Edit tour

Windows Analysis Report
Aura.exe

Overview

General Information

Sample name:	Aura.exe
Analysis ID:	1635429
MD5:	bcfc6d6a511252168841ec1ecc958dd6
SHA1:	1d517629c8994f87aff924862c2f99ca1dfc433a
SHA256:	805b842a22a72b58a7932a54da75bcf703dbec25d25bf0dccf853c860666fcea
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Aura.exe (PID: 8488 cmdline: "C:\Users\user\Desktop\Aura.exe" MD5: BCFC6D6A511252168841EC1ECC958DD6)

conhost.exe (PID: 8496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Aura.exe (PID: 8548 cmdline: "C:\Users\user\Desktop\Aura.exe" MD5: BCFC6D6A511252168841EC1ECC958DD6)

Aura.exe (PID: 8556 cmdline: "C:\Users\user\Desktop\Aura.exe" MD5: BCFC6D6A511252168841EC1ECC958DD6)

WerFault.exe (PID: 8648 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8488 -s 400 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.1484274331.0000000001327000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2578327207.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000003.00000003.1425991879.0000000001383000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1484126690.0000000001327000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1483876553.0000000001327000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Aura.exe PID: 8556	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Aura.exe PID: 8556	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.Aura.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
3.2.Aura.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:10:12.781362+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	149.154.167.99	443	TCP
2025-03-11T17:10:15.037924+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.93.43	443	TCP
2025-03-11T17:10:16.744887+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.16.1	443	TCP
2025-03-11T17:10:19.476810+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	104.21.16.1	443	TCP
2025-03-11T17:10:22.141023+0100	2028371	3	Unknown Traffic	192.168.2.5	49712	104.21.16.1	443	TCP
2025-03-11T17:10:24.892669+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	104.21.16.1	443	TCP
2025-03-11T17:10:28.142209+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	104.21.16.1	443	TCP
2025-03-11T17:10:31.407366+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	104.21.16.1	443	TCP
2025-03-11T17:10:35.037987+0100	2028371	3	Unknown Traffic	192.168.2.5	49719	104.21.16.1	443	TCP
2025-03-11T17:10:36.669576+0100	2028371	3	Unknown Traffic	192.168.2.5	49721	188.114.97.3	443	TCP

HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65Host: mrodularmall.top

Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowko
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv209h
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://featureccus.shop/bdMAnM
Source: Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://featureccus.shop/l
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/
Source: Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/P
Source: Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUa
Source: Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/cb
Source: Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu:443/bdWUaicrosoft
Source: Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1509261866.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1534242372.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/
Source: Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/8
Source: Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/P=C:
Source: Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/Sb
Source: Aura.exe, 00000003.00000003.1509261866.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/Y
Source: Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/a
Source: Aura.exe, 00000003.00000003.1534242372.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzS
Source: Aura.exe, 00000003.00000003.1555362408.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1555401145.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1534242372.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzSim
Source: Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzSy
Source: Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/p#b
Source: Aura.exe, 00000003.00000003.1449006745.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1425124973.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1423142277.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1508869079.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1424052324.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1477825528.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1395874766.0000000001303000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1424492990.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top:443/aNzS
Source: Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top:443/aNzSMicrosoft
Source: Aura.exe, 00000003.00000003.1508869079.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1477825528.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top:443/aNzShv.default-release/key4.dbPK
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Aura.exe, 00000003.00000003.1353557204.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353634903.0000000001303000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1395874766.0000000001303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Aura.exe, 00000003.00000003.1353519964.0000000001371000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2578727115.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/asdawfq
Source: Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Aura.exe, 00000003.00000003.1353712898.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353557204.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=534dbfa6f9df898e79_173770952914
Source: Aura.exe, 00000003.00000003.1353712898.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353557204.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgX-Frame-OptionsALLOW-FROM
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49721 version: TLS 1.2

Source: C:\Users\user\Desktop\Aura.exe

Code function: 3_2_00440070 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

3_2_00440070

Source: C:\Users\user\Desktop\Aura.exe

Code function: 3_2_03721000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

3_2_03721000

Source: C:\Users\user\Desktop\Aura.exe

Code function: 3_2_00440070 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

3_2_00440070

Source: C:\Users\user\Desktop\Aura.exe

Code function: 3_2_00440220 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

