Windows Analysis Report
https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win

Overview

General Information

Sample URL:	https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win
Analysis ID:	1428697

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Enables debug privileges

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win	HTTP Parser: No favicon
Source: https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: unknown

DNS traffic detected: queries for: update1.nextron-systems.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@20/12@6/80

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03

Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe

File opened: C:\Windows\system32\77f94e831ececf7dd57afd28c1df76bbc7d87e73f210314e550f03609ad4a2e7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1956,i,12269075984306992411,5489090037202435979,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1956,i,12269075984306992411,5489090037202435979,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe "C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe "C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe

File opened: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\config\false-positives.cfg

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe

Process information queried: ProcessInformation

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\Temp1_aurora-agent-lite-win-pack.zip\aurora-agent-64.exe

Process token adjusted: Debug

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
64.233.185.113	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
87.106.126.89	update1.nextron-systems.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
64.233.185.94	unknown	United States	15169	GOOGLEUS	false
142.251.15.84	unknown	United States	15169	GOOGLEUS	false
142.251.15.147	www.google.com	United States	15169	GOOGLEUS	false
172.253.124.138	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
update1.nextron-systems.com	87.106.126.89	true
www.google.com	142.251.15.147	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win	false		unknown

ID:	1428697
Product:	CloudBasic
Start time:	11:55:50
Start date:	19.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:56:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	87E39B4F13EE1AD08D9E294C11159811	DBF8EE240C4A8C34773ADB1683DA0580F488BE2B	9E282B197310C9909C646E4B1EBB09B61B177D7B2B7754626AB1016BF8C90333
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:56:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C8CA183E0EBCBD76E6EEF725FA215010	7D8B3783E8806904462B259EFB1245CFE2F70598	267980FF2A8EAC1D949BEE1C78BFCD657A1961154AE227B01BB1926272389E50
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	003F1433EDD9B877ED03AC70E207DA2F	4842741A1C0B88DC2465047B65C906AA502327C5	C9F3192780B46F213A6D283F10F9F4F723F74125D306D8B3774A574BA5F1128E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:56:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	421619F20D7506879BB873EE4A997AE3	8201333D87F6A1E6E85E5F27EEA546372C741012	FDFDCEE621882CE3FD962BD382EA91566085603C700B144258E18E25A7B2B317
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:56:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	412DBA8C01A4D7B1057A6A306ADE6E30	5B8827233D20695791D28FAF53A0F84793D405D3	816F37FCBBF4B5F5D4841BB7BFA8E3941E0CB4504D613BA78ABECBDE8BC6A97D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:56:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CF5551E6E55FFFA3A1B006B8488FF4F6	3CFBF55F7A8000EB7222F80E86E2EDE0F351F453	0FCEB41A49A28F9CAF765AF5068023F92CD31E644F8882D9C09C3F279CF96A9B
C:\Users\user\Downloads\a87f6afb-320c-4e1b-ae83-ea9d9c2ea4c1.tmp	Zip archive data, at least v1.0 to extract, compression method=store	4A2F47F51B4E00EA18BB7FA2A640D4C7	BCD38EECE7AC12197E3B827A6BB41E9143798FEF	674A021C2080071933B894118CB06493CB1B056071C8C1B5F97E2F4C40AD11FD
C:\Users\user\Downloads\aurora-agent-lite-win-pack.zip (copy)	Zip archive data, at least v1.0 to extract, compression method=store	FC153A658C77C4A0328A79E38AC0F65F	A9B0BB5EE948B9EEACF3CA665C4EF0DA386D6918	C94429D2DEB1D5672D770074650BB189AA8020474CEF14A62EBCD6EB21FC0D11
C:\Users\user\Downloads\aurora-agent-lite-win-pack.zip.crdownload	Zip archive data, at least v1.0 to extract, compression method=store	FC153A658C77C4A0328A79E38AC0F65F	A9B0BB5EE948B9EEACF3CA665C4EF0DA386D6918	C94429D2DEB1D5672D770074650BB189AA8020474CEF14A62EBCD6EB21FC0D11
Chrome Cache Entry: 65	ASCII text	BCC3EC9DF081E80EFE599ADC1CA3FB56	FFFFF12FF1F96757FB864AF08C59F71978AF3916	29CFBA36A660097035110F9074732634EF0711C53A4CA4F1967E244B649D22F3
Chrome Cache Entry: 67	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	272E09A275448748EE79A2F9F268E82D	C52F10BB7008D0D49D98A7207B3D6D5B93E318F1	E4CAB202C7FA676E6E549A099B3E2F81FC39EE525696EBF6A11C44365372FD8D
Chrome Cache Entry: 68	HTML document, ASCII text, with very long lines (13668)	C1FC04C863F201125825245000E8851C	737C62259EF3EFC81F30AABD52E723EC933BA951	9999EFF591D934DED15C96534A411DD6AF6DBC1BF1BD4A4ED8E382C4FD0C7898
Chrome Cache Entry: 70	ASCII text, with very long lines (65447)	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E

Windows Analysis Report
https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://update1.nextron-systems.com/getlite.php?type=aurora-agent-lite-win