Edit tour

Windows Analysis Report
test.exe

Overview

General Information

Sample name:	test.exe
Analysis ID:	1524536
MD5:	2a98009ebc2e830e2e2de723312ee8a6
SHA1:	4d767fa5085f36a9d6c8a70de8106b5e4a6a6802
SHA256:	0f28c564a6268c2f3203bf3d594cb519dde447032911eebf3b430e925a94915a
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

DLL reload attack detected

Multi AV Scanner detection for dropped file

Submitted sample is a known malware sample

AI detected suspicious sample

Contains functionality to inject threads in other processes

Drops executables to the windows directory (C:\Windows) and starts them

Found stalling execution ending in API Sleep call

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Writes to foreign memory regions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

test.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\test.exe" MD5: 2A98009EBC2E830E2E2DE723312EE8A6)

explorer.exe (PID: 984 cmdline: explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

@AE2AF6.tmp.exe (PID: 2084 cmdline: "C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe" MD5: 252EE18EB5E305056FDC9915B278656F)

cmd.exe (PID: 4948 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user0.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WdExt.exe (PID: 6788 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe" MD5: 7942494EAC73B2B3281E4A8E94C39376)

cmd.exe (PID: 5228 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

launch.exe (PID: 2720 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe" /i 6788 MD5: DAAC1781C9D22F5743ADE0CB41FEAEBF)

cmd.exe (PID: 2020 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user2.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wtmps.exe (PID: 4480 cmdline: "C:\Users\user\AppData\Local\Temp\wtmps.exe" MD5: 75C1467042B38332D1EA0298F29FB592)

mscaps.exe (PID: 6612 cmdline: "C:\Windows\system32\mscaps.exe" /C:\Users\user\AppData\Local\Temp\wtmps.exe MD5: 78D3C8705F8BAF7D34E6A6737D1CFA18)

cmd.exe (PID: 2140 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

test.exe (PID: 2196 cmdline: "C:\Users\user\Desktop\test.exe" MD5: AA2C0EDAD4DE949A1347F8C6A346AAAB)

cleanup

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe, ProcessId: 2720, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: test.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Avira: detection malicious, Label: TR/Rogue.kdv.685680
Source: C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll	Avira: detection malicious, Label: TR/Spy.Agent.auk
Source: C:\Windows\SysWOW64\mscaps.exe	Avira: detection malicious, Label: TR/Spy.Agent.auh
Source: C:\Users\user\AppData\Roaming\Microsoft\Shared\Modules\fil.dll	Avira: detection malicious, Label: TR/Crypt.FKM.1350
Source: C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll	Avira: detection malicious, Label: BDS/Fynloski.IG
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Addins\att.dll	Avira: detection malicious, Label: TR/Spy.Agent.aul
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Avira: detection malicious, Label: TR/Drop.Daws.awfy
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Avira: detection malicious, Label: TR/PSW.Agent.pzuba
Source: C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	Avira: detection malicious, Label: TR/Spy.Agent.rddod
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Avira: detection malicious, Label: BDS/Nanocore.MG
Source: C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll	Avira: detection malicious, Label: BDS/Fynloski.BA

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Shared\Modules\fil.dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Addins\att.dll	ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\mscaps.exe	ReversingLabs: Detection: 100%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\mscaps.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: test.exe

Joe Sandbox ML: detected

Source: test.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00401466 FindFirstFileW,FindClose,	2_2_00401466
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00404D6B FindFirstFileW,FindClose,	2_2_00404D6B
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_004012A4 FindFirstFileW,FindClose,	11_2_004012A4
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_004034D3 FindFirstFileW,FindClose,	11_2_004034D3
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_00403177 DeleteFileA,FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	15_2_00403177

Source: test.exe.1.dr

String found in binary or memory: https://github.com/Denvi/Candle/

System Summary

Submitted sample is a known malware sample

Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Dropped file: MD5: fffa05401511ad2a89283c52d0c86472 Family: Lazarus Group Alias: Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group, Andariel Group, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Group 77, Labyrinth Chollima, Operation Troy, Operation GhostSecret, Guardians of Peace, ZINC, NICKEL ACADEMY, APT-C-26, Silent Chollima, Lazarus Group Description: Lazarus Group, active since at least 2009, is an APT group that has been attributed to the North Korean. There are lots of campaigns connected, including Operation Blockbuster, Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, Ten Days of Rain, etc.In November 2014, it carried out destructive wiping attack against Sony Pictures Entertainment. In 2016, it attacked Bangladesh central banks and stole US$81 million. In the middle of 2017, the WannaCry malware which leverages the leaked EternalBlue exploits affected as many as 300,000 computers worldwide. References: Data Source: https://github.com/RedDrip7/APT_Digital_Weapon
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Dropped file: MD5: 78d3c8705f8baf7d34e6a6737d1cfa18 Family: Lazarus Group Alias: Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group, Andariel Group, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Group 77, Labyrinth Chollima, Operation Troy, Operation GhostSecret, Guardians of Peace, ZINC, NICKEL ACADEMY, APT-C-26, Silent Chollima, Lazarus Group Description: Lazarus Group, active since at least 2009, is an APT group that has been attributed to the North Korean. There are lots of campaigns connected, including Operation Blockbuster, Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, Ten Days of Rain, etc.In November 2014, it carried out destructive wiping attack against Sony Pictures Entertainment. In 2016, it attacked Bangladesh central banks and stole US$81 million. In the middle of 2017, the WannaCry malware which leverages the leaked EternalBlue exploits affected as many as 300,000 computers worldwide. References: Data Source: https://github.com/RedDrip7/APT_Digital_Weapon

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe

File created: C:\Windows\SysWOW64\mscaps.exe

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00404069	2_2_00404069
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_0040A8DB	2_2_0040A8DB
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00406550	2_2_00406550
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_0040B965	2_2_0040B965
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00403D17	2_2_00403D17
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_004035D5	2_2_004035D5
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_004039DA	2_2_004039DA
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_004159BF	2_2_004159BF
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_0040866E	2_2_0040866E
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00407E7F	2_2_00407E7F
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_0040AECE	2_2_0040AECE
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_004042F0	2_2_004042F0
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00410334	2_2_00410334
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_0040A3BD	2_2_0040A3BD
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_1000A69F	2_2_1000A69F
Source: C:\Users\user\Desktop\test.exe	Code function: 3_2_00407753	3_2_00407753
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Code function: 8_2_1000A69F	8_2_1000A69F
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_0040247F	11_2_0040247F
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_004074EC	11_2_004074EC
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00402142	11_2_00402142
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00401D3D	11_2_00401D3D
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_0040C1C4	11_2_0040C1C4
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00404DCD	11_2_00404DCD
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_004055BC	11_2_004055BC
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00402A58	11_2_00402A58
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00407A68	11_2_00407A68
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00406FCE	11_2_00406FCE
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_004027D1	11_2_004027D1
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_0040FF99	11_2_0040FF99
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_1000A69F	11_2_1000A69F
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Code function: 14_2_00407F2C	14_2_00407F2C
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Code function: 14_2_004015A0	14_2_004015A0
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_00401F70	15_2_00401F70
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_0040A13C	15_2_0040A13C
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_004071EE	15_2_004071EE

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\wtmps.exe 3B20C853D4CA23240CD338B8CAB16F1027C540DDFE9C4FFDCA1624D2F923B373

Source: C:\Users\user\Desktop\test.exe	Code function: String function: 00472F40 appears 478 times
Source: C:\Users\user\Desktop\test.exe	Code function: String function: 00452670 appears 83 times
Source: C:\Users\user\Desktop\test.exe	Code function: String function: 00471AA0 appears 51 times

Source: test.exe, 00000000.00000000.1700270642.00000000004BE000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCandle.exe. vs test.exe
Source: test.exe, 00000003.00000000.1705827339.00000000004BE000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCandle.exe. vs test.exe
Source: test.exe	Binary or memory string: OriginalFilenameCandle.exe. vs test.exe
Source: test.exe	Binary or memory string: OriginalFilenameWdExt.exe vs test.exe
Source: test.exe.1.dr	Binary or memory string: OriginalFilenameCandle.exe. vs test.exe

Source: test.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.evad.winEXE@35/29@0/0

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_1000180D CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle,

2_2_1000180D

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe

Code function: 14_2_00401080 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FindResourceA,LoadResource,LockResource,GetModuleFileNameA,CopyFileA,ExitProcess,RegCreateKeyExA,RegOpenKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,BeginUpdateResourceA,UpdateResourceA,EndUpdateResourceA,

14_2_00401080

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Messenger

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_03

Source: C:\Windows\SysWOW64\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user0.bat" "

Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: test.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\explorer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: test.exe

String found in binary or memory: Dlibgcc_s_dw2-1.dll__register_frame_infolibgcj-13.dll_Jv_RegisterClasses__deregister_frame_info/translations/_.qmdefaultlocale:qt_1.1.7QWidget {font-size: 8pt}Operation was cancelled by userSpindle (%1).txt.nc.ncc.ngc.tap.mapCheckScrollAutoscrollCheck modeGC:|\[|\]|G[01234]\s|M[0345]+\s|\sF[\d\.]+|\sS[\d\.]+overrided!~^GRBL|GCARVIN\s\d\.\d.Overriding- (%1/%2/%3) (%1/%2)CJogdefaultupdating border drawerCandlefrmMain&OpenE&xit&Settings&New&SaveSave &as...&About&ClearSave &transformed as...G-code programIsometric viewTop viewFront viewLeft viewFitHeightmap settingsBorder:X:H:Y:W:Show borderAutoProbe grid:Zb:Zt:Show gridInterpolation grid:Type:BicubicShowOpenResetSendPauseAbortStateWork coordinates:X0YZMachine coordinates:Status:statusControlHome...Z-probeZero XYZero ZRestore originSafe positionUnlockUser commandsSpindle on/offHeightmapUse heightmapMap:AbsentCreateEdit modeX-Y-X+Y+Z+Z-Stop10010510.10.01ContinuouslyStep:Feed:2000100050050Keyboard controlConsoleSend commandClear console&File&Recent files&Service&Help/*QWidget {

Source: C:\Users\user\Desktop\test.exe

File read: C:\Users\user\Desktop\test.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"
Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe "C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe"
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user0.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe "C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe "C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe" /i 6788
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user2.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\wtmps.exe "C:\Users\user\AppData\Local\Temp\wtmps.exe"
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Process created: C:\Windows\SysWOW64\mscaps.exe "C:\Windows\system32\mscaps.exe" /C:\Users\user\AppData\Local\Temp\wtmps.exe
Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe "C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user0.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe "C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe "C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe" /i 6788
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user2.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\wtmps.exe "C:\Users\user\AppData\Local\Temp\wtmps.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Process created: C:\Windows\SysWOW64\mscaps.exe "C:\Windows\system32\mscaps.exe" /C:\Users\user\AppData\Local\Temp\wtmps.exe

Source: C:\Users\user\Desktop\test.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: qt5core.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: qt5gui.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: qt5opengl.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: qt5serialport.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: qt5widgets.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: qt5winextras.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: libstdc++-6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\mscaps.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\mscaps.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\mscaps.exe	Section loaded: dhcpcsvc.dll

Source: C:\Windows\SysWOW64\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: test.exe

Static file information: File size 2614323 > 1048576

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_00402056 __EH_prolog,GetComputerNameW,GetUserNameW,GetSystemDefaultLangID,GetAdaptersInfo,GetAdaptersInfo,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryA,GetProcAddress,InternetGetConnectedState,FreeLibrary,GetTempPathW,GetTempFileNameW,GetTempFileNameW,GetTempFileNameW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

2_2_00402056

Source: test.exe.1.dr

Static PE information: section name: .eh_fram

Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00401650 push eax; ret	0_2_0040167E
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_0040C8A0 push eax; ret	2_2_0040C8BE
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_0040D510 push eax; ret	2_2_0040D53E
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_10005978 push eax; ret	2_2_10005996
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_10005380 push eax; ret	2_2_100053AE
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Code function: 8_2_10005978 push eax; ret	8_2_10005996
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Code function: 8_2_10005380 push eax; ret	8_2_100053AE
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00408950 push eax; ret	11_2_0040896E
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_00409E10 push eax; ret	11_2_00409E3E
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_10005978 push eax; ret	11_2_10005996
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_10005380 push eax; ret	11_2_100053AE
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Code function: 14_2_004026D0 push eax; ret	14_2_004026FE
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_00403090 push eax; ret	15_2_004030BE

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe

Executable created and started: C:\Windows\SysWOW64\mscaps.exe

Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Addins\att.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Shared\Modules\fil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Local\Temp\wtmps.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	File created: C:\Windows\SysWOW64\mscaps.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Desktop\test.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe

File created: C:\Windows\SysWOW64\mscaps.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\mscaps.exe

Code function: 15_2_00401D10 GetTempPathA,GetTempFileNameA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,DeleteFileA,

15_2_00401D10

Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Defender Extension			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Defender Extension			Jump to behavior

Hooking and other Techniques for Hiding and Protection

DLL reload attack detected

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Module Loaded: Original DLL: C:\USERS\user\APPDATA\ROAMING\TEMP\MYDLL.DLL reload: C:\WINDOWS\SYSWOW64\WS2_32.DLL
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Module Loaded: Original DLL: C:\USERS\user\APPDATA\ROAMING\TEMP\MYDLL.DLL reload: C:\WINDOWS\SYSWOW64\WS2_32.DLL

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe

14_2_00401080

Source: C:\Users\user\Desktop\test.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\wtmps.exe

Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_1000180D CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle,

2_2_1000180D

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: __EH_prolog,GetComputerNameW,GetUserNameW,GetSystemDefaultLangID,GetAdaptersInfo,GetAdaptersInfo,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryA,GetProcAddress,InternetGetConnectedState,FreeLibrary,GetTempPathW,GetTempFileNameW,GetTempFileNameW,GetTempFileNameW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	2_2_00402056
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,inet_addr,inet_addr,	2_2_00401CB0
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Code function: GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,GetProcessHeap,HeapFree,	14_2_00401D20
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,GetProcessHeap,HeapFree,	15_2_00402600

Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Shared\Modules\fil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Addins\att.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe TID: 6784

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00401466 FindFirstFileW,FindClose,	2_2_00401466
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00404D6B FindFirstFileW,FindClose,	2_2_00404D6B
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_004012A4 FindFirstFileW,FindClose,	11_2_004012A4
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_004034D3 FindFirstFileW,FindClose,	11_2_004034D3
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_00403177 DeleteFileA,FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	15_2_00403177

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_0040318C GetVersionExW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetModuleHandleW,GetProcAddress,GetSystemMetrics,

2_2_0040318C

Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WdExt.exe, 00000008.00000002.1776161415.0000000000650000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: @AE2AF6.tmp.exe, 00000002.00000002.1732872130.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, @AE2AF6.tmp.exe, 00000002.00000002.1732872130.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, WdExt.exe, 00000008.00000002.1776161415.000000000061E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	API call chain: ExitProcess graph end node	graph_2-18953
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\mscaps.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_1000180D CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle,

2_2_1000180D

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

2_2_00402056

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_00404732 VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualAlloc,VirtualAlloc,

2_2_00404732

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00411746 SetUnhandledExceptionFilter,	2_2_00411746
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_00411758 SetUnhandledExceptionFilter,	2_2_00411758
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_1000BA64 SetUnhandledExceptionFilter,	2_2_1000BA64
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Code function: 2_2_1000BA76 SetUnhandledExceptionFilter,	2_2_1000BA76
Source: C:\Users\user\Desktop\test.exe	Code function: 3_2_00401179 Sleep,Sleep,SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,	3_2_00401179
Source: C:\Users\user\Desktop\test.exe	Code function: 3_2_00451880 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	3_2_00451880
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Code function: 8_2_1000BA64 SetUnhandledExceptionFilter,	8_2_1000BA64
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Code function: 8_2_1000BA76 SetUnhandledExceptionFilter,	8_2_1000BA76
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_0040C6A6 SetUnhandledExceptionFilter,	11_2_0040C6A6
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_0040C6B8 SetUnhandledExceptionFilter,	11_2_0040C6B8
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_1000BA64 SetUnhandledExceptionFilter,	11_2_1000BA64
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Code function: 11_2_1000BA76 SetUnhandledExceptionFilter,	11_2_1000BA76
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Code function: 14_2_00406250 SetUnhandledExceptionFilter,	14_2_00406250
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Code function: 14_2_0040623E SetUnhandledExceptionFilter,	14_2_0040623E
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Code function: 14_2_00401AD0 SetUnhandledExceptionFilter,	14_2_00401AD0
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_00408007 SetUnhandledExceptionFilter,	15_2_00408007
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_004024A0 SetUnhandledExceptionFilter,	15_2_004024A0
Source: C:\Windows\SysWOW64\mscaps.exe	Code function: 15_2_00407FF5 SetUnhandledExceptionFilter,	15_2_00407FF5

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Windows\SysWOW64\mscaps.exe

Code function: 15_2_00401950 DeleteFileA,OpenProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,CloseHandle,WriteProcessMemory,CreateRemoteThread,VirtualFreeEx,Sleep,Sleep,GetExitCodeThread,CloseHandle,CloseHandle,VirtualFreeEx,CloseHandle,

15_2_00401950

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\Desktop\test.exe	Memory written: PID: 984 base: 1279C0 value: 55			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Memory written: PID: 984 base: 127F80 value: 04			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\test.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 1279C0			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 127F80			Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe "C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user0.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe "C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe "C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe" /i 6788
Source: C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user2.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\wtmps.exe "C:\Users\user\AppData\Local\Temp\wtmps.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wtmps.exe	Process created: C:\Windows\SysWOW64\mscaps.exe "C:\Windows\system32\mscaps.exe" /C:\Users\user\AppData\Local\Temp\wtmps.exe

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_0040B8D2 GetSystemTime,

2_2_0040B8D2

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

2_2_00402056

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_00412794 InterlockedDecrement,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

2_2_00412794

Source: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Code function: 2_2_0040318C GetVersionExW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetModuleHandleW,GetProcAddress,GetSystemMetrics,

2_2_0040318C

Source: C:\Users\user\Desktop\test.exe

Code function: 3_2_0043B9C0 _ZNK13QOpenGLBuffer9isCreatedEv,_ZNK24QOpenGLVertexArrayObject9isCreatedEv,_ZN13QOpenGLBuffer4bindEv,_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE,_ZN13QOpenGLBuffer7releaseEv,_ZN13QOpenGLBuffer8allocateEPKvi,_ZN10QArrayData10deallocateEPS_jj,_ZN13QOpenGLBuffer7releaseEv,_ZN24QOpenGLVertexArrayObject4bindEv,_ZN24QOpenGLVertexArrayObject7releaseEv,_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE,_ZNK20QOpenGLShaderProgram17attributeLocationEPKc,_ZN20QOpenGLShaderProgram20enableAttributeArrayEi,_ZN20QOpenGLShaderProgram18setAttributeBufferEijiii,_ZN24QOpenGLVertexArrayObject7releaseEv,_Z9qBadAllocv,_Z9qBadAllocv,

3_2_0043B9C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Command and Scripting Interpreter	1 Scripting	311 Process Injection	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 DLL Side-Loading	11 DLL Side-Loading	311 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	4 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
test.exe	100%	Avira	TR/Drop.Daws.awfy
test.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\wtmps.exe	100%	Avira	TR/Rogue.kdv.685680
C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll	100%	Avira	TR/Spy.Agent.auk
C:\Windows\SysWOW64\mscaps.exe	100%	Avira	TR/Spy.Agent.auh
C:\Users\user\AppData\Roaming\Microsoft\Shared\Modules\fil.dll	100%	Avira	TR/Crypt.FKM.1350
C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll	100%	Avira	BDS/Fynloski.IG
C:\Users\user\AppData\Roaming\Microsoft\Windows\Addins\att.dll	100%	Avira	TR/Spy.Agent.aul
C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	100%	Avira	TR/Drop.Daws.awfy
C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	100%	Avira	TR/PSW.Agent.pzuba
C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	100%	Avira	TR/Spy.Agent.rddod
C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	100%	Avira	BDS/Nanocore.MG
C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll	100%	Avira	BDS/Fynloski.BA
C:\Users\user\AppData\Local\Temp\wtmps.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\mscaps.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe	100%	ReversingLabs	Win32.Infostealer.BZub
C:\Users\user\AppData\Local\Temp\wtmps.exe	100%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll	91%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll	92%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe	100%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll	96%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll	87%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\AppData\Roaming\Microsoft\Shared\Modules\fil.dll	92%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\AppData\Roaming\Microsoft\Windows\Addins\att.dll	88%	ReversingLabs	Win32.Worm.Faedevour
C:\Users\user\Desktop\test.exe	0%	ReversingLabs
C:\Windows\SysWOW64\mscaps.exe	100%	ReversingLabs	Win32.Worm.Faedevour

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/Denvi/Candle/	test.exe.1.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524536
Start date and time:	2024-10-02 23:23:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	test.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@35/29@0/0
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 56 Number of non-executed functions: 305
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.72.235.82
Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, ocsp.digicert.com, slscr.update.microsoft.com, windowsupdate.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target test.exe, PID 2196 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: test.exe

Simulations

Behavior and APIs

Time	Type	Description
17:24:49	API Interceptor	1x Sleep call for process: WdExt.exe modified
22:24:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Extension "C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe"
22:25:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Extension "C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\wtmps.exe	N1uYSp0Uxh.exe	Get hash	malicious	Unknown	Browse
	WdExt.exe	Get hash	malicious	Unknown	Browse
	WdExt.exe	Get hash	malicious	Unknown	Browse
	PkW6FhsgXx.exe	Get hash	malicious	Unknown	Browse
	K7DLe06XsR.exe	Get hash	malicious	Unknown	Browse
	PkW6FhsgXx.exe	Get hash	malicious	Unknown	Browse
	K7DLe06XsR.exe	Get hash	malicious	Unknown	Browse
	ZnOjZ2jrSH.exe	Get hash	malicious	Unknown	Browse
	LVaL5Icyef.exe	Get hash	malicious	Unknown	Browse
	ZnOjZ2jrSH.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\5F25.tmp

Download File

Process:	C:\Windows\SysWOW64\mscaps.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.350477861599205
Encrypted:	false
SSDEEP:	6:oWAGVISs4KHunXwBFq7+fAmvIHcDNeEc7vyx07WmnN/9udXiIP+KHuH1jIy4EE+h:lDVE45nXwu74Awq7sfeuh+KOVjiEE+hn
MD5:	37512BCC96B2C0C0CF0AD1ED8CFAE5CD
SHA1:	EDF7F17CE28E1C4C82207CAB8CA77F2056EA545C
SHA-256:	27E678BF5DC82219D6EDD744F0B82567A26E40F8A9DCD6487205E13058E3ED1F
SHA-512:	6D4252AB5AA441A76CE2127224FEFCB221259AB4D39F06437B269BD6BFDAAE009C8F34E9603EC734159553BC9F1359BDD70316CD426D73B171A9F17C41077641
Malicious:	false
Preview:	[ICO]..01=%SystemRoot%\system32..02=wtime32.dll..03=Software\Microsoft\Active Setup\Installed Components..04={ef2b00e3-19da-4e78-b118-6b6451b719f2}..05={a96adc11-e20e-4e21-bfac-3e483c40906e}..06=%SystemRoot%\explorer.exe..07=%APPDATA%\Microsoft\Protect\SETUP..08=wtime32.dll..09=Software\Microsoft\Windows\CurrentVersion\Run..10=JREUpdate..11=%SystemRoot%\explorer.exe..12=%SystemRoot%\system32\gdi32.dll..

C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1797699
Entropy (8bit):	7.976046783043414
Encrypted:	false
SSDEEP:	24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNd:mbTChxKCnFnQXBbrtgb/iQvu0UHO9y
MD5:	252EE18EB5E305056FDC9915B278656F
SHA1:	D4B1AC5389C7DE600CC7B63DF4F8DF545565A18A
SHA-256:	B74969A67DF1BA88F4D93AF98D65898EDD91539AD4C7A74CB1102CB0D6E1CAA5
SHA-512:	8772F4C8844B4D75280EB86F238AE3CA551CC5E67419077751E547654BB768D11B7BB2C04971AD0D6EE137761CB0F362BFDCE55870A946A54E8BC0DA5E388C93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..a..e2..e2..e2h.i2..e2..k2..e2..o2..e2..82..e2..d2j.e2..n2..e2..c2..e2Rich..e2........PE..L....^O.................f..........p.............@.............................................................................x....................................................................................................................text...Rd.......f.................. ..`.rdata..&............j..............@..@.data...\|v....... ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Se3578.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	ASCII text, with very long lines (896), with no line terminators
Category:	dropped
Size (bytes):	896
Entropy (8bit):	4.700288873450408
Encrypted:	false
SSDEEP:	24:keK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeK+DeKD:d1q1q1q1q1q1q1q1q1q1q1q1q1q1q1qo
MD5:	BE49EE9D1B6DA594241CE3B7432C5D64
SHA1:	D81E68B9BF84258AF2E6B5595C4F5C8D53B9C901
SHA-256:	DB66D62796AE12BF459E514F27BB1A0D416D804365F44E8EC53DD760E3F7B8B8
SHA-512:	0C15D8D86E0DFCCBCECD50B3DD5906F8F5B7C52511128D01BE82B394CCB08ED85A486A101BBB5D992A688D1E62F21FDA712DAEF1BF3A5ECBA9AAD152E47562F5
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\Sp3577.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	ASCII text, with very long lines (620), with no line terminators
Category:	dropped
Size (bytes):	620
Entropy (8bit):	4.7002729531161505
Encrypted:	false
SSDEEP:	12:kvmNKzuXDvmNKzuXDvmNKzuXDvmNKzuXDvmNKzuXDvmNKzuXDvmNKzuXDvmNKzum:keK+DeK+DeK+DeK+DeK+DeK+DeK+DeKT
MD5:	1D713C403B1DA202F059FCA73E0E6C61
SHA1:	BA91DFDC9786177C0F6CB0ED2F324FFB1DD1F050
SHA-256:	FB2BF10E6A64C014A8DB3F0DEA7E1B795B36632E4EDC532A2422975802632B0A
SHA-512:	E88F3C0FA520EBC9B982B5404025E6484A9BED925D889915250797B1592CCD8B4218428BB8A0CAF0685BCCA5584E05151EC2F7FAF105347AFC94E1A955E4BC01
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUV

C:\Users\user\AppData\Local\Temp\tmp2F3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1796415
Entropy (8bit):	4.70043971812567
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyp:F
MD5:	6354B0F69E2257A69F01F15C2624B294
SHA1:	B36C8CA0B00405373AAF1C65F61BE60BEF267225
SHA-256:	A7651F484533E1C5B6D7235E0C129A450188341014D6FFCFFE8F7D633C0F4344
SHA-512:	961DC74DD338DC0499B37D3CF1908226BD1841B3E43558E70448083C8D3EC77BCB5682AE0B28659987AD9B915DD2200AC05F09A04E3CFE7B1E0137A61269A69F
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3588.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	7.774852528796053
Encrypted:	false
SSDEEP:	12:yVcca7jUJ6J4rDayFMdNWjx3V3aHn8aH4WjjKdP9e2J2i0odDwRlLiWicTvZNX+e:3U4JJogNWV3VKre9P2iP5ipZsG
MD5:	C833778DEC21525FD7622C02BD6CCCAF
SHA1:	300C4611EE736FB33A82E5EDEB1BFF18B760235B
SHA-256:	41ED4FD4CCB449E108E99E25F0E7BA192A3DA0FD5A82C32468DD04D99A22B857
SHA-512:	85C60D074E13E2ECCAA456AD5915FE5CC0264A6ED3DB9914AA73FF34A7307B5D7A1F1FD7879FFC7B9C276F7CD6AE89DBF3956D26A424ED9B3A9BAEB49B2AD807
Malicious:	false
Preview:	x......9..\...12..c.<........8\..(.....bBM.........].\|vKj..[7J.8X.....tZ...F..8..V.m".q.B......}?(}...Gbn~"...r.......i:X.Xn."OvJ>X.L.Q).".....[....j....?1...o..i......t......F...<+.'.N."...W@c.S............+.Y..@.y..q..U.....-A..k..6.P.r.<.)...i=.[.C..0.l...`.x-G...F...... .2..2.:..F...>....q..h....}....lQ.h..J.$K....L..2F.zB...e7j:........_..t>...a..h.Djd.............t..\|......V.<K...n3.+.yR....9q..)....@....9Em.Q.l.#.]..%i........q..[_.....8......F.......$.a..\p.G..j...\|......G..ef.....wB0...WuVf0Q9.w..O.{.D..,.\....[~..ml ...N....`>@V,S,4lp!q.i..@).M.BKe.X1...t..1......X0.+....^xNe.\x..(.>....nY..O..v}.F!.....Z.x.O......}f...l...+-..F...#.....I\q..."...F.J...Z.qL}..E..0...R...n..(.S$k_..:$.G.:.<..5T..5...3p.U.k..P>uU.02-.@...-.._...W$rP,g1........,.....F..U......4.&0Hk.0.......a^F[..Q....@<`(5...p'~...3.....Y.mo8.oh.r.n..U[...CX.-..m

C:\Users\user\AppData\Local\Temp\tmp3A29.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1053442
Entropy (8bit):	4.700439718141092
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:O
MD5:	DF2C63605573C2398D796370C11CB26C
SHA1:	EFBA97E2184BA3941EDB008FCC61D8873B2B1653
SHA-256:	07FFCDE2097D0AF67464907FEC6A4079B92DA11583013BAE7D3313FA32312FE8
SHA-512:	D9726E33FCFA96415CC906BDB1B0E53EBA674EAF30ED77D41D245C1C59AA53E222246F691D82FA3A45F049FBF23D441768F9DA21370E489232770AD5AE91D32F
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3AB6.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	235266
Entropy (8bit):	4.70043971626439
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
MD5:	6F90E1169D19DFDE14D6F753F06C862B
SHA1:	E9BCA93C68D7DF73D000F4A6E6EB73A343682AC5
SHA-256:	70A392389AECD0F58251E72C3FD7E9159F481061D14209FF8708A0FD9FF584DC
SHA-512:	F0C898222E9578C01EBE1BEFAC27A3FB68D8FB6E76C7D1DEC7A8572C1AA3201BACF1E69AA63859E95606790CF09962BCF7DC33B770A6846BED5BD7DED957B0B3
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3B63.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	123650
Entropy (8bit):	4.700439712479302
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:u
MD5:	F558C76B0376AF9273717FA24D99EBBF
SHA1:	F84BCECE5C6138B62EF94E9D668CF26178EE14CC
SHA-256:	01631353726DC51BCEA311DBC012572CF96775E516B1C79A2DE572EF15954B7A
SHA-512:	2092D1E126D0420FEC5FC0311D6B99762506563F4890E4049E48E2D87DDE5AC3E2E2ECC986AB305DE2C6CEB619F18879A69A815D3241CCF8140BC5EA00C6768D
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3D0A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	129282
Entropy (8bit):	4.700439711235807
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
MD5:	02AE22335713A8F6D6ADF80BF418202B
SHA1:	4C40C11F43DF761B92A5745F85A799DB7B389215
SHA-256:	AE5697F849FA48DB6D3D13455C224FCF6CEB0602A1E8AC443E211DD0F32D50F4
SHA-512:	727D16102BFC768535B52A37E4E7B5D894F5DAA268D220DF108382C36DCCE063AFDBC31FD495A7A61305263EC4CD7E92713D894FAA35B585C0B379217A1D929C
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3D4A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	91394
Entropy (8bit):	4.700439710541972
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyS:O
MD5:	09203A9741B91F3A9ED01C82DCB8778D
SHA1:	13E6F3FB169CD6AA5E4D450417A7E15665A2E140
SHA-256:	63149AD45DB380F5DD15F65D9CEB2611D53A0A66E022483BEE4CE2FF7D2610E2
SHA-512:	9E9E6FE0DD713417D0E28BA787CF862D55ECDA9EE9F3DF1EADA144657F6A3B6ADA1984FD05A3FFFCD597A9715383225A8E40B6E5D0D8D39EC0D3A64B8DEA9846
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3D99.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	102146
Entropy (8bit):	4.7004397081852405
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
MD5:	9A27BFB55DD768AE81CA8716DB2DA343
SHA1:	55DA0F4282BD838F72F435A5D4D24AC15B04482B
SHA-256:	5EC8093EF5939D1ABCE1C576097B584FB600B94AD767C1DA897F7CB7F0063D26
SHA-512:	D9BB49D2F282ED09C351A1D8EB2540781E6A7FB39265473FD59D146BFC162F27A4AB1405301ED7395C12929A80551A399437D7D794D7AC48650E9037B60EB69C
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3DE8.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	176386
Entropy (8bit):	4.700439717028234
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
MD5:	2634FA3A332C297711CB59D43F54FFCE
SHA1:	8E2B68D0EE4E792EFB1945BA86ECEB87F07087D2
SHA-256:	27C945CCB84AA024F1F063701327E829A7EF3A7EDE4A43B2FEBBB1DDDBDF8740
SHA-512:	84E4799B9B18A7CC7BE685C793A9B4FB135EA331D1D235FE823E1D7091130F131AB2FBAD1DA4DEA795E82547AA16B00F4E2A9FAAA96CB522D795F9ABFDA2FC53
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\tmp3E56.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	282624
Entropy (8bit):	4.700439717346398
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyX:T
MD5:	E07C6A9E595F045FADC463DFDA44AB16
SHA1:	E6B199272ADE02613F2003C365A4CB1487431E23
SHA-256:	D2FA6F9686386A92253A9C5EA25ACE702A111483540B60C1300789235CEA7FDC
SHA-512:	F3C630AE8381B99519AEEADBC2918810E7FB09A909F73EE6C46F4E9D3CF8C5051A5CF763DB6A775D6CD8713CCF95A63B18DF9ED756FA28276E8D7AB6A47F2CBF
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\AppData\Local\Temp\wtmps.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282624
Entropy (8bit):	7.055084803288937
Encrypted:	false
SSDEEP:	6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
MD5:	75C1467042B38332D1EA0298F29FB592
SHA1:	F92EA770C2DDB04CF0D20914578E4C482328F0F8
SHA-256:	3B20C853D4CA23240CD338B8CAB16F1027C540DDFE9C4FFDCA1624D2F923B373
SHA-512:	5C47C59AD222E2597CCDF2C100853C48F022E933F44C279154346EACF9E7E6F54214ADA541D43A10424035F160B56131AAB206C11512A9FD6EA614FBD3160AA0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: N1uYSp0Uxh.exe, Detection: malicious, Browse Filename: WdExt.exe, Detection: malicious, Browse Filename: WdExt.exe, Detection: malicious, Browse Filename: PkW6FhsgXx.exe, Detection: malicious, Browse Filename: K7DLe06XsR.exe, Detection: malicious, Browse Filename: PkW6FhsgXx.exe, Detection: malicious, Browse Filename: K7DLe06XsR.exe, Detection: malicious, Browse Filename: ZnOjZ2jrSH.exe, Detection: malicious, Browse Filename: LVaL5Icyef.exe, Detection: malicious, Browse Filename: ZnOjZ2jrSH.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[...............d...........o.....................q...................Rich............PE..L...n..M.............................'............@..........................`.................................................P....................................................................................................................text...0\|.......................... ..`.rdata..@...........................@..@.data...(*....... ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102146
Entropy (8bit):	6.672724217779346
Encrypted:	false
SSDEEP:	1536:AfVMTLl0+j+R3S6CVaTqifclr7MB3tY0ZHp8FkK4+3IOqFnToIfwCBztSoRa6A:Fl67CVgBbNEfZqtTBfwCptSw/A
MD5:	F1C9F4A1F92588AEB82BE5D2D4C2C730
SHA1:	3DC5A017B15BA74FAE2342937380905BF7E8FBD5
SHA-256:	D3A46F71AA7467920B16B64C9D17EAF6C4E147F41CD1390DCCFF01E4A81F8DFA
SHA-512:	6171E740CE318D8FC35C92663684F2C35E7B5374C9A8CE6F4DC1C28C9AE62064F9CF44116266C650089BD5A3D328E87F9BDBD63AC1123E0A33CE52A1D21CFFAD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<a.R2.R2.R2f.\2.R2..X2f.R2&..2.R2.S2..R2..Y2..R2].T2.R2..V2.R2Rich.R2................PE..L....^O...........!......................... .......................................................................k.......b..P.......X............................................................................ ...............................text............................... ..`.rdata..JL... ...N..................@..@.data....l...p.......X..............@....rsrc...X............n..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123650
Entropy (8bit):	6.665333125659156
Encrypted:	false
SSDEEP:	3072:PWFWnu/0NPlE+qoytTBf+28aVytl34iQA:PW8nlQ+RytTBV2J
MD5:	1FCC5B3ED6BC76D70CFA49D051E0DFF6
SHA1:	3FFA43EFDC893A57DCAD3D45C9B14980DD52EB58
SHA-256:	B0C0C49EED934E6D2ED990913D4C71108F6104352D23F72D3EF0A3EF4074D92E
SHA-512:	8769438AACC26F0A720926F419A2564813DEE2F526B2DBB7A3F57D587DC385612BF5780F4E39CE2149DE5FB4C1AF839DCC099F3D77387989E16D2BC76C6DE929
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........{X..(X..(X..(..(A..(...(..(...(Q..(X..(...(...(B..(.(Y..(...(Y..(RichX..(........PE..L....^O...........!.....D...................`.....@.........................p......................................0..........<....@..h....................P..4....................................................`...............................text...mC.......D.................. ..`.rdata...W...`...X...H..............@..@.data....u..........................@....rsrc...h....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176386
Entropy (8bit):	7.467006043338271
Encrypted:	false
SSDEEP:	3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
MD5:	DAAC1781C9D22F5743ADE0CB41FEAEBF
SHA1:	E2549EEEEA42A6892B89D354498FCAA8FFD9CAC4
SHA-256:	6A7093440420306CF7DE53421A67AF8A1094771E0AAB9535ACBD748D08ED766C
SHA-512:	190A7D5291E20002F996EDF1E04456BFDFF8B7B2F4EF113178BD42A9E5FD89FE6D410AE2C505DE0358C4F53F9654AC1CAAA8634665AFA6D9691640DD4EE86160
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................B......)...G.................)......y.......Rich............PE..L.....^O.................................... ....@..........................0..................................................P.... ............................................................................... ..P............................text............................... ..`.rdata..\.... ......................@..@.data...\|k..........................@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1053442
Entropy (8bit):	7.383233334811567
Encrypted:	false
SSDEEP:	24576:XitBcqPTSNCs8Fm6nQbkkcCZIkj3tTkgbGqt/dKcMM1Wy/:SIqriCsmm6nYqkjdTkgSqNdKcMs/
MD5:	2D9DF706D1857434FCAA014DF70D1C66
SHA1:	75A65DD394941CD78234EE100D68C8D2F53F77C6
SHA-256:	126593B3672E6985FE4E4903D656040E16A69264FAF91B1A416EF00565E17E7C
SHA-512:	BC476A3AAF54323F1E77BB5EFFC05C407A1034A42B495DA3A374F2253002BA948929EBAAAF52A5204095AA0D66C740F5A2828E2FD3C46749544580966024CACC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?]0.^3c.^3c.^3c.B?c.^3c[B=c.^3c0A9c`^3c.Qlc.^3c.Qnc.^3c.^2ck^3c0A8c.^3c`X5c.^3c0A7c.^3cRich.^3c........................PE..L.....^O...........!................U.............. .................................................................X.......K..d....P.......................p...Z......................................................\............................text............................... ..`.rdata...i.......j..................@..@.data...L....`...D...@..............@....rsrc........P......................@..@.reloc..Lr...p...t..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1799318
Entropy (8bit):	7.975944248689045
Encrypted:	false
SSDEEP:	24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNN:mbTChxKCnFnQXBbrtgb/iQvu0UHO9I
MD5:	7942494EAC73B2B3281E4A8E94C39376
SHA1:	88C3CD0A88E1C93CFFEEE72D372B1D79144F35AC
SHA-256:	B9818299D1719F7DE6F22CE1F67AE8D3CB5770C945DE5746AE502656FE112984
SHA-512:	8C22BD07628CFB865A72E44E2F271A1158BBBD250D9CD8356187648C08FD37974A0EAFF341D06ACBB4EECD217BC6B837489BFE4E3A0A301A183DC8FBBA5A36CD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..a..e2..e2..e2h.i2..e2..k2..e2..o2..e2..82..e2..d2j.e2..n2..e2..c2..e2Rich..e2........PE..L....^O.................f..........p.............@.............................................................................x....................................................................................................................text...Rd.......f.................. ..`.rdata..&............j..............@..@.data...\|v....... ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91394
Entropy (8bit):	6.654533417168698
Encrypted:	false
SSDEEP:	1536:h5QmUNtCKcKcyR2zh5Te2D6grD5Z3MIOKFnToIf+VHutHaA:hItC42zhlGgrXCKtTBf+VOtHaA
MD5:	6A9461F260EBB2556B8AE1D0BA93858A
SHA1:	01E14B87B69DCE8272D84669F44F81D685DCF7C5
SHA-256:	0B059565160C180DF60470349770A6DD225981A8051639385BB49D33D2A73632
SHA-512:	263041E149A2E7CD95C16A614175179B5E1FEA8ECA137AAC02D903B45F107AD1C9467A3E790408CACA7250B0CB83DA77AA73887239F25B7B93B221CFFC02772B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Al....uD..uD..uD..{D..uD...D..uD..(D..uD..tDj.uD..~D..uD..sD..uD..qD..uDRich..uD........PE..L....^O...........!.................y.............`.................................................................D.......=..P.......`...............................................................................h............................text............................... ..`.rdata...E.......F..................@..@.data....k...P.......0..............@....rsrc...`............D..............@..@.reloc..$............J..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Shared\Modules\fil.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129282
Entropy (8bit):	6.621412156936795
Encrypted:	false
SSDEEP:	3072:h3Qj8Ajn/VzK9fmfiCunng05hlOytTBfitzImtw+FU16DA:h3Qjtz/qf1Cung05hlOytTBN+Fqb
MD5:	D0C9ADA173DA923EFABB53D5A9B28D54
SHA1:	0CEFE568D2A06BD44FE9DFAB65B1E27BD34DEF11
SHA-256:	AD01AB517CF1C9F5D30B3EA749C91C5C8FC613E771D25287483023D2066E1523
SHA-512:	6919CA6D0EB94402B470EF131362AA1FD35BE994161B857FABF4A7ACA7710A757BF490AD6E2F8B5618B53E9BF3390638A9340642035E6A71EA4EEDC94E403E27
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;z..;z..;z...q..;z..'v..;z.T't..;z.?$p.Y;z..4'..;z..;{..;z.?$q..;z.o=\|..;z.?$~..;z.Rich.;z.........................PE..L....^O...........!.....H...................`.....P................................................................ .......h...<....P..`....................`.......................................................`...............................text...BG.......H.................. ..`.rdata...N...`...P...L..............@..@.data............:..................@....rsrc...`....P......................@..@.reloc..r....`......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Addins\att.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	235266
Entropy (8bit):	6.653536540157241
Encrypted:	false
SSDEEP:	6144:/fbIMsWVgui7vKbeDb2J1dZSbgOtTBpkFqAcURC:X3xu7vKiDb2nnegOtTnkFDC
MD5:	FFFA05401511AD2A89283C52D0C86472
SHA1:	99A9FBCAC39B9522D1D628620B69C4CD7CC110F1
SHA-256:	41A712FD2111C5DDEC6FE58A29C80F19923CC72E88B4508D5A3DAEB236DDF1B8
SHA-512:	468B9B50B342D0DEBBF81E37983C600E171BD35AB38680F495A8F52D8476735876E2329228D009F2631356E99770371740F97D77235383DB3E00F7ECD12DB6B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q..q..q..q..q._....q.4.{.Z.q...,..q..p...q.4.z..q.d.w..q.4.u..q.Rich.q.........................PE..L....^O...........!.........8......5..............0.........................P.......................................F......85..........h.................... .......................................................................................text...f........................... ..`CODE.........0...................... ..`.rdata...V.......X..................@..@.data...$....P.......2..............@...DATA.................H..............@...BSS.....e............X..............@....rsrc...h............b..............@..@.reloc...)... ...*...h..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Temp\user0.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.660429712853706
Encrypted:	false
SSDEEP:	3:I5Pt+kiEaKC5Sufoms+L4AHSvKZOt+kiEaKC595Ytzvn:INwknaZ5SuMcyvKowknaZ5bsDn
MD5:	5838B249DFFF3C4BCF6094F52325FB83
SHA1:	7FB503ACAC1BF4BD0AFCDB4ED0A432CD9314422B
SHA-256:	ECED495D7F070597196A9C2C800EC4B3A0901F2E40F919A230460DB54C79A352
SHA-512:	D65D77AD5BF90DD7C32E0CC1E2E8DD711D682FBB46E3411034E6534EE884DDC6017CDDC846B31B89A2DA2CE7E4A216B6B96BA06E6C1C5EF74B751937AD2D5A54
Malicious:	false
Preview:	"C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe" ..del "C:\Users\user\AppData\Roaming\Temp\user0.bat"..