3_2_00440220

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A54D60	0_2_00A54D60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A91EE0	0_2_00A91EE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A926F0	0_2_00A926F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5C0A0	0_2_00A5C0A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A858A0	0_2_00A858A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A868A0	0_2_00A868A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA28A0	0_2_00AA28A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB78A0	0_2_00AB78A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6D8E0	0_2_00A6D8E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A898F0	0_2_00A898F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A918F0	0_2_00A918F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB88F0	0_2_00AB88F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6E0D0	0_2_00A6E0D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAD0D0	0_2_00AAD0D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A68020	0_2_00A68020
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A78020	0_2_00A78020
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA9030	0_2_00AA9030
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A64810	0_2_00A64810
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8A816	0_2_00A8A816
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A59860	0_2_00A59860
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5D870	0_2_00A5D870
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6D070	0_2_00A6D070
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A60070	0_2_00A60070
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAA073	0_2_00AAA073
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AD5072	0_2_00AD5072
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8E050	0_2_00A8E050
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAA1BB	0_2_00AAA1BB
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A67980	0_2_00A67980
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5E9E0	0_2_00A5E9E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA59E0	0_2_00AA59E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AD31F8	0_2_00AD31F8
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAD9C0	0_2_00AAD9C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABA9C0	0_2_00ABA9C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7F920	0_2_00A7F920
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A65130	0_2_00A65130
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A85130	0_2_00A85130
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5C90C	0_2_00A5C90C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A9C910	0_2_00A9C910
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A56119	0_2_00A56119
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A77160	0_2_00A77160
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8D160	0_2_00A8D160
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A62940	0_2_00A62940
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A90140	0_2_00A90140
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8C150	0_2_00A8C150
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A59AA0	0_2_00A59AA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB92A0	0_2_00AB92A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7EAB0	0_2_00A7EAB0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7D2B0	0_2_00A7D2B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A9C2B0	0_2_00A9C2B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB62B0	0_2_00AB62B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A57280	0_2_00A57280
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB4A80	0_2_00AB4A80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A88290	0_2_00A88290
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAC290	0_2_00AAC290
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6F2F0	0_2_00A6F2F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6A2F0	0_2_00A6A2F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7A2F0	0_2_00A7A2F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A84AF0	0_2_00A84AF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A76A20	0_2_00A76A20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A9EA20	0_2_00A9EA20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A60A10	0_2_00A60A10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A70A10	0_2_00A70A10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB0A10	0_2_00AB0A10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6FA40	0_2_00A6FA40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A74A40	0_2_00A74A40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A87240	0_2_00A87240
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5AA4A	0_2_00A5AA4A
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A67250	0_2_00A67250
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A72BA0	0_2_00A72BA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A9D3A0	0_2_00A9D3A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA93B9	0_2_00AA93B9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A58BB0	0_2_00A58BB0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAD3B0	0_2_00AAD3B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A62380	0_2_00A62380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A70380	0_2_00A70380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7C380	0_2_00A7C380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8FB80	0_2_00A8FB80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAB380	0_2_00AAB380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB5B80	0_2_00AB5B80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABA39F	0_2_00ABA39F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABD3E8	0_2_00ABD3E8
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A793D0	0_2_00A793D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A85BD0	0_2_00A85BD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A57B21	0_2_00A57B21
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A63B20	0_2_00A63B20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7FB30	0_2_00A7FB30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A71330	0_2_00A71330
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A94B00	0_2_00A94B00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6EB10	0_2_00A6EB10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7E310	0_2_00A7E310
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A85360	0_2_00A85360
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB0360	0_2_00AB0360
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6D340	0_2_00A6D340
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A75B40	0_2_00A75B40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A82350	0_2_00A82350
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A93B50	0_2_00A93B50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA4350	0_2_00AA4350
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5FCA0	0_2_00A5FCA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A804A0	0_2_00A804A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A904B0	0_2_00A904B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAACB0	0_2_00AAACB0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAE480	0_2_00AAE480
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB2480	0_2_00AB2480
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA8C90	0_2_00AA8C90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA94EB	0_2_00AA94EB
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6CCE0	0_2_00A6CCE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A734E0	0_2_00A734E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A834E0	0_2_00A834E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A61CF0	0_2_00A61CF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A84CF0	0_2_00A84CF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A94CF0	0_2_00A94CF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA04F0	0_2_00AA04F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A81CC0	0_2_00A81CC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA6CC4	0_2_00AA6CC4
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8BC20	0_2_00A8BC20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A84430	0_2_00A84430
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A64400	0_2_00A64400
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA9C00	0_2_00AA9C00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A96C10	0_2_00A96C10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7CC70	0_2_00A7CC70
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A89C70	0_2_00A89C70
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5C44A	0_2_00A5C44A
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A69DA0	0_2_00A69DA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AC1DAA	0_2_00AC1DAA
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A575B0	0_2_00A575B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA6D8B	0_2_00AA6D8B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7DD90	0_2_00A7DD90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A70590	0_2_00A70590
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABA590	0_2_00ABA590
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A62DE0	0_2_00A62DE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA5DE0	0_2_00AA5DE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB85E0	0_2_00AB85E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A585F0	0_2_00A585F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5E5C0	0_2_00A5E5C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A62530	0_2_00A62530
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AC7D10	0_2_00AC7D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A66560	0_2_00A66560
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5BD40	0_2_00A5BD40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A74540	0_2_00A74540
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB7D40	0_2_00AB7D40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A76D50	0_2_00A76D50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5A55B	0_2_00A5A55B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7EE80	0_2_00A7EE80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA2E80	0_2_00AA2E80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A56E90	0_2_00A56E90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7FE90	0_2_00A7FE90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB3E90	0_2_00AB3E90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5CEE0	0_2_00A5CEE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A536F0	0_2_00A536F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A83ED0	0_2_00A83ED0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A75E20	0_2_00A75E20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A87630	0_2_00A87630
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A87E30	0_2_00A87E30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB4630	0_2_00AB4630
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A57E00	0_2_00A57E00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A60600	0_2_00A60600
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7C600	0_2_00A7C600
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A73E00	0_2_00A73E00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB4E68	0_2_00AB4E68
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A85E70	0_2_00A85E70
