2e9b14159a3a1d27d1abd9ffa52d5534b462cfe7f717ce8546e34eb78b2d311b

SHA512
1d6f990148391a903c3e434abd92412fbb97a0710d782917df850b9436505a053ea42e7d6351fe660636fd5b46dfe89b4370f7548e76dd9cd6603d048b8fc8ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
468408a30920e024e10c8bbbf52ae19c

SHA1
c6426965440950a3282874a68169897f44b1f5e7

SHA256
ce2b8124f3a4af11280c7fffe07b17b392f1da8462e845581ffd72e2d740b0b9

SHA512
f856de2e342d3ddd5761a3d89508c5c4121bfcc9130d38881e632d32b12c3b19e1549427ace0d2dbc2eb75759be3ae595c2c80495193e0cc93325b112749cade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1de0b9dce68549ea8564244c75d10ed2

SHA1
12732e1202c9f9fe0bcb3e59a560e66e7b69bf11

SHA256
d2f04ab7e55092d767469d13e513f8d247fe2a664cfe12304f71ef295a179289

SHA512
56eaa4a5e4388564fc1c79720ff5d6afb5bf141b95649e68b26524dad567a89297ef6f3610d834354187f925f571b3ef43d3eaa77cee39f82f6558f35477bdb2

Download Submit
C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

Filesize
719KB

MD5
3386ad81408434f9ed016b9e53dbace9

SHA1
c0213ff91de115282db35d4d9eeeffcef41cd6e3

SHA256
e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

SHA512
05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

Download Submit
C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

Filesize
719KB

MD5
3386ad81408434f9ed016b9e53dbace9

SHA1
c0213ff91de115282db35d4d9eeeffcef41cd6e3

SHA256
e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

SHA512
05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

Download Submit
C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

Filesize
719KB

MD5
3386ad81408434f9ed016b9e53dbace9

SHA1
c0213ff91de115282db35d4d9eeeffcef41cd6e3

SHA256
e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

SHA512
05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

Download Submit
C:\Users\Admin\Documents\Downloads\Aura_protected-Deobfuscated.exe

Filesize
719KB

MD5
3386ad81408434f9ed016b9e53dbace9

SHA1
c0213ff91de115282db35d4d9eeeffcef41cd6e3

SHA256
e111558c67563a6cd72ffd1bb0d0150c8187f99cc62a800167b6421228b93916

SHA512
05ca5146ddf5d836201e78014a67c36749d91af4e291dd12014d907861ac7913da66faeacb0066a49d15ca18608ae5490e0128a4ae16116a8d858f3d161c9204

Download Submit
C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Documents\Downloads\Colorful.Console.dll

Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Documents\Downloads\Configuration.json

Filesize
50B

MD5
f02de144619935ec7a7ca8e525b72809

SHA1
6634430896cad76891f43866f1cc943d2ac7dc42

SHA256
7d4388a93452f34a0a37c08f43528f3be6af2f94b02bbe2d3bb68275c32b515e

SHA512
48a037fd3b43512e8f7b60ec0f07df8f1ccf3f589e7e6f09c08550a8c5fabcb131b4fff2a3ed28d4e11820b9d078aadb6a1be8334abf057c3782c5d75d67011c

Download Submit
C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Documents\Downloads\Leaf.xNet.dll

Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Documents\Downloads\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Documents\Downloads\Results\2023. September 15., Friday - 06.56.20\NordVPN Free.txt

Filesize
4KB

MD5
2f43fabd25ca3852b1e63b0970a9b5e4

SHA1
3417bb79b7b005bb966914938c981fdc75f7d5b2

SHA256
d68923f0ebe24f16031f9a998cf95ee473c0ed420d40710dda6433fce7552b5b

SHA512
8c09c1b9fd6c18fabc46480f987c4d7c6833a3d9e0380073d22cd64f70420045fb7dceb3a40a8b80b5198848185d3d471d3a14ec2a2806e93700fbe31f7eddb0

Download Submit
C:\Users\Admin\Downloads\proxies.txt

Filesize
11KB

MD5
ffcf04e04acc27643bd230be9e826c47

SHA1
e800c5ddcb0f2229cfccfbea3a9963686319ac89

SHA256
a86ef90e8bf795211b2d4271b0add230a77f127c733bbc6067445f15662870a7

SHA512
dff2aa87d7d415dcb1ed96b95b80178c0fd7dcadfbbe5a1296adcef6019c5a5357155a0d2379c073baf5ef43b76d0779912d559f3805a33e20fe1498c5ac8661

Download Submit
memory/4524-12-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4524-31-0x00000000062E0000-0x0000000006884000-memory.dmp

Filesize
5.6MB

Download
memory/4524-17-0x0000000005840000-0x00000000058F0000-memory.dmp

Filesize
704KB

Download
memory/4524-30-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4524-21-0x0000000005790000-0x00000000057B6000-memory.dmp

Filesize
152KB

Download
memory/4524-23-0x00000000057F0000-0x0000000005812000-memory.dmp

Filesize
136KB

Download
memory/4524-29-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4524-13-0x0000000000CC0000-0x0000000000D7A000-memory.dmp

Filesize
744KB

Download
memory/4524-27-0x00000000057C0000-0x00000000057DC000-memory.dmp

Filesize
112KB

Download
memory/4524-32-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4524-34-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4524-28-0x0000000005C90000-0x0000000005D22000-memory.dmp

Filesize
584KB

Download
memory/4768-37-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/4768-44-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4768-45-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/4768-682-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4768-635-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/8080-767-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/8080-773-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/8080-800-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/8080-814-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download