C:\Users\user\AppData\Roaming\Temp\user1.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.8419035287667
Encrypted:	false
SSDEEP:	3:I5Pt+kiEaKC5SufhADu25U4AHwMF3vBkZOt+kiEaKC595YGjn:INwknaZ5SuJmv5U49wBkowknaZ5bJjn
MD5:	5EAC731C619F72CF9DF1C72A2D734BE7
SHA1:	DBD3300B67E578DF5CE04B6A125478BB9718D252
SHA-256:	03E35825C4136DCCCF6E8BE6A919686A435736872DE16229304150EB47C25796
SHA-512:	371A96D779D79756DA96C31888C5CE467D906B6ABE37824B8D714539AEF96487D31B57AA1FF46F3EF37B26374097F17FADC715506E35A9DF0D556EEA948CA4D0
Malicious:	false
Preview:	"C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe" /i 6788..del "C:\Users\user\AppData\Roaming\Temp\user1.bat"..

C:\Users\user\AppData\Roaming\Temp\user2.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.594912323903514
Encrypted:	false
SSDEEP:	3:I5Pt+kiE2J5xAI8JlovKZOt+kiEaKC595YM+vn:INwkn23f8JyvKowknaZ5bEn
MD5:	777A79CAA1236D029E5BB4C6577A1373
SHA1:	181B61AB20B758E96304781BB503753948054499
SHA-256:	575C47B3B66AA387BCBF9526B701F9455249EA114CD7C6574128EC5AAD2C30B6
SHA-512:	36FFE4EFB594DD2A518405E82A0CA39F901AB2FD81B5A2E7C99218DAB5A02C0157017072A1CB66351583573CC76AFB0126FB0151DF09F7EA6D9B95465622DD65
Malicious:	false
Preview:	"C:\Users\user\AppData\Local\Temp\wtmps.exe" ..del "C:\Users\user\AppData\Roaming\Temp\user2.bat"..

C:\Users\user\AppData\Roaming\Temp\mydll.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	397728
Entropy (8bit):	4.700439717593888
Encrypted:	false
SSDEEP:	96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyz:/
MD5:	E1E47695A0B98432911311352B63EAED
SHA1:	836142E550301E0FC13C1A047AAE5A2F4481D7CD
SHA-256:	C67ED34D9254B31E611EE830125C3F2572A1E686F82DEB69E1580FB9A4614CD0
SHA-512:	DA49234EE2E1D8F9956BA59D4A49FE04D3AB154F5DD60CF7A6C72E9D42DEFE8A4B0AEB38845444FE3A8D9C80976467D2101F7C992A48F98F6A9317D0E61CA961
Malicious:	false
Preview:	ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKL

C:\Users\user\Desktop\test.exe

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	809472
Entropy (8bit):	6.4977514182547225
Encrypted:	false
SSDEEP:	12288:8OorOSUTlyRQJok8n3edtG6bV2MEJi099ifVpiLngVqzw8s/KdWGd7rSfjLtVpRT:0OJTI+JL8n3YG6bVDZNUzY55Z
MD5:	AA2C0EDAD4DE949A1347F8C6A346AAAB
SHA1:	81D420887F3D87EAD91CA7A4BAFE827D9409BFD9
SHA-256:	5B516BF84FA5FD2E4159EDCF70916AD775E71257790FF70B2D39A487D0F9DCA1
SHA-512:	351BF8D28D8EA78FA34A9F3BE413F21458336AB4BDE2BE3DFB3744575B61DDC70C30162FBDD892E864730D9FAC76A06BD923A58250356000AEDC8FF4979035EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o............/..........V....................@..................................P........ .................................4.......................................................................................,............................text...(...........................`.P`.data...............................@.@..rdata...+.......,..................@.p@.eh_fram..... ......................@.0@.bss..................................`..idata..4...........................@.0..CRT....4............t..............@.0..tls.... ............v..............@.0..rsrc................x..............@.0.........................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\mscaps.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\wtmps.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	7.357970003886077
Encrypted:	false
SSDEEP:	3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
MD5:	78D3C8705F8BAF7D34E6A6737D1CFA18
SHA1:	9F09E248A29311DBEEFAE9D85937B13DA042A010
SHA-256:	2C4C9EC8E9291BA5C73F641AF2E0C3E1BBD257AC40D9FB9D3FAAB7CEBC978905
SHA-512:	9A3C3175276DA58F1BC8D1138E63238C8D8CCFBFA1A8A1338E88525ECA47F8D745158BB34396B7C3F25E4296BE5F45A71781DA33AD0BBDF7AD88A9C305B85609
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X....................).......B.......i..............B...............Rich............PE..L...O..M.....................`.......5............@..........................@..................................................x.......$%..............................................................................\|............................text...P........................... ..`.rdata..z........ ..................@..@.data...p,..........................@....rsrc...$%.......0..................@..@........................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.703447785090587
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	test.exe
File size:	2'614'323 bytes
MD5:	2a98009ebc2e830e2e2de723312ee8a6
SHA1:	4d767fa5085f36a9d6c8a70de8106b5e4a6a6802
SHA256:	0f28c564a6268c2f3203bf3d594cb519dde447032911eebf3b430e925a94915a
SHA512:	af07aeb62940d7fd562b759f2ca09a42a0955fc880793f2d153fc5bbfa529507dcfe4682ecbfef8cea1aa4c1a83c2b9d3641501c41626925e22abeeb76d3b7c5
SSDEEP:	49152:5OJTDJA3+OW5ZOxbTChxKCnFnQXBbrtgb/iQvu0UHO9z:5OJvJAux5ZOx6hxvWbrtUTrUHO9z
TLSH:	74C5D119FA01D474EF1B85B203C6EE7A56362D304A17CC47F9902E2855B3EB779E1B22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[....................J.......................................Rich............PE..L...c{TO...................................

File Icon


Icon Hash:	89a4b2e5e5cc9cd5

Static PE Info

General

Entrypoint:	0x40167f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4F547B63 [Mon Mar 5 08:37:55 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	730073214094cd328547bf1f72289752

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004020F8h
push 00401830h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
pop edi
push edi
call dword ptr [004020D4h]
pop ecx
or dword ptr [00403090h], FFFFFFFFh
or dword ptr [00403094h], FFFFFFFFh
call dword ptr [004020D0h]
mov ecx, dword ptr [0040308Ch]
mov dword ptr [eax], ecx
call dword ptr [004020CCh]
mov ecx, dword ptr [00403088h]
mov dword ptr [eax], ecx
mov eax, dword ptr [004020C8h]
mov eax, dword ptr [eax]
mov dword ptr [00403098h], eax
call 00007F97A0B143AAh
cmp dword ptr [00403070h], ebx
jne 00007F97A0B1427Eh
push 00401822h
call dword ptr [004020C4h]
pop ecx
call 00007F97A0B1437Ch
push 0040300Ch
push 00403008h
call 00007F97A0B14367h
mov eax, dword ptr [00403084h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00403080h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004020BCh]
push 00403004h
push 00403000h

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2104	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbe000	0xe0f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xf4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x83c	0xa00	6dbb11cce72cc16b887018dd4c34d252	False	0.569921875	data	5.438914555753771	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x5c6	0x600	838666d924e8b6e9dfc84f930bd16733	False	0.515625	data	4.859194046971246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0xbb000	0x200	7d6dcdf3bcb22dca4957ddb77c1c8cbf	False	0.130859375	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	0.545273764156015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xbe000	0xe0f4	0xe200	e7c931bab9c2d389ac0ab577dc48d249	False	0.44571003871681414	data	5.885941048379587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xbe21c	0x4627	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9883623809788964
RT_ICON	0xc2844	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 0	English	United States	0.17868632707774798
RT_ICON	0xc628c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.204149377593361
RT_ICON	0xc8834	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.21893491124260356
RT_ICON	0xca29c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.2450750469043152
RT_ICON	0xcb344	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.23662790697674418
RT_ICON	0xcb9fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.30230496453900707
RT_GROUP_ICON	0xcbe64	0x68	data	English	United States	0.7596153846153846
RT_VERSION	0xcbecc	0x228	data	English	United States	0.4963768115942029

Imports

DLL	Import
KERNEL32.dll	ResumeThread, WriteProcessMemory, VirtualProtectEx, GetModuleFileNameW, DuplicateHandle, GetCurrentProcess, SetFileTime, CopyFileW, GetDriveTypeW, GetFileTime, CreateFileW, SetErrorMode, GetTempFileNameW, GetTempPathW, ExitProcess, Sleep, DeleteFileW, CloseHandle, WaitForSingleObject, CreateProcessW, ReadProcessMemory, GetThreadSelectorEntry, GetThreadContext, GetLastError, lstrlenW, GetModuleHandleW, GetStartupInfoW
USER32.dll	MessageBoxA
SHELL32.dll	ShellExecuteW
MSVCRT.dll	memset, wcscpy, free, _fileno, _chsize, wcsrchr, wcscat, malloc, fclose, fread, fwrite, fseek, _wfopen, sprintf, fflush, _exit, _XcptFilter, exit, _wcmdln, __wgetmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 23:25:02.103918076 CEST	53	62427	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	17:24:42
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\test.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\test.exe"
Imagebase:	0x400000
File size:	2'614'323 bytes
MD5 hash:	2A98009EBC2E830E2E2DE723312EE8A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:24:42
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	explorer.exe
Imagebase:	0x40000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:24:42
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe"
Imagebase:	0x400000
File size:	1'797'699 bytes
MD5 hash:	252EE18EB5E305056FDC9915B278656F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:24:42
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\test.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\test.exe"
Imagebase:	0x400000
File size:	809'472 bytes
MD5 hash:	AA2C0EDAD4DE949A1347F8C6A346AAAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	17:24:45
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user0.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:24:45
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:24:45
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:24:45
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:24:45
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
Imagebase:	0x400000
File size:	1'799'318 bytes
MD5 hash:	7942494EAC73B2B3281E4A8E94C39376
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:24:49
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user1.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 4564, Parent PID: 5228

General

Target ID:	10
Start time:	17:24:49
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:24:49
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe" /i 6788
Imagebase:	0x400000
File size:	176'386 bytes
MD5 hash:	DAAC1781C9D22F5743ADE0CB41FEAEBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:24:52
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\user2.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:24:52
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:24:52
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\wtmps.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\wtmps.exe"
Imagebase:	0x400000
File size:	282'624 bytes
MD5 hash:	75C1467042B38332D1EA0298F29FB592
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:24:53
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\mscaps.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\mscaps.exe" /C:\Users\user\AppData\Local\Temp\wtmps.exe
Imagebase:	0x400000
File size:	204'800 bytes
MD5 hash:	78D3C8705F8BAF7D34E6A6737D1CFA18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	93.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 203
injectionprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000044,00000000,00000000,?,004017DA,00000002), ref: 00401058
wcscpy.MSVCRT ref: 004011BF
wcscpy.MSVCRT ref: 004011CD
wcscpy.MSVCRT ref: 004011DB
wcscpy.MSVCRT ref: 004011E6
wcscpy.MSVCRT ref: 004011F1
wcscpy.MSVCRT ref: 004011FC
wcscpy.MSVCRT ref: 00401207
GetCurrentProcess.KERNEL32(004017DA,?,00000000,00000000,00000000), ref: 00401227
GetCurrentProcess.KERNEL32(00000000), ref: 0040122A
DuplicateHandle.KERNELBASE(00000000), ref: 0040122D
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401241

Part of subcall function 00401346: Wow64GetThreadContext.KERNEL32(00401252,?,74DF2EE0,74DF2E80,75977310), ref: 00401366
Part of subcall function 00401346: GetThreadSelectorEntry.KERNEL32(00401252,?,?), ref: 00401379
Part of subcall function 00401346: ReadProcessMemory.KERNELBASE(004017DA,00401252,?,00000B2C,00000000), ref: 004013B5
Part of subcall function 00401346: ReadProcessMemory.KERNELBASE(004017DA,?,?,000001D8,00000000), ref: 004013CE
Part of subcall function 00401346: ReadProcessMemory.KERNELBASE(004017DA,?,004017DA,00000004,00000000), ref: 004013E5
Part of subcall function 00401346: ReadProcessMemory.KERNELBASE(004017DA,59000000,?,00000018,00000000), ref: 004013FA

VirtualProtectEx.KERNELBASE(004017DA,?,00000ABA,00000040,?), ref: 00401279
WriteProcessMemory.KERNELBASE(004017DA,?,004017DA,00000000,00000000), ref: 0040128B
WriteProcessMemory.KERNELBASE(004017DA,?,?,00000ABA,00000000), ref: 004012A8
ResumeThread.KERNELBASE(00000000), ref: 004012B1
CloseHandle.KERNELBASE(00000000), ref: 004012BA
CloseHandle.KERNEL32(004017DA), ref: 004012BF
free.MSVCRT ref: 004012C4

Strings

\, xrefs: 00401214
H0@, xrefs: 00401019

Memory Dump Source

Source File: 00000000.00000002.1701404604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1701388428.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701420272.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701451740.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_test.jbxd

Similarity

API ID: Process$wcscpy$Memory$Read$HandleThread$CloseCurrentWrite$ContextCreateDuplicateEntryFileModuleNameProtectResumeSelectorVirtualWow64free
String ID: H0@$\
API String ID: 2752700894-3173346701
Opcode ID: ac48f256abe60f638106692655660bf668ea59fe7fa0b28b22a79a51fcc009a3
Instruction ID: 8b8ae813a4a7e84dff6f5983beaa3dde5466e697ef8a21ee926d92c0f9824885
Opcode Fuzzy Hash: ac48f256abe60f638106692655660bf668ea59fe7fa0b28b22a79a51fcc009a3
Instruction Fuzzy Hash: A581A8B5A00319AFDB50DFA4DE44F9A7BF8FB09314F1044A6AA09F3290D7B4AA44CF55

Function 0040167F Relevance: 16.6, APIs: 11, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 004016AE
__p__fmode.MSVCRT ref: 004016C3
__p__commode.MSVCRT ref: 004016D1
__setusermatherr.MSVCRT ref: 004016FD
_initterm.MSVCRT ref: 00401713
__wgetmainargs.MSVCRT ref: 00401736
_initterm.MSVCRT ref: 00401746
GetStartupInfoW.KERNEL32(?), ref: 004017A8
GetModuleHandleW.KERNEL32(00000000,00000000,?,0000000A), ref: 004017CE
exit.KERNELBASE ref: 004017DE
_XcptFilter.MSVCRT ref: 004017F0

Memory Dump Source

Source File: 00000000.00000002.1701404604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1701388428.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701420272.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701451740.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_test.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargsexit
String ID:
API String ID: 3327129161-0
Opcode ID: a7e3de02016792ec4999e95f60872d58e145630f5871f36365fbc75c2c295fc9
Instruction ID: dcf3f338402d9aae81c2f9e9b520dcb6328aedd0bbb1ca33c4f5cfcad8a8470b
Opcode Fuzzy Hash: a7e3de02016792ec4999e95f60872d58e145630f5871f36365fbc75c2c295fc9
Instruction Fuzzy Hash: 844160B69013049FC724AFA5DE49AA9BBB8FB04711F20423FEA55B72E0D7784941CB58

Function 004014EB Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?,?), ref: 00401527
lstrlenW.KERNEL32(?), ref: 0040153A
lstrlenW.KERNEL32(?), ref: 00401550
CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,004017DA), ref: 00401570
GetLastError.KERNEL32 ref: 00401576

Strings

\, xrefs: 0040153E
D, xrefs: 00401503

Memory Dump Source

Source File: 00000000.00000002.1701404604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1701388428.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701420272.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701451740.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_test.jbxd

Similarity

API ID: lstrlen$CreateErrorLastPathProcessTemp
String ID: D$\
API String ID: 3489217399-468123767
Opcode ID: dc9c4cdb5cd2c179eff2efa93a4405172a76a7c619e023eed5e3e2870705a702
Instruction ID: e41a149f76cc3bb6082800bb08762e11a74309c2223353c11ef59b11b956732b
Opcode Fuzzy Hash: dc9c4cdb5cd2c179eff2efa93a4405172a76a7c619e023eed5e3e2870705a702
Instruction Fuzzy Hash: 0201257280161CAEDF10DBE8DD4CADE77BCEB84301F104565D605F7150D6B45A49CB59

Function 00401346 Relevance: 9.1, APIs: 6, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(00401252,?,74DF2EE0,74DF2E80,75977310), ref: 00401366
GetThreadSelectorEntry.KERNEL32(00401252,?,?), ref: 00401379
ReadProcessMemory.KERNELBASE(004017DA,00401252,?,00000B2C,00000000), ref: 004013B5
ReadProcessMemory.KERNELBASE(004017DA,?,?,000001D8,00000000), ref: 004013CE
ReadProcessMemory.KERNELBASE(004017DA,?,004017DA,00000004,00000000), ref: 004013E5
ReadProcessMemory.KERNELBASE(004017DA,59000000,?,00000018,00000000), ref: 004013FA

Memory Dump Source

Source File: 00000000.00000002.1701404604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1701388428.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701420272.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701451740.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_test.jbxd

Similarity

API ID: MemoryProcessRead$Thread$ContextEntrySelectorWow64
String ID:
API String ID: 2327994366-0
Opcode ID: cc59c708fe6d56a024a7654490b93e11f8ec0de07c3e6b0a674b95a7b8557adb
Instruction ID: 4c816a06d37d702bd32cf5e2019a19290309f903cb74dd37cfec48fec69cc10a
Opcode Fuzzy Hash: cc59c708fe6d56a024a7654490b93e11f8ec0de07c3e6b0a674b95a7b8557adb
Instruction Fuzzy Hash: 8A21EFB294011EBFDB50DB94DD85EEE77BCEB48304F0000B2B605E2151D674EB499F60

Function 004015E1 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004015E9
fseek.MSVCRT ref: 0040160F
fread.MSVCRT ref: 00401625
free.MSVCRT ref: 00401633

Memory Dump Source

Source File: 00000000.00000002.1701404604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1701388428.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701420272.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701451740.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_test.jbxd

Similarity

API ID: freadfreefseekmalloc
String ID:
API String ID: 3471334931-0
Opcode ID: 44ac79e4b0f1bcf4dc7ae02b0996f741e120785c0b30b0b1d50e8aeaaf7d3969
Instruction ID: 1d382d1c7b83fd7ead5be8ccf3c43d9436ab592656dc9468087f722dc2080258
Opcode Fuzzy Hash: 44ac79e4b0f1bcf4dc7ae02b0996f741e120785c0b30b0b1d50e8aeaaf7d3969
Instruction Fuzzy Hash: EBF0BB31304211AFDB148F389D5896B7696EB88711F144D3AF316E13E0D6768C15C76A

Function 00401588 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wfopen.MSVCRT ref: 00401592
fseek.MSVCRT ref: 004015A8
fread.MSVCRT ref: 004015C4
fclose.MSVCRT ref: 004015D5

Memory Dump Source

Source File: 00000000.00000002.1701404604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1701388428.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701420272.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701451740.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_test.jbxd

Similarity

API ID: _wfopenfclosefreadfseek
String ID:
API String ID: 37012567-0
Opcode ID: 58a0d6c72bc6984039d2a2ecf4c9038545cb79c90ea8f2b82e46258bfba3e950
Instruction ID: e227e1178396003585923f979526c72ad7791703c8cdf5e963474d517e879b06
Opcode Fuzzy Hash: 58a0d6c72bc6984039d2a2ecf4c9038545cb79c90ea8f2b82e46258bfba3e950
Instruction Fuzzy Hash: 50F0E2322092607BE6340B2ABD0DF8B7F55EFC5732F104137F709A52E0C6744942C2A9

Function 00401435 Relevance: 4.6, APIs: 3, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004014EB: GetTempPathW.KERNEL32(00000104,?,?), ref: 00401527
Part of subcall function 004014EB: lstrlenW.KERNEL32(?), ref: 0040153A
Part of subcall function 004014EB: lstrlenW.KERNEL32(?), ref: 00401550
Part of subcall function 004014EB: CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,004017DA), ref: 00401570
Part of subcall function 004014EB: GetLastError.KERNEL32 ref: 00401576

SetErrorMode.KERNELBASE(00008003), ref: 0040146B
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 0040147F

Part of subcall function 00401588: _wfopen.MSVCRT ref: 00401592

_wfopen.MSVCRT ref: 004014B1

Memory Dump Source

Source File: 00000000.00000002.1701404604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1701388428.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701420272.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701451740.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_test.jbxd

Similarity

API ID: Error_wfopenlstrlen$CreateFileLastModeModuleNamePathProcessTemp
String ID:
API String ID: 1387098578-0
Opcode ID: 699a823cd1aa0335894426f21163e42a31b1eaad549d774e9f9875b55d5fa839
Instruction ID: 01e8a217c8b558288f5a1d2cbcf5def80e225c71c86d6d92af73ecd0454d4b8c
Opcode Fuzzy Hash: 699a823cd1aa0335894426f21163e42a31b1eaad549d774e9f9875b55d5fa839
Instruction Fuzzy Hash: 2D114272910109AFDF11EBE4DD85EEE77BCAB04759F10057AF601F11E1DAB99A808A24

Analysis Process: @AE2AF6.tmp.exePID: 2084, Parent PID: 984COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	30.5%
Signature Coverage:	4.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	217

Executed Functions

Function 0040318C Relevance: 94.8, APIs: 8, Strings: 46, Instructions: 297
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?,?,?,?,?,00000104,00000000), ref: 004031C9
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,00000104,00000000), ref: 004031E7
GetProcAddress.KERNEL32(00000000), ref: 004031F0
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,00000104,00000000), ref: 004031FA
GetSystemInfo.KERNEL32(?,?,?,?,?,00000104,00000000), ref: 00403202
GetModuleHandleW.KERNEL32(kernel32.dll,GetProductInfo,?,?,?,?,00000104,00000000), ref: 0040328F
GetProcAddress.KERNEL32(00000000), ref: 00403292
GetSystemMetrics.USER32(00000059), ref: 00403367

Strings

GetProductInfo, xrefs: 00403285
Windows Storage Server 2003, xrefs: 0040337E
Datacenter Edition for Itanium-based Systems, xrefs: 004033CA
Small Business Server, xrefs: 00403316
Starter Edition, xrefs: 004032E5
Ultimate Edition, xrefs: 004032C9
Standard x64 Edition, xrefs: 004033FF
GetNativeSystemInfo, xrefs: 004031DD
Web Server Edition, xrefs: 0040332B
Home Edition, xrefs: 0040346D
Standard Edition (core installation), xrefs: 00403324
Windows Home Server, xrefs: 0040338B
Server, xrefs: 004034C7
, 32-bit, xrefs: 00403545
Datacenter Edition (core installation), xrefs: 004032FA
Small Business Server Premium Edition, xrefs: 00403332
Standard Edition, xrefs: 0040331D, 00403437
Home Basic Edition, xrefs: 004032D7
Windows 2000 , xrefs: 00403493
Datacenter Edition, xrefs: 004032F3, 00403419
Compute Cluster Edition, xrefs: 0040340E
Windows Server 2003, , xrefs: 004033A6
Windows Vista , xrefs: 0040324E
, xrefs: 00403378
Windows XP Professional x64 Edition, xrefs: 0040339F
Advanced Server, xrefs: 004034C0
Windows XP , xrefs: 0040345A
Enterprise x64 Edition, xrefs: 004033F8
Home Premium Edition, xrefs: 004032D0
, 64-bit, xrefs: 00403537
Enterprise Edition (core installation), xrefs: 00403308
Cluster Server Edition, xrefs: 004032EC
Business Edition, xrefs: 004032DE
Datacenter Server, xrefs: 004034B3
Datacenter x64 Edition, xrefs: 004033EB
Windows 7 , xrefs: 00403271
Windows Server 2008 , xrefs: 00403255
kernel32.dll, xrefs: 004031E2, 0040328A
Web Edition, xrefs: 00403430
Professional, xrefs: 0040333E, 00403474, 004034A6
Enterprise Edition for Itanium-based Systems, xrefs: 0040330F, 004033D7
Windows Server 2003 R2, , xrefs: 00403371
(build %d), xrefs: 0040350C
Enterprise Edition, xrefs: 00403301, 00403424
Microsoft , xrefs: 00403225
Windows Server 2008 R2 , xrefs: 00403278

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: System$AddressHandleInfoModuleProc$MetricsNativeVersion
String ID: $ (build %d)$, 32-bit$, 64-bit$Advanced Server$Business Edition$Cluster Server Edition$Compute Cluster Edition$Datacenter Edition$Datacenter Edition (core installation)$Datacenter Edition for Itanium-based Systems$Datacenter Server$Datacenter x64 Edition$Enterprise Edition$Enterprise Edition (core installation)$Enterprise Edition for Itanium-based Systems$Enterprise x64 Edition$GetNativeSystemInfo$GetProductInfo$Home Basic Edition$Home Edition$Home Premium Edition$Microsoft $Professional$Server$Small Business Server$Small Business Server Premium Edition$Standard Edition$Standard Edition (core installation)$Standard x64 Edition$Starter Edition$Ultimate Edition$Web Edition$Web Server Edition$Windows 2000 $Windows 7 $Windows Home Server$Windows Server 2003 R2, $Windows Server 2003, $Windows Server 2008 $Windows Server 2008 R2 $Windows Storage Server 2003$Windows Vista $Windows XP $Windows XP Professional x64 Edition$kernel32.dll
API String ID: 3803635055-653857925
Opcode ID: 7e5a2062480d9b40d16f40cbb051c6ac1362f930747b00ba83a2c01a469456f8
Instruction ID: 052d8262fc2ca6c4471316aa09acfddedcf139bf951b45217982cd0803da5431
Opcode Fuzzy Hash: 7e5a2062480d9b40d16f40cbb051c6ac1362f930747b00ba83a2c01a469456f8
Instruction Fuzzy Hash: 66912A30B48328F6DF215F90AC86BEE6E6C5F25716F74417BE801711E1DA7C5B81861E

Function 00402056 Relevance: 65.5, APIs: 18, Strings: 19, Instructions: 734
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040205B

Part of subcall function 00401EE0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000104,?,00000104), ref: 00401FD6
Part of subcall function 00401EE0: CreateThread.KERNEL32(00000000,00000000,00401EBE,?,00000000,?), ref: 00401FEE
Part of subcall function 00401EE0: WaitForSingleObject.KERNEL32(00000000,00002710), ref: 00402000
Part of subcall function 00401EE0: GetExitCodeThread.KERNEL32(00000000,?), ref: 00402014

Part of subcall function 0040B8D2: GetSystemTime.KERNEL32(?,?,?,00401CF7,?,?,?,00424D98,00000104), ref: 0040B8DC

Part of subcall function 0040BE9C: wsprintfW.USER32 ref: 0040BF29
Part of subcall function 0040BE9C: wsprintfW.USER32 ref: 0040BF5A
Part of subcall function 0040BE9C: wsprintfW.USER32 ref: 0040BF8B
Part of subcall function 0040BE9C: wsprintfW.USER32 ref: 0040BFBC

GetComputerNameW.KERNEL32(?,?), ref: 00402179
GetUserNameW.ADVAPI32(?,?), ref: 004021C4

Part of subcall function 0040318C: GetVersionExW.KERNEL32(?,?,?,?,?,00000104,00000000), ref: 004031C9
Part of subcall function 0040318C: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,00000104,00000000), ref: 004031E7
Part of subcall function 0040318C: GetProcAddress.KERNEL32(00000000), ref: 004031F0
Part of subcall function 0040318C: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,00000104,00000000), ref: 004031FA
Part of subcall function 0040318C: GetModuleHandleW.KERNEL32(kernel32.dll,GetProductInfo,?,?,?,?,00000104,00000000), ref: 0040328F
Part of subcall function 0040318C: GetProcAddress.KERNEL32(00000000), ref: 00403292

GetSystemDefaultLangID.KERNEL32(?,00000000), ref: 0040220E
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 0040226C
GetAdaptersInfo.IPHLPAPI(?,?), ref: 00402291
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000100,?,00000100,?,?,?,00000000), ref: 004022D8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000010,?,00000010,?,00000000,?,?,?,?,?,?,?,?), ref: 004023B5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000010,?,00000010,?,?,?,?,?,?,?,?,00000000), ref: 004023CC
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00421154,00000000,?,00000000,?,?), ref: 004024D1
GetProcAddress.KERNEL32(?,?), ref: 0040253A
InternetGetConnectedState.WININET(?,00000000), ref: 00402549
FreeLibrary.KERNEL32(?), ref: 0040254E
GetTempPathW.KERNEL32(00000104,?,?,00000000,?,?,?,?,00000000), ref: 0040271E
GetTempFileNameW.KERNEL32(?,004210C0,00000000,?,?,?,?,?,00000000), ref: 0040273E
GetTempFileNameW.KERNEL32(?,004210B8,00000000,?,?,?,?,?,00000000), ref: 00402754
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000104,?,00000104,00000000,00000000), ref: 0040290E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000104,?,00000104,00000000,00000000), ref: 00402936

Strings

Network: Closed, xrefs: 00402447
-> IP: %s/%s %s, xrefs: 004023F6
UserName: %s, xrefs: 004021D7
, xrefs: 004025C0
LAN , xrefs: 00402560
-> MAC: %02X-%02X-%02X-%02X-%02X-%02X, xrefs: 0040234E
TTL: %d (initial:%d), xrefs: 004026A8
col13[N)*+3K,@=<MnY7X-&Ze3 21<9, xrefs: 00402891, 00402894
(DHCP), xrefs: 004023D8, 004023E4
OS: %s (language:0x%X), xrefs: 00402225
PROXY , xrefs: 00402638
MODEM , xrefs: 00402596
OFFLINE , xrefs: 004025CC
Network: Internet, xrefs: 00402440
), xrefs: 00402668
Adapter: %s, xrefs: 004022EB
ComputerName: %s, xrefs: 0040218C
Time(UTC): %s, xrefs: 00402141
RAS , xrefs: 00402602

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ByteCharMultiWide$Namewsprintf$AddressInfoProcSystemTemp$AdaptersFileHandleLibraryModuleThread$CodeComputerConnectedCreateDefaultExitFreeH_prologInternetLangLoadNativeObjectPathSingleStateTimeUserVersionWait
String ID: $(DHCP)$)$-> IP: %s/%s %s$-> MAC: %02X-%02X-%02X-%02X-%02X-%02X$Adapter: %s$ComputerName: %s$LAN $MODEM $Network: Closed$Network: Internet$OFFLINE $OS: %s (language:0x%X)$PROXY $RAS $TTL: %d (initial:%d)$Time(UTC): %s$UserName: %s$col13[N)*+3K,@=<MnY7X-&Ze3 21<9
API String ID: 2776397759-791159086
Opcode ID: 714c95d6952ae8532d33d2ae3412cf31f457a6f50c4026011f6513dbd7ed768e
Instruction ID: 82a2c2adfaedeff0a0092a37c3b46ab2e2a42cac6b12bc584979c085ee255e03
Opcode Fuzzy Hash: 714c95d6952ae8532d33d2ae3412cf31f457a6f50c4026011f6513dbd7ed768e
Instruction Fuzzy Hash: 014288B2900258AADB11DBA4DC85FDF777CAF09304F4405BBF209B7181DB799A848B69

Function 1000180D Relevance: 13.6, APIs: 9, Instructions: 63
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 10001826
Thread32First.KERNEL32(00000000,00000000), ref: 10001842
GetCurrentProcessId.KERNEL32(?,00000004,00000000), ref: 10001852
GetCurrentThreadId.KERNEL32 ref: 1000185D
OpenThread.KERNEL32(00000002,00000000,?,?,00000004,00000000), ref: 1000186F
ResumeThread.KERNEL32(00000000,?,00000004,00000000), ref: 10001882
CloseHandle.KERNEL32(00000000,?,00000004,00000000), ref: 1000188E
Thread32Next.KERNEL32(00000000,0000001C), ref: 10001895
CloseHandle.KERNEL32(00000000,00000004,00000000), ref: 100018A0

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: Thread$CloseCurrentHandleThread32$CreateFirstNextOpenProcessResumeSnapshotToolhelp32
String ID:
API String ID: 859823506-0
Opcode ID: 66e904a91da0d58909503a222a5da84082675bbe6a8bc6ed494a10005acb0f73
Instruction ID: f2e930b831cbdd08f27b90cab4d865d1a0233698321c17ea87ca414643b385ec
Opcode Fuzzy Hash: 66e904a91da0d58909503a222a5da84082675bbe6a8bc6ed494a10005acb0f73
Instruction Fuzzy Hash: 70119E71900259ABF710EB748C85BEFB7ADEF003D0F108511F611B6089CBB4AA858B71

Function 00404732 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 119
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00000000,?,?,?,?,00401C84,00000000,00000001), ref: 0040476D
VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,?,00000000,?,?,?,?,00401C84,00000000,00000001), ref: 0040477D
GetProcessHeap.KERNEL32(00000000,00000014,?,00000000,?,?,?,?,00401C84,00000000,00000001), ref: 0040478E
HeapAlloc.KERNEL32(00000000,?,00000000,?,?,?,?,00401C84,00000000,00000001), ref: 00404795
VirtualAlloc.KERNEL32(00000001,?,00001000,00000004,?,00000000,?,?,?,?,00401C84,00000000,00000001), ref: 004047B9
VirtualAlloc.KERNEL32(00000001,?,00001000,00000004,?,00000000,?,?,?,?,00401C84,00000000,00000001), ref: 004047C8

Strings

t)W, xrefs: 00404815

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Alloc$Virtual$Heap$Process
String ID: t)W
API String ID: 2020977634-2778948157
Opcode ID: 0b5aed4809dcae3756cf1a22090440293038446c4a6b41401dda8afb1c322aa3
Instruction ID: 537f02f18b8e21970bf095ebe7f34f1c2112e700200359e7f210670ce1f1b5cb
Opcode Fuzzy Hash: 0b5aed4809dcae3756cf1a22090440293038446c4a6b41401dda8afb1c322aa3
Instruction Fuzzy Hash: 1D3160B2600305BFD714AFA9DC85F6B7BA8AF88754F14843EF605E7281D774E9008B68

Function 00401466 Relevance: 3.0, APIs: 2, Instructions: 17fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00402BAD,?), ref: 00401479
FindClose.KERNEL32(00000000), ref: 00401489

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 59c2e92a5655e99502496943e2282ba4184573f97bf7188561b506f46f133912
Instruction ID: 85e77e974d2a6bc85b95dcb03606bac31f48628942dc84b9f603adafd2122286
Opcode Fuzzy Hash: 59c2e92a5655e99502496943e2282ba4184573f97bf7188561b506f46f133912
Instruction Fuzzy Hash: C7D0A73040050C6BCF105F74EC4D4DA3BAD9744369F404260ED21D21F0C730CA4979B8

Function 00402A96 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 461
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402A9B
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe,00000104,?,00000000,?,00403065,0040D84F,00000000), ref: 00402ADF

Part of subcall function 00401058: __EH_prolog.LIBCMT ref: 0040105D

Sleep.KERNEL32(0001D4C0), ref: 0040303F

Part of subcall function 00401CB0: GetAdaptersInfo.IPHLPAPI(00000000,00000280), ref: 00401D66
Part of subcall function 00401CB0: GetAdaptersInfo.IPHLPAPI(00000000,00000280), ref: 00401D8B
Part of subcall function 00401CB0: inet_addr.WS2_32(000001B0), ref: 00401DA1
Part of subcall function 00401CB0: inet_addr.WS2_32(000001C0), ref: 00401DB0

WideCharToMultiByte.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe,00000104,?,00000104,00000000,00000000), ref: 00402B86
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000104,00000000,00000104,00000000,00000000), ref: 00402CAA
GetCurrentProcessId.KERNEL32 ref: 00402CB0
Sleep.KERNEL32(000003E8), ref: 00402CE9

Strings

C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe, xrefs: 00402AFF, 00402B1A, 00402BA3, 00402BD9, 00402C22, 00402D0A, 00402D11, 00402D22, 00402D52, 00402D57, 00402D5E, 00402D83, 00402D97, 00402DA7
/u %d, xrefs: 00402CBA
C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe, xrefs: 00402B04
/i %d, xrefs: 00402FF4
C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe, xrefs: 00402AD6, 00402ADC, 00402AED, 00402B19, 00402B7F, 00402D23, 00402DEB, 00402E2D, 00402E83, 00402F62

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AdaptersByteCharH_prologInfoMultiSleepWideinet_addr$CurrentFileModuleNameProcess
String ID: /i %d$/u %d$C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe$C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe$C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
API String ID: 3262664952-2187094131
Opcode ID: 7d8fc5e4c102de3cf784049d0c6dc99a83b6fb1ce5ef76f9df1eee29df6d3955
Instruction ID: 4bbd02dc5c401744a1b2f0d44b804cd0e1069e0a9cdfdf3ed85dd48fc2b4bb21
Opcode Fuzzy Hash: 7d8fc5e4c102de3cf784049d0c6dc99a83b6fb1ce5ef76f9df1eee29df6d3955
Instruction Fuzzy Hash: 34F1A5B2A00214ABEB20DBA4DC45BEB77BDEF89304F1004BAF504F61D1DA799E45CB59

Function 1000232C Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,?), ref: 1000239D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 10002488
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?), ref: 100024FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 10002514
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 10002526

Strings

"%s" %sdel "%s", xrefs: 100024A5
open, xrefs: 10002520
%s%s%s%d.bat, xrefs: 100023DD
\, xrefs: 100023AF
wt+, xrefs: 10002443
tmp, xrefs: 1000236A

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ByteCharMultiWide$ExecuteNameShellUser
String ID: "%s" %sdel "%s"$%s%s%s%d.bat$\$open$tmp$wt+
API String ID: 1071661744-3710747550
Opcode ID: bc9a6e5162e27da9705036057f49e652a76dff2939cad07ee55e3e4b7bc04dc2
Instruction ID: 1e5fc5fc54b0182e69e4d0566aa8bde90df0a13d479aede635db1cf34de350d7
Opcode Fuzzy Hash: bc9a6e5162e27da9705036057f49e652a76dff2939cad07ee55e3e4b7bc04dc2
Instruction Fuzzy Hash: A4514E72A00158ABEB25CBA4CC94EDFB7B9EB48340F1144AAF609E3150DA759FC58F50

Function 10001C52 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,?), ref: 10001CC5
WideCharToMultiByte.KERNEL32(?,?,?,?,?), ref: 10001DAD
ShellExecuteW.SHELL32(?,open,?), ref: 10001F6D

Strings

open, xrefs: 10001F67
\, xrefs: 10001CD7
%s%s%s%d.bat, xrefs: 10001D05
wt+, xrefs: 10001D6B
tmp, xrefs: 10001C92

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ByteCharExecuteMultiNameShellUserWide
String ID: %s%s%s%d.bat$\$open$tmp$wt+
API String ID: 1401121979-4278069354
Opcode ID: b16f70ae5c3f3ee9d54a52924125b396119716f646ec8ce75c942e49535d2edc
Instruction ID: b4101bf210db583b03f93a028528ca2c63661fc888a937a329b7782714303ac6
Opcode Fuzzy Hash: b16f70ae5c3f3ee9d54a52924125b396119716f646ec8ce75c942e49535d2edc
Instruction Fuzzy Hash: E291AA7294021CBAFB20DB94DC8AFDB736CEB04745F5044A6F309EA0C5EAB59BD48B51

Function 100016D3 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00000104), ref: 10001762
CreateDirectoryW.KERNEL32(?,00000000), ref: 100017B6
GetLastError.KERNEL32 ref: 100017C0
InterlockedIncrement.KERNEL32(1001103C), ref: 10001800

Strings

\, xrefs: 10001774
%s%s%c%c%c%c, xrefs: 100017A0
%s\%c%c%c%c%c%c%c%c%c, xrefs: 100017ED

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: CreateDirectoryEnvironmentErrorIncrementInterlockedLastVariable
String ID: %s%s%c%c%c%c$%s\%c%c%c%c%c%c%c%c%c$\
API String ID: 3633764033-1980533215
Opcode ID: a1df38e7ae124333fa33ba4af8a962b120b187a8a8e3fac50d6a8624bacb1ebf
Instruction ID: 75e7eb03eb993b12d01cc441aa5ef8f158e2bd3ceaf2a8d4126e0fd689ac5d56
Opcode Fuzzy Hash: a1df38e7ae124333fa33ba4af8a962b120b187a8a8e3fac50d6a8624bacb1ebf
Instruction Fuzzy Hash: 7631C4B5B403587AF720CA648C45FDB72ADEB48744F0044A5B749FB1C0DAF1AAD44B55

Function 1000B74E Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 241
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000001,80000000,10002F8D,0000000C,00000001,00000080,00000000,00000001,00000000,00000000), ref: 1000B901
GetLastError.KERNEL32 ref: 1000B90D
GetFileType.KERNEL32(00000000), ref: 1000B922
CloseHandle.KERNEL32(00000000), ref: 1000B92D

Strings

H, xrefs: 1000B974
@, xrefs: 1000B93A

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: @$H
API String ID: 1809617866-104103126
Opcode ID: 135215ee96e25ee8a8efc5695d3880bda97763f3ee48cfb356986b8452ad0dcf
Instruction ID: 7a42c947a19329fa8c6dd8419bcff967ddc10ced02f347353924d189b6712a32
Opcode Fuzzy Hash: 135215ee96e25ee8a8efc5695d3880bda97763f3ee48cfb356986b8452ad0dcf
Instruction Fuzzy Hash: 49813B31D08A5A9AFB10CF64CC807AD7BE4EF013E4F218669E965671E9CBB48D44C751

Function 1000C389 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 241
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000001,80000000,?,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 1000C53C
GetLastError.KERNEL32 ref: 1000C548
GetFileType.KERNEL32(00000000), ref: 1000C55D
CloseHandle.KERNEL32(00000000), ref: 1000C568

Strings

@, xrefs: 1000C575
H, xrefs: 1000C5AF

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: @$H
API String ID: 1809617866-104103126
Opcode ID: 241ebd9ba73e3fade414ea2b0c9828dd4f23b00f0127123be1d71313763c1dc2
Instruction ID: 567d32f5d40eb58ccd44413fef24414c47b30826c6c5fbd1b49f09f0f5995f8e
Opcode Fuzzy Hash: 241ebd9ba73e3fade414ea2b0c9828dd4f23b00f0127123be1d71313763c1dc2
Instruction Fuzzy Hash: 6781E571C0879E5AFB20CFA4CC50FAD7BA0FF013E4F218219E961A62D9C7B59E858751

Function 00401EE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 143
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000104,?,00000104), ref: 00401FD6
CreateThread.KERNEL32(00000000,00000000,00401EBE,?,00000000,?), ref: 00401FEE
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 00402000
GetExitCodeThread.KERNEL32(00000000,?), ref: 00402014
TerminateThread.KERNEL32(00000000,00000000), ref: 0040202E

Strings

C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe, xrefs: 00401EE8

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Thread$ByteCharCodeCreateExitMultiObjectSingleTerminateWaitWide
String ID: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
API String ID: 2084129242-1954932391
Opcode ID: 10337f52fb143e34f1f805d398a030dc3978f2d891c98419bb57d7c270c50101
Instruction ID: 239ba0d05ee60cf0674a408b2aeaa55976477d4996a500f9bd75b048c5916d61
Opcode Fuzzy Hash: 10337f52fb143e34f1f805d398a030dc3978f2d891c98419bb57d7c270c50101
Instruction Fuzzy Hash: 2441CC717883487AF3309A21DD4BFA7769EE788B44F00043EF748B91C1D6F995548665