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA8E40	0_2_00AA8E40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB0640	0_2_00AB0640
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A9A650	0_2_00A9A650
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA9FAB	0_2_00AA9FAB
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8A7A0	0_2_00A8A7A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA87A0	0_2_00AA87A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAA7A0	0_2_00AAA7A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A657B0	0_2_00A657B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAB7B0	0_2_00AAB7B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A61F80	0_2_00A61F80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AB9780	0_2_00AB9780
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7A790	0_2_00A7A790
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A797E0	0_2_00A797E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A7CFE0	0_2_00A7CFE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA37E0	0_2_00AA37E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6FFC0	0_2_00A6FFC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A87FC0	0_2_00A87FC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A547D0	0_2_00A547D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6F7D0	0_2_00A6F7D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A73FD0	0_2_00A73FD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A93720	0_2_00A93720
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A6C730	0_2_00A6C730
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8E730	0_2_00A8E730
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA4730	0_2_00AA4730
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA5700	0_2_00AA5700
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5AF10	0_2_00A5AF10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A57F10	0_2_00A57F10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A82F10	0_2_00A82F10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A8B710	0_2_00A8B710
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A95F10	0_2_00A95F10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA3F60	0_2_00AA3F60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A74770	0_2_00A74770
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAE770	0_2_00AAE770
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AA9F4C	0_2_00AA9F4C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00A5F750	0_2_00A5F750
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAF750	0_2_00AAF750
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AAFF50	0_2_00AAFF50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5C0A0	2_2_00A5C0A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A560A0	2_2_00A560A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A858A0	2_2_00A858A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A868A0	2_2_00A868A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA28A0	2_2_00AA28A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB78A0	2_2_00AB78A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6D8E0	2_2_00A6D8E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A898F0	2_2_00A898F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A918F0	2_2_00A918F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB88F0	2_2_00AB88F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6E0D0	2_2_00A6E0D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAD0D0	2_2_00AAD0D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A68020	2_2_00A68020
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A78020	2_2_00A78020
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA9030	2_2_00AA9030
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A64810	2_2_00A64810
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8A816	2_2_00A8A816
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A59860	2_2_00A59860
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5D870	2_2_00A5D870
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6D070	2_2_00A6D070
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A60070	2_2_00A60070
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AD5072	2_2_00AD5072
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8E050	2_2_00A8E050
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A67980	2_2_00A67980
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A92195	2_2_00A92195
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5E9E0	2_2_00A5E9E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA59E0	2_2_00AA59E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AD31F8	2_2_00AD31F8
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAD9C0	2_2_00AAD9C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ABA9C0	2_2_00ABA9C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A65130	2_2_00A65130
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A85130	2_2_00A85130
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A9C910	2_2_00A9C910
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A77160	2_2_00A77160
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8D160	2_2_00A8D160
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A62940	2_2_00A62940
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A90140	2_2_00A90140
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8C150	2_2_00A8C150
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A59AA0	2_2_00A59AA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7EAB1	2_2_00A7EAB1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7D2B0	2_2_00A7D2B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A9C2B0	2_2_00A9C2B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A57A80	2_2_00A57A80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A57280	2_2_00A57280
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB4A80	2_2_00AB4A80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A88290	2_2_00A88290
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAC290	2_2_00AAC290
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6F2F0	2_2_00A6F2F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6A2F0	2_2_00A6A2F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7A2F0	2_2_00A7A2F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A84AF0	2_2_00A84AF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A76A20	2_2_00A76A20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A9EA20	2_2_00A9EA20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A60A10	2_2_00A60A10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A70A10	2_2_00A70A10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB0A10	2_2_00AB0A10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA7260	2_2_00AA7260
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6FA40	2_2_00A6FA40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A74A40	2_2_00A74A40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A87240	2_2_00A87240
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A67250	2_2_00A67250
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A72BA0	2_2_00A72BA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A9D3A0	2_2_00A9D3A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A58BB0	2_2_00A58BB0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5C3B0	2_2_00A5C3B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAD3B0	2_2_00AAD3B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A62380	2_2_00A62380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7C380	2_2_00A7C380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A70380	2_2_00A70380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8FB80	2_2_00A8FB80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAB380	2_2_00AAB380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB5B80	2_2_00AB5B80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ABD3E8	2_2_00ABD3E8
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5ABC0	2_2_00A5ABC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A793D0	2_2_00A793D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A85BD0	2_2_00A85BD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A63B20	2_2_00A63B20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A71330	2_2_00A71330
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7FB30	2_2_00A7FB30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA9330	2_2_00AA9330
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A94B00	2_2_00A94B00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ABA300	2_2_00ABA300
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6EB10	2_2_00A6EB10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A85360	2_2_00A85360
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB0360	2_2_00AB0360
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6D340	2_2_00A6D340
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A75B40	2_2_00A75B40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A82350	2_2_00A82350
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A93B50	2_2_00A93B50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA4350	2_2_00AA4350
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5FCA0	2_2_00A5FCA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A904B0	2_2_00A904B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAACB0	2_2_00AAACB0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAE480	2_2_00AAE480
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB2480	2_2_00AB2480
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA8C90	2_2_00AA8C90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6CCE0	2_2_00A6CCE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A734E0	2_2_00A734E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A834E0	2_2_00A834E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5A4F0	2_2_00A5A4F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A61CF0	2_2_00A61CF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A94CF0	2_2_00A94CF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA04F0	2_2_00AA04F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A81CC0	2_2_00A81CC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8BC20	2_2_00A8BC20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA6C20	2_2_00AA6C20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A84430	2_2_00A84430
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A64400	2_2_00A64400
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA9C00	2_2_00AA9C00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A96C10	2_2_00A96C10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A89C70	2_2_00A89C70
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A69DA0	2_2_00A69DA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AC1DAA	2_2_00AC1DAA
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A575B0	2_2_00A575B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A70590	2_2_00A70590
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ABA590	2_2_00ABA590
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A62DE0	2_2_00A62DE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA5DE0	2_2_00AA5DE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB85E0	2_2_00AB85E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A585F0	2_2_00A585F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5E5C0	2_2_00A5E5C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A62530	2_2_00A62530
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AC7D10	2_2_00AC7D10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A54D60	2_2_00A54D60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A66560	2_2_00A66560
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5BD40	2_2_00A5BD40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A74540	2_2_00A74540
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB7D40	2_2_00AB7D40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A76D50	2_2_00A76D50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7EE81	2_2_00A7EE81
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA2E80	2_2_00AA2E80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A56E90	2_2_00A56E90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB3E90	2_2_00AB3E90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5CEE0	2_2_00A5CEE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A536F0	2_2_00A536F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A926F0	2_2_00A926F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A83ED0	2_2_00A83ED0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A75E20	2_2_00A75E20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A87630	2_2_00A87630
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A87E30	2_2_00A87E30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB4630	2_2_00AB4630
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A57E00	2_2_00A57E00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A60600	2_2_00A60600
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7C600	2_2_00A7C600
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A73E00	2_2_00A73E00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB4E68	2_2_00AB4E68
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A85E70	2_2_00A85E70
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA8E40	2_2_00AA8E40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AB0640	2_2_00AB0640
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A9A650	2_2_00A9A650
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8A7A0	2_2_00A8A7A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA87A0	2_2_00AA87A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAA7A0	2_2_00AAA7A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A657B0	2_2_00A657B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAB7B0	2_2_00AAB7B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A61F80	2_2_00A61F80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7A790	2_2_00A7A790
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A7CFE0	2_2_00A7CFE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A797E0	2_2_00A797E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA37E0	2_2_00AA37E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6FFC0	2_2_00A6FFC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A87FC0	2_2_00A87FC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A547D0	2_2_00A547D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6F7D0	2_2_00A6F7D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A73FD0	2_2_00A73FD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A93720	2_2_00A93720
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A6C730	2_2_00A6C730
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8E730	2_2_00A8E730
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA4730	2_2_00AA4730
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA9F00	2_2_00AA9F00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA5700	2_2_00AA5700
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5AF10	2_2_00A5AF10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A57F10	2_2_00A57F10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A8B710	2_2_00A8B710
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A95F10	2_2_00A95F10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AA3F60	2_2_00AA3F60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A74770	2_2_00A74770
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAE770	2_2_00AAE770
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00A5F750	2_2_00A5F750
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAF750	2_2_00AAF750
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AAFF50	2_2_00AAFF50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0042C080	3_2_0042C080
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044F1D0	3_2_0044F1D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004452C0	3_2_004452C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00428570	3_2_00428570
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004375EB	3_2_004375EB
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044E6D0	3_2_0044E6D0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040E82F	3_2_0040E82F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041695B	3_2_0041695B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0042FA30	3_2_0042FA30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044DAC0	3_2_0044DAC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040BB90	3_2_0040BB90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044EC20	3_2_0044EC20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00436D60	3_2_00436D60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041EECC	3_2_0041EECC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00444EE0	3_2_00444EE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00421EF0	3_2_00421EF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00448F30	3_2_00448F30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00401040	3_2_00401040
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044D050	3_2_0044D050
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00430020	3_2_00430020
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044D0F0	3_2_0044D0F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043E092	3_2_0043E092
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00421094	3_2_00421094
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043C10C	3_2_0043C10C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004101B0	3_2_004101B0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00446240	3_2_00446240
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00426220	3_2_00426220
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004302C1	3_2_004302C1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043B2DE	3_2_0043B2DE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004242E0	3_2_004242E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040A340	3_2_0040A340
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044E340	3_2_0044E340
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040C360	3_2_0040C360
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044D380	3_2_0044D380
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043238F	3_2_0043238F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043644C	3_2_0043644C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043E4EB	3_2_0043E4EB
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040F4FC	3_2_0040F4FC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00444480	3_2_00444480
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00429490	3_2_00429490
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040D540	3_2_0040D540
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00403560	3_2_00403560
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00409560	3_2_00409560
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00421510	3_2_00421510
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00433520	3_2_00433520
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044D580	3_2_0044D580
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00413670	3_2_00413670
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043D6D2	3_2_0043D6D2
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004446E0	3_2_004446E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041F6E9	3_2_0041F6E9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040C6F0	3_2_0040C6F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041F68B	3_2_0041F68B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004176B3	3_2_004176B3
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00410700	3_2_00410700
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043D712	3_2_0043D712
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004047E2	3_2_004047E2
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004027A0	3_2_004027A0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00438809	3_2_00438809
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_004278F0	3_2_004278F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043C905	3_2_0043C905
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00431934	3_2_00431934
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044AA44	3_2_0044AA44
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00425A00	3_2_00425A00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00408AC0	3_2_00408AC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043FAE0	3_2_0043FAE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041EB48	3_2_0041EB48
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00402B50	3_2_00402B50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043EBE7	3_2_0043EBE7
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00449BA0	3_2_00449BA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00431C50	3_2_00431C50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00424C00	3_2_00424C00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00430CC8	3_2_00430CC8
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00442CE4	3_2_00442CE4
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044ACF4	3_2_0044ACF4
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043ACFB	3_2_0043ACFB
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041BC90	3_2_0041BC90
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040FCA0	3_2_0040FCA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040AD40	3_2_0040AD40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041CD4F	3_2_0041CD4F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044CD60	3_2_0044CD60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0042CD11	3_2_0042CD11
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043FDC0	3_2_0043FDC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00407DD0	3_2_00407DD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0040CE40	3_2_0040CE40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044CE50	3_2_0044CE50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00443E2E	3_2_00443E2E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0042EE30	3_2_0042EE30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00411E3A	3_2_00411E3A
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00445EC0	3_2_00445EC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043CEE0	3_2_0043CEE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041DEF1	3_2_0041DEF1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00428EA0	3_2_00428EA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00403F00	3_2_00403F00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00424F29	3_2_00424F29
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0044DFD0	3_2_0044DFD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00408FE0	3_2_00408FE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00437FFD	3_2_00437FFD
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00446F87	3_2_00446F87
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0042AF8B	3_2_0042AF8B

Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 0041BC80 appears 102 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 00ACA904 appears 32 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 00AC5B5C appears 38 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 00ABD8F0 appears 88 times
Source: C:\Users\user\Desktop\Aura.exe	Code function: String function: 0040B360 appears 49 times

Source: C:\Users\user\Desktop\Aura.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8488 -s 400

Source: Aura.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Aura.exe	Static PE information: Section: .bss ZLIB complexity 1.0003291478064067
Source: Aura.exe	Static PE information: Section: .bss ZLIB complexity 1.0003291478064067

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@5/4

Source: C:\Users\user\Desktop\Aura.exe

Code function: 3_2_004452C0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_004452C0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8496:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8488

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\cdc5e494-92eb-4e77-9e4a-a1290d46e312

Jump to behavior

Source: Aura.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Aura.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Aura.exe, 00000003.00000003.1397004528.000000000391B000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1424329710.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1397253623.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1425124973.00000000038DA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Aura.exe	Virustotal: Detection: 41%
Source: Aura.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\Aura.exe

File read: C:\Users\user\Desktop\Aura.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8488 -s 400
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Aura.exe

Static file information: File size 1381888 > 1048576

Source: Aura.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABDAAA push ecx; ret	0_2_00ABDABD
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ABDAAA push ecx; ret	2_2_00ABDABD
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0043F467 pushad ; iretd	3_2_0043F46B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_00454909 push ecx; retf	3_2_0045490A

Source: Aura.exe

Static PE information: section name: .text entropy: 7.096196420710893

Source: C:\Users\user\Desktop\Aura.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Aura.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Aura.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Window / User API: threadDelayed 6008

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe TID: 8600	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe TID: 9128	Thread sleep count: 6008 > 30			Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Aura.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Aura.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ACF86F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00ACF86F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ACF7BE FindFirstFileExW,	0_2_00ACF7BE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ACF86F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00ACF86F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ACF7BE FindFirstFileExW,	2_2_00ACF7BE

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Aura.exe, 00000003.00000003.1425430503.000000000392D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Aura.exe, 00000003.00000003.1353712898.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1484274331.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2578879535.000000000132B000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1554970055.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1509341317.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353557204.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1483876553.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.2198771625.000000000132A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2578727115.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.2198373308.0000000001327000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Aura.exe, 00000003.00000003.1353712898.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1484274331.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2578879535.000000000132B000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1554970055.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1509341317.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353557204.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1483876553.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.2198771625.000000000132A000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.2198373308.0000000001327000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWyk!
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.LOG1.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.24224532.B64.2408191502,BiosReleaseDate:08/19/2024,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.LOG1.6.dr	Binary or memory string: VMware, Inc.
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.LOG1.6.dr	Binary or memory string: VMware Virtual RAMX
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dd-92 e8 86 9f a5 a6 64 93
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Aura.exe, 00000003.00000003.1425430503.0000000003928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\Aura.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Aura.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Code function: 3_2_0044B1C0 LdrInitializeThunk,

3_2_0044B1C0

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_00AC58AE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00AC58AE

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_00AE61B4 mov edi, dword ptr fs:[00000030h]

0_2_00AE61B4

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_00ACB1FC GetProcessHeap,

0_2_00ACB1FC

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00AC58AE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AC58AE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABD3C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00ABD3C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABD77C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ABD77C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00ABD770 SetUnhandledExceptionFilter,	0_2_00ABD770
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00AC58AE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00AC58AE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ABD3C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00ABD3C0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 2_2_00ABD77C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00ABD77C

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_00AE61B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00AE61B4