Function 100025B9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00000104), ref: 10002647
CopyFileW.KERNEL32(?,?,00000000), ref: 100026BA
LoadLibraryW.KERNEL32(?), ref: 100026C6
GetProcAddress.KERNEL32(?,?), ref: 100026DE

Strings

%s%s%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c, xrefs: 100026A0
\, xrefs: 10002659

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: AddressCopyEnvironmentFileLibraryLoadProcVariable
String ID: %s%s%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c$\
API String ID: 1113758109-1100431915
Opcode ID: 5c857b86d3b9db1595a9569733b948357d0aeefdeca943a408051796bc8a2eda
Instruction ID: 6da3ee52d82f2b450fdcbe27bdb40211bc38835922def5947a7665048901805a
Opcode Fuzzy Hash: 5c857b86d3b9db1595a9569733b948357d0aeefdeca943a408051796bc8a2eda
Instruction Fuzzy Hash: D931B476B80358BAF730C664CC4AFCB736EAB84B44F004465B349BB1D5D6F16A908A54

Function 00403068 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 004030AE
lstrlenW.KERNEL32(?,?,?,?,?,?,00000000), ref: 004030C1
lstrlenW.KERNEL32(?,?,?,?,?,?,00000000), ref: 004030D5
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 004030F5
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 004030FB

Strings

\, xrefs: 004030C3

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: lstrlen$CreateErrorLastPathProcessTemp
String ID: \
API String ID: 3489217399-2967466578
Opcode ID: e3571185e1c746b7617ab9132659640be5aa7f4656a2ba5ded501037a61c0dd1
Instruction ID: 0257e6b17935841fec469620f06e91c1c621e9a3f8a3c40a5195ff03cd617aa4
Opcode Fuzzy Hash: e3571185e1c746b7617ab9132659640be5aa7f4656a2ba5ded501037a61c0dd1
Instruction Fuzzy Hash: E911847280121CAECB10EBE9EC4CEDF7BBCEFC9705F11456AE605E2040E6745A48CB68

Function 00414B9F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000001,80000000,?,0000000C,00000001,00000080,00000000,00000001,00000000,00000000), ref: 00414D52
GetLastError.KERNEL32 ref: 00414D5E
GetFileType.KERNEL32(00000000), ref: 00414D73
CloseHandle.KERNEL32(00000000), ref: 00414D7E

Strings

@,S@, xrefs: 00414B9F

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: @,S@
API String ID: 1809617866-1817016226
Opcode ID: 3e826eb931e5c1fc7bd965506deb645fb69a84a9def9e3e34e6e7f313f445755
Instruction ID: b22405384b978b32f86057f3daa07e98a13ec70f44172869c59a16613b36f91f
Opcode Fuzzy Hash: 3e826eb931e5c1fc7bd965506deb645fb69a84a9def9e3e34e6e7f313f445755
Instruction Fuzzy Hash: 8E8149719042099AEF208F68CC443EF7B64AF81328F25421BE465AB3D1D7BC89C5C79E

Function 004124D6 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 170fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000100,00000000,00000000), ref: 00412550
GetLastError.KERNEL32 ref: 0041255A
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 00412620
GetLastError.KERNEL32 ref: 0041262A

Strings

@,S@, xrefs: 004124D6

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: @,S@
API String ID: 1948546556-1817016226
Opcode ID: 70d97e1d307b992346792c5f8cd5602eb05a1af0af6e0c409591ca3c1ae161dd
Instruction ID: 2078f594b2b3751a6d52fa019bffb4031f7e7983a443e01007e5b9519ebc7202
Opcode Fuzzy Hash: 70d97e1d307b992346792c5f8cd5602eb05a1af0af6e0c409591ca3c1ae161dd
Instruction Fuzzy Hash: 2D51D530604385EFDF218F58C984BDA7BB1BF16304F54409BE855CB391D7B899A2CB1A

Function 00410A31 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00414E2F,00000000,00001000), ref: 00410AF8

Strings

@,S@, xrefs: 00410A31

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: FileWrite
String ID: @,S@
API String ID: 3934441357-1817016226
Opcode ID: bdac9948307d1d99ba14741aac4a6466b3f909a0482d8b6be9aff8e03909965b
Instruction ID: 45298e78308a274b476932748e67503fe90b06bcb34fc512e35019f82fa51ec6
Opcode Fuzzy Hash: bdac9948307d1d99ba14741aac4a6466b3f909a0482d8b6be9aff8e03909965b
Instruction Fuzzy Hash: DA519031904208EFCB11CFA8C984ADE7BB4FF55398F1481AAE815DB251D7B4EAC1CB59

Function 004057F3 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 298fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040501B: GetTempPathW.KERNEL32(00000104,?,?), ref: 0040504A
Part of subcall function 0040501B: GetTempFileNameW.KERNEL32(?,tmp,00000000,00000000), ref: 00405065

CopyFileW.KERNEL32(?,?,00000000), ref: 00405AF7

Strings

|<#YKs$^, xrefs: 00405A46
toPm|<#YKs$^, xrefs: 0040591A, 00405A6E, 00405A27
%eR@toPm|<#YKs$^, xrefs: 004058ED, 004058F2

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: FileTemp$CopyNamePath
String ID: %eR@toPm|<#YKs$^$toPm|<#YKs$^$|<#YKs$^
API String ID: 291496533-3958563027
Opcode ID: 46f25c6ffa3f13151a9f36a544417d5587b15a13c2086594c4c673ce1e5127d7
Instruction ID: ada56393937183257899d74d6c61394e5e9a94cfac53ea075563eef363fadbc8
Opcode Fuzzy Hash: 46f25c6ffa3f13151a9f36a544417d5587b15a13c2086594c4c673ce1e5127d7
Instruction Fuzzy Hash: 1FA1B2B2D00259AADF20EAA5CC45FDF7B7CDF01314F0440ABF504B61C1DA79AA448FA9

Function 10009C7D Relevance: 6.2, APIs: 4, Instructions: 170fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000100,00000000,00000000), ref: 10009CF7
GetLastError.KERNEL32 ref: 10009D01
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 10009DC7
GetLastError.KERNEL32 ref: 10009DD1

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: bfc86eb3975069c3503e58b30f01c7fa03bc72a3b8dcc1a19b649ed53bed725b
Instruction ID: 112b51a9e9df8e17a4da5f6e900801004be0aa4b1eb9ffde17c4bbe6ab169035
Opcode Fuzzy Hash: bfc86eb3975069c3503e58b30f01c7fa03bc72a3b8dcc1a19b649ed53bed725b
Instruction Fuzzy Hash: 2B51AE34A043C99FFB21CF58C884B897BE4EF063C4F11859AE8A59B29AD370DD85CB11

Function 100096E4 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000002,00000000,00000000), ref: 100097AB

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 018c6b6fc8cfa1e5fd6981127b514c99a21702c1938d837151f9b58f2bca6904
Instruction ID: 1da450f8c3b8c9d4468de0c4ede5f192845efbfc5bac6160383af9ab42e74039
Opcode Fuzzy Hash: 018c6b6fc8cfa1e5fd6981127b514c99a21702c1938d837151f9b58f2bca6904
Instruction Fuzzy Hash: E2518E71904258EFEB11CF68C884A9D7BF4FF467C0F21C1A9E9199B259DB70DA80DB60

Function 00401369 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe,00000000,00000104), ref: 0040141D
GetLastError.KERNEL32 ref: 00401427

Strings

C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe, xrefs: 0040137C

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
API String ID: 1375471231-2452780512
Opcode ID: 6d5a5c38fac08dcdb88923f3b64a5fdc813761319cec5d26508c13ca6c91abe2
Instruction ID: f6158145c072bfd1161d14a966cb37a0d493e4c537f281356958d61a106ee023
Opcode Fuzzy Hash: 6d5a5c38fac08dcdb88923f3b64a5fdc813761319cec5d26508c13ca6c91abe2
Instruction Fuzzy Hash: FE21D672900314A9EF306BA0EC45BD777A89F00318F10457FE955F61F2EBB899848B5A

Function 0040501B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?), ref: 0040504A
GetTempFileNameW.KERNEL32(?,tmp,00000000,00000000), ref: 00405065

Strings

tmp, xrefs: 0040505F

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: tmp
API String ID: 3285503233-753892680
Opcode ID: 60ddd8d863f0bb8c70083f10fc5c7d9ade46887357d609d095e69c8898780b87
Instruction ID: f7f4ea0963ff9731c5d172acee9a0c7bf278b3c5608c23117a7ff17804f99f7c
Opcode Fuzzy Hash: 60ddd8d863f0bb8c70083f10fc5c7d9ade46887357d609d095e69c8898780b87
Instruction Fuzzy Hash: 30F082B290021CBBDF109B54DC49FEA77BCBB54308F0045B5BA14E51A1EAB4AAC98F64

Function 1000A4F3 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000060,?,00000000,1000A2BB,?,10002B52,?,100059AD,10002B52,00000001,10002B52), ref: 1000A51B
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1000A2BB,?,10002B52,?,100059AD,10002B52,00000001,10002B52), ref: 1000A54F
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,1000A2BB,?,10002B52,?,100059AD,10002B52,00000001,10002B52), ref: 1000A569
HeapFree.KERNEL32(00000000,?,?,00000000,1000A2BB,?,10002B52,?,100059AD,10002B52,00000001,10002B52), ref: 1000A580

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: e7d53fcb432b193359c2d3c762577acfbdeebbc602f74a7539a784fa40f94b59
Instruction ID: f9b9bca051faa4c4395142488475ca9e6f1505f6ac6d4a224501308950da0d18
Opcode Fuzzy Hash: e7d53fcb432b193359c2d3c762577acfbdeebbc602f74a7539a784fa40f94b59
Instruction Fuzzy Hash: C2118C71600621AFF329CF18CCC49967BB6FB857A1B148719F151D25B4C772D882CF50

Function 00410188 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00000000,0040FF50,00000000,?,?,?,0040D7E0), ref: 004101B0
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0040FF50,00000000,?,?,?,0040D7E0), ref: 004101E4
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,0040D7E0), ref: 004101FE
HeapFree.KERNEL32(00000000,?,?,0040D7E0), ref: 00410215

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: d4ebb6c3055726f3e021de0e7be60e321f02a85c7d07cb7f3145eaf994726d18
Instruction ID: 4c941d701b1655fced5b36d5e2eaff67646d118412ca2d9b6e582d9a56b3a414
Opcode Fuzzy Hash: d4ebb6c3055726f3e021de0e7be60e321f02a85c7d07cb7f3145eaf994726d18
Instruction Fuzzy Hash: 7F119170302200AFD7718F58EC89D9A7BF6FBA87507918A7DF151C65B0CB789886CB08

Function 00404A39 Relevance: 4.6, APIs: 3, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(00000000,00000014), ref: 00404A66
LoadLibraryA.KERNEL32(?,?,00000001), ref: 00404A82
GetProcAddress.KERNEL32(?,?), ref: 00404AFB

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AddressLibraryLoadProcRead
String ID:
API String ID: 1160701153-0
Opcode ID: eb3855e5d68afdffa96e803db3e488d9ef4465284e0f3de40d703cb68a80ee15
Instruction ID: aa789371ac22be00fab353384b8dba6d33eb928b8a5bf093cb3fac925c739874
Opcode Fuzzy Hash: eb3855e5d68afdffa96e803db3e488d9ef4465284e0f3de40d703cb68a80ee15
Instruction Fuzzy Hash: 99319CB26042069FD710CF19C844B26B7F8FB85311F19853EEA519B390D778E809CBA9

Function 0040F8F2 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0040F8DD,?,00000000,00000000,0040D858,00000000,00000000), ref: 0040F907
TerminateProcess.KERNEL32(00000000,?,0040F8DD,?,00000000,00000000,0040D858,00000000,00000000), ref: 0040F90E
ExitProcess.KERNEL32 ref: 0040F98F

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fff0bef1090f52581fa5e801765930f7ae85e464ff4ad9afd2056aa9f12b3acd
Instruction ID: b875da6c4a052fcc968e6b1edeaeb8b5d698a395de6a0a9d8143f0f48acd8947
Opcode Fuzzy Hash: fff0bef1090f52581fa5e801765930f7ae85e464ff4ad9afd2056aa9f12b3acd
Instruction Fuzzy Hash: 7101E5B2304251BFD730AB65FC45F5A7B94AB90710BA1403FE050629E1CB7C988A8B5D

Function 00401058 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040105D

Strings

C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe, xrefs: 00401069

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: H_prolog
String ID: C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
API String ID: 3519838083-1954932391
Opcode ID: cfbaaa1b22c554bb31573ec703c7fd45f6d8fef36d6f38fbc9d3c5fcd145bfda
Instruction ID: e4318dac4722833bd1ff42220be8e7e7d42a1610d27cf0ebc6c5280c9fdf8d93
Opcode Fuzzy Hash: cfbaaa1b22c554bb31573ec703c7fd45f6d8fef36d6f38fbc9d3c5fcd145bfda
Instruction Fuzzy Hash: 2831747290021CAADF11DB50CC85ADE77B9FF48354F0045B7FA08E6291DB399A958B94

Function 00402974 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402979

Strings

C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe, xrefs: 0040298A

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: H_prolog
String ID: C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
API String ID: 3519838083-2452780512
Opcode ID: 4103c638aac2f931a59fb28560d504d7b0f24a04c04ce5252aae75c0725a5ff7
Instruction ID: 704933a26061435bf67265672d9d4c74204cce8f33d6def4ef8f726a9b403be0
Opcode Fuzzy Hash: 4103c638aac2f931a59fb28560d504d7b0f24a04c04ce5252aae75c0725a5ff7
Instruction Fuzzy Hash: FA3186B290011D6ADF20AB91CD89BDB777DAB14344F0044B7AA09F3181D6785A888FA9

Function 10002C82 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?), ref: 10002D19

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 10002CDF, 10002CE4, 10002CF3, 10002CFE

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: DeleteFile
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 4033686569-2885122082
Opcode ID: d3a1f1d499eb310ac9aae2e4afc16f8a77a404a22cbdc6eb422138bc75621a17
Instruction ID: 92d17fa0b14a5af7329250172c5805927784a4bb7c7694fb9111e74194b93865
Opcode Fuzzy Hash: d3a1f1d499eb310ac9aae2e4afc16f8a77a404a22cbdc6eb422138bc75621a17
Instruction Fuzzy Hash: BD014C3A64061137F521E2345D4BF9F268EDF812E6F614426FD087E28FADAABD8100B5

Function 10002BE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 10002C77

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 10002C3D, 10002C42, 10002C51, 10002C5C

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: DeleteFile
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 4033686569-2885122082
Opcode ID: 159033949d6d254564c68fa4ed14517349e41e72de2d5e47a14f798df58b5e7e
Instruction ID: 69db9cab23b1fa9cd104ceeaaf3f448452a4a73fd5dc0a516e68a03c6d391f32
Opcode Fuzzy Hash: 159033949d6d254564c68fa4ed14517349e41e72de2d5e47a14f798df58b5e7e
Instruction Fuzzy Hash: 5301283A1406213AF521E2345D4FFAF368DDF812E7F510515FD487A28FADAABC8500A5

Function 00404CC9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000,00405B0D,?), ref: 00404D60

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00404D26, 00404D2B, 00404D3A, 00404D45

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: DeleteFile
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 4033686569-2885122082
Opcode ID: ebf798424b031ede0e6352213d8cbf8d4c2279d9fef084fffa65cda67b932e63
Instruction ID: 389f95961ebf70c1e5a1c39805fcc405ecefc2c21d2d8b8def11a56da08309aa
Opcode Fuzzy Hash: ebf798424b031ede0e6352213d8cbf8d4c2279d9fef084fffa65cda67b932e63
Instruction Fuzzy Hash: AD01D2B2A4122036D62132B56C47F9F16588FD1765F21053BFE04762D3AD7D6C4640AE

Function 10002761 Relevance: 3.1, APIs: 2, Instructions: 75networkCOMMON

Download Yara Rule

APIs

Part of subcall function 100025B9: GetEnvironmentVariableW.KERNEL32(?,?,00000104), ref: 10002647
Part of subcall function 100025B9: CopyFileW.KERNEL32(?,?,00000000), ref: 100026BA
Part of subcall function 100025B9: LoadLibraryW.KERNEL32(?), ref: 100026C6

gethostbyname.WS2_32(?), ref: 100027C5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000104), ref: 1000280E

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ByteCharCopyEnvironmentFileLibraryLoadMultiVariableWidegethostbyname
String ID:
API String ID: 1796540264-0
Opcode ID: 21b1d34c230ec8cde792df6b250d6c805b2cb3f97d722041a91c2ecf82f0f2ab
Instruction ID: 4bf55e3d8553a2f2db0d4677d9c9547ac1be228fa81fd252a7f26e60b6d1d960
Opcode Fuzzy Hash: 21b1d34c230ec8cde792df6b250d6c805b2cb3f97d722041a91c2ecf82f0f2ab
Instruction Fuzzy Hash: 912160796403487FFB20CF64CC92FD977AAEB14744F008465BB08AB2D1D6B1AAA48B10

Function 00404902 Relevance: 3.1, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,00004000,00000000,?,00000001,00000000,00000000,?,0040481D), ref: 0040494F
VirtualProtect.KERNEL32(?,?,00000000,0040481D,00000000,?,00000001,00000000,00000000,?,0040481D), ref: 0040499C

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: b37fded90a9ee95ef88d2e65fd03ae813906012dff82cfeda412e0bc88bdd011
Instruction ID: 23a1a8aed7d365f4658076222b0a7de0e3986e2618b3570fee8ed56a7c62751d
Opcode Fuzzy Hash: b37fded90a9ee95ef88d2e65fd03ae813906012dff82cfeda412e0bc88bdd011
Instruction Fuzzy Hash: DA21CCB19002049FDB08CB09D998BBB7BA5EB84305F0141ADEA466B2E5C738AD15CBA5

Function 10009959 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,10009731,00000000,00000000,00000002,00000002,00000000,00000000), ref: 10009983
GetLastError.KERNEL32 ref: 10009990

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 6aca38a825f181dc59ce418a07435b041ad8d9af8aa50f7243897de5077f33c8
Instruction ID: 502b574fdaf890ed0d67a85e2c542a07d9da45366fc76386cc3438d010d73362
Opcode Fuzzy Hash: 6aca38a825f181dc59ce418a07435b041ad8d9af8aa50f7243897de5077f33c8
Instruction Fuzzy Hash: F1F0F4362156228AE610CB7D9C4868D3698EB863F1F21071DF661DB1E9DF31D8418352

Function 00412322 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000100,00000000,00000000,00000100,00000000,00414DE4,00000000,000000FF,00000002), ref: 0041234C
GetLastError.KERNEL32 ref: 00412359

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7c0bcaa50f10cde8f29df42a8ff8e050c4b1dad4583fe5032ce29c40b013c853
Instruction ID: cc9df2705e7d246d2e90aa0eed58d2a4bd7cfb1ff8d24d51888191b61044b12d
Opcode Fuzzy Hash: 7c0bcaa50f10cde8f29df42a8ff8e050c4b1dad4583fe5032ce29c40b013c853
Instruction Fuzzy Hash: E4F02D3221461597CA105B78DD049DE3758AF85334F21075FF971C72E1DFBCC9A2825A

Function 10009442 Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,10005B3A,00000001), ref: 10009453

Part of subcall function 10009E56: HeapAlloc.KERNEL32(00000000,00000140,10009467), ref: 10009E63

HeapDestroy.KERNEL32 ref: 10009471

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: e66e29cdc271b43ae1db77c560582d15898b65baeb39c63ad38d1afc6279ffb6
Instruction ID: f4472f837166203d5add59c709619122e036c8906bcc8431ca6e634266941605
Opcode Fuzzy Hash: e66e29cdc271b43ae1db77c560582d15898b65baeb39c63ad38d1afc6279ffb6
Instruction Fuzzy Hash: 29E05B713543519EFB548F708C49B6535D5FB447C2F018435F945C40BCF7B1C8909501

Function 0040FAAF Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,0040D7CE,00000001), ref: 0040FAC0

Part of subcall function 0040FAEB: HeapAlloc.KERNEL32(00000000,00000140,0040FAD4), ref: 0040FAF8

HeapDestroy.KERNEL32 ref: 0040FADE

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 60bc7874c0892740f5bf3f5d23c2057e67fbe65029b361d713d5196f1f0ec72a
Instruction ID: 2b69f0e4cf7586cf50728afc9d602f6943fc834738f0166ecf41d45cdcb92224
Opcode Fuzzy Hash: 60bc7874c0892740f5bf3f5d23c2057e67fbe65029b361d713d5196f1f0ec72a
Instruction Fuzzy Hash: 15E012B13113016AEF205B31AC0976B37D59B487D2F10C83AF944D41E0EF7884419E18

Function 00401EBE Relevance: 3.0, APIs: 2, Instructions: 12threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00401DF4: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000104), ref: 00401E35

GetCurrentThread.KERNEL32 ref: 00401ECD
TerminateThread.KERNEL32(00000000), ref: 00401ED4

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Thread$ByteCharCurrentMultiTerminateWide
String ID:
API String ID: 3738390375-0
Opcode ID: b1bf82b93590effd6c2570a3584d88b96098e56c4bf512450ae0f0fa54bc6cdc
Instruction ID: d81fb3dfb365e8c97b2ab233d75ed44bed5dac9a058e1f322600a32016f706a0
Opcode Fuzzy Hash: b1bf82b93590effd6c2570a3584d88b96098e56c4bf512450ae0f0fa54bc6cdc
Instruction Fuzzy Hash: 52C08C721021306FC60077A9ED0D8CB7E38EF183D2302843EFA0081170CF344845D6A8

Function 00404855 Relevance: 2.6, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,39665300,00001000,00000004,00000000,00000000,?,00401C84,00000000), ref: 004048AB
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000000,00000000,?,00401C84,00000000), ref: 004048CC

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b43f2ccb3bde99bede24ae8d0d1ab885cc3ccf2a476ff53ea6ce85554c0f209f
Instruction ID: 18aeadbba4ee41183083de854a9585785ae68afd4d8615a9ec6745384b5827e2
Opcode Fuzzy Hash: b43f2ccb3bde99bede24ae8d0d1ab885cc3ccf2a476ff53ea6ce85554c0f209f
Instruction Fuzzy Hash: 7E214CB6D00204EFDB10DF99C881F6AB7F8EF44304F10846AEA40AB391D374EA50DB54

Function 10007C91 Relevance: 2.6, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000100,1000B9B1,10007C69,1000B9B1,1000B9B1,00000100,00000000,1000B9B1,00000000), ref: 10007CCB
GetLastError.KERNEL32 ref: 10007CD5

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 4e6753dfeec659a6515f133fdc6bdf11e0025ebb5b9536e45a1ad1cdded0c35e
Instruction ID: 1c43c5bac7add92881f3f25639eb8cc538f19979ff9e5f32e8d22aa856e4c6da
Opcode Fuzzy Hash: 4e6753dfeec659a6515f133fdc6bdf11e0025ebb5b9536e45a1ad1cdded0c35e
Instruction Fuzzy Hash: CF014236A0592292F620DB396C48EAA2394EF813F1B26012EF428D71CDDE28EC814121

Function 004107E7 Relevance: 2.6, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000100,00414E02,004107BF,00414E02,00414E02,00000100,00000000,00414E02,00000000), ref: 00410821
GetLastError.KERNEL32 ref: 0041082B

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 15489ded154256aa0314b293602dccbd2caaddf08e040c775c46227e2981354c
Instruction ID: 12507beaab73c8a92fdd184a0b995e36fd4d4dad8fe1e0d9cbcd53ee81901129
Opcode Fuzzy Hash: 15489ded154256aa0314b293602dccbd2caaddf08e040c775c46227e2981354c
Instruction Fuzzy Hash: 4601263311911095C620767AAC09AEF66189FC1374F2A062FF460CB2C1EEBCC8C280EE

Function 10002541 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10002546

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6605e5c714a23395e6ca3157e090a76eaeb6092df434bf0686e534e85d830608
Instruction ID: 4e0bfbd715a92d40728436efd5e79f459a0278b0f7339945bf44ab8902b67496
Opcode Fuzzy Hash: 6605e5c714a23395e6ca3157e090a76eaeb6092df434bf0686e534e85d830608
Instruction Fuzzy Hash: CCF06D34900189EFEF15DF50C891AED7731FF143C0F0005AAB4A5661A9DB75AE99EB10

Function 1000666B Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10002B43,?,?,1000664F,000000E0,100059AD,10002B52,00000001,10002B52), ref: 100066B0

Part of subcall function 10007128: InitializeCriticalSection.KERNEL32(00000000,?,10002B52,?,10006680,00000009,?,?,1000664F,000000E0,100059AD,10002B52,00000001,10002B52), ref: 10007165
Part of subcall function 10007128: EnterCriticalSection.KERNEL32(10002B52,10002B52,?,10006680,00000009,?,?,1000664F,000000E0,100059AD,10002B52,00000001,10002B52), ref: 10007180

Part of subcall function 10007189: LeaveCriticalSection.KERNEL32(?,1000661B,00000009,10002B52,10007174,00000000,?,10002B52,?,10006680,00000009,?,?,1000664F,000000E0,100059AD), ref: 10007196

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitializeLeave
String ID:
API String ID: 495028619-0
Opcode ID: a124ef6f470b63a908ed55005ccaba26b7c42fa01b9ece875ac1777e8becf4c0
Instruction ID: 0942ba4c2885353f4566518416193bf04d26edd6df8c11a2adb540413f6f63ff
Opcode Fuzzy Hash: a124ef6f470b63a908ed55005ccaba26b7c42fa01b9ece875ac1777e8becf4c0
Instruction Fuzzy Hash: 34E02B33E4063066F501E2585C41BCA3696EB857E1F260110FD487B1DEDAB27C8141D0

Function 0040D277 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0040D25B,000000E0,0040D248,?,0040F7D8,00000018,00000000,?,?,004136EB,00000009), ref: 0040D2BC

Part of subcall function 0040F7B8: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F7F5
Part of subcall function 0040F7B8: EnterCriticalSection.KERNEL32(?,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F810

Part of subcall function 0040F819: LeaveCriticalSection.KERNEL32(?,0040D29B,00000009,?,00000009,00000000,?,0040D25B,000000E0,0040D248,?,0040F7D8,00000018,00000000,?), ref: 0040F826

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitializeLeave
String ID:
API String ID: 495028619-0
Opcode ID: d8f5ebb994ff6751785fd5dd1168b9b2bd6fb01eff549f90315b4ca8e928cb60
Instruction ID: 18341a33d7748c63d1a54db78d9972d0c2dab86d02ebf2be6c965773c7472506
Opcode Fuzzy Hash: d8f5ebb994ff6751785fd5dd1168b9b2bd6fb01eff549f90315b4ca8e928cb60
Instruction Fuzzy Hash: F7E0E533E4192067C5313268AC02FCB22049B90760F2A017AFD043B2D1EBB99C0A01DD

Function 0040D2C5 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040F7B8: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F7F5
Part of subcall function 0040F7B8: EnterCriticalSection.KERNEL32(?,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F810

RtlFreeHeap.NTDLL(00000000,?,?,0040F804,00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074), ref: 0040D305

Part of subcall function 0040F819: LeaveCriticalSection.KERNEL32(?,0040D29B,00000009,?,00000009,00000000,?,0040D25B,000000E0,0040D248,?,0040F7D8,00000018,00000000,?), ref: 0040F826

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitializeLeave
String ID:
API String ID: 1934031791-0
Opcode ID: abf12e635248a913374f4e699008c282f403e7966ff102dbaa17fb56d7602904
Instruction ID: b62db35f07bedd583dbab6a1794776c129a564cf2fc88aebb07114b1f3df1ac8
Opcode Fuzzy Hash: abf12e635248a913374f4e699008c282f403e7966ff102dbaa17fb56d7602904
Instruction Fuzzy Hash: CDE0D83250212029E4303261BC26FCB2B089F41B28F09447FF504364D1DEB8584944AA

Function 10002A88 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 10002A96

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8c5c1e3144b280ec424f8760fa683ce219e3bc8bc87b2e2ac0836760bfc627cf
Instruction ID: e7b2c27c3066a66a1e335c951f1cd26fe229dda2a60edd01389849d2b6cec8b2
Opcode Fuzzy Hash: 8c5c1e3144b280ec424f8760fa683ce219e3bc8bc87b2e2ac0836760bfc627cf
Instruction Fuzzy Hash: 26D022AB90C2800EFE10E770D84ACD63B5CDF022E43020C4AF020AF028DE24F885862D

Function 00401DF4 Relevance: 1.3, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000104), ref: 00401E35

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: c0f6835731fd1eea5426c0defd6449a2a839c54598c13acd97ac2cc972fee249
Instruction ID: f98c89c02a6e3b81cb18550de75389c9a1836c0a54d5ec48ea77f014a7d584b8
Opcode Fuzzy Hash: c0f6835731fd1eea5426c0defd6449a2a839c54598c13acd97ac2cc972fee249
Instruction Fuzzy Hash: A7219271A00114BFDB209B64DC88EEB3779FF49354F504269F915AB2E1CB719C46CB94

Function 1000B20A Relevance: 1.3, APIs: 1, Instructions: 56memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000000,100089C6,00000001,00000074,?,1000AD29,00000000,?,00000000,?,10007016,00000000), ref: 1000B25F

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 1a2534760b87700af9a20506a247ae1a3783fb516e94bb58213d7ab5230ec3e5
Instruction ID: 230f29dcab697d8115d35d1c1f3a4268e90e38ad0d77f379f36a11c98e9109b0
Opcode Fuzzy Hash: 1a2534760b87700af9a20506a247ae1a3783fb516e94bb58213d7ab5230ec3e5
Instruction Fuzzy Hash: 6501FC37E01E2066F252EE281C81B9F2395EBC66F1F160235FD54BB2DEDA719C454191

Function 004136B5 Relevance: 1.3, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,?,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0041370A

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 6b805033be3dfd8aec8fba2a50e8b39a3f510794c423120b97b6b830a73cba6c
Instruction ID: 0405488357d01b0d7d33f173714abb77fa443cb2f0d55b1e9c3abf510c1fdeb8
Opcode Fuzzy Hash: 6b805033be3dfd8aec8fba2a50e8b39a3f510794c423120b97b6b830a73cba6c
Instruction Fuzzy Hash: FC0168B360161076D6312A252D81BEB22459BD17B6F1A8237FDA4373D2D73C4D8541AE

Non-executed Functions

Function 004159BF Relevance: 26.7, Strings: 21, Instructions: 417COMMON

Download Yara Rule

Strings

+, xrefs: 00415A91
0, xrefs: 00415C2D
1, xrefs: 00415C37
0, xrefs: 00415C5E
0, xrefs: 00415B60
E, xrefs: 00415AA9
0, xrefs: 00415AE9
e, xrefs: 00415AB7
-, xrefs: 00415A96
9, xrefs: 00415C40
C, xrefs: 00415AA0
9, xrefs: 00415AD4
0, xrefs: 00415A9B
-, xrefs: 00415BBD
9, xrefs: 00415A2E
9, xrefs: 00415A80
9, xrefs: 00415C50
+, xrefs: 00415BB4
1, xrefs: 00415C04
9, xrefs: 00415C0C
c, xrefs: 00415AAE

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$C$E$c$e
API String ID: 0-1157002505
Opcode ID: fd718a4b1d25891a9623ba093a2e368119ea61908d8e7ede695203f28c067b3a
Instruction ID: 7a40ff32b27998bf451d3fd510ff84ae5c4565cd2c8181801484e1d527ceae2d
Opcode Fuzzy Hash: fd718a4b1d25891a9623ba093a2e368119ea61908d8e7ede695203f28c067b3a
Instruction Fuzzy Hash: E1E1F231E95A09DEEB248F64D9853FE7BB1FB80344F68411BD401E6281E37C89C2CB59

Function 00412794 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040F7B8: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F7F5
Part of subcall function 0040F7B8: EnterCriticalSection.KERNEL32(?,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F810

Part of subcall function 0040F819: LeaveCriticalSection.KERNEL32(?,0040D29B,00000009,?,00000009,00000000,?,0040D25B,000000E0,0040D248,?,0040F7D8,00000018,00000000,?), ref: 0040F826

GetTimeZoneInformation.KERNEL32(0000000C,00428674,00000001,74DEE860,0000000B,0000000B,?,00412785,00412FB0,00428674,00000001,74DEE860,?,00412C55,?,0040DFD0), ref: 004127E2
WideCharToMultiByte.KERNEL32(00000220,0042713C,000000FF,0000003F,00000000,?,?,00412785,00412FB0,00428674,00000001,74DEE860,?,00412C55,?,0040DFD0), ref: 00412878
WideCharToMultiByte.KERNEL32(00000220,00427190,000000FF,0000003F,00000000,?,?,00412785,00412FB0,00428674,00000001,74DEE860,?,00412C55,?,0040DFD0), ref: 004128B1

Strings

D'B, xrefs: 004128C4, 004129F7, 00412A05

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CriticalSection$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
String ID: D'B
API String ID: 3442286286-3401936599
Opcode ID: ca0169f396f97780d5b4c72c5dba751821852e5422b26609a54334435c35daf0
Instruction ID: bac85999667ab6fa4acd2a44ad9f7cf65d16d5179dd343f0d8393dd61ed5ec0b
Opcode Fuzzy Hash: ca0169f396f97780d5b4c72c5dba751821852e5422b26609a54334435c35daf0
Instruction Fuzzy Hash: A5612271B08141ABCB359F28AE41BA63BA8FB41314FA4013FE481D72A1D7F849E3971D

Function 00401CB0 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 0040B8D2: GetSystemTime.KERNEL32(?,?,?,00401CF7,?,?,?,00424D98,00000104), ref: 0040B8DC

GetAdaptersInfo.IPHLPAPI(00000000,00000280), ref: 00401D66
GetAdaptersInfo.IPHLPAPI(00000000,00000280), ref: 00401D8B
inet_addr.WS2_32(000001B0), ref: 00401DA1
inet_addr.WS2_32(000001C0), ref: 00401DB0

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AdaptersInfoinet_addr$SystemTime
String ID:
API String ID: 3486824068-0
Opcode ID: c70e5440fa235b82c573284c17a60fb24bf1905bdb5251d572d8fe752cd7b3c1
Instruction ID: 54e8c12d576ca6b7caf344530300b328f00db62220261b197ce77c557f6b5e8a
Opcode Fuzzy Hash: c70e5440fa235b82c573284c17a60fb24bf1905bdb5251d572d8fe752cd7b3c1
Instruction Fuzzy Hash: 9D317076900205ABDB20EFE1C8C19EE73B9AF05315F10847FE901BB291DB78EA458B58

Function 00404D6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(CO@,?), ref: 00404D7E
FindClose.KERNEL32(00000000), ref: 00404D8E

Strings

CO@, xrefs: 00404D7B

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: CO@
API String ID: 2295610775-2359359697
Opcode ID: 59c2e92a5655e99502496943e2282ba4184573f97bf7188561b506f46f133912
Instruction ID: 7997a3ce03a6632c997954cbab8bd1add13e5a71e7a97ac9a76e5e9aed3183c9
Opcode Fuzzy Hash: 59c2e92a5655e99502496943e2282ba4184573f97bf7188561b506f46f133912
Instruction Fuzzy Hash: A6D0A7704005086BCF105F74EC8D4E63BAD9B44379F004264E921D21E0C730C959A9B8

Function 00406550 Relevance: 1.9, Strings: 1, Instructions: 695COMMON

Download Yara Rule

Strings

o*@, xrefs: 00406550

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID: o*@
API String ID: 0-2776488119
Opcode ID: fdbe7896ae568621a81b7b57c219c87215e5e3eda7b1a3e510c3e11f171588a1
Instruction ID: c8492ed10934067126d3085e3c6eb2a05f8fc1d052168f2954518de5219e02b6
Opcode Fuzzy Hash: fdbe7896ae568621a81b7b57c219c87215e5e3eda7b1a3e510c3e11f171588a1
Instruction Fuzzy Hash: 6E523470200A019FD734CF29C580A26B7F1FF55704B158A2ED89797B82D738F86ACB69

Function 0040A3BD Relevance: 1.6, Strings: 1, Instructions: 362COMMON

Download Yara Rule

Strings

o*@, xrefs: 0040A3BD

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID: o*@
API String ID: 0-2776488119
Opcode ID: 7fdfc5674a3c395f318b755db5e5700b5c8da01c6adf705441184529230558f0
Instruction ID: cf0970e7dc5844527f2f93088e04cf856841487182f7d5d4fd2575ea2e9c4145
Opcode Fuzzy Hash: 7fdfc5674a3c395f318b755db5e5700b5c8da01c6adf705441184529230558f0
Instruction Fuzzy Hash: 15F19D761092418FC7058F14C8D89F57BE5EFA8324B2F82FAC8599F3A2D3319981CB56

Function 004035D5 Relevance: 1.6, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

, xrefs: 004039C0

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-3916222277
Opcode ID: cc39de3b1a29dd1e753ec60d2152355b3287580950938171bad13ad8d4974699
Instruction ID: b62d34e8ca2a58c9b409f4ce41911bd90675e303d7a92e3c551e2aef61e422ab
Opcode Fuzzy Hash: cc39de3b1a29dd1e753ec60d2152355b3287580950938171bad13ad8d4974699
Instruction Fuzzy Hash: F7D1C0B15006499FDB28CF29C4806EA7BE9EF48315F14C43FE95AAB281D778A745CB18

Function 0040A8DB Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

o*@, xrefs: 0040A8DB

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID: o*@
API String ID: 0-2776488119
Opcode ID: 9629e07ad3a23c31d4a4c507b061c531e8fcf7d54b7483547e05af43629d42f6
Instruction ID: d3c5ef61e98080039596287ab7779ad48eb6a6bdcd7fd59c12b1c1b6b4b4b1ea
Opcode Fuzzy Hash: 9629e07ad3a23c31d4a4c507b061c531e8fcf7d54b7483547e05af43629d42f6
Instruction Fuzzy Hash: D1C15CB62082518FC7098F18C5D88F57BB5FF98314B2E82F9C94A5F3A2D371A981CB55

Function 0040B8D2 Relevance: 1.5, APIs: 1, Instructions: 19timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,00401CF7,?,?,?,00424D98,00000104), ref: 0040B8DC

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 26923415602c39bdce9042173864df5b857c09fa3b62b70609fd367192be0909
Instruction ID: 5b5284f3accbc16899fd182256fc60eb3f5370fc130b0bc18d9cf5fb0b9f1a2f
Opcode Fuzzy Hash: 26923415602c39bdce9042173864df5b857c09fa3b62b70609fd367192be0909
Instruction Fuzzy Hash: 74E0E5B490020DDFCF08DF94C8848ADBBB8BB08304B008069E515A7350DB34A904CB64

Function 1000BA64 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000BA1E), ref: 1000BA69

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: da60e90880c41934350f99a2307c6ae7985fed395fc1f87130ece117c1b3260c
Instruction ID: e74182e0a3c4a19c261303c78882b0aea27feb6a69fdaed8c5c719b8bfcbd79b
Opcode Fuzzy Hash: da60e90880c41934350f99a2307c6ae7985fed395fc1f87130ece117c1b3260c
Instruction Fuzzy Hash: 29A002B85026619BFB4C9FB58C895CC3AE0FB493A2F008469EB41E222CDB305470DF52

Function 00411746 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00011700), ref: 0041174B

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e2bfd412b76bae2984f3f33c5c26d48bc328b691bc86d04d53dbb007f9897de1
Instruction ID: 4f88e08222042b02ca5e58d0153aaa38bd4941cc0e458ae2a1781b23ef335445
Opcode Fuzzy Hash: e2bfd412b76bae2984f3f33c5c26d48bc328b691bc86d04d53dbb007f9897de1
Instruction Fuzzy Hash: 9AA002B5646300DBCB115FA1BE095843B60A7457F3B52D07AEE51813B8DF7900869F1D

Function 1000BA76 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 1000BA7B

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e7f75223f19c17c1f8635fb674e80c5fccc611b0be8749e2d318314e68517e21
Instruction ID: 2cb8f8d43ab8341b38dc9022f785d75d96dc348357102a32110e8122763c71d2
Opcode Fuzzy Hash: e7f75223f19c17c1f8635fb674e80c5fccc611b0be8749e2d318314e68517e21
Instruction Fuzzy Hash:

Function 00411758 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0041175D

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 16399e27035b4216d1d49b9e2c69565b7dbf4b95767e74660e1280de2fe6a825
Instruction ID: 846f3daf239d59d0f3b999c64deea7e8ed28fef8115a8682c9cff1e9468243e4
Opcode Fuzzy Hash: 16399e27035b4216d1d49b9e2c69565b7dbf4b95767e74660e1280de2fe6a825
Instruction Fuzzy Hash:

Function 00404069 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

, xrefs: 00404207

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-3916222277
Opcode ID: 07de6a45d12827bada51b8c62a929caaf6827b4f763e0a9a6a9521a6f6e2564f
Instruction ID: a8fd5b00e422921a4810eb9676bbc095d2e2d0a1f74c7c47d296ed23bdbcb651
Opcode Fuzzy Hash: 07de6a45d12827bada51b8c62a929caaf6827b4f763e0a9a6a9521a6f6e2564f
Instruction Fuzzy Hash: E081B2B5A002499FCB05CF69C4809EEBBF1EF89314F1480AEE559EB352D634EA45CF58

Function 004042F0 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

, xrefs: 00404494

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-3916222277
Opcode ID: c1511bd0c8770e08a0ea41fa7c3abce3fb5a631a81c73275da93a9f90e3d2e51
Instruction ID: 210e419feffe7ae8fe5d67e4afa69908a4be552131fcc5cb378c83bbdd227617
Opcode Fuzzy Hash: c1511bd0c8770e08a0ea41fa7c3abce3fb5a631a81c73275da93a9f90e3d2e51
Instruction Fuzzy Hash: 4F81B175A002489FCB05CF68C480AEEBBF5EF89318F24806EE559E7352D634AA55CF54

Function 0040866E Relevance: .9, Instructions: 916COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7687e97c64ed50e4283743cd4c7f435c3b403562f7e94877b51a9eb223645143
Instruction ID: 5fe9dd86b02d7d751ab855177b5b112a357d4b54f978e1ceb6792171e5ea2880
Opcode Fuzzy Hash: 7687e97c64ed50e4283743cd4c7f435c3b403562f7e94877b51a9eb223645143
Instruction Fuzzy Hash: E0825B71A00605DFCB24CFA8CA906AEBBF2FF44314F14456ED482A77D1DB78AA85DB44

Function 00407E7F Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f0c90f2aabcbae6e7b2b57a3009e96eefef9ddf6974b9e37fc60db4b39574d
Instruction ID: 731dc392cb9b640d91678dbff7036c970d93ae30cee7d5ba15d98b73a44ba6c8
Opcode Fuzzy Hash: f7f0c90f2aabcbae6e7b2b57a3009e96eefef9ddf6974b9e37fc60db4b39574d
Instruction Fuzzy Hash: AB327B70A04705DFDB24CF69C98066ABBF2FF54304F14857ED886A7392DB39AA45CB48

Function 004039DA Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e356e33d35281ad90930b46335b016b8e6e083e8de737c30692d3a1a0f09bf93
Instruction ID: c884a945cb9aeb6c66c38d18ffd164f97e9f24d3b013d654c7b349e826d78007
Opcode Fuzzy Hash: e356e33d35281ad90930b46335b016b8e6e083e8de737c30692d3a1a0f09bf93
Instruction Fuzzy Hash: A9B1AF75A191C59EDB05CFB984A04EAFFF2AF4E20074ED6EAC5D8AB313C530A605C794

Function 00403D17 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b193a79c10ab1ef82c7d7d121995fda310db13f1d2a83f85b22ee7ef5de2d008
Instruction ID: 6954941a9402ce2fb8904419fa0ce0908b8cc3de2b52907dabb8f9428c8b5c49
Opcode Fuzzy Hash: b193a79c10ab1ef82c7d7d121995fda310db13f1d2a83f85b22ee7ef5de2d008
Instruction Fuzzy Hash: 81B18E35A081D59EDB05CFB984904EAFFF3AF8E204B4EC2E6C998AB312C5706615C794

Function 1000A69F Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 754a44b372b380c23ae24bf4ed424f9b4114d4bc42bbcdb81ae2a783c1755291
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 27B16C35A0024ADFEB15CF04C5D0A98BBE1FB49358F25C2ADD8595B386D731EE86CB90

Function 00410334 Relevance: .3, Instructions: 259COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 84d1b603a421c56570a5ac6b4e09178991cd8bc7202d86f7cc5cf634adb95260
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: E2B16B7590020ADFDB25CF04C5D0AE9BBA1BF58318F24C19ED95A5B342C775EE82CB94

Function 0040AECE Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3430db1d9f8a6228101d62a8065e73749940f66ed247ec47a898fa2d2bd510a
Instruction ID: cf87a71cd981ae1b0bbb94abe23ccb71446de01f4929d75b65902012915092b9
Opcode Fuzzy Hash: a3430db1d9f8a6228101d62a8065e73749940f66ed247ec47a898fa2d2bd510a
Instruction Fuzzy Hash: 827110716541998BCB2CCF68ECF16A637A1FB5E300B06C43EDA26C7291D774A522CB48

Function 0040B965 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf268516a2157e3c5b1edc10c3384df3deabb20c418a1a20615e134fc864775c
Instruction ID: 1a3213f8fd8969cd3c78d9e71a515505116e37426b332b17603b1e7f3b8446f0
Opcode Fuzzy Hash: cf268516a2157e3c5b1edc10c3384df3deabb20c418a1a20615e134fc864775c
Instruction Fuzzy Hash: 54515E76F002049FDB08CE5EC8916AEB7F6EBD8324F28C16AE404EB280D7759D468B44

Function 10001421 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 10001448
GetModuleHandleW.KERNEL32(?), ref: 10001456
FreeLibrary.KERNEL32(00000000), ref: 1000145D
LoadLibraryA.KERNEL32(?), ref: 100014A8
GetProcAddress.KERNEL32(?,?), ref: 1000150B
GetModuleFileNameExW.PSAPI(?,?,?,00000104), ref: 1000155C

Strings

RemoteThread, xrefs: 1000162D, 10001635

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: LibraryModule$AddressCurrentFileFreeHandleLoadNameProcProcess
String ID: RemoteThread
API String ID: 384485914-1527770381
Opcode ID: 7f29649263da9fd249f9d903987e1f4995867d50850d77f501d422d16fcdfb8a
Instruction ID: 54f2b5fe37813bdb6cbaa394ea52629edcace97c1cd76af53f02dcf4bb087067
Opcode Fuzzy Hash: 7f29649263da9fd249f9d903987e1f4995867d50850d77f501d422d16fcdfb8a
Instruction Fuzzy Hash: D38120B5A8035CBAFB30DB60CC46FDF7BADDB04B91F404051B708B90D5D6B6AE908A60

Function 0040BE9C Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 0040BB38: __allrem.LIBCMT ref: 0040BB59
Part of subcall function 0040BB38: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040BB68
Part of subcall function 0040BB38: __allrem.LIBCMT ref: 0040BB7B
Part of subcall function 0040BB38: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040BB89

wsprintfW.USER32 ref: 0040BF29
wsprintfW.USER32 ref: 0040BF5A
wsprintfW.USER32 ref: 0040BF8B
wsprintfW.USER32 ref: 0040BFBC
wsprintfW.USER32 ref: 0040BFED
wsprintfW.USER32 ref: 0040C01E

Strings

%#n, xrefs: 0040C003, 0040C021
%#u, xrefs: 0040BFA1, 0040BFBF
%#s, xrefs: 0040BF3F, 0040BF5D
Invalid datetime, xrefs: 0040C063
%03d, xrefs: 0040BF23, 0040BF85, 0040BFE7

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: wsprintf$Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID: %#n$%#s$%#u$%03d$Invalid datetime
API String ID: 2900553612-886435284
Opcode ID: e3cb1ede60b1f0cba4e2a4dc11ad36a7b25568725a8ba564b0ad4c99122eef0b
Instruction ID: c8c36c93b72c69e4ee92b2371ce51bf7befbec509832ecd36b6b6c247a5f6846
Opcode Fuzzy Hash: e3cb1ede60b1f0cba4e2a4dc11ad36a7b25568725a8ba564b0ad4c99122eef0b
Instruction Fuzzy Hash: 3641D672B40218B6C6117BA26C82FBF3A6DDF61B48F54003BFD04B51E2E77D991096AD

Function 00414361 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041F774,00000001,00000000,00000000,$+@,?,00428674,00000000,00424D98,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe,C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe), ref: 004143A3
LCMapStringA.KERNEL32(00000000,00000100,0041F770,00000001,00000000,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe,C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe), ref: 004143BF
LCMapStringW.KERNEL32(?,$+@,?,?,00424D98,00000000,$+@,?,00428674,00000000,00424D98,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe,C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe), ref: 00414408
WideCharToMultiByte.KERNEL32(00428674,00000220,?,?,00000000,00000000,00000000,00000000,$+@,?,00428674,00000000,00424D98,?,?,00402B24), ref: 0041443B
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,?,00000000,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe), ref: 00414492
LCMapStringA.KERNEL32(?,$+@,00000000,?,00000000,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe), ref: 004144AE
LCMapStringA.KERNEL32(?,?,?,?,?,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe), ref: 00414504

Strings

$+@, xrefs: 004144A8, 004144FE, 00414402
$+@, xrefs: 00414383

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: $+@$$+@
API String ID: 352835431-2210268641
Opcode ID: 0e0567e7bf6d69f5348a680e30feec40899a33747b97d2795ff1e71acfe17187
Instruction ID: bd0543e9003dd66f5c3d55ec1ea95815b24fd956480843ea7bfaa8e64d7287af
Opcode Fuzzy Hash: 0e0567e7bf6d69f5348a680e30feec40899a33747b97d2795ff1e71acfe17187
Instruction Fuzzy Hash: 4151A031900259FBCF228F95DC45AEF7F76FB48750F14402AFA28A5260C3398991DBA9

Function 100018DA Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 216libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10001954
GetProcAddress.KERNEL32(?,?), ref: 100019AC
GetProcAddress.KERNEL32(?,?), ref: 10001A04
GetModuleHandleA.KERNEL32(?), ref: 10001A4D
GetProcAddress.KERNEL32(?,?), ref: 10001A98
FreeLibrary.KERNEL32(?), ref: 10001AB8
OpenProcess.KERNEL32(0000043A,00000000,?), ref: 10001AE3
FreeLibrary.KERNEL32(?), ref: 10001B06

Strings

ernel32.dll, xrefs: 10001A35, 10001A3D

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: AddressLibraryProc$Free$HandleLoadModuleOpenProcess
String ID: ernel32.dll
API String ID: 1269845195-594813063
Opcode ID: 1208e8b74169e1fa8a9f4041290d1ef900583441e8b20d599adfd41ea33e171c
Instruction ID: 0f0f3e06b4fe35486ca1a1d6347558ff8203be8ce8feae1a5c9791bfbdf42504
Opcode Fuzzy Hash: 1208e8b74169e1fa8a9f4041290d1ef900583441e8b20d599adfd41ea33e171c
Instruction Fuzzy Hash: 8E6105B1B8035D7AFB34D6A08D4BFDA72ADDB04F81F400461B704BE0C5E6F5AE948A65

Function 10001F90 Relevance: 15.2, APIs: 10, Instructions: 242libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 1000200A
GetProcAddress.KERNEL32(?,?), ref: 10002062
GetProcAddress.KERNEL32(?,?), ref: 100020BA
GetModuleHandleA.KERNEL32(?), ref: 10002106
GetProcAddress.KERNEL32(?,?), ref: 10002155
OpenProcess.KERNEL32(0000043A,00000000), ref: 100021BE
GetModuleBaseNameA.PSAPI(00000000,?,00000000,00000104), ref: 100021E8
CloseHandle.KERNEL32(00000000), ref: 10002203
FreeLibrary.KERNEL32(?), ref: 10002218
FreeLibrary.KERNEL32(?), ref: 1000222A

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleModule$BaseCloseLoadNameOpenProcess
String ID:
API String ID: 2877627430-0
Opcode ID: 198c61c343d8d65844ce9acd5a12e9fc22120eaa794cbfc0f7411a9f00b2f379
Instruction ID: 73c1d16a7ae2ba8ce2470e824ab43fcd253f6b7002b793fc18cd0c4f65eae655
Opcode Fuzzy Hash: 198c61c343d8d65844ce9acd5a12e9fc22120eaa794cbfc0f7411a9f00b2f379
Instruction Fuzzy Hash: 6D815771E80319BAFB21D790DC46FEE77BDEB48B81F400095B744B90C5E6F5ABA48A14

Function 00416123 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041F774,00000001,00000000,$+@,?,00428674,00000000,00424D98,?,?,00402B24), ref: 00416162
GetStringTypeA.KERNEL32(00000000,00000001,0041F770,00000001,?,?,?,00402B24), ref: 0041617C
GetStringTypeW.KERNEL32(?,$+@,?,?,$+@,?,00428674,00000000,00424D98,?,?,00402B24), ref: 004161A3
WideCharToMultiByte.KERNEL32(?,00000220,$+@,?,00000000,00000000,00000000,00000000,$+@,?,00428674,00000000,00424D98,?,?,00402B24), ref: 004161D6
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,00402B24), ref: 0041623F
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00402B24), ref: 004162AA

Strings

$+@, xrefs: 004161CB, 00416234, 0041619D
$+@, xrefs: 00416145

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: $+@$$+@
API String ID: 3852931651-2210268641
Opcode ID: 5a60bbccdf56786892d67aa7cdf5dc4e3dee70d9f666aaf44982346db2b07ba3
Instruction ID: 1d612d5df6f568afd8e087b4164691ed10648b1d1f810b4c733d69fb9f15a378
Opcode Fuzzy Hash: 5a60bbccdf56786892d67aa7cdf5dc4e3dee70d9f666aaf44982346db2b07ba3
Instruction Fuzzy Hash: A3518E71900619EFCF219F99CC46AEF7FB8FF49714F22452AF514A2290D3349991CBA8

Function 1000C300 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,10009650,?,Microsoft Visual C++ Runtime Library,00012010,?,1000E7D4,?,1000E824,?,?,?,Runtime Error!Program: ), ref: 1000C312
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1000C32A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 1000C33B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 1000C348

Strings

GetActiveWindow, xrefs: 1000C335
GetLastActivePopup, xrefs: 1000C33D
MessageBoxA, xrefs: 1000C324
user32.dll, xrefs: 1000C30D

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 128530e129fb6776b43ff053db9ad34881fa31f5cb0703661425cb77cf38f600
Instruction ID: 3bcacc6b1598bac565da9c86e3d03fbacbd56148ee9f6cdd2c2eaa3ade7af819
Opcode Fuzzy Hash: 128530e129fb6776b43ff053db9ad34881fa31f5cb0703661425cb77cf38f600
Instruction Fuzzy Hash: 35015A31600366AEFB00CFF69CC0D9A3AE8EB886C0701C429F604E2128DB70C8159B61

Function 00414F31 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00412209,?,Microsoft Visual C++ Runtime Library,00012010,?,0041F570,?,0041F5C0,?,?,?,Runtime Error!Program: ), ref: 00414F43
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00414F5B
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00414F6C
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00414F79

Strings

user32.dll, xrefs: 00414F3E
GetActiveWindow, xrefs: 00414F66
GetLastActivePopup, xrefs: 00414F6E
MessageBoxA, xrefs: 00414F55

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: ef0b2b88f1608e080d111fe0c269d9813dd26266f66e87f79009e77a88a1d14d
Instruction ID: 3aeb20cd3d141d449aa641801d62b101dce212d2a3cfbef49429f3aa040938e9
Opcode Fuzzy Hash: ef0b2b88f1608e080d111fe0c269d9813dd26266f66e87f79009e77a88a1d14d
Instruction Fuzzy Hash: 61012C31708302EF8761DFB49C84A9B7BE8AB89790315047BF508C2361DB6D88879B7D

Function 004168C0 Relevance: 13.7, APIs: 9, Instructions: 221COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0041F774,00000001,0041F774,00000001,00000000,-00000004,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000), ref: 004168FE
CompareStringA.KERNEL32(00000000,00000000,0041F770,00000001,0041F770,00000001,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 0041691B
CompareStringA.KERNEL32(?,00000000,00000000,0040DFD0,00000000,0040DFD0,00000000,-00000004,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000), ref: 00416979
GetCPInfo.KERNEL32(0040DFD0,00000000,00000000,-00000004,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 004169CA
MultiByteToWideChar.KERNEL32(0040DFD0,00000009,00000000,0040DFD0,00000000,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416A49
MultiByteToWideChar.KERNEL32(0040DFD0,00000001,00000000,0040DFD0,0040DFD0,0040DFD0,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416AAA
MultiByteToWideChar.KERNEL32(0040DFD0,00000009,00000000,0040DFD0,00000000,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416ABD
MultiByteToWideChar.KERNEL32(0040DFD0,00000001,00000000,0040DFD0,?,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416B09
CompareStringW.KERNEL32(?,00000000,0040DFD0,0040DFD0,?,00000000,?,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416B21

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID:
API String ID: 1651298574-0
Opcode ID: 04703151882954d6d92edba438c215b4450f96dbfc96dac07f87f9e465537dc8
Instruction ID: f1cae54e8e48ec70fdba284df45739787bad953a687df2729b822c1be6aaf156
Opcode Fuzzy Hash: 04703151882954d6d92edba438c215b4450f96dbfc96dac07f87f9e465537dc8
Instruction Fuzzy Hash: 1671BD72904149EFCF219F959C81AEF7FBAEF09344F12402BF954A2260C739D891CB99

Function 1000CF55 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,1000E864,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 1000CF97
LCMapStringA.KERNEL32(00000000,00000100,1000E860,00000001,00000000,00000000), ref: 1000CFB3
LCMapStringA.KERNEL32(?,00000100,00000020,00000001,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 1000CFFC
MultiByteToWideChar.KERNEL32(00000000,00000101,00000020,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 1000D034
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 1000D08C
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 1000D0A2
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 1000D0D5
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 1000D13D

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: c8d20f4e56d3d156e632033c757d61f90dcf30927a82f938c165a7452664eb3f
Instruction ID: 4ddebbf8e4329545ab3144b50fe820065b42d78ffb362d58e5454d5a28e999cb
Opcode Fuzzy Hash: c8d20f4e56d3d156e632033c757d61f90dcf30927a82f938c165a7452664eb3f
Instruction Fuzzy Hash: 9B516A72900249AFEF22DF94CC85ADE3FB5FB487D0F10851AF918A2168C3329D51DB61

Function 004155CF Relevance: 13.7, APIs: 9, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041F774,00000001,00000000,00000000,00000100,00000001,00000000,00000000,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 00415611
LCMapStringA.KERNEL32(00000000,00000100,0041F770,00000001,00000000,00000000,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 0041562D
LCMapStringA.KERNEL32(00000000,00401C95,?,00000001,?,00000000,00000100,00000001,00000000,00000000,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 00415676
MultiByteToWideChar.KERNEL32(00000000,00000002,?,00000001,00000000,00000000,00000100,00000001,00000000,00000000,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 004156AE
MultiByteToWideChar.KERNEL32(?,00000001,?,00000001,?,00000000,?,00000001,?,00401C95,00000000), ref: 00415706
LCMapStringW.KERNEL32(00000000,00401C95,00000000,00000000,00000000,00000000,?,00000001,?,00401C95,00000000), ref: 0041571C
LCMapStringW.KERNEL32(00000000,00401C95,00000000,00000000,?,?,?,00000001,?,00401C95,00000000), ref: 0041574F
LCMapStringW.KERNEL32(00000000,00401C95,00000000,00000000,?,00000000,?,00000001,?,00401C95,00000000), ref: 004157B7

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 54639eaa1e88e8aba79d0bfb87c835f61b69fc4376d0359fc4e24f3ef4defc34
Instruction ID: c98063cf3f2f28be6c6fde9ee765e17db69f0972600e8ea42cf796d09a82ff02
Opcode Fuzzy Hash: 54639eaa1e88e8aba79d0bfb87c835f61b69fc4376d0359fc4e24f3ef4defc34
Instruction Fuzzy Hash: 3A515E31900609EFCF218F95CC46ADF7FB9FB89754F10412AF924A12A0D3398992DB69

Function 00411C02 Relevance: 13.6, APIs: 9, Instructions: 147COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,0040D805), ref: 00411C20
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,0040D805), ref: 00411C34
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,0040D805), ref: 00411C55
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00411C8C
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,0040D805), ref: 00411CAC
MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,?,0040D805), ref: 00411CCA
FreeEnvironmentStringsA.KERNEL32(00000000,?,00000000,?,?,?,0040D805), ref: 00411CFF
MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,0040D805,?,00000000,?,?,?,0040D805), ref: 00411D2F
FreeEnvironmentStringsA.KERNEL32(00000000,?,00000000,?,?,?,0040D805), ref: 00411D65

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 430383f94c9601cc9abb21fb9faf9b17a59a43af17ef76a8277b7701f354be51
Instruction ID: 3090c6bc3a1742862e2e0e64a859aa86bf3849621cf42877fae6005f5b539d00
Opcode Fuzzy Hash: 430383f94c9601cc9abb21fb9faf9b17a59a43af17ef76a8277b7701f354be51
Instruction Fuzzy Hash: 11412832A482116BD7316F65EC44BE77698EB45714F26423FEA01D73A0EB78DC8182DD

Function 1000952C Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,10002B52), ref: 10009599
GetStdHandle.KERNEL32(000000F4,1000E7D4,00000000,10002B52,00000000,10002B52), ref: 1000966F
WriteFile.KERNEL32(00000000), ref: 10009676

Strings

Microsoft Visual C++ Runtime Library, xrefs: 10009645
<program name unknown>, xrefs: 100095A9
Runtime Error!Program: , xrefs: 100095FF
..., xrefs: 100095EB

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: ea0aefca77f81431ba08ae345cfe8b03a1e754fc5cee4c380e72236d7967db81
Instruction ID: 178abc943d900cdddc95ff121c26e31f1f9fca6714615d81558fc3e48779c060
Opcode Fuzzy Hash: ea0aefca77f81431ba08ae345cfe8b03a1e754fc5cee4c380e72236d7967db81
Instruction Fuzzy Hash: 4431B772A002189FFF21DB60CC85FDA73ADEB453C5F500466F589E6049EA70EA94CB51

Function 004120E5 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00412152
GetStdHandle.KERNEL32(000000F4,0041F570,00000000,?,00000000,?), ref: 00412228
WriteFile.KERNEL32(00000000), ref: 0041222F

Strings

<program name unknown>, xrefs: 00412162
..., xrefs: 004121A4
Runtime Error!Program: , xrefs: 004121B8
Microsoft Visual C++ Runtime Library, xrefs: 004121FE

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 94ef7481e6b027e58786b40d54ef855c7b3dd6018c705d79d6d9ec024a23f2e9
Instruction ID: 77ffc6442223af21855e83ebf50e4e10e44f81062925e762b119b775f980ce86
Opcode Fuzzy Hash: 94ef7481e6b027e58786b40d54ef855c7b3dd6018c705d79d6d9ec024a23f2e9
Instruction Fuzzy Hash: CC31D272600218BFDF20DB60CE46FDE736DEB49304F64046BF545E2190EAB8AAD58A1D

Function 10001211 Relevance: 12.2, APIs: 8, Instructions: 214libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 10001274
GetProcAddress.KERNEL32(?,?), ref: 100012CA
GetProcAddress.KERNEL32(?,?), ref: 10001324
GetProcAddress.KERNEL32(?,?), ref: 1000137C
GetProcAddress.KERNEL32(?,?), ref: 100013E8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10001405
CloseHandle.KERNEL32(00000000), ref: 10001412
CloseHandle.KERNEL32(?), ref: 10001417

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: AddressProc$Handle$Close$ModuleObjectSingleWait
String ID:
API String ID: 2743844413-0
Opcode ID: 802593ae90f17b18c79662a3e1d270b58ba0ee5f8a4df7299d5aea8cafb05fb4
Instruction ID: 9a7eeab185e46d06bf56ebbfeee1b870957da3878e33c4a72f9ae6495fbb8191
Opcode Fuzzy Hash: 802593ae90f17b18c79662a3e1d270b58ba0ee5f8a4df7299d5aea8cafb05fb4
Instruction Fuzzy Hash: 6A6104B5F8431CBAFB309A609C47FDB7A6DDB04B81F404061B708BD0D5D6F66E918AA0

Function 1000AD2E Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,1000E864,00000001,00000000,00000000,?,?,10012768,10001574,00000000,?,?,?,?,00000104), ref: 1000AD70
LCMapStringA.KERNEL32(00000000,00000100,1000E860,00000001,00000000,00000000), ref: 1000AD8C
LCMapStringW.KERNEL32(?,?,?,?,00000000,10001574,?,?,10012768,10001574,00000000,?,?,?,?,00000104), ref: 1000ADD5
WideCharToMultiByte.KERNEL32(10012768,00000220,?,?,00000000,00000000,00000000,00000000,?,?,10012768,10001574,00000000,?,?,?), ref: 1000AE08
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 1000AE5F
LCMapStringA.KERNEL32(?,?,?,?,00000000,00000000), ref: 1000AE7B
LCMapStringA.KERNEL32(?,?,?,?,?,00000000), ref: 1000AED1

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 8f05e58b05e9a447cfb959372668e7abf9ba84083b2cc2ff43c1636e0db6dea5
Instruction ID: fe289346f532971cbccc950126f10ae72bd3b0df8f0bc12cb035537b02f92d92
Opcode Fuzzy Hash: 8f05e58b05e9a447cfb959372668e7abf9ba84083b2cc2ff43c1636e0db6dea5
Instruction Fuzzy Hash: D0515DB290026AAFEF22CF91CC45AEF3FB5FB0A7D0F104225F915A5164C7358991DBA1

Function 10009310 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10005B8F), ref: 1000932B
GetEnvironmentStrings.KERNEL32(?,?,?,?,10005B8F), ref: 1000933F
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10005B8F), ref: 1000936B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,10005B8F), ref: 100093A3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,10005B8F), ref: 100093C5
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,10005B8F), ref: 100093DE
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,10005B8F), ref: 100093F1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 1000942F

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: b5af69dadc5efcc076ab60009370ba4e8c1262b8b097945ac6c57da46478fe6f
Instruction ID: 2b81245d939cd83357b068e11a87cd151e038e3c4334040fef868fdd10b89fca
Opcode Fuzzy Hash: b5af69dadc5efcc076ab60009370ba4e8c1262b8b097945ac6c57da46478fe6f
Instruction Fuzzy Hash: 393149B24083A2AFF320FFB85CC4C6F77DCE7482D4B120939F552C3148E6619D824A61

Function 00401A36 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 194libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 00401AA1
GetProcAddress.KERNEL32(00000000,?), ref: 00401AEE
GetProcAddress.KERNEL32(00000000,?), ref: 00401B2C
GetProcAddress.KERNEL32(00000000,?), ref: 00401B6A
GetProcAddress.KERNEL32(00000000,?), ref: 00401BAC

Strings

BIN, xrefs: 00401BAE

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: BIN
API String ID: 667068680-1015027815
Opcode ID: 426b30f3620974495326e62c2c60232af0cb6738e2bec8c0dcf57d0a5699cdcb
Instruction ID: d33b504a52d157aab54a39868a1b44e55f0db24058a997c431131fa17ba52408
Opcode Fuzzy Hash: 426b30f3620974495326e62c2c60232af0cb6738e2bec8c0dcf57d0a5699cdcb
Instruction Fuzzy Hash: 6151D771BC43447AF2309671DC47FAB769DAB49F44F00082EB744BE0C2D6FAA6144665

Function 10008DFA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 10008E58
GetFileType.KERNEL32(00000480), ref: 10008F03
GetStdHandle.KERNEL32(-000000F6), ref: 10008F66
GetFileType.KERNEL32(00000000), ref: 10008F74
SetHandleCount.KERNEL32 ref: 10008FAB

Strings

HO[, xrefs: 10008E1C, 10008E45, 10008F3C

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: HO[
API String ID: 1710529072-177266396
Opcode ID: 02b9d74386a5989b0b137aa57980a70e0f4be3b1f5c6b816f135ec974fccc55d
Instruction ID: ddfa1a036474b7ecfbd58c851be394f7d76dc5ca7c0e2929af7eacdf6a4d07e1
Opcode Fuzzy Hash: 02b9d74386a5989b0b137aa57980a70e0f4be3b1f5c6b816f135ec974fccc55d
Instruction Fuzzy Hash: 5951DF315046A28FF711CB78C8846A97BE1FB013E8F298678D5E29B2E5DB30DA46C751

Function 00411E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00411E6E
GetFileType.KERNEL32(?,?,00000000), ref: 00411F19
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00411F7C
GetFileType.KERNEL32(00000000,?,00000000), ref: 00411F8A
SetHandleCount.KERNEL32 ref: 00411FC1

Strings

$uB, xrefs: 00411EA8

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: $uB
API String ID: 1710529072-178231841
Opcode ID: 593c92c7eb8dc217b894d47eb924cc9a35d400393df819289d625f248b346279
Instruction ID: 38d4255647d52bf4454d4f47cfcd0d26b98a62e44eb290e802ac21e1cfab70cc
Opcode Fuzzy Hash: 593c92c7eb8dc217b894d47eb924cc9a35d400393df819289d625f248b346279
Instruction Fuzzy Hash: 5B510831A046018FC720CF68D8846A677E0AB15338F24466ED7A6D72F0DB38D887C75D

Function 0041482B Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 0040F7B8: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F7F5
Part of subcall function 0040F7B8: EnterCriticalSection.KERNEL32(?,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F810

InitializeCriticalSection.KERNEL32(00000068,00000100,00000080,@,S@,00000000,?,?,00414D1C,00000001,00000000,00000000), ref: 0041487E
EnterCriticalSection.KERNEL32(00000068,00000100,00000080,@,S@,00000000,?,?,00414D1C,00000001,00000000,00000000), ref: 00414893
LeaveCriticalSection.KERNEL32(00000068), ref: 004148A0

Strings

vB, xrefs: 004148DD
@,S@, xrefs: 0041482E
, xrefs: 004148D4
uB, xrefs: 00414846

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID: $ uB$ vB$@,S@
API String ID: 713024617-4028107869
Opcode ID: 2fcf63ef652f2c0e74e52bff06b73b5af4071bfdd219f627d315837f60cbb5e4
Instruction ID: be70e2c14c3603ac5746ce5d34877287c054dce09029812c88c6f1b27f3c77f8
Opcode Fuzzy Hash: 2fcf63ef652f2c0e74e52bff06b73b5af4071bfdd219f627d315837f60cbb5e4
Instruction Fuzzy Hash: E23135B21043419FD320AF34EC8479A77D4EF81738F24863EE666472D1DB789889871A

Function 1000C788 Relevance: 9.1, APIs: 6, Instructions: 143COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,1000E864,00000001,10001574,?,?,10012768,10001574,00000000,?,?,?), ref: 1000C7C7
GetStringTypeA.KERNEL32(00000000,00000001,1000E860,00000001,?), ref: 1000C7E1
GetStringTypeW.KERNEL32(00000100,?,?,?,?,?,10012768,10001574,00000000,?,?,?), ref: 1000C808
WideCharToMultiByte.KERNEL32(00000000,00000220,?,?,00000000,00000000,00000000,00000000,?,?,10012768,10001574,00000000,?,?,?), ref: 1000C83B
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 1000C8A4
GetStringTypeA.KERNEL32(?,00000100,?,?), ref: 1000C90F

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 65637de255ac76e6e7f76532fbcc80446d0a0cbfeb49186c18b28d8f0bea70a4
Instruction ID: 3834e5c373360181745353e4b3832744015ecb015a07ac9f4135a2620758db1e
Opcode Fuzzy Hash: 65637de255ac76e6e7f76532fbcc80446d0a0cbfeb49186c18b28d8f0bea70a4
Instruction Fuzzy Hash: 6B519A71900399EBEB21CF95CC89EDF7FB8EB497D0F108519F511A2194D7709A51CBA0

Function 1000C94D Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,1000E864,00000001,00000000,?,00000100,00000000,1000C1FE,00000001,00000020,00000100,?,00000000), ref: 1000C98C
GetStringTypeA.KERNEL32(00000000,00000001,1000E860,00000001,?), ref: 1000C9A6
GetStringTypeA.KERNEL32(00000000,?,00000100,00000020,00000001,?,00000100,00000000,1000C1FE,00000001,00000020,00000100,?,00000000), ref: 1000C9DA
MultiByteToWideChar.KERNEL32(1000C1FE,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,1000C1FE,00000001,00000020,00000100,?,00000000), ref: 1000CA12
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 1000CA68
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 1000CA7A

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 8c18163fd7cb7fb328bf5ae09abcb2a32844a993f7bb06213be619abc0828dfc
Instruction ID: 037dbdefde4d013786314c10ea3b09220e1c4c7773944604d13847e7930403d9
Opcode Fuzzy Hash: 8c18163fd7cb7fb328bf5ae09abcb2a32844a993f7bb06213be619abc0828dfc
Instruction Fuzzy Hash: 9B416A7260025EAFEB11CF94CC89EEE3BA8FB093D4F104525FA15E2154D7319D54CBA1

Function 00415486 Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041F774,00000001,00000000,00000100,00000001,00000000,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 004154C5
GetStringTypeA.KERNEL32(00000000,00000001,0041F770,00000001,?,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 004154DF
GetStringTypeA.KERNEL32(00000000,00000000,00401C95,?,00000001,00000100,00000001,00000000,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 00415513
MultiByteToWideChar.KERNEL32(?,00000002,00401C95,?,00000000,00000000,00000100,00000001,00000000,?,00000001,?,00401C95,00000000,DllGetClassObject), ref: 0041554B
MultiByteToWideChar.KERNEL32(?,00000001,00401C95,?,?,?,?,?,?,?,00000001,?,00401C95,00000000), ref: 004155A1
GetStringTypeW.KERNEL32(00000000,?,00000000,00000001,?,?,?,?,?,?,00000001,?,00401C95,00000000), ref: 004155B3

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 46c1e1efbf68a1b9c3dca6136892804e34c50b007045e83396152ebd5b2c70ef
Instruction ID: a579a62adc80f026206eeacd120a953fb5ac64c8790a5af1e40b5935c4da18f0
Opcode Fuzzy Hash: 46c1e1efbf68a1b9c3dca6136892804e34c50b007045e83396152ebd5b2c70ef
Instruction Fuzzy Hash: 03416E72A00509FFCF218F94CC89EEB3F6AFB48754F10452AF915D6250D3788995CBA9

Function 00411D6F Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,00000000,?,?,0040D7FB), ref: 00411D88
GetCommandLineA.KERNEL32(?,00000000,?,?,0040D7FB), ref: 00411D9A
GetCommandLineW.KERNEL32(?,00000000,?,?,0040D7FB), ref: 00411DB1
GetCommandLineA.KERNEL32(?,00000000,?,?,0040D7FB), ref: 00411DBA
MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,0040D7FB), ref: 00411DD3
MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,0040D7FB), ref: 00411DF8

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CommandLine$ByteCharMultiWide
String ID:
API String ID: 3068183746-0
Opcode ID: a5543fad8a4234462ea19dc9d77a33d97f9d14257ac7e0c8ff6f7cbd7543386f
Instruction ID: 7f57305f5f48fc3308e12dfa4f530b447d2b4a88bf3a8819f48e49d9868202e0
Opcode Fuzzy Hash: a5543fad8a4234462ea19dc9d77a33d97f9d14257ac7e0c8ff6f7cbd7543386f
Instruction Fuzzy Hash: 7811CC32704219A6D6205BE5AC41FF7375CDF42365F220137EA10D72F1DAA5DC824AED

Function 00416B3D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 0040F7B8: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F7F5
Part of subcall function 0040F7B8: EnterCriticalSection.KERNEL32(?,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F810

GetCPInfo.KERNEL32(00000000,?), ref: 00416B8E

Part of subcall function 0040F819: LeaveCriticalSection.KERNEL32(?,0040D29B,00000009,?,00000009,00000000,?,0040D25B,000000E0,0040D248,?,0040F7D8,00000018,00000000,?), ref: 0040F826

Strings

X+B, xrefs: 00416B75
rB, xrefs: 00416C6C
rB, xrefs: 00416CB6
H,B, xrefs: 00416B82

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: H,B$X+B$rB$rB
API String ID: 1866836854-3838826781
Opcode ID: 8de95d3dfc8d72ad378295f86c02e45b56d8b3132e7ce49b123cafe39809b56a
Instruction ID: 65a658ebd2d53d0b8e3581262dd4c83a8b89734c92ddd14565b351d09dcc6dd2
Opcode Fuzzy Hash: 8de95d3dfc8d72ad378295f86c02e45b56d8b3132e7ce49b123cafe39809b56a
Instruction Fuzzy Hash: 9D41387160C260AEE721DB64D8803EA7B91DB05304F6680BBE585CB292D67DD8C6C79C

Function 0040D591 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00428674), ref: 0040D5EF
InterlockedDecrement.KERNEL32(00428674), ref: 0040D5FE
InterlockedDecrement.KERNEL32(00428674), ref: 0040D65C

Strings

$+@, xrefs: 0040D61C, 0040D5A1, 0040D5D2
C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe, xrefs: 0040D596

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Interlocked$Decrement$Increment
String ID: $+@$C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe
API String ID: 2574743344-2763535350
Opcode ID: e44f5cca523c1bbce0fe183b9a9583f5cce5e950200b30a6372c9fe17fb2ecd8
Instruction ID: 434f967d428384523260c60ec9955d5cee3339aa3ac38c669103ab5418d8fd4d
Opcode Fuzzy Hash: e44f5cca523c1bbce0fe183b9a9583f5cce5e950200b30a6372c9fe17fb2ecd8
Instruction Fuzzy Hash: 9421A376900205EBDB206F95D8456EA77A8EB04714F50C43BFC49AA2C0DB788EC6CF9D

Function 00413487 Relevance: 7.7, APIs: 5, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ae0dcb8c9e85e88f16ec3ad252fe16bcc93ced395766251b0c7ab93858c113
Instruction ID: 8b76d0335c75e456601fad6d949bcc15044b76aeca226337109a248b62bf8a62
Opcode Fuzzy Hash: 39ae0dcb8c9e85e88f16ec3ad252fe16bcc93ced395766251b0c7ab93858c113
Instruction Fuzzy Hash: B051CA71A00149FFDF31AF50DD808EE7BBAEB40316B62817BE55696250D7398EC68B18

Function 1000B3DA Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 10007128: InitializeCriticalSection.KERNEL32(00000000,?,10002B52,?,10006680,00000009,?,?,1000664F,000000E0,100059AD,10002B52,00000001,10002B52), ref: 10007165
Part of subcall function 10007128: EnterCriticalSection.KERNEL32(10002B52,10002B52,?,10006680,00000009,?,?,1000664F,000000E0,100059AD,10002B52,00000001,10002B52), ref: 10007180

InitializeCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,1000B8CB,00000001,00000000,00000000), ref: 1000B42D
EnterCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,1000B8CB,00000001,00000000,00000000), ref: 1000B442
LeaveCriticalSection.KERNEL32(00000068,?,00000000,?,?,1000B8CB,00000001,00000000,00000000), ref: 1000B44F

Strings

HO[, xrefs: 1000B3F5
, xrefs: 1000B483

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID: $HO[
API String ID: 713024617-3714246590
Opcode ID: 763a3f4733fb243791e99211741b653b94060ddeb637a506f5486018309758c8
Instruction ID: ed49ec3101de35bba78ea3940e76779101a720b959259f2900186d2d71f27fd6
Opcode Fuzzy Hash: 763a3f4733fb243791e99211741b653b94060ddeb637a506f5486018309758c8
Instruction Fuzzy Hash: 453112725047419FF314CF24CCC479A77D4FB403A4F258A2CE5654A1D7C7B4EA848711

Function 1000947E Relevance: 7.5, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(005B05C4,00100000,00004000,?,?,?,?,10005BE0,10005C34,?,?,?), ref: 100094AC
VirtualFree.KERNEL32(005B05C4,00000000,00008000,?,?,10005BE0,10005C34,?,?,?), ref: 100094B7
HeapFree.KERNEL32(00000000,005B0700,?,?,10005BE0,10005C34,?,?,?), ref: 100094C4
HeapFree.KERNEL32(00000000,?,?,10005BE0,10005C34,?,?,?), ref: 100094E2
HeapDestroy.KERNEL32(?,?,10005BE0,10005C34,?,?,?), ref: 100094EA

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: Free$Heap$Virtual$Destroy
String ID:
API String ID: 782257640-0
Opcode ID: b35f386f5967b22487236f92b0a632c729da4a67992a83c097bf518819c70c28
Instruction ID: 79a529c26f2269d1bb7fa9166d85c2a5e8f024c85fec41328c91a863a656031d
Opcode Fuzzy Hash: b35f386f5967b22487236f92b0a632c729da4a67992a83c097bf518819c70c28
Instruction Fuzzy Hash: 81F0173A240225BFFB259F51CCC5F857B66FB847A0F2A8024F244260B5C6B3B865DB58

Function 100089A1 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000,100098E7,100096D1,?,1000C75F,?,00000000,00000002,00000020,?,00000000,00000007,?,1000AD29,00000000), ref: 100089A3
TlsGetValue.KERNEL32(?,1000AD29,00000000,?,00000000,?,10007016,00000000,00000000,10006A6B,00000000,?,100051FB,?,00000000,00000000), ref: 100089B1
SetLastError.KERNEL32(00000000,?,1000AD29,00000000,?,00000000,?,10007016,00000000,00000000,10006A6B,00000000,?,100051FB,?,00000000), ref: 100089FD

Part of subcall function 1000B20A: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000000,100089C6,00000001,00000074,?,1000AD29,00000000,?,00000000,?,10007016,00000000), ref: 1000B25F

TlsSetValue.KERNEL32(00000000,?,1000AD29,00000000,?,00000000,?,10007016,00000000,00000000,10006A6B,00000000,?,100051FB,?,00000000), ref: 100089D5
GetCurrentThreadId.KERNEL32 ref: 100089E6

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 5e1e9148d7b878ed103a2ec25932d88dd9a5e7fe7a9e4b39f72545ffad241bed
Instruction ID: e2d9743bec49df8f1e21d7b67743586fe623e2b20218ca44f90ded4584f35bb7
Opcode Fuzzy Hash: 5e1e9148d7b878ed103a2ec25932d88dd9a5e7fe7a9e4b39f72545ffad241bed
Instruction Fuzzy Hash: 22F0F6366002329BF6247B309C4962A3A50FB457F1B154628F6D0E61E9CFB08C418766

Function 0040E8E3 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000100,00000000,004122B0,004149B6,00000100,00000000,00414DA1,00000000,00000000), ref: 0040E8E5
TlsGetValue.KERNEL32 ref: 0040E8F3
SetLastError.KERNEL32(00000000), ref: 0040E93F

Part of subcall function 004136B5: HeapAlloc.KERNEL32(00000008,?,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0041370A

TlsSetValue.KERNEL32(00000000), ref: 0040E917
GetCurrentThreadId.KERNEL32 ref: 0040E928

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: b985bd8542c82dd67ccfa6d5669cd8db65a88773f2c83ef21a65d2b108fb800b
Instruction ID: 9f61251463e7e37e6423e796c13b01a931e201981835502aa1cd9af062a6a855
Opcode Fuzzy Hash: b985bd8542c82dd67ccfa6d5669cd8db65a88773f2c83ef21a65d2b108fb800b
Instruction Fuzzy Hash: E9F09632600321BBC6312B76AC0959A3A50AB147F1B11853EF561E62F1DF388841869C

Function 100070BC Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,10008975,10005BDB,10005C34,?,?,?), ref: 100070F0
DeleteCriticalSection.KERNEL32(?,?,10008975,10005BDB,10005C34,?,?,?), ref: 1000710B
DeleteCriticalSection.KERNEL32 ref: 10007113
DeleteCriticalSection.KERNEL32 ref: 1000711B
DeleteCriticalSection.KERNEL32 ref: 10007123

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: 9e69759ed002e24659984a7f435f97bc025c4070d5df05447b94f6d5e3a5fbce
Instruction ID: cf58868213997e36051f3376a6e725bb11fa79f154b32d579c881074b99f913b
Opcode Fuzzy Hash: 9e69759ed002e24659984a7f435f97bc025c4070d5df05447b94f6d5e3a5fbce
Instruction Fuzzy Hash: 3EF05425F40365F7EA71F715CC8C8897661EBC13D03424172F8CA66138DEBEDD818A80

Function 00414467 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,?,00000000,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe), ref: 00414492
LCMapStringA.KERNEL32(?,$+@,00000000,?,00000000,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe), ref: 004144AE
LCMapStringA.KERNEL32(?,?,?,?,?,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe), ref: 00414504
MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,?,?,?,00000000,?,?,00402B24,C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe), ref: 00414546

Strings

$+@, xrefs: 004144A8, 004144FE

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID: $+@
API String ID: 2829165498-3232336855
Opcode ID: 1c8450ee31f7a9110dbba800e545e0dd2b1cd7292b63a24c96e78346ab624120
Instruction ID: 4f5137f97fd2356129a150dbaa5cde0c9aa4d21ec916f5203b4995e5c37383f1
Opcode Fuzzy Hash: 1c8450ee31f7a9110dbba800e545e0dd2b1cd7292b63a24c96e78346ab624120
Instruction Fuzzy Hash: 01215172900219BBCF228F94DC459EE7F76FF48750F14801AFA2465160D3398991DBA9

Function 00414E6F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00428674), ref: 00414E7B
InterlockedDecrement.KERNEL32(00428674), ref: 00414E92

Part of subcall function 0040F7B8: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F7F5
Part of subcall function 0040F7B8: EnterCriticalSection.KERNEL32(?,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F810

InterlockedDecrement.KERNEL32(00428674), ref: 00414EBE

Strings

!B, xrefs: 00414E6F

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: !B
API String ID: 2038102319-4034699715
Opcode ID: 3199c93f3b0bab531b6d63b90894785d3336c39e95a846418a2edcd88d4db09b
Instruction ID: 665e77978c722901bea5e4fa00d2eba61c4c5290c7a08fda2fd3ff2ab79372e9
Opcode Fuzzy Hash: 3199c93f3b0bab531b6d63b90894785d3336c39e95a846418a2edcd88d4db09b
Instruction Fuzzy Hash: D0F0B43210121C6ED7102BA5BC41ECB7B5CEF85339B11813FF508591808F75598646AD

Function 004137C6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00428674), ref: 004137D2
InterlockedDecrement.KERNEL32(00428674), ref: 004137E9

Part of subcall function 0040F7B8: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F7F5
Part of subcall function 0040F7B8: EnterCriticalSection.KERNEL32(?,?,?,004136EB,00000009,?,?,?,0040E89B,00000001,00000074,?,0040D7E0), ref: 0040F810

InterlockedDecrement.KERNEL32(00428674), ref: 00413819

Strings

8b@, xrefs: 004137C6

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: 8b@
API String ID: 2038102319-4096664975
Opcode ID: aa7f0651c13fcd1ebd1ac851582d1fd861859e0837f66e530d82a2f8df76540d
Instruction ID: bdd68373600cb70d33b190d259ec905e176670b953d2b87ec9c1c7cbffc26e36
Opcode Fuzzy Hash: aa7f0651c13fcd1ebd1ac851582d1fd861859e0837f66e530d82a2f8df76540d
Instruction Fuzzy Hash: 22F0B43250125DBFDB117FA1AC919DF3B9CEF45725F00803FFA0415151CFB54A5686A9

Function 0040F340 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CD7A), ref: 0040F345
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040F355

Strings

KERNEL32, xrefs: 0040F340
IsProcessorFeaturePresent, xrefs: 0040F34F

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: fb413194f2de41c59819ed9e99b839e4801d8f7edbcad4f3ae5a422335417f45
Instruction ID: bdbbaf358dd800c7f714fd99258dbf88c1ad81857618fab68b5394e8f8f88707
Opcode Fuzzy Hash: fb413194f2de41c59819ed9e99b839e4801d8f7edbcad4f3ae5a422335417f45
Instruction Fuzzy Hash: 6BC01234B84B08A2DA705BB19C0AB9728282B08B22F25807BAC0AE15C0CE7DC04D912D

Function 0040BB38 Relevance: 6.2, APIs: 4, Instructions: 206COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0040BB59
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040BB68
__allrem.LIBCMT ref: 0040BB7B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040BB89