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Aura.exe

Memory written: C:\Users\user\Desktop\Aura.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_00ACF0C6
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_00ACF067
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_00ACF19B
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_00ACF1E6
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00ACF28D
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_00ACAAE7
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_00ACF393
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00ACEB28
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_00ACA5EC
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_00ACED79
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00ACEE14
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_00ACF0C6
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_00ACF067
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_00ACF19B
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_00ACF1E6
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00ACF28D
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_00ACAAE7
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_00ACF393
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00ACEB28
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	2_2_00ACA5EC
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	2_2_00ACED79
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00ACEE14

Source: C:\Users\user\Desktop\Aura.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_00ABE1B7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00ABE1B7

Source: C:\Users\user\Desktop\Aura.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Aura.exe, 00000003.00000003.1555362408.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1509261866.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1509341317.000000000131C000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.2198750598.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1508934868.000000000131B000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1534242372.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\Aura.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Aura.exe PID: 8556, type: MEMORYSTR
Source: Yara match	File source: 3.2.Aura.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Aura.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2578327207.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Aura.exe, 00000003.00000003.1509536347.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: Aura.exe, 00000003.00000003.1509536347.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Aura.exe, 00000003.00000003.1509536347.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Aura.exe, 00000003.00000003.1509536347.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: Aura.exe, 00000003.00000003.1509536347.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Aura.exe, 00000003.00000003.1509536347.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Aura.exe, 00000003.00000003.1509536347.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Aura.exe, 00000003.00000003.1484126690.0000000001383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Aura.exe, 00000003.00000003.1484126690.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior

Source: Yara match	File source: 00000003.00000003.1484274331.0000000001327000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1425991879.0000000001383000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1484126690.0000000001327000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1483876553.0000000001327000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aura.exe PID: 8556, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Aura.exe PID: 8556, type: MEMORYSTR
Source: Yara match	File source: 3.2.Aura.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Aura.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2578327207.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	22 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	251 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	22 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	3 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Aura.exe	41%	Virustotal		Browse
Aura.exe	37%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://jowinjoinery.icu/	100%	Avira URL Cloud	malware
https://jowinjoinery.icu/P	100%	Avira URL Cloud	malware
https://mrodularmall.top:443/aNzS	100%	Avira URL Cloud	malware
https://mrodularmall.top:443/aNzShv.default-release/key4.dbPK	100%	Avira URL Cloud	malware
https://astralconnec.icu/DPowko	100%	Avira URL Cloud	malware
https://mrodularmall.top/8	100%	Avira URL Cloud	malware
https://mrodularmall.top/P=C:	100%	Avira URL Cloud	malware
https://mrodularmall.top:443/aNzSMicrosoft	100%	Avira URL Cloud	malware
https://jowinjoinery.icu/bdWUa	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzSy	100%	Avira URL Cloud	malware
https://mrodularmall.top/Sb	100%	Avira URL Cloud	malware
https://jowinjoinery.icu/cb	100%	Avira URL Cloud	malware
https://featureccus.shop/l	100%	Avira URL Cloud	malware
https://mrodularmall.top/a	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzS	100%	Avira URL Cloud	malware
https://mrodularmall.top/p#b	100%	Avira URL Cloud	malware
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=534dbfa6f9df898e79_173770952914	0%	Avira URL Cloud	safe
https://jowinjoinery.icu:443/bdWUaicrosoft	100%	Avira URL Cloud	malware
https://web.telegram.orgX-Frame-OptionsALLOW-FROM	0%	Avira URL Cloud	safe
https://mrodularmall.top/Y	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzSim	100%	Avira URL Cloud	malware
https://featureccus.shop/bdMAnM	100%	Avira URL Cloud	malware
https://mrodularmall.top/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jowinjoinery.icu	188.114.97.3	true	true	unknown
t.me	149.154.167.99	true	false	high
featureccus.shop	104.21.93.43	true	false	high
mrodularmall.top	104.21.16.1	true	true	unknown
astralconnec.icu	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://jowinjoinery.icu/bdWUa	true	Avira URL Cloud: malware	unknown
https://mrodularmall.top/aNzS	false	Avira URL Cloud: malware	unknown
https://t.me/asdawfq	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jowinjoinery.icu/	Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mrodularmall.top/P=C:	Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/	Aura.exe, 00000003.00000003.1353557204.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353634903.0000000001303000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1395874766.0000000001303000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.org	Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mrodularmall.top/aNzSy	Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mrodularmall.top:443/aNzSMicrosoft	Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://jowinjoinery.icu/P	Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mrodularmall.top/8	Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://astralconnec.icu/DPowko	Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mrodularmall.top:443/aNzShv.default-release/key4.dbPK	Aura.exe, 00000003.00000003.1508869079.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1477825528.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mrodularmall.top:443/aNzS	Aura.exe, 00000003.00000003.1449006745.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1425124973.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1423142277.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1508869079.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1424052324.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1477825528.00000000038F4000.00000004.00000800.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1395874766.0000000001303000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1424492990.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jowinjoinery.icu/cb	Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/Sb	Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://featureccus.shop/l	Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mrodularmall.top/p#b	Aura.exe, 00000003.00000003.2198542182.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000002.2579059811.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/v20	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/a	Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=534dbfa6f9df898e79_173770952914	Aura.exe, 00000003.00000003.1353712898.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353557204.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.orgX-Frame-OptionsALLOW-FROM	Aura.exe, 00000003.00000003.1353712898.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1353557204.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jowinjoinery.icu:443/bdWUaicrosoft	Aura.exe, 00000003.00000002.2579588323.00000000038F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Aura.exe, 00000003.00000003.1449954436.0000000003913000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/Y	Aura.exe, 00000003.00000003.1509261866.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtabv209h	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/aNzSim	Aura.exe, 00000003.00000003.1555362408.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1555401145.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1534242372.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://featureccus.shop/bdMAnM	Aura.exe, 00000003.00000003.1395874766.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	Aura.exe, 00000003.00000003.1451593904.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	Aura.exe, 00000003.00000003.1397442042.00000000038E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/	Aura.exe, 00000003.00000003.1425991879.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1509261866.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Aura.exe, 00000003.00000003.1534242372.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.93.43	featureccus.shop	United States	13335	CLOUDFLARENETUS	false
104.21.16.1	mrodularmall.top	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	jowinjoinery.icu	European Union	13335	CLOUDFLARENETUS	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635429
Start date and time:	2025-03-11 17:09:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Aura.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@5/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 89% Number of executed functions: 17 Number of non-executed functions: 137
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 40.126.31.1, 4.175.87.197, 150.171.27.10, 2.19.122.46
Excluded domains from analysis (whitelisted): www.bing.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, g.bing.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Aura.exe, PID 8548 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:10:12	API Interceptor	8x Sleep call for process: Aura.exe modified
12:10:16	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Aura.exe_98d0e6341323622f506a8b19fb9a5df54236296_a4015d25_df12852c-7a67-4495-98bc-e541da452b20\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7132533790842776
Encrypted:	false
SSDEEP:	96:TKFAA05csahwoI7RM6tQXIDcQvc6QcEVcw3cE/n+HbHg/TgJ3YOZUXOyK/ZAX/dj:un05cj0BU/gj/+zuiFnZ24IO8O
MD5:	BA8B74B6F02DD3E0662F8EDFFC41754C
SHA1:	7A157A25BA9D6D558A1BB8965368A3EBDF3707DA
SHA-256:	C0B487B05760D8EF1431208939E1832136F77E843C20B77CE63E7C88CF56833F
SHA-512:	A7BD644567862D5F92ECDC6BB440D0D6877922EB47D7CAC5601D06ECD3FB39E13EC14A4C6CC0433AD0767089606DB82A2B9566B2E742BD2EBE68D922798E72D1
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.6.1.8.3.0.1.0.5.8.4.7.0.1.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.6.1.8.3.0.1.1.0.0.6.5.8.2.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.1.2.8.5.2.c.-.7.a.6.7.-.4.4.9.5.-.9.8.b.c.-.e.5.4.1.d.a.4.5.2.b.2.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.6.0.9.3.9.4.-.2.4.a.9.-.4.7.7.0.-.8.b.0.7.-.a.d.4.f.f.d.0.b.3.e.8.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.A.u.r.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.1.2.8.-.0.0.0.1.-.0.0.1.8.-.7.9.b.5.-.f.a.0.f.a.0.9.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.0.9.2.f.3.8.a.9.1.e.8.4.d.d.a.1.7.b.5.7.9.e.d.e.4.7.3.f.d.d.4.0.0.0.0.f.f.f.f.!.0.0.0.0.1.d.5.1.7.6.2.9.c.8.9.9.4.f.8.7.a.f.f.9.2.4.8.6.2.c.2.f.9.9.c.a.1.d.f.c.4.3.3.a.!.A.u.r.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5././.0.3././.1.1.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A64.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Mar 11 16:10:10 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	36832
Entropy (8bit):	1.7717604961668305
Encrypted:	false
SSDEEP:	96:5c8rg9nLpL+GFbxy7B+4mY8i7OVlUt7sRt6ihJXsTXMZvnO6LypEUpWIkWImjIBN:F094ph8OXYRt6iUTXyXeXpuPvwcXJ3l
MD5:	C59EA3238E87B455C08E821F3387A94E
SHA1:	0960C7AC804EFA581D2BF35D35688ED290EA551F
SHA-256:	AD493586A18B8A6CF6E177FA04DF9B73EBD1BD2028D0C049C68351CA4DB0BE09
SHA-512:	6FFC1CE9B92A49BED13690976530B7D2812B03574CA7D86C91287D5B0E606E6D2FFA5ACA4977115B12A878965A542EF6FB511B0A2C826D5E2C235293CF6B9807
Malicious:	false
Preview:	MDMP..a..... .......b`.g........................0...............Z...........T.......8...........T...........(...........................................................................................................eJ......P.......GenuineIntel............T.......(!..a`.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B11.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.6957709653437276
Encrypted:	false
SSDEEP:	192:R6l7wVeJaF6bJk6YVUSU+Jgmf3Kpr789bbasf0Jm:R6lXJQ6W6YGSU+Jgmf3Db5f3
MD5:	793E19E273C886C55948CBB357F48093
SHA1:	7BADB23B84D0588F34F174764D95D0B7BB8558F8
SHA-256:	C72EE3A957801359E7E80DF1F9CDE7A1D298752A821E8BDD74AB771C620B1DEC
SHA-512:	DA191CC3497028D210746AE57F9BC12A7FFFBB767E4EE5157FD5A18C8EF2DE0D598290681755A4D98D6AAAB88C7325EBCBF38BB2B0D159C92B4FD0688E830935
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.4.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B41.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.459116044