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: fff05f784ce0bcbbe042ba8cc1b2d73a54de2a2c09b7feb9c908bfa9eb0798ec
Instruction ID: 8f8fcd52b4759e703182c14bd552bb073fc00ad4ea3f9e3920774124ba682e4c
Opcode Fuzzy Hash: fff05f784ce0bcbbe042ba8cc1b2d73a54de2a2c09b7feb9c908bfa9eb0798ec
Instruction Fuzzy Hash: C86150B1F006149BD714CF9EC88065AB7E6EB98314B39C07AE809EB351D7B6DD128BC4

Function 00416A7B Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0040DFD0,00000001,00000000,0040DFD0,0040DFD0,0040DFD0,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416AAA
MultiByteToWideChar.KERNEL32(0040DFD0,00000009,00000000,0040DFD0,00000000,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416ABD
MultiByteToWideChar.KERNEL32(0040DFD0,00000001,00000000,0040DFD0,?,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416B09
CompareStringW.KERNEL32(?,00000000,0040DFD0,0040DFD0,?,00000000,?,00000000,?,00412B8F,0040DFD0,0040DFD0,0040DFD0,0040DFD0,00000000,0040DFD0), ref: 00416B21

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: 6a48dbc9fe27ccdb7e2b5afbaaae9767b6802422ad6f196e6bf848d67f3be152
Instruction ID: d432f733f2ed69cf75d8d7b950ffdf43c4a318ad5a64495c68b8fdfee3381f80
Opcode Fuzzy Hash: 6a48dbc9fe27ccdb7e2b5afbaaae9767b6802422ad6f196e6bf848d67f3be152
Instruction Fuzzy Hash: 37211832900219EBCF219F95CC419DEBFB5FF4D350F12416AFA14B21A0C736A961DBA4

Function 00404BBF Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00000001,00404846,00000000,?,?,?,00401C84,00000000,00000001), ref: 00404BFB
VirtualFree.KERNEL32(?,00000000,00008000,?,00000001,00404846,00000000,?,?,?,00401C84,00000000,00000001), ref: 00404C1F
GetProcessHeap.KERNEL32(00000000,00000001,?,00000001,00404846,00000000,?,?,?,00401C84,00000000,00000001), ref: 00404C27
HeapFree.KERNEL32(00000000,?,?,?,00401C84,00000000,00000001), ref: 00404C2E

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Free$Heap$LibraryProcessVirtual
String ID:
API String ID: 548792435-0
Opcode ID: 167be693a8985a9f9c73ef0efebdf1d14adc20e20237db8df440473cd541fe7e
Instruction ID: b38d9afa45eead5bdd55cf5a23908fead77d6ad92500e43aeedd019bbe57284c
Opcode Fuzzy Hash: 167be693a8985a9f9c73ef0efebdf1d14adc20e20237db8df440473cd541fe7e
Instruction Fuzzy Hash: 090121B55056019FD7248FA9CCC4967B7E9FB88325315893EF296A3590CB34FC45CB18

Function 1000C15F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 1000C173

Strings

, xrefs: 1000C1BC
, xrefs: 1000C198

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 542543d206a95f6c63ce2e3c9ecb8d5dda4050018df6d26d5e097ca0ae24a915
Instruction ID: a7d753c6c2874a8986b08f861c04606aad37ebce78db97bb7f1172f2256a78b7
Opcode Fuzzy Hash: 542543d206a95f6c63ce2e3c9ecb8d5dda4050018df6d26d5e097ca0ae24a915
Instruction Fuzzy Hash: 4C4119315043AC5EFB19CB94CC85FEA7FA9DB067C4F1040F5E686D7096C2718948DBA2

Function 00416D90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?), ref: 00416DA4

Strings

, xrefs: 00416DC9
, xrefs: 00416DED

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: ce8b78341ca5b2e9188c19ec593f55b1c2e0fc9ab97de19a8a70aff7c43f35f6
Instruction ID: 8738f5bd17488016f5b5c4cce4a7dc7a1990465905e3fb195ccc7aec701b56c1
Opcode Fuzzy Hash: ce8b78341ca5b2e9188c19ec593f55b1c2e0fc9ab97de19a8a70aff7c43f35f6
Instruction Fuzzy Hash: 19418E312083586EEB22D714DD59BFB7F99DB02700F1500E6E545C7193C23989C5DBAE

Function 00404D98 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(00000002,?,00000104,?,?,?,?,00401101,00000000,00000000), ref: 00404E78

Strings

qY@, xrefs: 00404EA9, 00404DFB
%s%s%s, xrefs: 00404E9E

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: EnvironmentVariable
String ID: %s%s%s$qY@
API String ID: 1431749950-1628662383
Opcode ID: 72a6b6654fea98f93945160f4ecc85e4d4973da5075d3a2efb098018a34d4313
Instruction ID: b51b18539a02b601262caadefb1db32c1c28ccf0f7a66d34a922fd809fd0284b
Opcode Fuzzy Hash: 72a6b6654fea98f93945160f4ecc85e4d4973da5075d3a2efb098018a34d4313
Instruction Fuzzy Hash: 7C312773600218BBCB209BA5CC89ADB776DBF84304F1045BAF704F7190EA759A9187D8

Function 004163F1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00412322: SetFilePointer.KERNEL32(00000000,00000100,00000000,00000000,00000100,00000000,00414DE4,00000000,000000FF,00000002), ref: 0041234C
Part of subcall function 00412322: GetLastError.KERNEL32 ref: 00412359

SetEndOfFile.KERNEL32(00000000,?,?,?,00000100,?,?,?,00414E2F,00000000,0000001A), ref: 004164CE
GetLastError.KERNEL32(?,?,?,00000100,?,?,?,00414E2F,00000000,0000001A), ref: 004164EC

Strings

@,S@, xrefs: 004163F1

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID: @,S@
API String ID: 1697706070-1817016226
Opcode ID: fba8649b9e6eb2ee347c64e015b8f4832a02dc9d7992d13052f2934211b47bb8
Instruction ID: 078275469bbd33506af0275a5805691d9f2aac2e4cfb1e07a62de63b4dd83938
Opcode Fuzzy Hash: fba8649b9e6eb2ee347c64e015b8f4832a02dc9d7992d13052f2934211b47bb8
Instruction Fuzzy Hash: 3231D5329001147ACF112F79CC41BCD3A65EF00368F12417BF918DB291EA79DED18A9D

Function 00416213 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,00402B24), ref: 0041623F
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00402B24), ref: 004162AA

Strings

$+@, xrefs: 00416234

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide
String ID: $+@
API String ID: 3139900361-3232336855
Opcode ID: 1ab5709f8d6834a3a4b88a97ff4803a233ecba1001be81026512e25c7716fa16
Instruction ID: c98a976f16736608043865ae8b184436da9360259561a9bacea657c745c163ec
Opcode Fuzzy Hash: 1ab5709f8d6834a3a4b88a97ff4803a233ecba1001be81026512e25c7716fa16
Instruction Fuzzy Hash: EF217C3190061AEFCF20DF98CC459DEBBB1FF48314F22855AE510732A0D3359991CB94

Function 0040C0E2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C0E7

Strings

string too long, xrefs: 0040C0EF
|IB, xrefs: 0040C0FA

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: H_prolog
String ID: string too long$|IB
API String ID: 3519838083-205027280
Opcode ID: adf922865bcbf773d628d941c16721c6900b57e06b511b800cc419ddac508d7b
Instruction ID: c2d73e001ad19d5b6ca3acc6226604809243cb83edcc773596166e9365ef075c
Opcode Fuzzy Hash: adf922865bcbf773d628d941c16721c6900b57e06b511b800cc419ddac508d7b
Instruction Fuzzy Hash: 83F062B2A00254AEDB009F95DC81BAEB7B8EF84314F00456FB511A7291C7B85904C7A8

Function 00412A78 Relevance: 5.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000009,?,000000FF,00000000,0040DFE3,74DEE860,00428674,00000000,?,00412A59,00000000,?,0040DFE3,?,0040DFE3,?), ref: 00412ADF
GetLastError.KERNEL32(?,00412A59,00000000,?,0040DFE3,?,0040DFE3,?,00000000,00000000,?,?,?,?,00000000,?), ref: 00412AE9
MultiByteToWideChar.KERNEL32(00000001,?,?,00000000,0040DFE3,?,00412A59,00000000,?,0040DFE3,?,0040DFE3,?,00000000,00000000), ref: 00412B3E
MultiByteToWideChar.KERNEL32(00000009,?,000000FF,00000000,00000000,74DEE860,00428674,00000000,?,00412A59,00000000,?,0040DFE3,?,0040DFE3,?), ref: 00412B68

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 64e1477176139964343b1c6459b3b3e5cd564f77b681a68d3d2878c794b48bfa
Instruction ID: 2a56a42d278125ad634d74eb586f69142b7d7cb3a1436235cbcec2a717df93c1
Opcode Fuzzy Hash: 64e1477176139964343b1c6459b3b3e5cd564f77b681a68d3d2878c794b48bfa
Instruction Fuzzy Hash: 6531A734209115AFDB314F24DE40AEB3B65FF45764B25822AF855C62E0D6B8ACA1C79C

Function 10007093 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,10008922,?,10005B72), ref: 100070A0
InitializeCriticalSection.KERNEL32 ref: 100070A8
InitializeCriticalSection.KERNEL32 ref: 100070B0
InitializeCriticalSection.KERNEL32 ref: 100070B8

Memory Dump Source

Source File: 00000002.00000002.1736326119.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1735905725.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736612802.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1736868230.0000000010010000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_@AE2AF6.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: df881dd359dc54fa86db7768642a35b41112ed37ae1d6e776f33cabba6f89b4f
Instruction ID: 577411244c626e9fc6ee63a52d48d50eca6bb40afa868a4b0455fa2252862c5d
Opcode Fuzzy Hash: df881dd359dc54fa86db7768642a35b41112ed37ae1d6e776f33cabba6f89b4f
Instruction Fuzzy Hash: 47C00231A90135FBEA12AB65DD898897F25EB043A03018063F54451035CEB55C50DFD0

Function 0040F78F Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,0040E882,?,0040D7E0), ref: 0040F79C
InitializeCriticalSection.KERNEL32(?,0040E882,?,0040D7E0), ref: 0040F7A4
InitializeCriticalSection.KERNEL32(?,0040E882,?,0040D7E0), ref: 0040F7AC
InitializeCriticalSection.KERNEL32(?,0040E882,?,0040D7E0), ref: 0040F7B4

Memory Dump Source

Source File: 00000002.00000002.1732408164.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1732393095.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732438731.0000000000418000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000421000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732460768.0000000000424000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1732549022.0000000000429000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_@AE2AF6.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 7c1ebc378b22d0e8b3ae53161043e8d2a38dbd2c77177f54a8f64ca9e07651ac
Instruction ID: 50c9ae2927645dc934af3625bb155b39ac17ac1ccfa62184e15f329c955f65e4
Opcode Fuzzy Hash: 7c1ebc378b22d0e8b3ae53161043e8d2a38dbd2c77177f54a8f64ca9e07651ac
Instruction Fuzzy Hash: 1AC00232A01034BACA362B55FF058867F75EB152A13414073A30452070CAA11C12EFD8

Analysis Process: test.exePID: 2196, Parent PID: 984COMMON

Non-executed Functions

Function 0043B9C0 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

_ZNK13QOpenGLBuffer9isCreatedEv.QT5GUI ref: 0043B9D0
_ZN13QOpenGLBuffer4bindEv.QT5GUI ref: 0043B9F7
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 0043BA41
_ZN13QOpenGLBuffer7releaseEv.QT5GUI ref: 0043BA92
_ZN13QOpenGLBuffer8allocateEPKvi.QT5GUI ref: 0043BB01
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043BB26
_ZN13QOpenGLBuffer7releaseEv.QT5GUI ref: 0043BB3D
_ZN24QOpenGLVertexArrayObject4bindEv.QT5GUI ref: 0043BB62
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 0043BBC3
_Z9qBadAllocv.QT5CORE ref: 0043BCF0

Strings

a_color, xrefs: 0043BC47
$, xrefs: 0043BCB4
$, xrefs: 0043BB1B
a_start, xrefs: 0043BC95

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Open$Array$AllocationBuffer7releaseData8allocateEjjj6FlagsOptionS_16$AllocvBuffer4bindBuffer8allocateBuffer9isCreatedData10deallocateObject4bindS_jjVertex
String ID: $$$$a_color$a_start
API String ID: 976633068-3993229557
Opcode ID: 000386fb188aae6a37d44c9d39d7420fe5393183c9f959d11fcb9abfb6bc1378
Instruction ID: a9a0630f5ac7c6e9c26d01203a34b4ec3e04c7bb494e5e1cca410d6c2aae7dd8
Opcode Fuzzy Hash: 000386fb188aae6a37d44c9d39d7420fe5393183c9f959d11fcb9abfb6bc1378
Instruction Fuzzy Hash: 66A15AB0A04205DFCB00EF68D4986AEBBF1FF88314F10852EE9569B355DB389945CF96

Function 00401179 Relevance: 18.2, APIs: 12, Instructions: 202sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00401211
SetUnhandledExceptionFilter.KERNEL32 ref: 00401292
malloc.MSVCRT ref: 0040133F
strlen.MSVCRT ref: 00401366
malloc.MSVCRT ref: 00401371
memcpy.MSVCRT ref: 0040138D
GetStartupInfoA.KERNEL32 ref: 00401473

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: 25609d0bdb2af2d84345e5d985a947456fcd420ae17ec5186397dd20220b9703
Instruction ID: 53f1602e79e5c5f9722e637126e08f256338e11542e0716e6e256710acc29070
Opcode Fuzzy Hash: 25609d0bdb2af2d84345e5d985a947456fcd420ae17ec5186397dd20220b9703
Instruction Fuzzy Hash: D48180B1A08201CFD710DFA9D58475A7BE0FB46304F11853ED985EB3B2D778A849CB99

Function 00451880 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 004518CF
UnhandledExceptionFilter.KERNEL32 ref: 004518DF
GetCurrentProcess.KERNEL32 ref: 004518E8
TerminateProcess.KERNEL32 ref: 004518F9
abort.MSVCRT ref: 00451902

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 08d15e43aedef7dda845dd0e44642f85409120dbe397647334ccdf62fedb763a
Instruction ID: a690c7fc7135b6e26f041563c11b21ff09c7640cffe323d7e1500ddce41917a5
Opcode Fuzzy Hash: 08d15e43aedef7dda845dd0e44642f85409120dbe397647334ccdf62fedb763a
Instruction Fuzzy Hash: E101B6B5804204DFC740EFB9E9496497FF0FB4A305F408A3AE88997221E7B59558CF4A

Function 00440360 Relevance: 75.7, APIs: 42, Strings: 1, Instructions: 401COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00440390
_Z6qIsNaNf.QT5CORE ref: 004403AE
_ZN7QString6numberEdci.QT5CORE ref: 004403D4
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 004403F0
_ZN7QString6appendERKS_.QT5CORE ref: 00440405
_ZN7QString6appendERKS_.QT5CORE ref: 00440412
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440458
_Z6qIsNaNf.QT5CORE ref: 00440464
_ZN7QString6numberEdci.QT5CORE ref: 0044048A
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 004404A6
_ZN7QString6appendERKS_.QT5CORE ref: 004404BB
_ZN7QString6appendERKS_.QT5CORE ref: 004404C8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044050E
_Z6qIsNaNf.QT5CORE ref: 0044051A
_Z6qIsNaNf.QT5CORE ref: 0044053C
_ZN7QString6numberEdci.QT5CORE ref: 00440565
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00440581
_ZN7QString6appendERKS_.QT5CORE ref: 00440596
_ZN7QString6appendERKS_.QT5CORE ref: 004405A3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004405E9
_Z6qIsNaNf.QT5CORE ref: 004405F5
_ZN7QString6numberEdci.QT5CORE ref: 0044061E
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0044063A
_ZN7QString6appendERKS_.QT5CORE ref: 0044064F
_ZN7QString6appendERKS_.QT5CORE ref: 0044065C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004406A2
_Z6qIsNaNf.QT5CORE ref: 004406AE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440853
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440874

Strings

f, xrefs: 0044078D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: String6append$ArrayData10deallocateS_jj$EdciString15fromString6numberUtf8_helper$Ascii_helperString16from
String ID: f
API String ID: 4043239795-1993550816
Opcode ID: c1ab7615d746decde31920c067da5705adf2bd03a9b7fefba9dec64769f3c694
Instruction ID: b6b87e29f144be754a8321ed767d9d95072274eb90fed99891508e6da37d288a
Opcode Fuzzy Hash: c1ab7615d746decde31920c067da5705adf2bd03a9b7fefba9dec64769f3c694
Instruction Fuzzy Hash: 49029EB4904305DFEB00EF64D48869EBBF0FF84314F15892AE984A7364D73A9869CF46

Function 00433360 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 456windowCOMMON

Download Yara Rule

APIs

_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00433392
_ZN15QGuiApplication22applicationDisplayNameEv.QT5GUI ref: 0043339E
_ZN11QMessageBox7warningEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_.QT5WIDGETS ref: 004333BF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004333E3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00433405

Strings

G21G90; G53G0Z0, xrefs: 004335BA
Reset settings to default values?, xrefs: 00433383
&, xrefs: 0043355F
G21G91G38.2Z-30F100; G0Z1; G38.2Z-2F10, xrefs: 00433567

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Application22applicationBox7warningButtonDisplayFlagsMessageMetaNameObject2trS1_iS4_6S_14StandardStringWidget
String ID: &$G21G90; G53G0Z0$G21G91G38.2Z-30F100; G0Z1; G38.2Z-2F10$Reset settings to default values?
API String ID: 1526889372-1657726610
Opcode ID: 3f7eced39b6d704d1029c95adf305379524e94394c58f9f8152a4e2d3871ce59
Instruction ID: 7983c535889ed4ac6008d76a7dc82c0c69a7bfe6a1d5c5f94e8c120bd34348db
Opcode Fuzzy Hash: 3f7eced39b6d704d1029c95adf305379524e94394c58f9f8152a4e2d3871ce59
Instruction Fuzzy Hash: 0B22E7B45042048FDB04FF68D59976EBBF1AF94300F01856DD8859B3A5DB79A898CF82

Function 0042F9B0 Relevance: 65.1, APIs: 29, Strings: 8, Instructions: 322windowCOMMON

Download Yara Rule

APIs

_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0042F9F8
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 0042FA2A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042FA53
_ZN11QTextStreamlsEPKc.QT5CORE ref: 0042FA80
_ZN11QTextStreamlsEPKc.QT5CORE ref: 0042FAA6
_ZN6QDebugD1Ev.QT5CORE ref: 0042FABB
_ZN15QAbstractButton10setCheckedEb.QT5WIDGETS ref: 0042FBC6
_ZN8QVariantC1Eb.QT5CORE ref: 0042FBD8
_ZN7QObject11setPropertyEPKcRK8QVariant.QT5CORE ref: 0042FBF5
_ZN8QVariantD1Ev.QT5CORE ref: 0042FC00
_ZNK7QWidget5styleEv.QT5WIDGETS ref: 0042FC08
_ZNK7QWidget14ensurePolishedEv.QT5WIDGETS ref: 0042FC2D
_ZNK10QTableView16horizontalHeaderEv.QT5WIDGETS ref: 0042FC3F
_ZNK11QHeaderView9saveStateEv.QT5WIDGETS ref: 0042FC47
_ZNK10QTableView16horizontalHeaderEv.QT5WIDGETS ref: 0042FC85
_ZN11QHeaderView12restoreStateERK10QByteArray.QT5WIDGETS ref: 0042FC8F
_ZNK17QAbstractItemView14selectionModelEv.QT5WIDGETS ref: 0042FC9E
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 0042FCC7
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 0042FCCF
_ZN10QTableView9selectRowEi.QT5WIDGETS ref: 0042FCE2
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042FD41
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0042FDB3
_ZN9QLineEdit7setTextERK7QString.QT5WIDGETS ref: 0042FDC8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042FE25

Part of subcall function 00445990: _ZN18QAbstractItemModel15beginResetModelEv.QT5CORE(?,?,?,?,0000031A,00404281), ref: 00445996
Part of subcall function 00445990: _ZN18QAbstractItemModel13endResetModelEv.QT5CORE(?,?,?,?,0000031A,00404281), ref: 004459B7

Part of subcall function 00443460: _ZdlPv.LIBSTDC++-6 ref: 004434BC
Part of subcall function 00443460: _ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 00443536

Part of subcall function 00443460: _Z5qQNaNv.QT5CORE ref: 004435C8
Part of subcall function 00443460: _Z5qQNaNv.QT5CORE ref: 004435CD
Part of subcall function 00443460: _Z5qQNaNv.QT5CORE ref: 004435D2
Part of subcall function 00443460: _Z5qQNaNv.QT5CORE ref: 004435E3
Part of subcall function 00443460: _Z5qQNaNv.QT5CORE ref: 004435E8
Part of subcall function 00443460: _Z5qQNaNv.QT5CORE ref: 004435ED
Part of subcall function 00443460: _Z5qQNaNv.QT5CORE ref: 004435FE

Part of subcall function 00403F70: _ZNK9QVector3D6lengthEv.QT5GUI ref: 00403FE8
Part of subcall function 00403F70: _Z6qIsNaNd.QT5CORE ref: 00403FF5
Part of subcall function 00403F70: _ZN9QListData6detachEi.QT5CORE ref: 00404029

Part of subcall function 00471AA0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471AAE

_ZN11QTextStreamlsEc.QT5CORE ref: 0042FE4C
_ZN11QTextStreamlsEc.QT5CORE ref: 0042FE67
_ZN11QTextStreamlsEc.QT5CORE ref: 0042FE87
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042FEB3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042FED4

Strings

true, xrefs: 0042FA75, 0042FA9B
overrided, xrefs: 0042FBEE
1onTableCurrentChanged(QModelIndex,QModelIndex), xrefs: 0042FCAC
changes:, xrefs: 0042FA0C
2currentChanged(QModelIndex,QModelIndex), xrefs: 0042FCB8
false, xrefs: 0042FA68, 0042FA96
default, xrefs: 0042F9EB
Untitled, xrefs: 0042FDA4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayText$Streamls$Data10deallocateS_jj$AbstractHeader$ItemModelTableVariant$ConnectionListMetaResetStateStringView16horizontal$AllocationButton10setByteCheckedD6lengthDataData6detachData7disposeData8allocateDebugEdit7setEjjj6FlagsLineLogger5debugMessageModel13endModel15beginObject10Object11setObject2trObject7connectOptionPolishedPropertyQt14S1_iS_16TypeVector3View12restoreView14selectionView9saveView9selectWidget14ensureWidget5style
String ID: 1onTableCurrentChanged(QModelIndex,QModelIndex)$2currentChanged(QModelIndex,QModelIndex)$Untitled$changes:$default$false$overrided$true
API String ID: 2367289132-2706518009
Opcode ID: e7c4a973108be5ad41ee9b51201ba3f619d1e54eedc5c951da7469d07b6e19bf
Instruction ID: 472a54a46040f8fb270f7aac692bb7486b26cfaebdcb15eed94c9d6afe6b7562
Opcode Fuzzy Hash: e7c4a973108be5ad41ee9b51201ba3f619d1e54eedc5c951da7469d07b6e19bf
Instruction Fuzzy Hash: 32E180B4A042049FDB04EF68E49876E7BF1BF44304F91857DE8469B366DB389849CF4A

Function 00402519 Relevance: 59.8, APIs: 30, Strings: 4, Instructions: 264COMMON

Download Yara Rule

APIs

_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00401C09
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401C42
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00401CB3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401CF2
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401D1B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401D44
_Znwj.LIBSTDC++-6 ref: 00401D6A
_ZN11QTranslatorC1EP7QObject.QT5CORE ref: 00401D7E
_ZN11QTranslator4loadERK7QStringS2_S2_S2_.QT5CORE ref: 00401DC5
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401DF3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401E1C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401E45
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00401E6F
_ZN16QCoreApplication21setApplicationVersionERK7QString.QT5CORE ref: 00401E84
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401EAD
_ZNK12QApplication10styleSheetEv.QT5WIDGETS ref: 00401EC2
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00401F01
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401F3A
_ZN12QApplication13setStyleSheetERK7QString.QT5WIDGETS ref: 00401F49
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401F75
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401F9E
_ZN7QWidget4showEv.QT5WIDGETS ref: 00401FBF
_ZN12QApplication4execEv.QT5WIDGETS ref: 00401FC5
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00401FFB
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402024
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040204D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402072
_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040207E
_ZN12QApplicationD1Ev.QT5WIDGETS ref: 0040208A
_ZN16QCoreApplication17installTranslatorEP11QTranslator.QT5CORE ref: 00402529
_ZN16QCoreApplication17installTranslatorEP11QTranslator.QT5CORE ref: 0040253D

Strings

1.1.7, xrefs: 00401E68
.qm, xrefs: 00401CA8
qt_, xrefs: 00401BFE
QWidget {font-size: 8pt}, xrefs: 00401EF6

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Translator$CoreStringString15fromUtf8_helper$ApplicationApplication17installSheet$Application10styleApplication13setApplication21setApplication4execAscii_helperFormatObjectString16fromStyleTranslator4loadVersionWidget4showZnwj
String ID: .qm$1.1.7$QWidget {font-size: 8pt}$qt_
API String ID: 3769272640-4060635474
Opcode ID: df1740036eea80f12b4b34d7becba356dd7a783032694ad7bf5dcf5a17d8877f
Instruction ID: fab97603c71d1373fac279fab67cdba15be5163c4ffed7c064040b609f137f5d
Opcode Fuzzy Hash: df1740036eea80f12b4b34d7becba356dd7a783032694ad7bf5dcf5a17d8877f
Instruction Fuzzy Hash: 72D1E2B49053158FDB10AF24C98879EBBF1FF84344F1089ADD689AB364D7789988CF49

Function 0040F4B0 Relevance: 59.7, APIs: 29, Strings: 5, Instructions: 228COMMON

Download Yara Rule

APIs

_ZN9QSettingsC1ERK7QStringNS_6FormatEP7QObject.QT5CORE ref: 0040F4D8
_ZN9QSettings11setIniCodecEPKc.QT5CORE ref: 0040F4EB
_ZN8QVariantC1EPKc.QT5CORE ref: 0040F4FE
_ZNK8QVariant8toStringEv.QT5CORE ref: 0040F552
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0040F571
_ZN7QString6appendERKS_.QT5CORE ref: 0040F57F
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040F597
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040F5B7
_ZNK12QApplication10styleSheetEv.QT5WIDGETS ref: 0040F5CD
_ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 0040F5E0
_ZN12QApplication13setStyleSheetERK7QString.QT5WIDGETS ref: 0040F5F3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F61C
_ZN7QRegExpD1Ev.QT5CORE ref: 0040F624
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F64A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F670
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F696
_ZN8QVariantD1Ev.QT5CORE ref: 0040F6A5
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F6C7
_ZN8QVariantD1Ev.QT5CORE ref: 0040F6D3
_ZN9QGLFormat13defaultFormatEv.QT5OPENGL ref: 0040F6D8
_ZN8QVariantC1Eb.QT5CORE ref: 0040F6E7
_ZNK8QVariant6toBoolEv.QT5CORE ref: 0040F724
_ZN9QGLFormat15setSwapIntervalEi.QT5OPENGL ref: 0040F732
_ZN8QVariantD1Ev.QT5CORE ref: 0040F73E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F75C
_ZN8QVariantD1Ev.QT5CORE ref: 0040F764
_ZN9QGLFormat16setDefaultFormatERKS_.QT5OPENGL ref: 0040F769
_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F771
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F77A

Strings

fontSize, xrefs: 0040F514
font-size:\s*\d+, xrefs: 0040F590
vsync, xrefs: 0040F6FB
UTF-8, xrefs: 0040F4E4
font-size: , xrefs: 0040F566

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jjVariant$FormatString$SettingsSheet$Application10styleApplication13setAscii_helperBoolCaseCodecDefaultFormat13defaultFormat15setFormat16setIntervalObjectPatternQt15S_13SensitivitySettings11setString15fromString16fromString6appendString7replaceStyleSwapSyntaxUtf8_helperVariant6toVariant8to
String ID: UTF-8$font-size: $font-size:\s*\d+$fontSize$vsync
API String ID: 1710846834-3850597127
Opcode ID: 5a15afacf7cb6abf960a87028e162fa2ef7e66b055218a196d94e8826af5569b
Instruction ID: db21c44bc4e4a656a8dcf58416a975cc16f9afcd3e55df4a9d65e620bac9117f
Opcode Fuzzy Hash: 5a15afacf7cb6abf960a87028e162fa2ef7e66b055218a196d94e8826af5569b
Instruction Fuzzy Hash: 9BA118B49043059FDB14EFA8D49869EBBF0FF44314F548A3DD485A72A0EB399889CF46

Function 00403470 Relevance: 56.5, APIs: 28, Strings: 4, Instructions: 483COMMON

Download Yara Rule

APIs

__cxa_guard_acquire.LIBSTDC++-6 ref: 00403498
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00403533
_ZN15QAbstractButton7setTextERK7QString.QT5WIDGETS ref: 00403548
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00403571
_ZN7QWidget15setMinimumWidthEi.QT5WIDGETS ref: 00403591
_ZN7QWidget7repaintEv.QT5WIDGETS ref: 0040367F
__cxa_guard_acquire.LIBSTDC++-6 ref: 004036B7
__cxa_guard_release.LIBSTDC++-6 ref: 004036DE
_ZNK15QAbstractButton4textEv.QT5WIDGETS ref: 00403867
_ZeqRK7QStringS1_.QT5CORE ref: 0040387A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004038C3
_ZN15QAbstractButton7setTextERK7QString.QT5WIDGETS ref: 00403906
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040392F

Strings

Check mode, xrefs: 004037B5
Autoscroll, xrefs: 004038E5
Scroll, xrefs: 00403838, 00403A1D
Check, xrefs: 00403524, 00403708, 00403967

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractArrayData10deallocateS_jjString$Button7setText__cxa_guard_acquire$Button4textMetaMinimumObject2trS1_iWidget15setWidget7repaintWidth__cxa_guard_release
String ID: Autoscroll$Check$Check mode$Scroll
API String ID: 2270580755-4151716742
Opcode ID: 764d7d2ae982bd7607a25c4a17a70e1b4b384415a3f580180644f708cf3a7144
Instruction ID: 49773ea21b4a6999add3c0064889408d159629f4d7882c6ed7b5aaeee87fb8da
Opcode Fuzzy Hash: 764d7d2ae982bd7607a25c4a17a70e1b4b384415a3f580180644f708cf3a7144
Instruction Fuzzy Hash: FD226FB4A04201CFCB04DF68C48869EBBF1FF88315F158669E895AB3A1D739E845CF45

Function 00434BF0 Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 278COMMON

Download Yara Rule

APIs

_ZN7QDialogC2EP7QWidget6QFlagsIN2Qt10WindowTypeEE.QT5WIDGETS ref: 00434C09
_Znwj.LIBSTDC++-6 ref: 00434C26
_ZN13QIntValidatorC1EP7QObject.QT5GUI ref: 00434C4F
_ZN7QLocaleC1ENS_8LanguageENS_7CountryE.QT5CORE ref: 00434C7A
_ZN7QWidget9setLocaleERK7QLocale.QT5WIDGETS ref: 00434C88
_ZN7QLocaleD1Ev.QT5CORE ref: 00434C93
_ZN13QIntValidator9setBottomEi.QT5GUI ref: 00434CA5
_ZN13QIntValidator6setTopEi.QT5GUI ref: 00434CB7
_ZN9QComboBox12setValidatorEPK10QValidator.QT5WIDGETS ref: 00434CD5
_ZN9QComboBox12setValidatorEPK10QValidator.QT5WIDGETS ref: 00434CE9
_Z23qt_qFindChildren_helperPK7QObjectRK7QStringRK11QMetaObjectP5QListIPvE6QFlagsIN2Qt15FindChildOptionEE.QT5CORE ref: 00434D1B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00434DB8
_ZNK11QListWidget5countEv.QT5WIDGETS ref: 00434DC4
_ZNK11QListWidget4itemEi.QT5WIDGETS ref: 00434DD2
_ZNK7QObject10objectNameEv.QT5CORE ref: 00434DF0
_ZN8QVariantC1ERK7QString.QT5CORE ref: 00434DFF
_ZN8QVariantD1Ev.QT5CORE ref: 00434E21
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00434E47
_ZNK9QGroupBox5titleEv.QT5WIDGETS ref: 00434E7B
_ZNK11QListWidget5countEv.QT5WIDGETS ref: 00434E92
_ZN11QListWidget10insertItemEiRK7QString.QT5WIDGETS ref: 00434EA0
_ZNK11QListWidget4itemEi.QT5WIDGETS ref: 00434F15
_ZN11QListWidget15setItemSelectedEPK15QListWidgetItemb.QT5WIDGETS ref: 00434F30
_ZNK19QAbstractScrollArea17verticalScrollBarEv.QT5WIDGETS ref: 00434F3F
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 00434F6B
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 00434F74
_ZN9QListData6detachEi.QT5CORE ref: 00434FBA
memcpy.MSVCRT ref: 00434FFE

Strings

2valueChanged(int), xrefs: 00434F60
QC, xrefs: 00434C18
1onScrollBarValueChanged(int), xrefs: 00434F54

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$Validator$Locale$ObjectString$ArrayBox12setComboConnectionData10deallocateFindFlagsItemMetaS_jjScrollTypeVariantWidget4itemWidget5count$AbstractArea17verticalBottomBox5titleChildChildren_helperCountryData6detachDialogGroupItembLanguageNameObject10Object10objectObject7connectOptionQt10Qt14Qt15SelectedValidator6setValidator9setWidgetWidget10insertWidget15setWidget6Widget9setWindowZ23qt_qZnwjmemcpy
String ID: QC$1onScrollBarValueChanged(int)$2valueChanged(int)
API String ID: 3435305693-1886318998
Opcode ID: 789cd66c216b0073a68b2700d95e80c1b8e0097d8c5f84725f208e98eae51ca5
Instruction ID: 765925c98e1df5cc145d400bfa724ac36408931a4275cad640ecf07b8926fa6b
Opcode Fuzzy Hash: 789cd66c216b0073a68b2700d95e80c1b8e0097d8c5f84725f208e98eae51ca5
Instruction Fuzzy Hash: F5D12CB4904204CFCB04EF68D59859EBBF1FF88310F15856EE8459B365DB74A845CF86

Function 0040E600 Relevance: 54.7, APIs: 29, Strings: 2, Instructions: 476windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405D8B
Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DA0
Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DB4
Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DC2

_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 0040E646
_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 0040E660
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E69C
_Z6qIsNaNf.QT5CORE ref: 0040E6A1
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E709
_Z6qIsNaNd.QT5CORE ref: 0040E727
_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0040E779
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0040E798
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 0040E7A4
_ZN6QDebugD1Ev.QT5CORE ref: 0040E82C
_ZN6QDebugD1Ev.QT5CORE ref: 0040E830
_ZN6QDebugD1Ev.QT5CORE ref: 0040E838
_ZN6QDebugD1Ev.QT5CORE ref: 0040E83D
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E870
_ZNK9QVector3D10normalizedEv.QT5GUI ref: 0040E899
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E8C0
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0040E91D
_Znwj.LIBSTDC++-6 ref: 0040E9D5
_ZN9QListData6detachEi.QT5CORE ref: 0040EA12
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040EA86
_ZN11QTextStreamlsEc.QT5CORE ref: 0040EAA2
memcpy.MSVCRT ref: 0040EABE

Strings

ERROR length:, xrefs: 0040E78D
default, xrefs: 0040E76F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Box5valueDoubleSpin$Vector3$D6lengthDebug$ListStreamlsText$ArrayD10normalizedDataData10deallocateData6detachData7disposeLogger5debugMessageS_jjStringString15fromUtf8_helperZnwjmemcpy
String ID: ERROR length:$default
API String ID: 4015208753-1537122966
Opcode ID: 7c936f45afa2ee461846f8f5f0393fd6053fc6b702259f3f3e8397e27f996e60
Instruction ID: 71c70bc65d029fb791b3f7e5bb551834d4eb2eff15102b737d9e2fa7db171372
Opcode Fuzzy Hash: 7c936f45afa2ee461846f8f5f0393fd6053fc6b702259f3f3e8397e27f996e60
Instruction Fuzzy Hash: 28226170A04218CFCB14EF65D58869DBBF0FF44300F2589AAD889AB366DB349DA5CF45

Function 0040BB00 Relevance: 54.7, APIs: 29, Strings: 2, Instructions: 428COMMON

Download Yara Rule

APIs

_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040BB16
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0040BB45
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040BB5A
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0040BBB7
_ZNK7QString5toIntEPbi.QT5CORE ref: 0040BBCE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BBFA
_ZNK9QVector3D10normalizedEv.QT5GUI ref: 0040BC4E
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040BC81
_ZNK7QString3argEdici5QChar.QT5CORE ref: 0040BCC2
_ZNK7QString3argEdici5QChar.QT5CORE ref: 0040BCFB
_ZNK7QString3argEdici5QChar.QT5CORE ref: 0040BD34
_ZNK7QString3argExii5QChar.QT5CORE ref: 0040BD6A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BDB3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BDD9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BDFF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BE25
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BE4B

Strings

$J=G21G91X%1Y%2Z%3F%4, xrefs: 0040BC62, 0040BF5F
g, xrefs: 0040C003

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$CharString3arg$Edici5$Box11currentComboTextVector3$Ascii_helperD10normalizedD6lengthDoubleExii5String16fromString5toString8to
String ID: $J=G21G91X%1Y%2Z%3F%4$g
API String ID: 933172395-1902803442
Opcode ID: bd1a0e932d985e71c8c38d5bb791de106098ae52199360422c682335c1c0e6fe
Instruction ID: fb105eb140ad7745f5485a4dc0b5e2c64b55abc85c0abecde211c06132d9cda5
Opcode Fuzzy Hash: bd1a0e932d985e71c8c38d5bb791de106098ae52199360422c682335c1c0e6fe
Instruction Fuzzy Hash: CD1229B0904309DFDB00EF64D58869EBBF0FF84314F158969D484AB3A4E73A9959CF86

Function 0040ACF9 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 384COMMON

Download Yara Rule

APIs

Part of subcall function 004099C0: _ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AD75
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040ADA1
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040ADB6
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040ADE8
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040ADF7
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040AE29
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040AE38
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AF60
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AF86
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AFAC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AFD2
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AFF8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B01E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B044
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040B06A
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040B079
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040B0B7
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040B0C6
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040B104
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040B113
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B240
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B266
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B28C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B2B2
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B2D8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B2FE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B324

Strings

G53G90G0X%1Y%2Z%3, xrefs: 0040AE63
G21, xrefs: 0040AD25
g, xrefs: 0040B1E2
G92X%1Y%2Z%3, xrefs: 0040B14A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$DoubleEdit4textLineString8to$Device6isOpen
String ID: G21$G53G90G0X%1Y%2Z%3$G92X%1Y%2Z%3$g
API String ID: 3795681016-3115675479
Opcode ID: 34ae1692844f564a6d79399c7db777f8deda82ea610941afa6ae8297eee1aff8
Instruction ID: e2834fa09fb1c92ad391a0ca5a9ca049da0105ecf9b2bc2a86057e62da63c79c
Opcode Fuzzy Hash: 34ae1692844f564a6d79399c7db777f8deda82ea610941afa6ae8297eee1aff8
Instruction Fuzzy Hash: 47022AB4904305CBDB00EFA4D58879EBBF1FF88314F11896DE894AB395DB789848CB56

Function 0040A05C Relevance: 52.9, APIs: 27, Strings: 3, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040A068
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A0A1
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A0B6
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A0E8
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A0F7
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A129
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A138
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A265
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A28B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A2B1
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A2D7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A2FD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A323
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A349
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A36F
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A37E
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A3B0
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A3BF
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A3F1
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A400
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A521
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A547
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A56D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A593
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A5B9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A5DB
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A5FD

Strings

G21G53G90X%1Y%2Z%3, xrefs: 0040A168
g, xrefs: 0040A4C3
G21G92X%1Y%2Z%3, xrefs: 0040A42B

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$DoubleEdit4textLineString8to$ResumeUnwind_
String ID: G21G53G90X%1Y%2Z%3$G21G92X%1Y%2Z%3$g
API String ID: 4213677738-3882755902
Opcode ID: 84b682f238bbcde640fc966d2e2826517e07e6e5fdedb695324bda6c4d6981fa
Instruction ID: c88723479f5b871758223dc5baf98e72c5a3d24c8c206eb42ffcbcbb6029b354
Opcode Fuzzy Hash: 84b682f238bbcde640fc966d2e2826517e07e6e5fdedb695324bda6c4d6981fa
Instruction Fuzzy Hash: BFF139B4904305CBDB00EFA4D48869EBBF1FF88314F10896DE884AB395DB799859CB56

Function 0040A070 Relevance: 51.2, APIs: 26, Strings: 3, Instructions: 457COMMON

Download Yara Rule

APIs

_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A0A1
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A0B6
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A0E8
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A0F7
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A129
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A138
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A265
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A28B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A2B1
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A2D7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A2FD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A323
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A349
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A36F
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A37E
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A3B0
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A3BF
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 0040A3F1
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0040A400
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A521
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A547
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A56D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A593
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A5B9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A5DB
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A5FD

Strings

G21G53G90X%1Y%2Z%3, xrefs: 0040A168
g, xrefs: 0040A4C3
G21G92X%1Y%2Z%3, xrefs: 0040A42B

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$DoubleEdit4textLineString8to
String ID: G21G53G90X%1Y%2Z%3$G21G92X%1Y%2Z%3$g
API String ID: 3926616291-3882755902
Opcode ID: 460839cd2362f571c957ced56cdd1f47cfc0ec6f12a0d3a3ca009a70cac06f38
Instruction ID: 770e57adcb076919d2f126627f0abf58dab345ceeac997cac2a7f0f2528f4a34
Opcode Fuzzy Hash: 460839cd2362f571c957ced56cdd1f47cfc0ec6f12a0d3a3ca009a70cac06f38
Instruction Fuzzy Hash: 0B125BB4904305DBDB00EF68D48869EBBF1FF84314F148A6DE8946B394DB3A9859CB46

Function 0041B529 Relevance: 51.2, APIs: 24, Strings: 5, Instructions: 404COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041ACE1
_ZN9QListData5eraseEPPv.QT5CORE ref: 0041ACEC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041AD2A
_ZN7QString14trimmed_helperERKS_.QT5CORE ref: 0041AD43
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041AD7E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041ADFF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041AE28

Part of subcall function 00440DB0: _ZN7QString15toLatin1_helperERKS_.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041AE46), ref: 00440DD8
Part of subcall function 00440DB0: _ZN7QString6appendE5QChar.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041AE46), ref: 00440EB7
Part of subcall function 00440DB0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440F0E
Part of subcall function 00440DB0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440F34

_ZN7QStringaSERKS_.QT5CORE ref: 0041AEA2
_ZNK15QProgressDialog7maximumEv.QT5WIDGETS ref: 0041AF6F
_ZN15QProgressDialog8setValueEi.QT5WIDGETS ref: 0041AF86
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 0041AF96
_ZNK15QProgressDialog11wasCanceledEv.QT5WIDGETS ref: 0041AFA2
_ZN7QWidget5closeEv.QT5WIDGETS ref: 0041AFC6
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041B0F6
_ZN11QTextStreamlsEc.QT5CORE ref: 0041B6C2

Part of subcall function 004326F0: _ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS(?,0041B169), ref: 004326FF

Part of subcall function 00403F70: _ZNK9QVector3D6lengthEv.QT5GUI ref: 00403FE8
Part of subcall function 00403F70: _Z6qIsNaNd.QT5CORE ref: 00403FF5
Part of subcall function 00403F70: _ZN9QListData6detachEi.QT5CORE ref: 00404029

Part of subcall function 00471AA0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471AAE

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041B253
_ZN11QHeaderView12restoreStateERK10QByteArray.QT5WIDGETS ref: 0041B2D3
_ZNK17QAbstractItemView14selectionModelEv.QT5WIDGETS ref: 0041B2E8
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 0041B317
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 0041B31F
_ZN10QTableView9selectRowEi.QT5WIDGETS ref: 0041B332

Part of subcall function 00403E60: _ZdlPv.LIBSTDC++-6(?,?,?,0041B371), ref: 00403E8F
Part of subcall function 00403E60: _ZN9QLineEdit5clearEv.QT5WIDGETS(?,?,?,?,?,?,?,0041B371), ref: 00403EE3

_ZN15QProgressDialogD1Ev.QT5WIDGETS ref: 0041B37E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041B3B2
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041B3DB

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

Part of subcall function 0043CE90: _ZdlPv.LIBSTDC++-6 ref: 0043CEF8
Part of subcall function 0043CE90: _ZN7QObjectD2Ev.QT5CORE ref: 0043CF28

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041B438
_ZN11QTextStreamlsEc.QT5CORE ref: 0041B692
_ZN11QTextStreamlsEc.QT5CORE ref: 0041B6A7
_ZN11QTextStreamlsEc.QT5CORE ref: 0041B707

Strings

1onTableCurrentChanged(QModelIndex,QModelIndex), xrefs: 0041B2FC
model filled:, xrefs: 0041B0B4
2currentChanged(QModelIndex,QModelIndex), xrefs: 0041B308
view parser filled:, xrefs: 0041B211
default, xrefs: 0041B08A, 0041B1ED

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$Data10deallocateS_jj$ProgressStreamlsText$List$AbstractConnectionEvents$Application13processButton9isByteCanceledCharCheckedCoreD6lengthDataData5eraseData6detachData7disposeDialogDialog11wasDialog7maximumDialog8setEdit5clearEventFlagFlagsHeaderItemLatin1_helperLineLoop17MetaModelObjectObject10Object7connectProcessQt14StateString14trimmed_helperString15toString6appendStringaTableTypeValueVector3View12restoreView14selectionView9selectWidget5close
String ID: 1onTableCurrentChanged(QModelIndex,QModelIndex)$2currentChanged(QModelIndex,QModelIndex)$default$model filled:$view parser filled:
API String ID: 1623609310-1195016428
Opcode ID: 1030f92aa699a33240020ce898542518413fee53f3754f2cc978c7a7d74ee40a
Instruction ID: 389af5cd83772c36792c5d744256fe1a72f98c7591cfb28371349a0aedc0e3e5
Opcode Fuzzy Hash: 1030f92aa699a33240020ce898542518413fee53f3754f2cc978c7a7d74ee40a
Instruction Fuzzy Hash: AF22D5B4904319CFDB24EF24C99879EBBB1BF44304F0085ADD489A7351DB74AA89CF96

Function 0042E580 Relevance: 50.0, APIs: 33, Instructions: 458COMMON

Download Yara Rule

APIs

_ZN5QFileC1ERK7QString.QT5CORE ref: 0042E59B
_ZN4QDirC1ERK7QString.QT5CORE ref: 0042E5B8
_ZNK5QFile6existsEv.QT5CORE ref: 0042E5E5
_ZNK5QFile8fileNameEv.QT5CORE ref: 0042E5FD
_ZN4QDir6removeERK7QString.QT5CORE ref: 0042E60F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042E64D
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE.QT5CORE ref: 0042E65D
_ZN11QTextStreamC1EP9QIODevice.QT5CORE ref: 0042E67D
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E6A1
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E6B5
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E6D4
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E6F3
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E7C1
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E7D5
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E7F1
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E80D
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E932
_ZNK16QAbstractSpinBox4textEv.QT5WIDGETS ref: 0042E946
_ZNK9QComboBox12currentIndexEv.QT5WIDGETS ref: 0042E954
_ZN11QTextStreamlsEi.QT5CORE ref: 0042E960
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EBCE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EBEF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EC15
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EC3B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EC61

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractBox4textSpin$ArrayData10deallocateS_jj$String$Text$Box12currentComboDeviceDevice12Dir6removeFileFile4openFile6existsFile8fileFlagFlagsIndexModeNameOpenStreamStreamls
String ID:
API String ID: 1655651007-0
Opcode ID: c644d1d0806cdbb016a7f495be67af23f40e740b8c6ea1d2c35e4a38e225d5ba
Instruction ID: 7123866bbc87ccf535e6dfcc9eef2acb548c22b6c3917f90961ea0784f32a695
Opcode Fuzzy Hash: c644d1d0806cdbb016a7f495be67af23f40e740b8c6ea1d2c35e4a38e225d5ba
Instruction Fuzzy Hash: 68223CB0A043188FDB14EFB8D4986ADBBF1BF44310F54466DD88A97354EB34A989CF46

Function 004099C0 Relevance: 49.4, APIs: 26, Strings: 2, Instructions: 350COMMON

Download Yara Rule

APIs

_ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6
_ZN7QString14toUpper_helperERKS_.QT5CORE ref: 00409A00
_ZN7QStringaSERKS_.QT5CORE ref: 00409A73
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00409AB9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409B04
_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE ref: 00409B23
_ZN7QRegExp3capEi.QT5CORE ref: 00409B50
_ZNK7QString5toIntEPbi.QT5CORE ref: 00409B6B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409B97
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00409BD5
_ZNK7QString7indexOfERK7QRegExpi.QT5CORE ref: 00409C09
_ZN7QRegExpD1Ev.QT5CORE ref: 00409C1D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409C3F
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00409C81
_ZN7QString6appendERKS_.QT5CORE ref: 00409C92
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409CBB
_ZN7QString15toLatin1_helperERKS_.QT5CORE ref: 00409CCB
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 00409CEA
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409D13
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409D39
_ZN7QRegExpD1Ev.QT5CORE ref: 00409D42

Part of subcall function 0044D630: _ZN8QSpinBox8setValueEi.QT5WIDGETS(?,?,?,00409BC3), ref: 0044D646

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409D83
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409DB3

Strings

[Ss]0*(\d+), xrefs: 00409AB2
M0*2|M30, xrefs: 00409BCE

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperString16from$Box8setCaretDevice5writeDevice6isExp3capExp7indexExpiLatin1_helperModeOpenSpinString14toString15fromString15toString5toString6appendString7indexStringaStringiUpper_helperUtf8_helperValue
String ID: M0*2|M30$[Ss]0*(\d+)
API String ID: 3472984461-2506890424
Opcode ID: 8fc015a2c830d76297d1463c74fb1b2b3aedcb7f8f3020521dc86ff1cf0f5df3
Instruction ID: 3767587674780bea0f1802d3873bc840f95af1854b63fbb6b7ab974efcc1104f
Opcode Fuzzy Hash: 8fc015a2c830d76297d1463c74fb1b2b3aedcb7f8f3020521dc86ff1cf0f5df3
Instruction Fuzzy Hash: 3EF159B4904205DFCB04DF68D48869EBBF1FF88314F14862AE855AB3A1D739AC49CF56

Function 0042D8E0 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 353COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042D98F
_ZN11QTextStreamlsEc.QT5CORE ref: 0042DD87

Part of subcall function 00432480: _ZNK9QComboBox11currentTextEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,0040FA03), ref: 00432493
Part of subcall function 00432480: _ZNK7QString5toIntEPbi.QT5CORE ref: 004324AE
Part of subcall function 00432480: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004324D6

Part of subcall function 00432430: _ZNK9QComboBox11currentTextEv.QT5WIDGETS(?,?,?,?,00000002,0042C404), ref: 00432443

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042DA46
_ZN6QDebug9putStringEPK5QCharj.QT5CORE ref: 0042DA6C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042DAC6
_ZN11QTextStreamlsEi.QT5CORE ref: 0042DADF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042DB1D
_ZN7QString14compare_helperEPK5QChariPKciN2Qt15CaseSensitivityE.QT5CORE ref: 0042DB5E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042DB90
_ZNK9QIODevice6isOpenEv.QT5CORE(00000001), ref: 0042DBA8
_ZN11QSerialPort11setPortNameERK7QString.QT5SERIALPORT ref: 0042DBD2
_ZN11QSerialPort11setBaudRateEi6QFlagsINS_9DirectionEE.QT5SERIALPORT ref: 0042DC14
_ZN11QTextStreamlsEc.QT5CORE ref: 0042DD27
_ZN11QTextStreamlsEc.QT5CORE ref: 0042DD3C
_ZN11QTextStreamlsEc.QT5CORE ref: 0042DD57
_ZN11QTextStreamlsEc.QT5CORE ref: 0042DD6C
_ZNK11QSerialPort8portNameEv.QT5SERIALPORT ref: 0042DDA4
_ZeqRK7QStringS1_.QT5CORE ref: 0042DDCA
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042DDFB
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042DE1D

Strings

Port:, xrefs: 0042DA0D
Baud:, xrefs: 0042DA8A
default, xrefs: 0042D930, 0042D9F2
Applying settings, xrefs: 0042D94C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jjText$Streamls$SerialString$Box11currentComboNamePort11set$BaudCaseChariCharjDebug9putDevice6isDirectionFlagsOpenPortPort8portQt15RateSensitivityString14compare_helperString5to
String ID: Applying settings$Baud:$Port:$default
API String ID: 2779695237-3975943926
Opcode ID: bc13486aa8ae02e3c3636f62b8541cd46b0e4308149168c0e8c70219cff11007
Instruction ID: 528736bba5b87ce8832c3a77ce4224ba8f68d571ff065aeac6e2da2f8d866863
Opcode Fuzzy Hash: bc13486aa8ae02e3c3636f62b8541cd46b0e4308149168c0e8c70219cff11007
Instruction Fuzzy Hash: 1FF16CB0E08244DFDB04EFA8E48879EBBF1BF44304F54852EE4959B364DB799849CB46

Function 00404B90 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00404BC8
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00404BDD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404C06
_ZN7QWidget6updateEv.QT5WIDGETS ref: 00404C4A
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 00404C57

Strings

(%1/%2/%3), xrefs: 00404D75
Overriding, xrefs: 00404BB7, 00404E1A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Events$Application13processArrayBox8setCoreData10deallocateEventFlagFlagsGroupLoop17MetaObject2trProcessS1_iS_jjStringTitleWidget6update
String ID: (%1/%2/%3)$Overriding
API String ID: 1194972151-3697313130
Opcode ID: 6e714f907fc28e01d515a70357170ce980cc1fb187446643d35919c646322406
Instruction ID: 4b6b06bdbd3564aa32854c2e4091aaafe3fba6078c224ad87eb51a8b65034518
Opcode Fuzzy Hash: 6e714f907fc28e01d515a70357170ce980cc1fb187446643d35919c646322406
Instruction Fuzzy Hash: C2F18CB4904301DFDB04DF68D4886AEBBF1FF84314F14862AE954AB3A4D7799845CF86

Function 00442D50 Relevance: 45.2, APIs: 30, Instructions: 226COMMON

Download Yara Rule

APIs

_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442D7F
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442D90
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442DAB
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442DBC
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442DD7
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442DE8
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442E03
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442E14
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442E2F
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442E40
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442E5B
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442E68
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00442E88
_Z6qIsNaNd.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00443017
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00443027

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98ff7bf975d8f098e2a9eae005e161342d74f89f42a2417cd145b0dee59e0c9
Instruction ID: 9317f5e9bb02fea394928649fb5e2225a7c3b097e5489c98bb304e39613b4d3a
Opcode Fuzzy Hash: e98ff7bf975d8f098e2a9eae005e161342d74f89f42a2417cd145b0dee59e0c9
Instruction Fuzzy Hash: 8671F8B0408E07C7AA11BF01E58816AFFB0FF98784F910989F4C12116ADB768879978F

Function 004357D0 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 248COMMON

Download Yara Rule

APIs

_ZN7QDialogC2EP7QWidget6QFlagsIN2Qt10WindowTypeEE.QT5WIDGETS ref: 004357E9
_Znwj.LIBSTDC++-6 ref: 00435806

Part of subcall function 00461410: _ZNK7QObject10objectNameEv.QT5CORE ref: 00461424
Part of subcall function 00461410: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00461450
Part of subcall function 00461410: _ZN7QObject13setObjectNameERK7QString.QT5CORE ref: 0046146A
Part of subcall function 00461410: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00461493
Part of subcall function 00461410: _ZN7QWidget6resizeERK5QSize.QT5WIDGETS ref: 004614B0
Part of subcall function 00461410: _ZN7QString17fromLatin1_helperEPKci.QT5CORE ref: 004614C8
Part of subcall function 00461410: _ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS ref: 004614E0
Part of subcall function 00461410: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00461505
Part of subcall function 00461410: _Znwj.LIBSTDC++-6 ref: 00461512
Part of subcall function 00461410: _ZN11QVBoxLayoutC1EP7QWidget.QT5WIDGETS ref: 00461521
Part of subcall function 00461410: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00461568
Part of subcall function 00461410: _ZN7QLayout18setContentsMarginsEiiii.QT5WIDGETS ref: 0046158F
Part of subcall function 00461410: _Znwj.LIBSTDC++-6 ref: 0046159F

_ZN16QCoreApplication18applicationVersionEv.QT5CORE ref: 00435821
_ZNK6QLabel4textEv.QT5WIDGETS ref: 00435835
_ZNK7QString3argERKS_i5QChar.QT5CORE ref: 0043585A
_ZN6QLabel7setTextERK7QString.QT5WIDGETS ref: 0043586F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435898
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004358BE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004358E4
_ZN16QCoreApplication18applicationDirPathEv.QT5CORE ref: 004358F0
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00435923
_ZN7QString6appendERKS_.QT5CORE ref: 00435934
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043595D
_ZN5QFileC1ERK7QString.QT5CORE ref: 0043596B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435994
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004359BA
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE.QT5CORE ref: 004359C9
_ZN9QIODevice7readAllEv.QT5CORE ref: 004359E0
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00435A07
_ZN14QPlainTextEdit12setPlainTextERK7QString.QT5WIDGETS ref: 00435A19
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435A42
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435A68
_ZN5QFileD1Ev.QT5CORE ref: 00435A70

Strings

0WC, xrefs: 004357F8
/LICENSE, xrefs: 00435918

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$String$TextZnwj$Application18applicationCoreFileFlagsNamePlain$Ascii_helperCharContentsDevice12Device7readDialogEdit12setEiiiiFile4openFlagLabel4textLabel7setLatin1_helperLayoutLayout18setMarginsModeObjectObject10objectObject13setOpenPathQt10S_i5SheetSizeString15fromString16fromString17fromString3argString6appendStyleTypeUtf8_helperVersionWidgetWidget13setWidget6Widget6resizeWindow
String ID: /LICENSE$0WC
API String ID: 35986418-918975467
Opcode ID: 0cba59fe5debd1101f5c226e013d7fe5e8bdbaa67ed606467fe64c876dd49f08
Instruction ID: a82b7b1640b3eef0db677057ac734b9334223cc3146c7e937acdc12992eab2d0
Opcode Fuzzy Hash: 0cba59fe5debd1101f5c226e013d7fe5e8bdbaa67ed606467fe64c876dd49f08
Instruction Fuzzy Hash: 1AA17BB4904700DFDB04EF68D49876EBBF1FF88315F14861AE8859B360D7399885DB86

Function 00431510 Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 387COMMON

Download Yara Rule

APIs

_ZN11QFileDialog15getOpenFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE.QT5WIDGETS ref: 004315E8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043160E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431634
_ZN7QString14compare_helperEPK5QChariPKciN2Qt15CaseSensitivityE.QT5CORE ref: 00431662
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004316B4
_ZN11QFileDialog15getOpenFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE.QT5WIDGETS ref: 004317DE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431804
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043182A
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0043184D
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 00431871
_ZNK7QString11lastIndexOfERK7QRegExpi.QT5CORE ref: 00431888
_ZNK7QString4leftEi.QT5CORE ref: 0043189D
_ZN7QRegExpD1Ev.QT5CORE ref: 004318D8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004318FE

Strings

G-Code files (*.nc *.ncc *.ngc *.tap *.txt);;All files (*.*), xrefs: 00431771
Open, xrefs: 004315A5, 0043179E
[/\\]+, xrefs: 00431846
Heightmap files (*.map), xrefs: 0043156E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$File$String$CaseDialog15getFlagsNameOpenOptionQt15S2_6SensitivityWidget$Ascii_helperChariExpiIndexPatternS_13String11lastString14compare_helperString16fromString4leftSyntax
String ID: G-Code files (*.nc *.ncc *.ngc *.tap *.txt);;All files (*.*)$Heightmap files (*.map)$Open$[/\\]+
API String ID: 706382530-3463056738
Opcode ID: f0d6545a6dc70b81ae7ae3c6bc28e6b216c698863512e27eccc2390b612b18e0
Instruction ID: 06d7c6fe61200ab13aa8bd59ad8867926c88d1e9a9c7b589e6e5043c34bba3f9
Opcode Fuzzy Hash: f0d6545a6dc70b81ae7ae3c6bc28e6b216c698863512e27eccc2390b612b18e0
Instruction Fuzzy Hash: A0023AB49043059FDB00DF68C48869EBBF1FF88315F148A1EE4959B3A0D77A9846CF86

Function 00405620 Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

_ZNK9QGroupBox9isCheckedEv.QT5WIDGETS ref: 00405634
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00405666
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 0040567B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004056A0
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 004056D4
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 004056E7
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00405702
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00405716
_ZNK7QString8toDoubleEPb.QT5CORE ref: 00405725
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00405750
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0040577D
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004057FD
_ZN7QString6appendERKS_.QT5CORE ref: 00405821
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00405836

Strings

(%1/%2), xrefs: 0040576E
Jog, xrefs: 00405655, 004057EE

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Box11currentCheckedComboGroupMetaObject2trS1_iText$AbstractBox8setButton9isStringTitle$ArrayBox9isData10deallocateDoubleS_jjString6appendString8to
String ID: (%1/%2)$Jog
API String ID: 70142446-2497401342
Opcode ID: 3de2d89d9d6a413e41ddcd8570ae0da0a729695206e2fe36b87e5ef67f112527
Instruction ID: be07a9afbb00439369326ed93660fce6ebb399d25904583e129cf508c8c40e5b
Opcode Fuzzy Hash: 3de2d89d9d6a413e41ddcd8570ae0da0a729695206e2fe36b87e5ef67f112527
Instruction Fuzzy Hash: D7C17BB4904601DFDB04EF68D48869FBBF1FF84310F148669E894AB3A0D7399845CF86

Function 0042ED90 Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 362COMMON

Download Yara Rule

APIs

_ZN11QFileDialog15getSaveFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE.QT5WIDGETS ref: 0042EE38
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EE5E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EE84
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EF10
_ZN11QFileDialog15getSaveFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE.QT5WIDGETS ref: 0042EF9D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EFC3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042EFE9
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0042F056
_ZNK7QString11lastIndexOfERKS_iN2Qt15CaseSensitivityE.QT5CORE ref: 0042F075
_ZNK7QString3midEii.QT5CORE ref: 0042F095
_ZN9QLineEdit7setTextERK7QString.QT5WIDGETS ref: 0042F0AA

Strings

G-Code files (*.nc *.ncc *.ngc *.tap *.txt), xrefs: 0042EDC8
Save file as, xrefs: 0042EDF5, 0042EF5A
Heightmap files (*.map), xrefs: 0042EF2D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$File$String$Dialog15getFlagsNameOptionS2_6SaveWidget$Ascii_helperCaseEdit7setIndexLineQt15SensitivityString11lastString16fromString3midText
String ID: G-Code files (*.nc *.ncc *.ngc *.tap *.txt)$Heightmap files (*.map)$Save file as
API String ID: 2745152268-529487481
Opcode ID: e61b0e814e7b172b3269b1160f87f7b2ed62b18d94093dde0e69f9fb2da5d883
Instruction ID: a59168c985f537cd795fe4914da7c737bafdf0a92dc16f8b9316866d3c0c3c1e
Opcode Fuzzy Hash: e61b0e814e7b172b3269b1160f87f7b2ed62b18d94093dde0e69f9fb2da5d883
Instruction Fuzzy Hash: B3F19EB4A04311CFCB04DF68D4886AEBBF1FF85304F548A2EE4945B391D77A9849CB96

Function 0041E6F0 Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 429timeCOMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E846
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E8C3
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0041E9A9
_ZN9QListData6detachEi.QT5CORE ref: 0041EA0A
memcpy.MSVCRT ref: 0041EA4F

Part of subcall function 00472C50: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,00443248), ref: 00472C5E

_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EA7C
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EA91
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EAA6
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EABB
_ZdlPv.LIBSTDC++-6 ref: 0041EAF0
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041EBD6
_ZN17QAbstractItemView14clearSelectionEv.QT5WIDGETS ref: 0041EC79
_ZN10QTableView9selectRowEi.QT5WIDGETS ref: 0041EC8C
_ZN5QTimeC1Eiiii.QT5CORE ref: 0041ECB9
_ZN11QTextStreamlsEc.QT5CORE ref: 0041ED4B
_ZN11QTextStreamlsEc.QT5CORE ref: 0041ED60

Strings

drawn false:, xrefs: 0041E803
default, xrefs: 0041E7E1, 0041EB7F
table updated:, xrefs: 0041EB9D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: EnabledWidget10set$ArrayData10deallocateListS_jj$DataData7disposeStreamlsText$AbstractData6detachEiiiiItemSelectionTableTimeView14clearView9selectmemcpy
String ID: default$drawn false:$table updated:
API String ID: 3219745582-4252874899
Opcode ID: 5f44373abc87222c5b3ab938dbd46b06077e5f97be5f58cee30ae14f21eee31a
Instruction ID: e4d764857296acb69ad9317867eca899fe6411475ad961416909ed482a85b6a3
Opcode Fuzzy Hash: 5f44373abc87222c5b3ab938dbd46b06077e5f97be5f58cee30ae14f21eee31a
Instruction Fuzzy Hash: FE1269B4904204CFDB00EFA9D4987AEBBF1BF44304F14866DD8969B351DB78A889CF46

Function 0043FAD0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE ref: 0043FB04
_ZN7QRegExp3capEi.QT5CORE ref: 0043FB2A
_ZNK7QString8toDoubleEPb.QT5CORE ref: 0043FB3D
_ZN7QString6numberEdci.QT5CORE ref: 0043FB5F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FB85
_ZNK7QRegExp13matchedLengthEv.QT5CORE ref: 0043FB90
_ZNK7QString3midEii.QT5CORE ref: 0043FBAA
_ZNK7QString4leftEi.QT5CORE ref: 0043FBBD
_ZN7QStringaSERKS_.QT5CORE ref: 0043FC1E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FC47
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FC6D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FC93
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FCB9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FCE2
__cxa_guard_acquire.LIBSTDC++-6 ref: 0043FDCF
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0043FDEB
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0043FE0F
__cxa_guard_release.LIBSTDC++-6 ref: 0043FE1F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FE67

Strings

f, xrefs: 0043FB4C
(\d*\.\d*), xrefs: 0043FDE4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCaretCaseDoubleEdciExp13matchedExp3capExp7indexLengthModePatternQt15S_13SensitivityStringString16fromString3midString4leftString6numberString8toStringaStringiSyntax__cxa_guard_acquire__cxa_guard_release
String ID: (\d*\.\d*)$f
API String ID: 88297903-4282393098
Opcode ID: 22dcce85430f20f6a9c4832527992ea24a56a1e15a020ea388548d9f322ae291
Instruction ID: 5eaed56f7aab779c7da27238f4b2cc184792850c189baab2125a30b9ffb3514f
Opcode Fuzzy Hash: 22dcce85430f20f6a9c4832527992ea24a56a1e15a020ea388548d9f322ae291
Instruction Fuzzy Hash: 2FA181B4908305CFDB00DFA8D48869EBBF1FF48314F14962AE895973A0D73A9849CF56

Function 00404C99 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 208COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404C06
_ZN7QWidget6updateEv.QT5WIDGETS ref: 00404C4A
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 00404C57
_ZN7QString6numberEii.QT5CORE ref: 00404CD9
_ZN7QString6numberEii.QT5CORE ref: 00404D18
_ZN7QString6numberEii.QT5CORE ref: 00404D57
_ZNK7QString3argERKS_i5QChar.QT5CORE ref: 00404DB4
_ZNK7QString3argERKS_i5QChar.QT5CORE ref: 00404DDB
_ZNK7QString3argERKS_i5QChar.QT5CORE ref: 00404E02
_ZN7QString6appendERKS_.QT5CORE ref: 00404E51
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00404E66
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404E8F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404EB5
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404EDB
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404F01
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404F27
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404F4D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404F73
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404F99
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00404FDF
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00405002
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040502F

Strings

(%1/%2/%3), xrefs: 00404D75
Overriding, xrefs: 00404E1A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCharS_i5String16fromString3argString6number$Events$Application13processBox8setCoreEventFlagFlagsGroupLoop17ProcessStringString6appendTitleWidget6update
String ID: (%1/%2/%3)$Overriding
API String ID: 2783631364-3697313130
Opcode ID: a3bb20deb82732c28d9a4c92662460304372a24352c1c5e7e0c55de05b25f837
Instruction ID: b8d2580dfd8e8a592ed40e010e64756f34f75a2f3cc288aa57efa8441130ecf1
Opcode Fuzzy Hash: a3bb20deb82732c28d9a4c92662460304372a24352c1c5e7e0c55de05b25f837
Instruction Fuzzy Hash: FEA1C0B49053009FDB04EF64D4886AEBBF1FF84304F11896DE885AB3A5D7799845CF46

Function 00447680 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

_ZN7QWidgetC2EPS_6QFlagsIN2Qt10WindowTypeEE.QT5WIDGETS ref: 00447699
_ZN6QColor10invalidateEv.QT5GUI ref: 004476B2
_Znwj.LIBSTDC++-6 ref: 004476BF
_ZN11QHBoxLayoutC1EP7QWidget.QT5WIDGETS ref: 004476CB
_Znwj.LIBSTDC++-6 ref: 004476DE
_ZN6QFrameC1EP7QWidget6QFlagsIN2Qt10WindowTypeEE.QT5WIDGETS ref: 004476F2
_Znwj.LIBSTDC++-6 ref: 00447705
_ZN11QToolButtonC1EP7QWidget.QT5WIDGETS ref: 00447711
_ZN6QFrame13setFrameShapeENS_5ShapeE.QT5WIDGETS ref: 00447727
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0044773F
_ZN15QAbstractButton7setTextERK7QString.QT5WIDGETS ref: 00447751
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044777A
_ZN7QLayout9setMarginEi.QT5WIDGETS ref: 0044778A
_ZN10QBoxLayout9addWidgetEP7QWidgeti6QFlagsIN2Qt13AlignmentFlagEE.QT5WIDGETS ref: 004477B2
_ZN10QBoxLayout9addWidgetEP7QWidgeti6QFlagsIN2Qt13AlignmentFlagEE.QT5WIDGETS ref: 004477D0
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 004477FB
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 00447803

Strings

1onButtonClicked(), xrefs: 004477E0
..., xrefs: 00447738
`IG, xrefs: 004476A8
2clicked(), xrefs: 004477EC

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Widget$Flags$TypeZnwj$AlignmentConnectionFlagFrameLayout9addQt10Qt13ShapeWidgeti6Window$AbstractArrayAscii_helperButtonButton7setColor10invalidateData10deallocateFrame13setLayoutLayout9setMarginMetaObject10Object7connectQt14S_jjStringString16fromTextToolWidget6
String ID: ...$1onButtonClicked()$2clicked()$`IG
API String ID: 2254674564-1643727246
Opcode ID: c60889dd86ef5197e20294b9af9100fc343c8b144a7f4697eb6bb653fde805ed
Instruction ID: 15fcf9703b245334877e11445fe4ad193980d23aaae14c8f172faa38886ab367
Opcode Fuzzy Hash: c60889dd86ef5197e20294b9af9100fc343c8b144a7f4697eb6bb653fde805ed
Instruction Fuzzy Hash: 6C4106B09083009FDB00AF68D59835EBBF0FF44315F518A6DE8858B355DBB99889CF96

Function 0043F670 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

__cxa_guard_acquire.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041ADCA), ref: 0043F69C
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE.QT5CORE ref: 0043F6CA
_ZN7QString7replaceERK7QRegExpRKS_.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043F6EF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043F718
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE.QT5CORE ref: 0043F739
_ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 0043F75E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043F783
_ZN7QString14trimmed_helperERKS_.QT5CORE ref: 0043F790
__cxa_guard_acquire.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041ADCA), ref: 0043F7DC
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0043F7F8
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0043F81F
__cxa_guard_release.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043F82F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043F877

Strings

;.*, xrefs: 0043F88A
$+[^\(]*$+, xrefs: 0043F7F1

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayCaseData10deallocateQt15S_jjSensitivity$ChariString7indexString7replace__cxa_guard_acquire$Ascii_helperPatternS_13StringString14trimmed_helperString16fromSyntax__cxa_guard_release
String ID: ;.*$$+[^\(]*$+
API String ID: 3936861947-3250114144
Opcode ID: 481349fad3b33991668e6e976975a0816d1f2d45a14690e3ccd8edf265de410e
Instruction ID: 6890fd3866856f5fc036d1ccea26377fc7867601ac1879a6612e40bfafaa9ef7
Opcode Fuzzy Hash: 481349fad3b33991668e6e976975a0816d1f2d45a14690e3ccd8edf265de410e
Instruction Fuzzy Hash: EF613DB4D04205DFDB00AF69D49936EBBF0FF89314F10862EE894973A0D77D98498B4A

Function 0042045A Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 373COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00420569
_ZNK7QString3argEdici5QChar.QT5CORE ref: 004205B0
_ZNK7QString3argEdici5QChar.QT5CORE ref: 004205F0
_ZNK7QString3argEdici5QChar.QT5CORE ref: 00420632
_ZN7QString6appendERKS_.QT5CORE ref: 0042065F
_ZN7QStringaSERKS_.QT5CORE ref: 00420671
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042069D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004206C6
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004206EF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00420718
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042073E

Part of subcall function 00471200: _Znwj.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,?,?,?,0041AF1D), ref: 0047123A

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004207A0

Strings

X%1Y%2Z%3, xrefs: 00420544
f, xrefs: 0042061D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$CharEdici5String3arg$Ascii_helperString16fromString6appendStringaZnwj
String ID: X%1Y%2Z%3$f
API String ID: 1873680363-834748316
Opcode ID: 4592f1b235bd3f295711f34a066d71dec0dbecbdd1a2deec59f243b79b002c56
Instruction ID: 16733c49eb7493ad703ed9781be07e24d4c0a5cd19f5a80f6bf57a34cc440982
Opcode Fuzzy Hash: 4592f1b235bd3f295711f34a066d71dec0dbecbdd1a2deec59f243b79b002c56
Instruction Fuzzy Hash: 0C024870A00229CFDB20DF28D888B9EBBB1BF84304F5486DAD449A7366D735AD95CF45

Function 004067F0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040681F

Part of subcall function 00470650: _ZN9QListData11detach_growEPii.QT5CORE ref: 00470686

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040685A
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040686F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004068A5
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004068BA
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004068F0
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00406905
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040693B
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00406950
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00406986
_ZNK7QString7indexOfERKS_iN2Qt15CaseSensitivityE.QT5CORE ref: 004069FA

Strings

Check Door, xrefs: 00406949
Reset to continue, xrefs: 00406809
ALARM: Soft limit, xrefs: 004068B3
ALARM: Hard limit, xrefs: 004068FE
'$H'|'$X' to unlock, xrefs: 00406868

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayAscii_helperData10deallocateS_jjString16from$CaseData11detach_growListQt15SensitivityString7index
String ID: '$H'|'$X' to unlock$ALARM: Hard limit$ALARM: Soft limit$Check Door$Reset to continue
API String ID: 1614496162-3455368573
Opcode ID: 4484ab7c70675a9632da8cfb7be99ee9eea1ba79f7a7a2beaa4dd50953e68c8a
Instruction ID: 6af33ea5dbaef13b55b08cd8b619cce32fd3011105dc473d6374902fe71c958b
Opcode Fuzzy Hash: 4484ab7c70675a9632da8cfb7be99ee9eea1ba79f7a7a2beaa4dd50953e68c8a
Instruction Fuzzy Hash: 97A139B0904205DFDB04EF68C48469EBBF1FF84324F15852AE456B7390D73AA895CF5A

Function 0041A1C0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

_ZNK9QIODevice11errorStringEv.QT5CORE ref: 0041A1F4
_ZN7QString6numberEii.QT5CORE ref: 0041A20F
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0041A237
_ZN7QString6appendERKS_.QT5CORE ref: 0041A266
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0041A298
_ZN7QString6appendERKS_.QT5CORE ref: 0041A2AC
_ZN7QString6appendERKS_.QT5CORE ref: 0041A2F2
_ZN14QPlainTextEdit15appendPlainTextERK7QString.QT5WIDGETS ref: 0041A306
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A32F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A355
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A37B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A3A1
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A3C7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A3E9
_ZNK9QIODevice6isOpenEv.QT5CORE ref: 0041A3F1
_ZN11QSerialPort5closeEv.QT5SERIALPORT ref: 0041A3FD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A433

Strings

Serial port error , xrefs: 0041A228

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$String6append$PlainStringText$Device11errorDevice6isEdit15appendMetaObject2trOpenPort5closeS1_iSerialString15fromString6numberUtf8_helper
String ID: Serial port error
API String ID: 2067993489-4145358202
Opcode ID: 70eef79a7cb68fa3be96b8dda868682f2d477db736bbe43a914c982efbc6430d
Instruction ID: 4a514e900431131fd9d049cf33e5bb75c724cda6e6e47f37f563c4be11176b56
Opcode Fuzzy Hash: 70eef79a7cb68fa3be96b8dda868682f2d477db736bbe43a914c982efbc6430d
Instruction Fuzzy Hash: 95916BB4905305CFCB04DF64D4886AEBBF1FF84314F14861AE855AB364E73AAC99CB46

Function 00404660 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

_ZN8QVariantC1Eb.QT5CORE ref: 0040467B
_ZN7QObject11setPropertyEPKcRK8QVariant.QT5CORE ref: 00404698
_ZN8QVariantD1Ev.QT5CORE ref: 004046A3
_ZNK7QWidget5styleEv.QT5WIDGETS ref: 004046AB
_ZNK7QWidget14ensurePolishedEv.QT5WIDGETS ref: 004046D0
_ZNK9QGroupBox9isCheckedEv.QT5WIDGETS ref: 004046E5
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00404721
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00404736
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040475B
_ZNK7QString3argExii5QChar.QT5CORE ref: 00404800
_ZN7QString6appendERKS_.QT5CORE ref: 00404850
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00404865
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040488E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004048B4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004048D6

Strings

overrided, xrefs: 00404691
Spindle, xrefs: 00404712, 0040481C
(%1), xrefs: 004047BB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$GroupVariant$Box8setStringTitle$Box9isCharCheckedExii5MetaObject11setObject2trPolishedPropertyS1_iString3argString6appendWidget14ensureWidget5style
String ID: (%1)$Spindle$overrided
API String ID: 3883570626-4126582086
Opcode ID: 09a476ac42e8e3d3c02c84da314944fb102e972865638a406df85f615da225ed
Instruction ID: 55668fbf19d1886c1ff478afc141aa1e7984710375d28a5d0333be45bfb21f17
Opcode Fuzzy Hash: 09a476ac42e8e3d3c02c84da314944fb102e972865638a406df85f615da225ed
Instruction Fuzzy Hash: 65817EB4904300DFCB04EF68D49869EBBF1FF85310F14CA6AE995AB3A1D7399845CB46

Function 004455F0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 191COMMON

Download Yara Rule

APIs

_ZN19QAbstractTableModelC2EP7QObject.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?), ref: 00445601
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00445643
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0044566A
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00445691
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004456B8
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004456E1
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00445708

Part of subcall function 00470650: _ZN9QListData11detach_growEPii.QT5CORE ref: 00470686

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044578D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004457B3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004457D9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004457FF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00445825
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00445847

Strings

Response, xrefs: 00445682
Command, xrefs: 004456D0
State, xrefs: 004456A9
Line, xrefs: 0044565B
Args, xrefs: 00445628

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateMetaObject2trS1_iS_jj$AbstractData11detach_growListModelObjectTable
String ID: Args$Command$Line$Response$State
API String ID: 2249371053-722716890
Opcode ID: 6e144abfdef686eb4d05ca5fe43223375e231e3b87635d96c7c8c7912bb8ae55
Instruction ID: b788f72de5179dcbd0fd5f0ea40b9207b4150728f95434fd29bc3c39c50821b8
Opcode Fuzzy Hash: 6e144abfdef686eb4d05ca5fe43223375e231e3b87635d96c7c8c7912bb8ae55
Instruction Fuzzy Hash: E4816CB0905700DFEB00EF69C48869EBBF1FF85314F10CA2DE4945B291EB799859CB56

Function 00421370 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174windowCOMMON

Download Yara Rule

APIs

_ZN5QFileC1ERK7QString.QT5CORE ref: 00421385
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE.QT5CORE ref: 00421398
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004213CB
_ZN7QString6appendERKS_.QT5CORE ref: 004213F3
_ZNK7QWidget11windowTitleEv.QT5WIDGETS ref: 00421407
_ZN11QMessageBox8criticalEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_.QT5WIDGETS ref: 0042142E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00421454
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042147A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004214A0
_ZN7QStringaSERKS_.QT5CORE ref: 004214BF
_ZN11QTextStreamC1EP9QIODevice.QT5CORE ref: 004214D0
_ZNK11QTextStream5atEndEv.QT5CORE ref: 004214F2
_ZN11QTextStream8readLineEx.QT5CORE ref: 00421511
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00421543
_ZNK11QTextStream5atEndEv.QT5CORE ref: 0042154B
_ZN11QTextStreamD1Ev.QT5CORE ref: 00421583
_ZN5QFileD1Ev.QT5CORE ref: 0042158C

Strings

Can't open file:, xrefs: 004213BC

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Text$ArrayData10deallocateS_jj$FileFlagsStreamStream5atString$Box8criticalButtonDeviceDevice12File4openFlagLineMessageMetaModeObject2trOpenS1_iS4_6S_14StandardStream8readString6appendStringaTitleWidgetWidget11window
String ID: Can't open file:
API String ID: 1305402717-2899359307
Opcode ID: 69a8e97f5a1be8b6dfdfd9a9bf4a1c6fbd18939354b87c5ca55cab1f6de424af
Instruction ID: f37b1edaa6630c8cad1e76e20688dbf7c329ea2be883284b4a243dd0904eb061
Opcode Fuzzy Hash: 69a8e97f5a1be8b6dfdfd9a9bf4a1c6fbd18939354b87c5ca55cab1f6de424af
Instruction Fuzzy Hash: 277180B0A04314DFDB04AF68E49869EBBB1FF90354F50862DE45697360DB39A849CF86

Function 00408670 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

_ZN9QListData6detachEi.QT5CORE ref: 00408A2E
memcpy.MSVCRT ref: 00408A72

Strings

1onActRecentFileTriggered(), xrefs: 0040891B
2triggered(), xrefs: 00408927

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Data6detachListmemcpy
String ID: 1onActRecentFileTriggered()$2triggered()
API String ID: 3440376306-1671216855
Opcode ID: 2740e1a41ea30c0fe0a662b7164bbbf817df7c44d8c82d7c22d212156467bd24
Instruction ID: 6f130e26e9eb2837bd30b00aa8ed56c477dfd887d21c4fa2ae6f1dd3ff885943
Opcode Fuzzy Hash: 2740e1a41ea30c0fe0a662b7164bbbf817df7c44d8c82d7c22d212156467bd24
Instruction Fuzzy Hash: C4D14974900209CFCB04EF68C5849AEBBF1FF88314F15856ED895AB3A1DB34A845CF95

Function 0043F310 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__cxa_guard_acquire.LIBSTDC++-6 ref: 0043F332
_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043F357
_ZN7QRegExp3capEi.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043F381
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0043F3B8
_ZNK7QString3argEdici5QChar.QT5CORE ref: 0043F3F5
_ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 0043F40B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043F434
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043F45A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043F480
_ZN7QRegExp3capEi.QT5CORE ref: 0043F49E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043F4D7
_ZN7QString16fromAscii_helperEPKci.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0043EBEB), ref: 0043F580
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0043EBEB), ref: 0043F5A4
__cxa_guard_release.LIBSTDC++-6 ref: 0043F5B4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043F5E1

Strings

F%1, xrefs: 0043F3AB
g, xrefs: 0043F3DC

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperExp3capString16from$CaretCaseCharEdici5Exp7indexModePatternQt15S_13SensitivityStringString3argString7replaceStringiSyntax__cxa_guard_acquire__cxa_guard_release
String ID: F%1$g
API String ID: 2340270184-2179636994
Opcode ID: 5d20fb626c45e326893529b7c5bf19ad43f78fab8da24ff2b19abc21dd4875df
Instruction ID: e7baa646c871ab51cbd5bb7d0fcf1919fa21517a18fe4d7372e6c05a55ffc8a3
Opcode Fuzzy Hash: 5d20fb626c45e326893529b7c5bf19ad43f78fab8da24ff2b19abc21dd4875df
Instruction Fuzzy Hash: 73816CB0904305DFDB00AF68D58875EBBF0FF99314F10852EE8945B3A0D7799849CB5A

Function 0044A1C0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 124windowCOMMON

Download Yara Rule

APIs

_ZN16QOpenGLFunctions25initializeOpenGLFunctionsEv.QT5GUI ref: 0044A1CE
_Znwj.LIBSTDC++-6 ref: 0044A1DB
_ZN20QOpenGLShaderProgramC1EP7QObject.QT5GUI ref: 0044A1EB
_ZN20QOpenGLShaderProgram23addShaderFromSourceFileE6QFlagsIN13QOpenGLShader13ShaderTypeBitEERK7QString.QT5GUI ref: 0044A230
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044A255
_ZN20QOpenGLShaderProgram23addShaderFromSourceFileE6QFlagsIN13QOpenGLShader13ShaderTypeBitEERK7QString.QT5GUI ref: 0044A283
_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0044A2E0
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0044A2FC
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 0044A308
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044A32D
_ZN6QDebugD1Ev.QT5CORE ref: 0044A33F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044A363

Strings

default, xrefs: 0044A2D6
:/shaders/vshader.glsl, xrefs: 0044A20A
shader program created, xrefs: 0044A2F1
:/shaders/fshader.glsl, xrefs: 0044A263

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: OpenShader$ArrayData10deallocateS_jjString$FileFlagsFromProgram23addShader13SourceType$DebugFunctionsFunctions25initializeLogger5debugMessageObjectProgramStreamlsString15fromTextUtf8_helperZnwj
String ID: :/shaders/fshader.glsl$:/shaders/vshader.glsl$default$shader program created
API String ID: 1833095885-3826425475
Opcode ID: 3be2b8b5c2e878f358afe0fb8489b1285d8c53a6853ab1739a3a2c973cf9875f
Instruction ID: a8e0042573e6a2fc9d5b0d62ab930dbc04f6a859bb6dd8cde640f2cf6e1d35bd
Opcode Fuzzy Hash: 3be2b8b5c2e878f358afe0fb8489b1285d8c53a6853ab1739a3a2c973cf9875f
Instruction Fuzzy Hash: E5513AB0904204DFDB00EFA8D99879EBBF1FF44304F14852DE8999B360DB7A9859CB56

Function 0041FA87 Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00471AA0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471AAE

_ZN15QProgressDialogD1Ev.QT5WIDGETS ref: 0041FA9C
__cxa_begin_catch.LIBSTDC++-6 ref: 0041FAB9

Part of subcall function 00445990: _ZN18QAbstractItemModel15beginResetModelEv.QT5CORE(?,?,?,?,0000031A,00404281), ref: 00445996
Part of subcall function 00445990: _ZN18QAbstractItemModel13endResetModelEv.QT5CORE(?,?,?,?,0000031A,00404281), ref: 004459B7

_ZN11QHeaderView12restoreStateERK10QByteArray.QT5WIDGETS ref: 0041FB09
_ZNK17QAbstractItemView14selectionModelEv.QT5WIDGETS ref: 0041FB18
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 0041FB44
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 0041FB4C
_ZN10QTableView9selectRowEi.QT5WIDGETS ref: 0041FB5F
_ZN15QAbstractButton10setCheckedEb.QT5WIDGETS ref: 0041FB78
_ZNSt9exceptionD2Ev.LIBSTDC++-6 ref: 0041FB8B
__cxa_end_catch.LIBSTDC++-6 ref: 0041FB90
_ZNSt9exceptionD2Ev.LIBSTDC++-6 ref: 0041FBA5

Part of subcall function 00452AC0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE(?,?,?,?,?,?,?,?,?,00406496), ref: 00452ADE