Source: https://jowinjoinery.icu/	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/P	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top:443/aNzS	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top:443/aNzShv.default-release/key4.dbPK	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/DPowko	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/8	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/P=C:	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top:443/aNzSMicrosoft	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUa	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzSy	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/Sb	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/cb	Avira URL Cloud: Label: malware
Source: https://featureccus.shop/l	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/a	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzS	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/p#b	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu:443/bdWUaicrosoft	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/Y	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzSim	Avira URL Cloud: Label: malware
Source: https://featureccus.shop/bdMAnM	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/	Avira URL Cloud: Label: malware

Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: astralconnec.icu/DPowko
Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: featureccus.shop/bdMAn
Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mrodularmall.top/aNzS
Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: jowinjoinery.icu/bdWUa
Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: legenassedk.top/bdpWO
Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: htardwarehu.icu/Sbdsa
Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cjlaspcorne.icu/DbIps
Source: 00000000.00000002.1392334307.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bugildbett.top/bAuz

Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+10E8C126h]	3_2_00411040
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ecx, edi	3_2_0042C080
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [ecx], bl	3_2_00411640
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov eax, dword ptr [esp+58h]	3_2_0040E82F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	3_2_0044D990
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CA198B66h	3_2_0042FA30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7FFFFFFFh]	3_2_0042FA30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx eax, di	3_2_0042FA30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+4E5AD110h]	3_2_0040DAC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00436C8E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_00436D60
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then push eax	3_2_0040ED7F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-7FC4FC76h]	3_2_00421EF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 64DAE379h	3_2_00421EF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-7FC4FC82h]	3_2_00421EF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 6D58C181h	3_2_00421EF0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov dword ptr [esp], ecx	3_2_004380AC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_004371CF
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_0040A340
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_0040A340
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7A542AABh	3_2_0044E340
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-2Eh]	3_2_0043137E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-2Eh]	3_2_0043137E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04h]	3_2_0043238F
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00442440
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov dword ptr [esp], ecx	3_2_0043644C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041D4F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	3_2_00429490
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	3_2_00429490
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-1530D448h]	3_2_00421510
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+08h]	3_2_00421510
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax+013A68D0h]	3_2_00433587
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov dword ptr [esp], ecx	3_2_0043658C
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [ebx], cl	3_2_00436598
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edi+ecx*8], 744E5843h	3_2_00449650
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Ch]	3_2_00413670
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax+013A68D0h]	3_2_0043360A
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	3_2_0043163A
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041D6D2
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [ebx], cl	3_2_0040C6F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 3FDB1228h	3_2_00412723
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-7FCB06BCh]	3_2_004327D4
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041D782
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041D842
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7FC4FC82h]	3_2_00446850
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edi+6A51526Ah]	3_2_004278F0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_004369B3
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08BE7850h]	3_2_0044AA44
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov edx, ecx	3_2_00433A4B
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx]	3_2_0044EA50
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-3ECF6056h]	3_2_00425A00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_00425A00
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [edi], cx	3_2_00429A30
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ebp, eax	3_2_00408AC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov word ptr [ebx], cx	3_2_0042EA80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	3_2_0041EB48
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov dword ptr [esi+0Ch], ecx	3_2_00420B1E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	3_2_0041BBD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ch]	3_2_00449BA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041DBBC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then jmp ecx	3_2_00423C80
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then jmp ecx	3_2_00423C95
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [esp], 00000000h	3_2_00446D51
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	3_2_0041ED5D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax+00h]	3_2_0040CE40
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041DE36
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_00436E39
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	3_2_00445EC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00433EE0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041DEF1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041DEF1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041DEF1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041DEF1
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then add edi, ecx	3_2_0042EE93
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	3_2_00428EA0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov edx, dword ptr [esp+44h]	3_2_00424F20
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov edx, dword ptr [esp+44h]	3_2_00424F29
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 743EDB10h	3_2_0044DFD0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-7FC4FC7Ah]	3_2_0041DFE9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov dword ptr [esp], ecx	3_2_00437FFD
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	3_2_00446F87
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+eax+00h]	3_2_00446F87
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+12h]	3_2_00446F87
Source: C:\Users\user\Desktop\Aura.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00437F89

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.93.43:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49719 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49721 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7vP4BfyfrN0or9012ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14937Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f63DJ0o3bvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15046Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=cADwnI12Hp3p50User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20555Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4bm06xfoQd5zb8kw9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2693Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=pQ772M74MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569474Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 103Host: jowinjoinery.icu

Source: Aura.exe	Virustotal: Detection: 41%			Perma Link
Source: Aura.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041D1C2 CryptUnprotectData,		3_2_0041D1C2
Source: C:\Users\user\Desktop\Aura.exe	Code function: 3_2_0041EECC CryptUnprotectData,CryptUnprotectData,		3_2_0041EECC

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: astralconnec.icu
Source: global traffic	DNS traffic detected: DNS query: featureccus.shop
Source: global traffic	DNS traffic detected: DNS query: mrodularmall.top
Source: global traffic	DNS traffic detected: DNS query: jowinjoinery.icu

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Aura.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Aura.exe_98d0e6341323622f506a8b19fb9a5df54236296_a4015d25_df12852c-7a67-4495-98bc-e541da452b20\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A64.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B11.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B41.tmp.xml

Windows Analysis Report
Aura.exe