_ZNSt9exceptionD2Ev.LIBSTDC++-6 ref: 0041FBF2
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041FC05
_ZNSt9exceptionD2Ev.LIBSTDC++-6 ref: 0041FC16
__cxa_end_catch.LIBSTDC++-6 ref: 0041FC1B

Strings

1onTableCurrentChanged(QModelIndex,QModelIndex), xrefs: 0041FB29
2currentChanged(QModelIndex,QModelIndex), xrefs: 0041FB35

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractSt9exception$ItemModel$ArrayConnectionReset__cxa_end_catch$Button10setByteCheckedDataData10deallocateData7disposeDialogHeaderListMetaModel13endModel15beginObject10Object7connectProgressQt14ResumeS_jjStateTableTypeUnwind_View12restoreView14selectionView9select__cxa_begin_catch
String ID: 1onTableCurrentChanged(QModelIndex,QModelIndex)$2currentChanged(QModelIndex,QModelIndex)
API String ID: 744467675-838859644
Opcode ID: 31e1de6df354dcb71b967f016dc78e3860f5cb9140a2e5cc6bc9ff979b971152
Instruction ID: 49d2f00957d34b366e646fea64c44ef82d46eb3b5cfb5ab7263ee1b87bcd44d4
Opcode Fuzzy Hash: 31e1de6df354dcb71b967f016dc78e3860f5cb9140a2e5cc6bc9ff979b971152
Instruction Fuzzy Hash: 5C415E70A052098FDB00EF68D9946DDBBB0FF84305F0146AEE84A97352CB746D89CF99

Function 004051D0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0040520A
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 0040521F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00405248
_ZN7QWidget6updateEv.QT5WIDGETS ref: 00405253
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 00405260
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0040528D
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004052D0
_ZNK7QString3argExii5QChar.QT5CORE ref: 00405306
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00405331
_ZN7QString6appendERKS_.QT5CORE ref: 00405358
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 0040536D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00405396
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004053BC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004053DE

Strings

Spindle, xrefs: 004051F9, 00405322
(%1), xrefs: 004052BB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$MetaObject2trS1_i$Box8setEventsGroupStringTitle$AbstractApplication13processButton9isCharCheckedCoreEventExii5FlagFlagsLoop17ProcessString3argString6appendWidget6update
String ID: (%1)$Spindle
API String ID: 2489393047-1814662097
Opcode ID: 76330223f99b7a6dbbb502c8fa964ecddcb378233b8a07c6aaf8987742dda0e6
Instruction ID: 26e57378ae4a97a0a44f073ab9203b8c6f56ee2aec6f2aba25a71afc85a6ece9
Opcode Fuzzy Hash: 76330223f99b7a6dbbb502c8fa964ecddcb378233b8a07c6aaf8987742dda0e6
Instruction Fuzzy Hash: 41714AB49047058FDB10EF68C4986AEBBF1FF84314F14866DE8946B3A0D779A849CF46

Function 004484C0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 168COMMON

Download Yara Rule

APIs

_ZNK11QScrollArea6widgetEv.QT5WIDGETS ref: 004484DB
_Z23qt_qFindChildren_helperPK7QObjectRK7QStringRK11QMetaObjectP5QListIPvE6QFlagsIN2Qt15FindChildOptionEE.QT5CORE ref: 0044850E
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 004485BA
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 004485CB
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 004485F3
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 004485FB
_ZNK7QLayout15contentsMarginsEv.QT5WIDGETS ref: 00448622
_ZNK7QLayout15contentsMarginsEv.QT5WIDGETS ref: 0044863B
_ZN9QListData6detachEi.QT5CORE ref: 004486A9
memcpy.MSVCRT ref: 004486ED
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044871E

Strings

(G, xrefs: 004484F2
1onPressed(), xrefs: 004485D8
1onScroll(int,int), xrefs: 0044859F
2mouseMoved(int,int), xrefs: 004485A7
2mousePressed(), xrefs: 004485E0

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Connection$Meta$FindLayout15contentsListMarginsObjectObject10Object7connectQt14Type$Area6widgetArrayChildChildren_helperData10deallocateData6detachFlagsOptionQt15S_jjScrollStringZ23qt_qmemcpy
String ID: (G$1onPressed()$1onScroll(int,int)$2mouseMoved(int,int)$2mousePressed()
API String ID: 838599591-3739612319
Opcode ID: fce1e63258df10d205f8a49edbe780c15f84b69fceb345028dd23834b47c1bd9
Instruction ID: 9384c1bdb8bc35b18f06ff6c99755b0b82bedd3eab231a3fc45ec2cf0cac1852
Opcode Fuzzy Hash: fce1e63258df10d205f8a49edbe780c15f84b69fceb345028dd23834b47c1bd9
Instruction Fuzzy Hash: D37105749043098FCB00DFA9D98499DFBF1BF88314F148A6AE459AB361D774A886CF85

Function 004067E9 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 166COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040681F

Part of subcall function 00470650: _ZN9QListData11detach_growEPii.QT5CORE ref: 00470686

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040685A
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040686F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004068A5
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004068BA
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004068F0
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00406905
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040693B
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00406950
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00406986
_ZNK7QString7indexOfERKS_iN2Qt15CaseSensitivityE.QT5CORE ref: 004069FA

Strings

Check Door, xrefs: 00406949
Reset to continue, xrefs: 00406809
ALARM: Soft limit, xrefs: 004068B3
ALARM: Hard limit, xrefs: 004068FE
'$H'|'$X' to unlock, xrefs: 00406868

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayAscii_helperData10deallocateS_jjString16from$CaseData11detach_growListQt15SensitivityString7index
String ID: '$H'|'$X' to unlock$ALARM: Hard limit$ALARM: Soft limit$Check Door$Reset to continue
API String ID: 1614496162-3455368573
Opcode ID: 691294b919503bb01d3077c70c2b46b5aaaef5577fd01143ae34e5c819162238
Instruction ID: bbfc396e4e01fd2a8547bddf7911772bf5f14e179a7b616778aeecd2074da2e0
Opcode Fuzzy Hash: 691294b919503bb01d3077c70c2b46b5aaaef5577fd01143ae34e5c819162238
Instruction Fuzzy Hash: DE71E5B09043099FDB00EFA9C49469EBBF1FF88314F15852EE485A7350E779A894CF95

Function 004410D0 Relevance: 27.3, APIs: 18, Instructions: 259COMMON

Download Yara Rule

APIs

_Z5qQNaNv.QT5CORE ref: 004410EE
_Z5qQNaNv.QT5CORE ref: 004410F3
_Z5qQNaNv.QT5CORE ref: 004410F8
_Z5qQNaNv.QT5CORE ref: 004410FD
_ZN5QChar7toUpperEj.QT5CORE ref: 0044122A
_ZNK7QString3midEii.QT5CORE ref: 00441253
_ZNK7QString8toDoubleEPb.QT5CORE ref: 00441266
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004412B3
_Z6qIsNaNd.QT5CORE ref: 004413A4
_Z6qIsNaNd.QT5CORE ref: 0044140A
_Z6qIsNaNd.QT5CORE ref: 00441416

Part of subcall function 00440060: _Z6qIsNaNd.QT5CORE ref: 004400B1
Part of subcall function 00440060: _Z6qIsNaNd.QT5CORE ref: 004400C9
Part of subcall function 00440060: _Z6qIsNaNd.QT5CORE ref: 004400DD

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayChar7toData10deallocateDoubleS_jjString3midString8toUpper
String ID:
API String ID: 1268732198-0
Opcode ID: 6da5d422fff5ce23ba5764a48247dc7393c40319585c786e6713bd09acaa504e
Instruction ID: dd2039754a1711c312c459a515480d5f467d989a3e249fc2144fd80d37dbc764
Opcode Fuzzy Hash: 6da5d422fff5ce23ba5764a48247dc7393c40319585c786e6713bd09acaa504e
Instruction Fuzzy Hash: 00B16174904309DFDF10DFA8D4846AEBBF0FF48350F14865AE894A73A0D7399999CB4A

Function 0040E130 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 290windowCOMMON

Download Yara Rule

APIs

_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0040E188
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0040E1A7
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 0040E1B6
_ZN6QDebugD1Ev.QT5CORE ref: 0040E1F0
_Znwj.LIBSTDC++-6 ref: 0040E22A
_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 0040E249
_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 0040E26D

Strings

Updating interpolation, xrefs: 0040E19C
default, xrefs: 0040E17E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Box5valueDoubleSpin$DebugLogger5debugMessageStreamlsStringString15fromTextUtf8_helperZnwj
String ID: Updating interpolation$default
API String ID: 497035242-1846736205
Opcode ID: 14722bf055e764ecad9c4bee9e640e1a54606b292e7604a2e0a3b8b4cf4f0b5f
Instruction ID: 7ab530155aafea75068842b7a859b0f6aaf43ca9fe32e6a501a41d3b3ef6a835
Opcode Fuzzy Hash: 14722bf055e764ecad9c4bee9e640e1a54606b292e7604a2e0a3b8b4cf4f0b5f
Instruction Fuzzy Hash: 36D19D70D04208DFCB14DFA5D4846ADBBB1FF44304F10896AE895AB391DB399969CF49

Function 00409500 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 192windowCOMMON

Download Yara Rule

APIs

_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0040953A
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 00409566
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040958F
_ZN6QDebugD1Ev.QT5CORE ref: 004095A5
_ZN10QByteArrayC1Eic.QT5CORE ref: 004095BC
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 004095E7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409610
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004096DF
_ZN14QPlainTextEdit15appendPlainTextERK7QString.QT5WIDGETS ref: 00409706
_ZNK14QPlainTextEdit10blockCountEv.QT5WIDGETS ref: 00409731
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409787
_ZN11QTextStreamlsEc.QT5CORE ref: 00409827

Strings

grbl reset, xrefs: 00409550
default, xrefs: 00409530
[CTRL+X], xrefs: 004096A6

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayText$Data10deallocateS_jj$Plain$StreamlsString$ByteCountDebugDevice5writeEdit10blockEdit15appendLogger5debugMessage
String ID: [CTRL+X]$default$grbl reset
API String ID: 659757468-2983608331
Opcode ID: 7046a6515f153c1d9dc7ea606a984334a5dcc90eb600e6227e6b44405050d07e
Instruction ID: c441f5a44ad87fadb267ab83d18647b36ee9cdd40b6efd80c1ddbd6f3be75875
Opcode Fuzzy Hash: 7046a6515f153c1d9dc7ea606a984334a5dcc90eb600e6227e6b44405050d07e
Instruction Fuzzy Hash: 29916BB4904204DFCB04DF68D48879EBBF1BF88304F148669E844AB3A6D7799849CB59

Function 00402E50 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 174COMMON

Download Yara Rule

APIs

_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00402E8E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402EC4
_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00402F57
_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00402F8B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402FBF

Strings

.ngc, xrefs: 00402FF8
.tap, xrefs: 00403068
.txt, xrefs: 00402E69
.ncc, xrefs: 00402F6C
.nc, xrefs: 00402F38

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: CaseQt15SensitivityString8endsWith$ArrayData10deallocateS_jj
String ID: .nc$.ncc$.ngc$.tap$.txt
API String ID: 2043502143-3566413618
Opcode ID: 7021d3deeb99780b3b3fec2b7488a1bed7610e96011c95ac34fc2eea5867a328
Instruction ID: 25db4b9e7e86e70c6645edfba4c0f38f9c8534f2b0845453da4a904407c2bc93
Opcode Fuzzy Hash: 7021d3deeb99780b3b3fec2b7488a1bed7610e96011c95ac34fc2eea5867a328
Instruction Fuzzy Hash: BC617AB09043049BDB04DF78C58839EBBF0BF84315F14852EE494AB3D4D7BA9949DB96

Function 0040E5F9 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 165windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405D8B
Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DA0
Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DB4
Part of subcall function 00405D70: _ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DC2

_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 0040E646
_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 0040E660
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E69C
_Z6qIsNaNf.QT5CORE ref: 0040E6A1
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E709
_Z6qIsNaNd.QT5CORE ref: 0040E727
_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0040E779
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0040E798
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 0040E7A4
_ZN6QDebugD1Ev.QT5CORE ref: 0040E82C
_ZN6QDebugD1Ev.QT5CORE ref: 0040E830
_ZN6QDebugD1Ev.QT5CORE ref: 0040E838
_ZN6QDebugD1Ev.QT5CORE ref: 0040E83D
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E870
_ZNK9QVector3D10normalizedEv.QT5GUI ref: 0040E899
_ZNK9QVector3D6lengthEv.QT5GUI ref: 0040E8C0
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0040E91D
_Znwj.LIBSTDC++-6 ref: 0040E9D5
_ZN9QListData6detachEi.QT5CORE ref: 0040EA12
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040EA86
_ZN11QTextStreamlsEc.QT5CORE ref: 0040EAA2
memcpy.MSVCRT ref: 0040EABE

Strings

ERROR length:, xrefs: 0040E78D
default, xrefs: 0040E76F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Box5valueDoubleSpin$Vector3$D6lengthDebug$ListStreamlsText$ArrayD10normalizedDataData10deallocateData6detachData7disposeLogger5debugMessageS_jjStringString15fromUtf8_helperZnwjmemcpy
String ID: ERROR length:$default
API String ID: 4015208753-1537122966
Opcode ID: 61694034963bdc7e1518a7b8569344ca5f7b163b3f4fdbc536a80fd24e59f2a6
Instruction ID: a2a45536ef1b9542d7b112510ead07cc148450eaeac608fcc0e9886a769e01b0
Opcode Fuzzy Hash: 61694034963bdc7e1518a7b8569344ca5f7b163b3f4fdbc536a80fd24e59f2a6
Instruction Fuzzy Hash: A2713971E00218CFCB14EF65D98879DBBB0FF84304F2184AAD489A7265DB355EA9CF85

Function 004094ED Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 160windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 004094FA
_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0040953A
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 00409566
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040958F
_ZN6QDebugD1Ev.QT5CORE ref: 004095A5
_ZN10QByteArrayC1Eic.QT5CORE ref: 004095BC
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 004095E7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409610
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004096DF
_ZN14QPlainTextEdit15appendPlainTextERK7QString.QT5WIDGETS ref: 00409706
_ZNK14QPlainTextEdit10blockCountEv.QT5WIDGETS ref: 00409731
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00409787
_ZN11QTextStreamlsEc.QT5CORE ref: 00409827

Strings

grbl reset, xrefs: 00409550
default, xrefs: 00409530
[CTRL+X], xrefs: 004096A6

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$Data10deallocateS_jjText$Plain$StreamlsString$ByteCountDebugDevice5writeEdit10blockEdit15appendLogger5debugMessageResumeUnwind_
String ID: [CTRL+X]$default$grbl reset
API String ID: 4209539939-2983608331
Opcode ID: f5557f384d53b95efb0faf00d63dd23f71611704bf3c139573a431b4959b823b
Instruction ID: 9f8926cfcc87c16217f9f0a3c86d951f894735b1246aefeebe733dfa80534f73
Opcode Fuzzy Hash: f5557f384d53b95efb0faf00d63dd23f71611704bf3c139573a431b4959b823b
Instruction Fuzzy Hash: 908115B49043048FDB04EF68D49879EBBF1FF88304F04856DE844AB366D7B9A949CB59

Function 0040D150 Relevance: 25.9, APIs: 17, Instructions: 383COMMON

Download Yara Rule

APIs

_ZNK9QSplitter6handleEi.QT5WIDGETS ref: 0040D192
_ZN7QObject11eventFilterEPS_P6QEvent.QT5CORE ref: 0040D1AC
_ZN15QAbstractButton10setCheckedEb.QT5WIDGETS ref: 0040D2C0
_ZNK7QWidget11minimumSizeEv.QT5WIDGETS ref: 0040D385
_ZN9QSplitter8setSizesERK5QListIiE.QT5WIDGETS ref: 0040D40D
_ZNK9QSplitter11handleWidthEv.QT5WIDGETS ref: 0040D452
_ZN7QWidget16setMinimumHeightEi.QT5WIDGETS ref: 0040D474

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractButton10setCheckedEventFilterHeightListMinimumObject11eventSizeSizesSplitter11handleSplitter6handleSplitter8setWidget11minimumWidget16setWidth
String ID:
API String ID: 1674032690-0
Opcode ID: eed159f8e05ef5622984560eda25a02628d5fefc38ce7b069e1e8eecb845e3f8
Instruction ID: 0ff0c228381c5d08ebc452e9ed92133516ab1cdb787f628e75d27cf7e4bbf07a
Opcode Fuzzy Hash: eed159f8e05ef5622984560eda25a02628d5fefc38ce7b069e1e8eecb845e3f8
Instruction Fuzzy Hash: 89022174A00605CFCB24EFA8D5989AAB7F1FF48300F14867AD8469B791DB34E849CB59

Function 0040CD90 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

_ZNK9QIODevice6isOpenEv.QT5CORE ref: 0040CDA3
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0040CE06
_ZNK7QString3argExii5QChar.QT5CORE ref: 0040CE43
_ZNK7QString3argExii5QChar.QT5CORE ref: 0040CE76
_ZNK7QString3argExii5QChar.QT5CORE ref: 0040CEAE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040CEE4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040CF0A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040CF2C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040CF4E
_ZN10QByteArrayC1Eic.QT5CORE ref: 0040CFF1
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 0040D013
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040D038

Strings

Buffer: %1 / %2 / %3, xrefs: 0040CDF7
?, xrefs: 0040CFE0

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$Data10deallocateS_jj$CharExii5String3arg$ByteDevice5writeDevice6isMetaObject2trOpenS1_i
String ID: ?$Buffer: %1 / %2 / %3
API String ID: 2354960371-1937707986
Opcode ID: a89a13d47cd82c610e46d701a2c37accbd6bf68f979760b6645bc31f9c96829a
Instruction ID: 675c07d23a5f498c34b170ce675c4ed25b8b41c03873ad457aa12ce6cff51214
Opcode Fuzzy Hash: a89a13d47cd82c610e46d701a2c37accbd6bf68f979760b6645bc31f9c96829a
Instruction Fuzzy Hash: 968127B4904301DFDB00DF68C48879EBBF1FF84314F148669E8986B3A5D779984ACB96

Function 00438D30 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

_ZN7QObjectC2EPS_.QT5CORE ref: 00438D42

Part of subcall function 0043B720: _ZN16QOpenGLFunctionsC2Ev.QT5GUI(?,?,000000D2,?,?,?,0043BE6C,?,?,00000002,?,00429A9F), ref: 0043B731
Part of subcall function 0043B720: _ZN13QOpenGLBufferC1Ev.QT5GUI(?,?,000000D2,?,?,?,0043BE6C,?,?,00000002,?,00429A9F), ref: 0043B74D
Part of subcall function 0043B720: _ZN24QOpenGLVertexArrayObjectC1EP7QObject.QT5GUI(?,?,000000D2,?,?,?,0043BE6C,?,?,00000002,?,00429A9F), ref: 0043B75D

_ZN6QColor10invalidateEv.QT5GUI ref: 00438D6E
_ZN6QColor10invalidateEv.QT5GUI ref: 00438D73
_ZN6QColor10invalidateEv.QT5GUI ref: 00438D7B
_ZN6QColor10invalidateEv.QT5GUI ref: 00438D83
_ZN6QColor10invalidateEv.QT5GUI ref: 00438D8B
_ZN6QColor10invalidateEv.QT5GUI ref: 00438D93
_ZN6QTimerC1EP7QObject.QT5CORE ref: 00438DA4
_ZN6QImageC1Ev.QT5GUI ref: 00438DBB
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 00438E23
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 00438E2B
_ZN6QTimer5startEi.QT5CORE ref: 00438E3A

Strings

2timeout(), xrefs: 00438E14
1onTimerVertexUpdate(), xrefs: 00438E08

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Color10invalidate$Object$Open$Connection$ArrayBufferFunctionsImageMetaObject10Object7connectQt14TimerTimer5startTypeVertex
String ID: 1onTimerVertexUpdate()$2timeout()
API String ID: 321571006-4287782181
Opcode ID: 1ec73d526c6df8fba387a48d75319a75996ddf43bd0ba827651f2a4cf8897b8c
Instruction ID: d68ea61d2ff725c142be1ba0d7966148b2f68eb66273ecfcc1f6e1983678e0ca
Opcode Fuzzy Hash: 1ec73d526c6df8fba387a48d75319a75996ddf43bd0ba827651f2a4cf8897b8c
Instruction Fuzzy Hash: 723129B09042448FDB04AF28D8987AD7FB4FB44304F4045BEDC4A9B26ADB795949CF96

Function 00473D40 Relevance: 24.3, APIs: 16, Instructions: 276memoryCOMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00473E4A
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 00473E7A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$AllocationData10deallocateData8allocateEjjj6FlagsOptionS_16S_jj
String ID:
API String ID: 1338957267-0
Opcode ID: 91ec500d02793e032463d77cd85744788c18aa5270b2776dacd7083f1b2b0cf1
Instruction ID: e290987e834012f534b437b8ae1ff915bbb47617a3d9b20732e88306247c4b48
Opcode Fuzzy Hash: 91ec500d02793e032463d77cd85744788c18aa5270b2776dacd7083f1b2b0cf1
Instruction Fuzzy Hash: ABC13B75504241CFC710DF28C084A9AFBF1FF89325F19C65AE8989B3A1D738E945DB85

Function 00408468 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207windowCOMMON

Download Yara Rule

APIs

_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00407C52
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 00407D2C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00407D6F
_ZN15QAbstractButton7setTextERK7QString.QT5WIDGETS ref: 00407DB9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00407DE2
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 00407E04
_ZN7QAction10setVisibleEb.QT5WIDGETS ref: 00407E51
_ZNK11QToolButton4menuEv.QT5WIDGETS ref: 00407E74
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 00407E80
_ZN9QListData6detachEi.QT5CORE ref: 00407EA1
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00407EE0
memcpy.MSVCRT ref: 00408481
memcpy.MSVCRT ref: 004084A0

Strings

Probe, xrefs: 00407D92

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$ArrayDataData10deallocateData7disposeEdit4textLineS_jjmemcpy$AbstractAction10setButton4menuButton7setData6detachStringTextToolVisibleWidget7actions
String ID: Probe
API String ID: 4058281796-379535406
Opcode ID: 655263fc705fa3044b59eec769c3bf7dbbbd62ec0e15201bfb82ce4df2011ad0
Instruction ID: efb320d687f64ea4fc9cef4515f776982190978bb43a46c1b7725a5f720d3289
Opcode Fuzzy Hash: 655263fc705fa3044b59eec769c3bf7dbbbd62ec0e15201bfb82ce4df2011ad0
Instruction Fuzzy Hash: 9AA12BB49042058FDB04EF68C098AAEBBF1FF44300F1585A9DC959B396DB34E855CF56

Function 00433B10 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00433B2F
_ZN7QString6appendERKS_.QT5CORE ref: 00433B3D
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00433B55
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 00433B79
_ZNK12QApplication10styleSheetEv.QT5WIDGETS ref: 00433B90
_ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 00433BA3
_ZN12QApplication13setStyleSheetERK7QString.QT5WIDGETS ref: 00433BB1
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00433BD6
_ZN7QRegExpD1Ev.QT5CORE ref: 00433BDE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00433C00
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00433C22

Strings

font-size:\s*\d+, xrefs: 00433B4E
font-size: , xrefs: 00433B24

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$SheetString$Application10styleApplication13setAscii_helperCasePatternQt15S_13SensitivityString15fromString16fromString6appendString7replaceStyleSyntaxUtf8_helper
String ID: font-size: $font-size:\s*\d+
API String ID: 1187537974-446646615
Opcode ID: 087dbb8ffd76441f42d95f05c763d4c095fae1d71ccd26d3f5a1063bac2256d9
Instruction ID: d7a6bff2cc6a71d150df039e180a0daf96ce2625583cbd6a0d5652ccb09b0239
Opcode Fuzzy Hash: 087dbb8ffd76441f42d95f05c763d4c095fae1d71ccd26d3f5a1063bac2256d9
Instruction Fuzzy Hash: 43419FB55043018FDB00EF68D48869EBBF0FF48315F10962DD485A7360D7399989CF46

Function 00448090 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

_ZN11QScrollAreaC2EP7QWidget.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004480A1
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004480E5
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044811F
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00448134
_ZNK19QAbstractScrollArea17verticalScrollBarEv.QT5WIDGETS ref: 00448141
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044816A
_ZNK19QAbstractScrollArea17verticalScrollBarEv.QT5WIDGETS ref: 00448172
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 00448197
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 0044819F

Strings

1onVerticalScrollBarValueChanged(int), xrefs: 0044817C
@IG, xrefs: 004480B0
2valueChanged(int), xrefs: 00448188
QScrollBar:vertical {border: none; width: 2px; padding-top: 8px;} QScrollBar::handle:vertical {background: darkgray;} QScrollBar::add-line:vertical {border: none; backgroun, xrefs: 0044812D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Scroll$AbstractArea17verticalArrayAscii_helperConnectionData10deallocateS_jjString16from$AreaMetaObject10Object7connectQt14TypeWidget
String ID: 1onVerticalScrollBarValueChanged(int)$2valueChanged(int)$@IG$QScrollBar:vertical {border: none; width: 2px; padding-top: 8px;} QScrollBar::handle:vertical {background: darkgray;} QScrollBar::add-line:vertical {border: none; backgroun
API String ID: 2444537193-3884517918
Opcode ID: 1641a1793b626a6250a17073c30804e1875bf6fa0f6bd278c0fd413021e2ba0e
Instruction ID: 3b878da24d68f37fd0f9a94935a467ddcbb64f1bca200d9e7687b3ee0683660a
Opcode Fuzzy Hash: 1641a1793b626a6250a17073c30804e1875bf6fa0f6bd278c0fd413021e2ba0e
Instruction Fuzzy Hash: AD312FB09043059FDB00AF69D99835EBBF0FF84314F10852ED4959B360DB799849CF8A

Function 00448A40 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

_ZN15QAbstractButtonC2EP7QWidget.QT5WIDGETS ref: 00448A54
_ZN6QColor10invalidateEv.QT5GUI ref: 00448A72
_ZN6QColor10invalidateEv.QT5GUI ref: 00448A7C
_ZN6QColor10invalidateEv.QT5GUI ref: 00448A86
_ZNK7QWidget7paletteEv.QT5WIDGETS ref: 00448A97
_ZNK8QPalette5brushENS_10ColorGroupENS_9ColorRoleE.QT5GUI ref: 00448AB0
_ZN6QColoraSERKS_.QT5GUI ref: 00448AC5
_ZNK8QPalette5brushENS_10ColorGroupENS_9ColorRoleE.QT5GUI ref: 00448AE2
_ZN6QColoraSERKS_.QT5GUI ref: 00448AF2
_ZN6QColor6setRgbEiiii.QT5GUI ref: 00448B1B
_ZNK6QColor4darkEi.QT5GUI ref: 00448B37
_ZN6QColoraSERKS_.QT5GUI ref: 00448B46

Strings

x, xrefs: 00448B2A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Color$Color10invalidateColora$GroupPalette5brushRoleS_10$AbstractButtonColor4darkColor6setEiiiiWidgetWidget7palette
String ID: x
API String ID: 1997027963-2363233923
Opcode ID: 9bfddbb046f4a4af6c7c5ee9d50dfd6e3e3189619030e7814f28af1ae8e99c61
Instruction ID: 8d4b59df9419b269512976f587a71d54f513442ad5689dd5c21f38ea87dfd4b5
Opcode Fuzzy Hash: 9bfddbb046f4a4af6c7c5ee9d50dfd6e3e3189619030e7814f28af1ae8e99c61
Instruction Fuzzy Hash: 61310BB1A042049FCB04FF68D9986ADBFF5EF84300F41853DD885AB255DB78A848CF96

Function 00437510 Relevance: 21.4, APIs: 14, Instructions: 433COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00437611
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00437623
malloc.MSVCRT ref: 00437708
_ZN13QOpenGLBuffer4readEiPvi.QT5GUI ref: 00437743
_ZNK6QColor5blueFEv.QT5GUI ref: 00437778
_ZNK6QColor6greenFEv.QT5GUI ref: 00437786
_ZNK6QColor4redFEv.QT5GUI ref: 00437794
_ZNK6QColor5blueFEv.QT5GUI ref: 004377C5
_ZNK6QColor6greenFEv.QT5GUI ref: 004377CD
_ZNK6QColor4redFEv.QT5GUI ref: 004377D5
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 004378D8
memcpy.MSVCRT ref: 0043791E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Color4redColor5blueColor6greenDataData7disposeListmemcpy$Buffer4readOpenmalloc
String ID:
API String ID: 510264085-0
Opcode ID: 102a00aaaab058f7b9ce52e64237d6891f354b72ed628df84860030f710bfdcb
Instruction ID: 81e3ab3e348bc0d4a7a428ba89ba571a6bbc41cd75de8ed64dbe886f639584af
Opcode Fuzzy Hash: 102a00aaaab058f7b9ce52e64237d6891f354b72ed628df84860030f710bfdcb
Instruction Fuzzy Hash: 5E125EB4A04216CFCB24DFA8C484A9DBBF1FF48310F25856AD489AB355E734AC56CF85

Function 00435160 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00472410: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,0043519C), ref: 0047241E

Part of subcall function 00472040: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,0043421E), ref: 0047204E

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435256
_ZNK7QObject8propertyEPKc.QT5CORE ref: 00435289
_ZNK8QVariant8toDoubleEPb.QT5CORE ref: 00435297

Part of subcall function 00472770: _Znwj.LIBSTDC++-6(?,?,?,?,000B3C74,004352B1), ref: 004727A3

_ZN8QVariantD1Ev.QT5CORE ref: 004352B6
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435360
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0043538C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435443
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435474
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0043549D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00435565

Strings

value, xrefs: 0043527F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$DataData7disposeList$AbstractBox11currentButton9isCheckedComboDoubleObject8propertyTextVariantVariant8toZnwj
String ID: value
API String ID: 1969026285-494360628
Opcode ID: 8a4050fc1e65c642476f4c789f4e6d2e720fd5337bdd234b248559f73f20c2b1
Instruction ID: f830a111c38283105ad746ab3561d7e064778de3034e4961ee07ed5cab87610e
Opcode Fuzzy Hash: 8a4050fc1e65c642476f4c789f4e6d2e720fd5337bdd234b248559f73f20c2b1
Instruction Fuzzy Hash: DCF127B4904604CFCB04DFA9D484A9EBBF1FF88314F14892EE445A7361E779A849CF99

Function 0044E1D0 Relevance: 21.2, APIs: 14, Instructions: 188windowCOMMON

Download Yara Rule

APIs

_ZNK9QComboBox12currentIndexEv.QT5WIDGETS ref: 0044E1EF
_ZNK9QComboBox8itemTextEi.QT5WIDGETS ref: 0044E1FE
_ZeqRK7QStringS1_.QT5CORE ref: 0044E220
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044E249
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044E276
_ZNK9QComboBox8itemDataEii.QT5WIDGETS ref: 0044E2CB
_ZNK8QVariant3cmpERKS_.QT5CORE ref: 0044E2DA
_ZN9QComboBox15insertSeparatorEi.QT5WIDGETS ref: 0044E312
_ZN5QIconC1Ev.QT5GUI ref: 0044E336
_ZN9QComboBox10insertItemEiRK5QIconRK7QStringRK8QVariant.QT5WIDGETS ref: 0044E353
_ZN5QIconD1Ev.QT5GUI ref: 0044E35E
_ZN9QComboBox15setCurrentIndexEi.QT5WIDGETS ref: 0044E37A
_ZN9QComboBox11setEditableEb.QT5WIDGETS ref: 0044E3AD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044E453

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$ArrayData10deallocateIconS_jj$Box8itemIndexString$Box10insertBox11setBox12currentBox15insertBox15setCurrentDataEditableItemSeparatorTextVariantVariant3cmp
String ID:
API String ID: 449382430-0
Opcode ID: 9de2e6c512745e6487bb21d358a0e0edacb38a63a6ca77344ef10b820dacdfe9
Instruction ID: 501a4dc1afd80ea32d85504420b47800672fe02fba4febd00084775dfd902481
Opcode Fuzzy Hash: 9de2e6c512745e6487bb21d358a0e0edacb38a63a6ca77344ef10b820dacdfe9
Instruction Fuzzy Hash: 7A711BB0A043048FDF04EFB9D9985AEBBF5BF84300F54452DE89A9B360DB349949CB46

Function 0042F500 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 179windowCOMMON

Download Yara Rule

APIs

_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0042F689
_ZNK7QWidget11windowTitleEv.QT5WIDGETS ref: 0042F69D
_ZN11QMessageBox7warningEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_.QT5WIDGETS ref: 0042F6C4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042F6EC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042F70E

Strings

Heightmap file was changed. Save?, xrefs: 0042F553
G-code program file was changed. Save?, xrefs: 0042F673

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Box7warningButtonFlagsMessageMetaObject2trS1_iS4_6S_14StandardStringTitleWidgetWidget11window
String ID: G-code program file was changed. Save?$Heightmap file was changed. Save?
API String ID: 163025283-3052660131
Opcode ID: a473b8949a9a253cd987d2874ec86f4e9b6d23cda3fab561c7e64728e49f9ee6
Instruction ID: 48bc976fd598ec26167535461b4921171e51b6fa1a12b6f7ce1912c3db207344
Opcode Fuzzy Hash: a473b8949a9a253cd987d2874ec86f4e9b6d23cda3fab561c7e64728e49f9ee6
Instruction Fuzzy Hash: C47172B0A043159BDB10DF68E48879EBBF0FF84314F94863ED89497391D7798849CB56

Function 00402BA0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ZdlPv.LIBSTDC++-6 ref: 00402BCF
_ZNK9QGroupBox9isCheckedEv.QT5WIDGETS ref: 00402BFF
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 00402C12
_ZNK7QString3argExii5QChar.QT5CORE ref: 00402C8E
_ZN7QString6appendERKS_.QT5CORE ref: 00402CDC
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00402CF4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402D1D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402D43
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402D65
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402D87

Strings

Spindle, xrefs: 00402CAA
(%1), xrefs: 00402C4A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$CheckedGroup$AbstractBox8setBox9isButton9isCharExii5StringString3argString6appendTitle
String ID: (%1)$Spindle
API String ID: 3207239229-1814662097
Opcode ID: f60272e839d14d150f8f795d971a2e897687ee00c90de832ff21d6bea24bcd5e
Instruction ID: 9b95a252e212a37add460a5c6c006fa7421fad19e4e0cf8f184b8d556641dcb0
Opcode Fuzzy Hash: f60272e839d14d150f8f795d971a2e897687ee00c90de832ff21d6bea24bcd5e
Instruction Fuzzy Hash: 39618B749042058FCB00DF68D58C69EBBF1FF84314F14866AE854AB3E1D7B9AC45CB96

Function 0044D400 Relevance: 19.6, APIs: 13, Instructions: 132COMMON

Download Yara Rule

APIs

_ZN7QSlider10paintEventEP11QPaintEvent.QT5WIDGETS ref: 0044D411
_ZNK15QAbstractSlider5valueEv.QT5WIDGETS ref: 0044D41F
_ZN8QPainterC1EP12QPaintDevice.QT5GUI ref: 0044D436
_ZN8QPainter13setRenderHintENS_10RenderHintEb.QT5GUI ref: 0044D451
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0044D469
_ZN6QImageC1ERK7QStringPKc.QT5GUI ref: 0044D485
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044D4AE
_ZNK15QAbstractSlider7maximumEv.QT5WIDGETS ref: 0044D4D1
_ZNK6QImage6heightEv.QT5GUI ref: 0044D53D
_ZNK6QImage5widthEv.QT5GUI ref: 0044D550
_ZN8QPainter9drawImageERK7QPointFRK6QImage.QT5GUI ref: 0044D580
_ZN6QImageD1Ev.QT5GUI ref: 0044D58B
_ZN8QPainterD1Ev.QT5GUI ref: 0044D594

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Image$AbstractEventHintPaintPainterRender$ArrayAscii_helperData10deallocateDeviceImage5widthImage6heightPainter13setPainter9drawPointS_10S_jjSlider10paintSlider5valueSlider7maximumStringString16from
String ID:
API String ID: 2915859233-0
Opcode ID: ac94ae84ba5d1e08cd853089ca44006a57ea1d51b293536f74e51c2e2260d633
Instruction ID: e398883778ac2bb3a95c26fda5ca3566f2171610997d0277dbe0ffe49034b81c
Opcode Fuzzy Hash: ac94ae84ba5d1e08cd853089ca44006a57ea1d51b293536f74e51c2e2260d633
Instruction Fuzzy Hash: 19512B74E00249DFCB04EFE9E99859DBFB1FF84301F408529E846AB368DB359859CB45

Function 0041E2FC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 261COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041DF5C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E25F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E284

Strings

G0Z%1, xrefs: 0041E146
G0X%1Y%2, xrefs: 0041DDF7
g, xrefs: 0041E179
G38.2Z%1, xrefs: 0041DFD9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj
String ID: G0X%1Y%2$G0Z%1$G38.2Z%1$g
API String ID: 3736559311-1936129248
Opcode ID: f1142bdc1492ad2bfdc3a637cb0cfa250261b0e66d6d33854f3af87306a60db9
Instruction ID: 749e68eb4468531d40f5b30db38b32fdefcb179b94e9abd66d5f1ce150175b69
Opcode Fuzzy Hash: f1142bdc1492ad2bfdc3a637cb0cfa250261b0e66d6d33854f3af87306a60db9
Instruction Fuzzy Hash: 51D1FAB09043598FDB10EF68C48879EBBF1FF84314F108A9DE4999B294DB759988CF42

Function 0041E349 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 261COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E0F2
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E11B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E25F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E284

Strings

G0Z%1, xrefs: 0041E146
G0X%1Y%2, xrefs: 0041DDF7
g, xrefs: 0041E179
G38.2Z%1, xrefs: 0041DFD9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj
String ID: G0X%1Y%2$G0Z%1$G38.2Z%1$g
API String ID: 3736559311-1936129248
Opcode ID: 1b59d9c3f494d70f4fe2f34a7f0c3ed2ec5208e6904a5e77e8f52aed92758ebe
Instruction ID: 67c743e3905486c503b9cb58b868212185fb6009679f39728a6b4a03ae754c0e
Opcode Fuzzy Hash: 1b59d9c3f494d70f4fe2f34a7f0c3ed2ec5208e6904a5e77e8f52aed92758ebe
Instruction Fuzzy Hash: DED10AB09043598FDB10EF68C48879EBBF1FF84314F108A9DE4999B294DB759988CF42

Function 0041E399 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 261COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041DF85
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041DFAE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E0F2
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E11B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E25F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E284

Strings

G0Z%1, xrefs: 0041E146
G0X%1Y%2, xrefs: 0041DDF7
g, xrefs: 0041E179
G38.2Z%1, xrefs: 0041DFD9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj
String ID: G0X%1Y%2$G0Z%1$G38.2Z%1$g
API String ID: 3736559311-1936129248
Opcode ID: a8280523c2097267c77074d507d253faf5f7946648232ec8b0a4941e0b82151a
Instruction ID: bd7ab41d9b1493a69537cdac97de19609bf9902cbd82cf10efade7d7fa85215c
Opcode Fuzzy Hash: a8280523c2097267c77074d507d253faf5f7946648232ec8b0a4941e0b82151a
Instruction Fuzzy Hash: 6AD1FAB09047598FDB10EF68C48879EBBF1FF84314F108A9DE4999B294DB759988CF42

Function 004418D0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00441913
_ZNK7QRegExp13matchedLengthEv.QT5CORE ref: 0044191E
_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE ref: 0044193A
_ZN7QRegExp3capEi.QT5CORE ref: 0044195C
_ZNK7QString5toIntEPbi.QT5CORE ref: 00441977
__cxa_guard_acquire.LIBSTDC++-6 ref: 004419D1
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004419ED
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 00441A11
__cxa_guard_release.LIBSTDC++-6 ref: 00441A21
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00441A69

Strings

[Gg]0*(\d+), xrefs: 004419E6

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCaretCaseExp13matchedExp3capExp7indexLengthModePatternQt15S_13SensitivityStringString16fromString5toStringiSyntax__cxa_guard_acquire__cxa_guard_release
String ID: [Gg]0*(\d+)
API String ID: 3620934763-3212684299
Opcode ID: 18ce0050932b3f9630aac35ce4fdf772a480f6fc5a6901ed80b5be375c310fa6
Instruction ID: 5cb6a8343735e1e22467ac1fde7e29409483b364391882b1d2f109faba47a66b
Opcode Fuzzy Hash: 18ce0050932b3f9630aac35ce4fdf772a480f6fc5a6901ed80b5be375c310fa6
Instruction Fuzzy Hash: EB415EB0908304DFEB00AFA8D49836EBBF4FF45355F04892EE88597361D7795889CB5A

Function 00441AC0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00441B03
_ZNK7QRegExp13matchedLengthEv.QT5CORE ref: 00441B0E
_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE ref: 00441B2A
_ZN7QRegExp3capEi.QT5CORE ref: 00441B4C
_ZNK7QString5toIntEPbi.QT5CORE ref: 00441B67
__cxa_guard_acquire.LIBSTDC++-6 ref: 00441BC1
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00441BDD
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 00441C01
__cxa_guard_release.LIBSTDC++-6 ref: 00441C11
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00441C59

Strings

[Mm]0*(\d+), xrefs: 00441BD6

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCaretCaseExp13matchedExp3capExp7indexLengthModePatternQt15S_13SensitivityStringString16fromString5toStringiSyntax__cxa_guard_acquire__cxa_guard_release
String ID: [Mm]0*(\d+)
API String ID: 3620934763-1030862428
Opcode ID: 8a141d2837ba83b59828fa3d6922560ba7cdd00bffb4a3b13995c5ce41d3a2e9
Instruction ID: 9d0e0b57b8ab20ec263c912e104a34148b3dcb19acc7ee30e5a07bccc5fdc92f
Opcode Fuzzy Hash: 8a141d2837ba83b59828fa3d6922560ba7cdd00bffb4a3b13995c5ce41d3a2e9
Instruction Fuzzy Hash: 284191B0908204CFEB00AFA9D48836EBBF0FF45355F00852EE88597360E77D5889CB5A

Function 0041C690 Relevance: 18.4, APIs: 12, Instructions: 377COMMON

Download Yara Rule

APIs

_ZNK7QObject6senderEv.QT5CORE ref: 0041C6A4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Object6sender
String ID:
API String ID: 3167791116-0
Opcode ID: b22610495538c7a694e3eeac21561415b6b1a4b96ae69ec05779d947aa2c3bb9
Instruction ID: b4ea190a510a0c9ab0a68d9fe3b5acab1c2f574d1739b1e37b33d9c48e8b2c7e
Opcode Fuzzy Hash: b22610495538c7a694e3eeac21561415b6b1a4b96ae69ec05779d947aa2c3bb9
Instruction Fuzzy Hash: D102E6B4904309CFCB14EFA9D49469DBBF1BF48324F10866DE869AB391D734A885CF85

Function 00474170 Relevance: 18.2, APIs: 12, Instructions: 217COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00474220

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 8c938a59316333d38665806825d56bf055d6c13b26a74419dfe7ccdaf235e8d7
Instruction ID: b60b1ed6de8fa11930b6cc73e465d7f8623dd6a8109ec474bb169d000eed46c5
Opcode Fuzzy Hash: 8c938a59316333d38665806825d56bf055d6c13b26a74419dfe7ccdaf235e8d7
Instruction Fuzzy Hash: AFA13974A04205CFC700DF68C488AAAFBF0FF88310F19C65AE8689B351D738E855CB55

Function 00443460 Relevance: 18.2, APIs: 12, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

_ZdlPv.LIBSTDC++-6 ref: 004434BC
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 00443536
_Z5qQNaNv.QT5CORE ref: 004435C8
_Z5qQNaNv.QT5CORE ref: 004435CD
_Z5qQNaNv.QT5CORE ref: 004435D2
_Z5qQNaNv.QT5CORE ref: 004435E3
_Z5qQNaNv.QT5CORE ref: 004435E8
_Z5qQNaNv.QT5CORE ref: 004435ED
_Z5qQNaNv.QT5CORE ref: 004435FE
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 00443684
_Z9qBadAllocv.QT5CORE ref: 00443699
_Z9qBadAllocv.QT5CORE ref: 004436A4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AllocationAllocvArrayData8allocateEjjj6FlagsOptionS_16
String ID:
API String ID: 1252432087-0
Opcode ID: c42a68f401f38781b4b6a6163f72067da6efa63dbfca0ad895ae38b7fb9b5b18
Instruction ID: 1c33771c6011b546c1b7e90f335fc3872dab5c7fe767d886f5a9b46c36749625
Opcode Fuzzy Hash: c42a68f401f38781b4b6a6163f72067da6efa63dbfca0ad895ae38b7fb9b5b18
Instruction Fuzzy Hash: BF71AA70A00205DFEB20DF69D88469EFBF0BF48721F14866AD455A7390D738E956CB48

Function 00432280 Relevance: 18.1, APIs: 12, Instructions: 102COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004322A3
_ZN8QVariantD1Ev.QT5CORE ref: 004322AC
_ZNK7QRegion7isEmptyEv.QT5GUI ref: 004322CF
_ZN7QRegionD1Ev.QT5GUI ref: 004322E0
_ZNK11QListWidget5countEv.QT5WIDGETS ref: 004322EF
_ZNK11QListWidget4itemEi.QT5WIDGETS ref: 00432309
_ZNK8QVariant8toStringEv.QT5CORE ref: 00432330
_Z20qt_qFindChild_helperPK7QObjectRK7QStringRK11QMetaObject6QFlagsIN2Qt15FindChildOptionEE.QT5CORE ref: 00432351

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: FindListString$ArrayChildChild_helperData10deallocateEmptyFlagsMetaObjectObject6OptionQt15RegionRegion7isS_jjVariantVariant8toWidget4itemWidget5countZ20qt_q
String ID:
API String ID: 4143093196-0
Opcode ID: 6c75e9a22955342f3e94eddbcc6d7734da808ae69ad60b4e3018ea05578caeaa
Instruction ID: d4c72b20e1dc15b88b65be57399b172ccee92fe4951f57e0cb5ea09e7b185a51
Opcode Fuzzy Hash: 6c75e9a22955342f3e94eddbcc6d7734da808ae69ad60b4e3018ea05578caeaa
Instruction Fuzzy Hash: AD41FB74904205DFCB04EFB9E99899EBBF0FF48311F404529E85297360EB74A859CF95

Function 0040ED91 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040EE63
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040EFCB
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040EFED
_ZNK7QString7indexOfERK7QRegExpi.QT5CORE ref: 0040F033
_ZN7QRegExpD1Ev.QT5CORE ref: 0040F041
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F067

Part of subcall function 0046FA90: _ZN9QListData6detachEi.QT5CORE(?,?,?,?,?,?,?,?,?,?,0040F012), ref: 0046FAA9
Part of subcall function 0046FA90: _Znwj.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,?,?,0040F012), ref: 0046FAD8

_ZN8QVariantC1Ei.QT5CORE ref: 0040F08D

Strings

M0*2|M30, xrefs: 0040EFC4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCaseData6detachExpiListPatternQt15S_13SensitivityStringString16fromString7indexSyntaxVariantZnwj
String ID: M0*2|M30
API String ID: 1176667680-2299933850
Opcode ID: c37c9be0d37ed544c86d74e447228ab983dfb19aaa7efb554108b24f33195738
Instruction ID: 7eb52420d75068416b5fb032f666f5821a1c76a503bc47a9d8326c1d69bdb0c9
Opcode Fuzzy Hash: c37c9be0d37ed544c86d74e447228ab983dfb19aaa7efb554108b24f33195738
Instruction Fuzzy Hash: F6D134B4904305CFCB04EFA8C49869DBBF1BF84324F14862DE859AB395DB35A889CF45

Function 0040ED80 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040EFCB
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040EFED

Strings

M0*2|M30, xrefs: 0040EFC4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Ascii_helperCasePatternQt15S_13SensitivityStringString16fromSyntax
String ID: M0*2|M30
API String ID: 476007479-2299933850
Opcode ID: f7fc08653b9193f1e30f6e2f72b83b73b3fb5584900f85349a7d6981c1ffc4d6
Instruction ID: c7c8d10cdf5fc8da084dfeeacb9fc0215263201ae82e0b535afe0d2d207f5eb3
Opcode Fuzzy Hash: f7fc08653b9193f1e30f6e2f72b83b73b3fb5584900f85349a7d6981c1ffc4d6
Instruction Fuzzy Hash: 5FC115B4904305CFCB00EFA8C49869DBBF1BF88314F14866DE859AB395D735A985CF45

Function 00408B60 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00408BA3

Strings

text/uri-list, xrefs: 00408C36
text/plain, xrefs: 00408B9C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Ascii_helperString16from
String ID: text/plain$text/uri-list
API String ID: 3564552234-3611446695
Opcode ID: e9f6281d3ceac727e3ad5c1b78529ff9dea2290e7c1348f320696abfc408b3bd
Instruction ID: 3de6bd3418ff8ca5d6039f62abb0c42df1adc5d2aae52c868103f9376d6c73ad
Opcode Fuzzy Hash: e9f6281d3ceac727e3ad5c1b78529ff9dea2290e7c1348f320696abfc408b3bd
Instruction Fuzzy Hash: EF818FB4905249CFDF00DF68D184AEEBBF1BF44344F04816AE894AB395DB39A905CF69

Function 00431D20 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

_ZN11QFileDialog15getOpenFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE.QT5WIDGETS ref: 00431DDD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431E24
_ZN7QString14compare_helperEPK5QChariPKciN2Qt15CaseSensitivityE.QT5CORE ref: 00431E52
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431EA4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431EEE

Strings

Open, xrefs: 00431D9D
Heightmap files (*.map), xrefs: 00431D70

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$File$CaseChariDialog15getFlagsNameOpenOptionQt15S2_6SensitivityStringString14compare_helperWidget
String ID: Heightmap files (*.map)$Open
API String ID: 2231395888-315761322
Opcode ID: 621032d337ee563c34a17aed1e56e386181967143ba4d58d7e24220d6fe703a2
Instruction ID: 51da051272a89f2cd77031f441e1c701b45bfbbb82215b56fc8651948a847bee
Opcode Fuzzy Hash: 621032d337ee563c34a17aed1e56e386181967143ba4d58d7e24220d6fe703a2
Instruction Fuzzy Hash: 86816FB49043019FDB00DF64C48869EBBF1FF88314F14CA2EE8945B3A5D77A9849CB96

Function 0040EE49 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040EE63
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040EF1E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040EF44
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040EFCB
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040EFED
_ZNK7QString7indexOfERK7QRegExpi.QT5CORE ref: 0040F033
_ZN7QRegExpD1Ev.QT5CORE ref: 0040F041
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040F067
_ZN8QVariantC1Ei.QT5CORE ref: 0040F08D

Strings

M0*2|M30, xrefs: 0040EFC4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCaseExpiPatternQt15S_13SensitivityStringString16fromString7indexSyntaxVariant
String ID: M0*2|M30
API String ID: 2648252753-2299933850
Opcode ID: bb207f1e334e5e538626e6c1131b4e0822ea6ef8052fd524db2be5278b348ae5
Instruction ID: 8eaa9e0a807f812863902fbefb1c5e17f5e00b5df883f505dbcf97466a75588c
Opcode Fuzzy Hash: bb207f1e334e5e538626e6c1131b4e0822ea6ef8052fd524db2be5278b348ae5
Instruction Fuzzy Hash: DC9115B4904305CFCB00EFA8C49869DBBF1BF84314F14866DE899AB395DB359889CF45

Function 0040B710 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0040B727
_ZN10QByteArrayC1Eic.QT5CORE ref: 0040B747
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 0040B76D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B796
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040B7D9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B81E

Strings

M3 S%1, xrefs: 0040B85B

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$Data10deallocateS_jj$AbstractAscii_helperButton9isByteCheckedDevice5writeString16from
String ID: M3 S%1
API String ID: 742399625-2472580429
Opcode ID: 9901d8e5bace58cbb4158f062af8bfc3eebee53be568f1b98c941b20454b0925
Instruction ID: b7e737412d5fd8c77db1d5dfebe1d437e2225d39e899b6b2eb0ac10f70c1739a
Opcode Fuzzy Hash: 9901d8e5bace58cbb4158f062af8bfc3eebee53be568f1b98c941b20454b0925
Instruction Fuzzy Hash: BA5173B5904305CFDB00EF68D4886AEBBF5FF84314F14C529E8546B3A1D7399846CB9A

Function 004089FC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00408856
_ZN7QWidget12insertActionEP7QActionS1_.QT5WIDGETS ref: 00408876
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004088AE
_Znwj.LIBSTDC++-6 ref: 004088F7
_ZN7QActionC1ERK7QStringP7QObject.QT5WIDGETS ref: 00408907
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 00408936
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 0040893F
_ZN9QListData6detachEi.QT5CORE ref: 00408979

Strings

1onActRecentFileTriggered(), xrefs: 0040891B
2triggered(), xrefs: 00408927

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Action$ConnectionList$ArrayDataData10deallocateData6detachData7disposeMetaObjectObject10Object7connectQt14S_jjStringTypeWidget12insertZnwj
String ID: 1onActRecentFileTriggered()$2triggered()
API String ID: 525373236-1671216855
Opcode ID: 7dd01c78bd33648fb50403402c96df22ffd6fc1cc322fdc3d100781f87217df1
Instruction ID: 5fa61bacc2620dfa71bc6be41fead7fd26a8570ab96761756e641846da5da591
Opcode Fuzzy Hash: 7dd01c78bd33648fb50403402c96df22ffd6fc1cc322fdc3d100781f87217df1
Instruction Fuzzy Hash: CA512974904206CFCB04EF68D58899EBBF1FF44304F548A6EE895AB3A0DB34A945CF95

Function 0040CBE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_ZN8QVariantC1Eb.QT5CORE ref: 0040CBFB
_ZN7QObject11setPropertyEPKcRK8QVariant.QT5CORE ref: 0040CC18
_ZN8QVariantD1Ev.QT5CORE ref: 0040CC23
_ZNK7QWidget5styleEv.QT5WIDGETS ref: 0040CC2B
_ZNK7QWidget14ensurePolishedEv.QT5WIDGETS ref: 0040CC50
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040CCAF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040CCF1
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040CD3D

Strings

overrided, xrefs: 0040CC11
G90, xrefs: 0040CD36

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$Ascii_helperString16from$ArrayData10deallocateObject11setPolishedPropertyS_jjWidget14ensureWidget5style
String ID: G90$overrided
API String ID: 2325213093-2262859457
Opcode ID: bcb045b22c7c3714ec88e1ee1c86d8e60011721cad3cc0d9656c8c5a5f8f6abf
Instruction ID: 2f46f892ad17bc11762ecb97df29f20df13d2ba800e85aa804fd1e4839898c14
Opcode Fuzzy Hash: bcb045b22c7c3714ec88e1ee1c86d8e60011721cad3cc0d9656c8c5a5f8f6abf
Instruction Fuzzy Hash: 884184B4604344DFDB04AF68D49869DBFF1BF88310F04467EE8856B392CB389845CB5A

Function 004042F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00404310
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040432E
_ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 00404360
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404387
_ZN7QStringaSERKS_.QT5CORE ref: 00404396
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043BB
_ZN7QRegExpD1Ev.QT5CORE ref: 004043C3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043E5

Strings

GC:|\[|\]|G[01234]\s|M[0345]+\s|\sF[\d\.]+|\sS[\d\.]+, xrefs: 00404309
5, xrefs: 00404301

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCasePatternQt15S_13SensitivityStringString16fromString7replaceStringaSyntax
String ID: 5$GC:|\[|\]|G[01234]\s|M[0345]+\s|\sF[\d\.]+|\sS[\d\.]+
API String ID: 71511268-2282411076
Opcode ID: 001b490d57d8eee2a23122098b91cddaa3521b9e5c26d23ccb524bbb3ab7638a
Instruction ID: 9cf056819eb4cb7091d215956440725f8b209d8b5eac5f001702747cde867f27
Opcode Fuzzy Hash: 001b490d57d8eee2a23122098b91cddaa3521b9e5c26d23ccb524bbb3ab7638a
Instruction Fuzzy Hash: 12417FB4904305CFCB04DF68D4886AEBBF0FF84315F14862DE955A7390D7399889CB96

Function 00413240 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

_ZN11QSerialPort4openE6QFlagsIN9QIODevice12OpenModeFlagEE.QT5SERIALPORT ref: 00413257
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00413294
_ZN9QLineEdit7setTextERK7QString.QT5WIDGETS ref: 004132A9
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004132DA
_ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS ref: 004132EF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00413314

Strings

background-color: palette(button); color: palette(text);, xrefs: 004132D3
Port opened, xrefs: 00413283
8, xrefs: 004132CB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: String$ArrayAscii_helperData10deallocateDevice12Edit7setFlagFlagsLineMetaModeObject2trOpenPort4openS1_iS_jjSerialSheetString16fromStyleTextWidget13set
String ID: 8$Port opened$background-color: palette(button); color: palette(text);
API String ID: 3941000538-1369377024
Opcode ID: 3d9502d0b8feaf01bc75158eb357b2c2492b95e7dae158baf481a01e8e963ada
Instruction ID: b0a3fbfd7e97e4ddc00f311016c78ecd7f53c984e871f43d21b14fe9aa82baa5
Opcode Fuzzy Hash: 3d9502d0b8feaf01bc75158eb357b2c2492b95e7dae158baf481a01e8e963ada
Instruction Fuzzy Hash: 923172745043009FDB00AF68D49869EBBB0FF44316F14C65DE89957350DB395A89CB8A

Function 0043BD20 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_ZNK24QOpenGLVertexArrayObject9isCreatedEv.QT5GUI(?,?,?,?,00000002,000B2B30,0000031A,00413097), ref: 0043BD33
_ZNK13QOpenGLBuffer9isCreatedEv.QT5GUI(?,?,?,?,00000002,000B2B30,0000031A,00413097), ref: 0043BD46
_ZN13QOpenGLBuffer7destroyEv.QT5GUI(?,?,?,?,00000002,000B2B30,0000031A,00413097), ref: 0043BD52
_ZN24QOpenGLVertexArrayObjectD1Ev.QT5GUI(?,?,?,?,00000002,000B2B30,0000031A,00413097), ref: 0043BD5A
_ZN13QOpenGLBufferD1Ev.QT5GUI(?,?,?,?,00000002,000B2B30,0000031A,00413097), ref: 0043BD62
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043BD84
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043BDA6
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043BDC8
_ZN24QOpenGLVertexArrayObject7destroyEv.QT5GUI(?,?,?,?,00000002,000B2B30,0000031A,00413097), ref: 0043BE22

Strings

$, xrefs: 0043BDBD

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayOpen$Data10deallocateS_jjVertex$Created$BufferBuffer7destroyBuffer9isObjectObject7destroyObject9is
String ID: $
API String ID: 4109716583-3993045852
Opcode ID: 2246c9bc0a75725e75c01389b112c6a1d7594007e522e659f053842f77fe8464
Instruction ID: e1803f1c871a75ef041a10f5d26a1d81f6250e6c0b22701bb23ede2fb74d974c
Opcode Fuzzy Hash: 2246c9bc0a75725e75c01389b112c6a1d7594007e522e659f053842f77fe8464
Instruction Fuzzy Hash: EF2191B4204200DFDB149F28D4D836E3BB2FF89315F249659EA454B3A5D73A8C46CB8A

Function 004042EC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00404310
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040432E
_ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 00404360
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404387
_ZN7QStringaSERKS_.QT5CORE ref: 00404396
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043BB
_ZN7QRegExpD1Ev.QT5CORE ref: 004043C3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043E5

Strings

GC:|\[|\]|G[01234]\s|M[0345]+\s|\sF[\d\.]+|\sS[\d\.]+, xrefs: 00404309
5, xrefs: 00404301

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCasePatternQt15S_13SensitivityStringString16fromString7replaceStringaSyntax
String ID: 5$GC:|\[|\]|G[01234]\s|M[0345]+\s|\sF[\d\.]+|\sS[\d\.]+
API String ID: 71511268-2282411076
Opcode ID: 014098d524fedfda44c721df5ca7c8c349533fe77224adad851f8a2081e12bd3
Instruction ID: f6610380caaa330af5ace4cf575d093f85fefb1b5953f752f65e2cc23d69f4f4
Opcode Fuzzy Hash: 014098d524fedfda44c721df5ca7c8c349533fe77224adad851f8a2081e12bd3
Instruction Fuzzy Hash: 4F3129B4904305CFDB04EFA8D59869EBBF0FB88315F10852DE985A7360D7789849CF96

Function 0043EA90 Relevance: 16.8, APIs: 11, Instructions: 337COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043EAF0
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043EB71
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043EB97
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043EC14
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043EC3A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043ECA8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043ECCE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043ED76
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043ED9C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj
String ID:
API String ID: 3736559311-0
Opcode ID: 8aa7c93e151f8acbf7b8ce599ba6c13d0763a3a53fa972d10b527ec396ad5026
Instruction ID: 588bf13632576bce406b4551c413669ff2781b36dfe1e487f17f20e3971d3ad7
Opcode Fuzzy Hash: 8aa7c93e151f8acbf7b8ce599ba6c13d0763a3a53fa972d10b527ec396ad5026
Instruction Fuzzy Hash: D0E168B4905205CFCB04DF6AC48469EBBF2FF88314F14961AE455AB3A4D73A9C46CF46

Function 004310F0 Relevance: 16.8, APIs: 11, Instructions: 252COMMON

Download Yara Rule

APIs

_ZNK9QMimeData4urlsEv.QT5CORE ref: 00431107
_ZNK4QUrl11toLocalFileEv.QT5CORE ref: 00431120

Part of subcall function 00470080: _ZN4QUrlD1Ev.QT5CORE(?,?,?,00000000,?,?,00408DEB), ref: 004700B5
Part of subcall function 00470080: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,00000000,?,?,00408DEB), ref: 004700BE

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431173
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431245
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004312CE
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00431356
_ZNK9QMimeData4textEv.QT5CORE ref: 0043136A
_ZNK7QString5splitERKS_NS_13SplitBehaviorEN2Qt15CaseSensitivityE.QT5CORE ref: 00431390
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004313E7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431433

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Mime$Ascii_helperBehaviorCaseDataData4textData4urlsData7disposeFileListLocalQt15S_13SensitivitySplitString16fromString5splitUrl11to
String ID:
API String ID: 2497575-0
Opcode ID: d81ffb7fbdc6c94b08daf704f81db7b9da781d12d2ad6c9dbef7ebe7c1ffcb4f
Instruction ID: 3a34350f90a8dcd87afc7c4c3f3eba6441c182ebeee452a9ff7e6fd9ea45e929
Opcode Fuzzy Hash: d81ffb7fbdc6c94b08daf704f81db7b9da781d12d2ad6c9dbef7ebe7c1ffcb4f
Instruction Fuzzy Hash: 5BA17E74A042058FDB00DF68C4846AFB7F1FF88354F14862AD855AB364D73AAC49CF96

Function 004072C9 Relevance: 16.7, APIs: 11, Instructions: 195COMMON

Download Yara Rule

APIs

_ZN9QListData6detachEi.QT5CORE ref: 00406F3B
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00406F7A
_ZN7QWidget17setUpdatesEnabledEb.QT5WIDGETS(?), ref: 00406FB8
_ZN9QListData6detachEi.QT5CORE ref: 00406FF6
__cxa_guard_release.LIBSTDC++-6 ref: 004071F3
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 004072BB
memcpy.MSVCRT ref: 004072DB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData6detachData7dispose$EnabledUpdatesWidget17set__cxa_guard_releasememcpy
String ID:
API String ID: 4149923590-0
Opcode ID: 029eca73420a5b9c263d2b0ca7ac1c71faf0daa3db69aac523b39bdf9b1689d9
Instruction ID: 58acd42e498843f585bae483fcca50c253b52e53e95e72c7e68800ecc1c69975
Opcode Fuzzy Hash: 029eca73420a5b9c263d2b0ca7ac1c71faf0daa3db69aac523b39bdf9b1689d9
Instruction Fuzzy Hash: 20817174A042058FCB14EF78D48496EB7F1FF48300B1985BAE8469B3A1D738EC56CB56

Function 00440170 Relevance: 16.6, APIs: 11, Instructions: 132COMMON

Download Yara Rule

APIs

_Z5qQNaNv.QT5CORE ref: 00440185
_Z5qQNaNv.QT5CORE ref: 0044018A
_Z5qQNaNv.QT5CORE ref: 0044018F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044020F
_ZN5QChar7toUpperEj.QT5CORE ref: 00440247
_ZNK7QString3midEii.QT5CORE ref: 00440274
_ZNK7QString8toDoubleEPb.QT5CORE ref: 00440287
_ZNK7QString3midEii.QT5CORE ref: 004402D9
_ZNK7QString8toDoubleEPb.QT5CORE ref: 004402EC

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: DoubleString3midString8to$ArrayChar7toData10deallocateS_jjUpper
String ID:
API String ID: 150059324-0
Opcode ID: d3e1e71a57f3a88de4a688042279fb41cef5c4914a2271f8ccdc0e9034825958
Instruction ID: 24a90a7d0bd65688897c5e349930d4e3abefbf28020335ad5b0b8acd182a38de
Opcode Fuzzy Hash: d3e1e71a57f3a88de4a688042279fb41cef5c4914a2271f8ccdc0e9034825958
Instruction Fuzzy Hash: 8351617490470ACFDB10EFA8D4886AEBBF0FF48310F04C669E89497390D779A856CB59

Function 00447B90 Relevance: 16.6, APIs: 11, Instructions: 73windowCOMMON

Download Yara Rule

APIs

_ZNK9QComboBox5countEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447B9B
_ZNK9QComboBox8maxCountEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447BAB
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00447BD1
_ZN5QIconC1Ev.QT5GUI ref: 00447BE2
_ZN9QComboBox10insertItemEiRK5QIconRK7QStringRK8QVariant.QT5WIDGETS ref: 00447C00
_ZN5QIconD1Ev.QT5GUI ref: 00447C0B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00447C2D
_ZN8QVariantD1Ev.QT5CORE ref: 00447C35
_ZN9QComboBox15setCurrentIndexEi.QT5WIDGETS ref: 00447C44
_ZNK9QComboBox8maxCountEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447C72
_ZN9QComboBox10removeItemEi.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447C7C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$Icon$Box8maxCountItemVariant$ArrayBox10insertBox10removeBox11currentBox15setBox5countCurrentData10deallocateIndexS_jjStringText
String ID:
API String ID: 3112665431-0
Opcode ID: 1aa4d3e6a93e21d1751c15f510eda9f1e4b496c15efd3b7d74cd02a7104445a5
Instruction ID: 5ff047029bcfa56a5ebe7e3f35c5478d94b8745ba8d722b9b9c56a03a00cd6c5
Opcode Fuzzy Hash: 1aa4d3e6a93e21d1751c15f510eda9f1e4b496c15efd3b7d74cd02a7104445a5
Instruction Fuzzy Hash: 8F21A370A042059FDB00AF78D89869DBFB5FF88320F40463DE455D73A0DB34584ACB96

Function 0043D8F0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

_ZNK14QMessageLogger5debugEv.QT5CORE ref: 0043D92A
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0043D946
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 0043D952
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043D97B
_Zls6QDebugRK9QVector3D.QT5GUI ref: 0043D9A8
_Znwj.LIBSTDC++-6 ref: 0043DA88

Part of subcall function 004447E0: _ZdlPv.LIBSTDC++-6(?,?,?,?,?,0043DA24), ref: 004447F6
Part of subcall function 004447E0: _ZdlPv.LIBSTDC++-6(?,?,?,?,?,0043DA24), ref: 00444804
Part of subcall function 004447E0: _ZdlPv.LIBSTDC++-6(?,?,?,?,?,0043DA24), ref: 00444813

_ZdlPv.LIBSTDC++-6 ref: 0043DA27
_ZN11QTextStreamlsEc.QT5CORE ref: 0043DAE7

Strings

reseting gp, xrefs: 0043D93B

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: StreamlsText$ArrayData10deallocateDebugLogger5debugMessageS_jjStringString15fromUtf8_helperVector3Zls6Znwj
String ID: reseting gp
API String ID: 844818140-1593418405
Opcode ID: c8a60f17b0f3595e4db52c949bf522a7d8ccd381e7023d0498c9fc1b6bbed751
Instruction ID: bd6d47ad7e49220985c931e81617bf1db8818b7649920047b4976c8c647b70ad
Opcode Fuzzy Hash: c8a60f17b0f3595e4db52c949bf522a7d8ccd381e7023d0498c9fc1b6bbed751
Instruction Fuzzy Hash: 6F514AB0D042049FDB04EFA9E49869EBBF1FF88314F10852EE855AB351DB789945CF89

Function 00413380 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_ZNK9QIODevice6isOpenEv.QT5CORE ref: 00413391
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 004133B9
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00413402
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00413448
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0041349A
_ZNK7QString3argExii5QChar.QT5CORE ref: 004134D3

Part of subcall function 004099C0: _ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00413515
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00413537

Strings

S%1, xrefs: 00413493

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperDevice6isOpenString16from$AbstractButton9isCharCheckedExii5String3arg
String ID: S%1
API String ID: 3919080040-680958246
Opcode ID: c4a5d1783c7cfad485dbf9eb0105547554ffaba08c06358817881cc6a26c7406
Instruction ID: f0d6d6e874dc196768052f282e6d7341f775ab995fc4466a57d34528ae7bf80a
Opcode Fuzzy Hash: c4a5d1783c7cfad485dbf9eb0105547554ffaba08c06358817881cc6a26c7406
Instruction Fuzzy Hash: B9517CB0904304DFDB009F68C48839EBBF1FF84715F14856EE8989B391D7398989CB5A

Function 004478A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_ZN6QColoraSERKS_.QT5GUI(?,?,?,?,?,?,?,?,?,?,00434AC8), ref: 004478B7
_ZNK6QColor4nameEv.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,00434AC8), ref: 004478C5
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004478DD
_ZNK7QString3argERKS_i5QChar.QT5CORE ref: 00447907
_ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00447916
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044793B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044795D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044797F

Strings

background-color: %1, xrefs: 004478D6

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCharColor4nameColoraS_i5SheetStringString16fromString3argStyleWidget13set
String ID: background-color: %1
API String ID: 1303405689-1427882026
Opcode ID: 4c09f7f9417e4fc6fd1f7d34ea7dff804cf1a4ee785b641e4f11d97735988907
Instruction ID: b723bbc1883a3668c1835882d141e65680d49ce0a5cbce1a25cf7872270eeada
Opcode Fuzzy Hash: 4c09f7f9417e4fc6fd1f7d34ea7dff804cf1a4ee785b641e4f11d97735988907
Instruction Fuzzy Hash: BC314CF49082059FEB00EF68D58869EBBF1FF84314F148629E49557360D73A984ACB9A

Function 00448380 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

_ZNK19QAbstractScrollArea17verticalScrollBarEv.QT5WIDGETS ref: 0044838B
_ZNK11QScrollArea6widgetEv.QT5WIDGETS ref: 0044839E
_ZNK15QAbstractSlider5valueEv.QT5WIDGETS(?), ref: 004483BC
_ZNK15QAbstractSlider7minimumEv.QT5WIDGETS ref: 004483C6
_ZNK15QAbstractSlider7maximumEv.QT5WIDGETS ref: 0044841F
_ZNK7QWidget5styleEv.QT5WIDGETS ref: 0044845B
_ZNK7QWidget14ensurePolishedEv.QT5WIDGETS ref: 00448470

Strings

topBorder, xrefs: 004483F8
bottomBorder, xrefs: 00448445

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Abstract$Scroll$Area17verticalArea6widgetPolishedSlider5valueSlider7maximumSlider7minimumWidget14ensureWidget5style
String ID: bottomBorder$topBorder
API String ID: 3800568410-2561627314
Opcode ID: c94ead6259037564fcadf905c4e7440ab7c2cae526387c5708677efc46c12ada
Instruction ID: 7ca2b8511fbc7c1de6e2b85aebfd17a5c9e8164666e2417e04beeab513cfedce
Opcode Fuzzy Hash: c94ead6259037564fcadf905c4e7440ab7c2cae526387c5708677efc46c12ada
Instruction Fuzzy Hash: CD312D75E102149FCF04AFB8E9984ADBFF6BF88201B41467AE846E7361DF349805CB95

Function 0043F980 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__cxa_guard_acquire.LIBSTDC++-6 ref: 0043F99B
_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE ref: 0043F9BF
_ZN7QRegExp3capEi.QT5CORE ref: 0043F9DE
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0043F9FF
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0043FA1F
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0043FA43
__cxa_guard_release.LIBSTDC++-6 ref: 0043FA53
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043FA80

Strings

($[^\($]*\)|;[^;].*), xrefs: 0043FA18

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Ascii_helperString16from$ArrayCaretCaseData10deallocateExp3capExp7indexModePatternQt15S_13S_jjSensitivityStringStringiSyntax__cxa_guard_acquire__cxa_guard_release
String ID: ($[^\($]*\)|;[^;].*)
API String ID: 452882500-2829701144
Opcode ID: 912bd5253cc809522914855609eeeed044e8b1a180db266b9ee066470c53bf77
Instruction ID: 9aacb250a1338dc51fad174a6383950b29f6d4752d40e0def53f1b644beaf426
Opcode Fuzzy Hash: 912bd5253cc809522914855609eeeed044e8b1a180db266b9ee066470c53bf77
Instruction Fuzzy Hash: 423130B0908204DFDB00AFA8D55835EBBF0FF45354F10853EE9945B361D779588C9B8A

Function 00401500 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401515
LoadLibraryA.KERNEL32 ref: 0040152C
GetProcAddress.KERNEL32 ref: 00401545
GetModuleHandleA.KERNEL32 ref: 00401573
GetProcAddress.KERNEL32 ref: 0040158C

Strings

libgcj-13.dll, xrefs: 0040156C
libgcc_s_dw2-1.dll, xrefs: 0040150E, 00401525
__register_frame_info, xrefs: 0040153A
_Jv_RegisterClasses, xrefs: 00401581

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AddressHandleModuleProc$LibraryLoad
String ID: _Jv_RegisterClasses$__register_frame_info$libgcc_s_dw2-1.dll$libgcj-13.dll
API String ID: 652391981-159345992
Opcode ID: f490e806488dc32bf68dad0bd87db4bf7c34b1d2c78bb5c316a49847c911b63c
Instruction ID: 7451f4b0056bea047177fbb33e8633eb8e190bd6e673369b85e2d7479d2812e4
Opcode Fuzzy Hash: f490e806488dc32bf68dad0bd87db4bf7c34b1d2c78bb5c316a49847c911b63c
Instruction Fuzzy Hash: DA0152709092405BCB10BFB99A0929A7EE4EB85345F44853AD8898B355D7B8D808CB9B

Function 0044E6E0 Relevance: 15.1, APIs: 10, Instructions: 118COMMON

Download Yara Rule

APIs

_ZN9QComboBox5clearEv.QT5WIDGETS ref: 0044E6FF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044E7D2
_ZNK9QComboBox5countEv.QT5WIDGETS ref: 0044E819
_ZN9QComboBox15insertSeparatorEi.QT5WIDGETS ref: 0044E824

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$ArrayBox15insertBox5clearBox5countData10deallocateS_jjSeparator
String ID:
API String ID: 2339799715-0
Opcode ID: 5d7b2efd948519bacd7153162d6b0b1399501f0c239ac3337c7ee8806451c7f5
Instruction ID: b9fed84ca4d5f40f7a4e5c210dcd62b62b1af36e7fe6906f9f159d27e48f0b73
Opcode Fuzzy Hash: 5d7b2efd948519bacd7153162d6b0b1399501f0c239ac3337c7ee8806451c7f5
Instruction Fuzzy Hash: 1851AF74E00209CFEF10DF69D8986AEBBB1FF44324F14852AE445A7390D7389846CF56

Function 0042189C Relevance: 15.1, APIs: 10, Instructions: 94timewindowCOMMON

Download Yara Rule

APIs

_ZN5QTimeC1Eiiii.QT5CORE ref: 004218DE
_ZN5QTime5startEv.QT5CORE ref: 00421901
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0042192B
_ZN15QAbstractButton10setCheckedEb.QT5WIDGETS ref: 00421943
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 00421955

Part of subcall function 004042F0: _ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00404310
Part of subcall function 004042F0: _ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040432E
Part of subcall function 004042F0: _ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 00404360
Part of subcall function 004042F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404387
Part of subcall function 004042F0: _ZN7QStringaSERKS_.QT5CORE ref: 00404396
Part of subcall function 004042F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043BB
Part of subcall function 004042F0: _ZN7QRegExpD1Ev.QT5CORE ref: 004043C3
Part of subcall function 004042F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043E5

_ZN8QSysInfo14windowsVersionEv.QT5CORE ref: 0042195E
_ZN19QWinTaskbarProgress10setMaximumEi.QT5WINEXTRAS ref: 004219B9
_ZN19QWinTaskbarProgress8setValueEi.QT5WINEXTRAS ref: 004219D1
_ZN19QWinTaskbarProgress4showEv.QT5WINEXTRAS ref: 004219E0
_ZN7QWidget8setFocusEN2Qt11FocusReasonE.QT5WIDGETS ref: 00421A07
_ZNK8QVariant5toIntEPb.QT5CORE ref: 00421B27
_ZN8QVariantD1Ev.QT5CORE ref: 00421B34

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractArrayCheckedData10deallocateS_jjTaskbar$Button9isFocus$Ascii_helperButton10setCaseEiiiiInfo14windowsMaximumPatternProgress10setProgress4showProgress8setQt11Qt15ReasonS_13SensitivityStringString16fromString7replaceStringaSyntaxTimeTime5startValueVariantVariant5toVersionWidget8set
String ID:
API String ID: 1029089598-0
Opcode ID: e19cc23d735511c4a1bae26fc3783d239162c15197ff64a149092c4d6b501aaa
Instruction ID: 8f071cd23ff3398d8b370ff582f46e13014b775c1b0ca0e65c816f330228b09a
Opcode Fuzzy Hash: e19cc23d735511c4a1bae26fc3783d239162c15197ff64a149092c4d6b501aaa
Instruction Fuzzy Hash: DE411BB4A006448FD710EF78D598BAEBBF0BF48300F4045ADD89A97391CB34A948CF56

Function 00406570 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040659F

Part of subcall function 00470650: _ZN9QListData11detach_growEPii.QT5CORE ref: 00470686

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004065DA
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004065EF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00406625
_ZNK7QString7indexOfERKS_iN2Qt15CaseSensitivityE.QT5CORE ref: 00406699

Strings

error, xrefs: 004065E8

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayAscii_helperData10deallocateS_jjString16from$CaseData11detach_growListQt15SensitivityString7index
String ID: error
API String ID: 1614496162-1574812785
Opcode ID: 20e4447b56991a221a4392821b934997a9babed3281794c3ccddd09652539bf8
Instruction ID: f15bcf3b317e55e302584573a0f907492b637f2fdb6c5674c3a30f7b122d2cb1
Opcode Fuzzy Hash: 20e4447b56991a221a4392821b934997a9babed3281794c3ccddd09652539bf8
Instruction Fuzzy Hash: 90616CB4904205CFCB04DFA8D48469EBBF1FF88328F15852AD455AB390D73AA855CF95

Function 00440A30 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156windowCOMMON

Download Yara Rule

APIs

_hypot.MSVCRT ref: 00440AB4
_ZNK14QMessageLogger5debugEv.QT5CORE ref: 00440B5C
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00440B7B
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 00440B8A
_ZN6QDebugD1Ev.QT5CORE ref: 00440BB8

Strings

Error computing arc radius., xrefs: 00440B70

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: DebugLogger5debugMessageStreamlsStringString15fromTextUtf8_helper_hypot
String ID: Error computing arc radius.
API String ID: 1318116894-1659689772
Opcode ID: c41e0a96dfedc5b7067e4a62bf0a9822a040926664848def706b97823bf43900
Instruction ID: 0415b71bfcc9d64af3acea9c60136e5d5552016bb47fa8cb74efe338e86cfbdb
Opcode Fuzzy Hash: c41e0a96dfedc5b7067e4a62bf0a9822a040926664848def706b97823bf43900
Instruction Fuzzy Hash: 1D51BDB1E00209DBDB01BF90E5886CDBFB0FF44394F21489AE48576269EB365969CFC5

Function 0044B2C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127timeCOMMON

Download Yara Rule

APIs

_ZN9QGLWidgetC2EP7QWidgetPKS_6QFlagsIN2Qt10WindowTypeEE.QT5OPENGL ref: 0044B2E0
_ZN16QOpenGLFunctionsC2Ev.QT5GUI ref: 0044B2EC
_ZN6QColor10invalidateEv.QT5GUI ref: 0044B4D1
_ZN6QColor10invalidateEv.QT5GUI ref: 0044B4D9

Part of subcall function 0044A400: _ZN10QMatrix4x47frustumEffffff.QT5GUI ref: 0044A4E9

_ZN5QTime6setHMSEiiii.QT5CORE ref: 0044B597
_ZN5QTime6setHMSEiiii.QT5CORE ref: 0044B5C1
_ZN6QTimer10singleShotEiPK7QObjectPKc.QT5CORE ref: 0044B5EA

Strings

<, xrefs: 0044B5CD

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Color10invalidateEiiiiTime6setWidget$EffffffFlagsFunctionsMatrix4x47frustumObjectOpenQt10ShotTimer10singleTypeWindow
String ID: <
API String ID: 1630362984-4251816714
Opcode ID: ecbf2d95b65fc75c5588b22f4fca58abec36c3e4f45eee9ff0f80e9cd37ddf6f
Instruction ID: 9ba56759ec3404f0b5883c4cfd422cd6e4e3b508a7009ee5c13162aa5f96e44d
Opcode Fuzzy Hash: ecbf2d95b65fc75c5588b22f4fca58abec36c3e4f45eee9ff0f80e9cd37ddf6f
Instruction Fuzzy Hash: A6718BB0005601DBEB41AF15D5E83C67BA4FF49308F5885B8DC8C4E29ADBBA4458DFA6

Function 0042F7C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

_ZNK9QIODevice6isOpenEv.QT5CORE ref: 0042F809
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0042F892
_ZNK7QWidget11windowTitleEv.QT5WIDGETS ref: 0042F8A1
_ZN11QMessageBox7warningEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_.QT5WIDGETS ref: 0042F8CB
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042F8F0
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042F912
_ZN11QSerialPort5closeEv.QT5SERIALPORT ref: 0042F972

Strings

File sending in progress. Terminate and exit?, xrefs: 0042F883

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Box7warningButtonDevice6isFlagsMessageMetaObject2trOpenPort5closeS1_iS4_6S_14SerialStandardStringTitleWidgetWidget11window
String ID: File sending in progress. Terminate and exit?
API String ID: 66700925-2885346009
Opcode ID: a1e1e9e5d7dbf50c25c986f27a6eac0e8779bee05e3c25efc99424a437acd32e
Instruction ID: 5592936268a11ce998f5b9a4aa3c64a185a1a66b4ec1118ef3d746659cc8b1d3
Opcode Fuzzy Hash: a1e1e9e5d7dbf50c25c986f27a6eac0e8779bee05e3c25efc99424a437acd32e
Instruction Fuzzy Hash: FA41A0B0A043568BCB00DF69E4947AEBBB0BF44314F84867AE8945B352D738954ACF99

Function 004036E9 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

_ZN7QWidget7repaintEv.QT5WIDGETS ref: 0040367F
_ZNK15QAbstractButton4textEv.QT5WIDGETS ref: 00403737
_ZeqRK7QStringS1_.QT5CORE ref: 0040374A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00403793
_ZN15QAbstractButton7setTextERK7QString.QT5WIDGETS ref: 004037D6
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004037FF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00403B93

Strings

Check mode, xrefs: 004037B5
Check, xrefs: 00403708

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$AbstractString$Button4textButton7setTextWidget7repaint
String ID: Check$Check mode
API String ID: 2919470273-392678444
Opcode ID: d888ee96853d614f743af21df81dcfe82b28b693ff8ae58958c754f782b92e7e
Instruction ID: 318ab171dd750fe0bbc30aafb3506d0c90fa6e4c955d5963c7a4131742660886
Opcode Fuzzy Hash: d888ee96853d614f743af21df81dcfe82b28b693ff8ae58958c754f782b92e7e
Instruction Fuzzy Hash: D03148B4A043058FDB00EF68C48869EBBF1FF84354F14CA2DE895973A1DB79A845CB46

Function 0044DB00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73timeCOMMON

Download Yara Rule

APIs

_ZN7QWidgetC2EPS_6QFlagsIN2Qt10WindowTypeEE.QT5WIDGETS ref: 0044DB19
_Znwj.LIBSTDC++-6 ref: 0044DB36
_ZN6QTimerC1EP7QObject.QT5CORE ref: 0044DB4A

Part of subcall function 00461F50: _ZNK7QObject10objectNameEv.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00461F66
Part of subcall function 00461F50: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00461F95
Part of subcall function 00461F50: _ZN7QObject13setObjectNameERK7QString.QT5CORE ref: 00461FAE
Part of subcall function 00461F50: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00461FD7
Part of subcall function 00461F50: _ZN7QWidget6resizeERK5QSize.QT5WIDGETS ref: 00461FF0
Part of subcall function 00461F50: _Znwj.LIBSTDC++-6 ref: 00462000
Part of subcall function 00461F50: _ZN11QVBoxLayoutC1EP7QWidget.QT5WIDGETS ref: 0046200D
Part of subcall function 00461F50: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00462054
Part of subcall function 00461F50: _ZN7QLayout18setContentsMarginsEiiii.QT5WIDGETS ref: 0046207B
Part of subcall function 00461F50: _Znwj.LIBSTDC++-6 ref: 0046208B
Part of subcall function 00461F50: _ZN11QHBoxLayoutC1Ev.QT5WIDGETS ref: 00462095
Part of subcall function 00461F50: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004620D3
Part of subcall function 00461F50: _Znwj.LIBSTDC++-6 ref: 004620E0

Part of subcall function 0044DAB0: _ZN8QSpinBox10setMinimumEi.QT5WIDGETS(00000002,000B2260,?,0042B208), ref: 0044DAC9

Part of subcall function 0044D9A0: _ZN8QSpinBox10setMaximumEi.QT5WIDGETS(00000002,000B2260,?,0042B220), ref: 0044D9B9

Part of subcall function 0044D630: _ZN8QSpinBox8setValueEi.QT5WIDGETS(?,?,?,00409BC3), ref: 0044D646

Part of subcall function 0044D680: _ZNK8QSpinBox5valueEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6AD
Part of subcall function 0044D680: _ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6C1
Part of subcall function 0044D680: _ZN7QString16fromAscii_helperEPKci.QT5CORE(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6E7
Part of subcall function 0044D680: _ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6FC
Part of subcall function 0044D680: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044D721

_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE.QT5CORE ref: 0044DBF8
_ZN11QMetaObject10ConnectionD1Ev.QT5CORE ref: 0044DC00
_ZN6QTimer11setIntervalEi.QT5CORE ref: 0044DC0F

Strings

1onTimerValueChanged(), xrefs: 0044DBDD
2timeout(), xrefs: 0044DBE9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$SpinZnwj$Box10setConnectionLayoutNameObjectStringTypeWidget$AbstractAscii_helperBox5valueBox8setButton9isCheckedContentsEiiiiFlagsIntervalLayout18setMarginsMaximumMetaMinimumObject10Object10objectObject13setObject7connectQt10Qt14SheetSizeString16fromStyleTimerTimer11setValueWidget13setWidget6resizeWindow
String ID: 1onTimerValueChanged()$2timeout()
API String ID: 147573032-1740788808
Opcode ID: 70b17e52ab2467749ba3e5fd556af34eb83be56b439b0c605fb1770e6ff02d66
Instruction ID: f9036ebaad5f89eee1dd01aa2f37062e98fd3060bde56a94761b7f12f08e328a
Opcode Fuzzy Hash: 70b17e52ab2467749ba3e5fd556af34eb83be56b439b0c605fb1770e6ff02d66
Instruction Fuzzy Hash: B831E9F16082008FDB04BF69D19926EBBF0BB44304F41493DE88A9B355DB789498CB97

Function 00404A40 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_ZN7QString14toUpper_helperERKS_.QT5CORE ref: 00404A56
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00404A6B
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 00404A8D
_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE ref: 00404AAC
_ZN7QRegExpD1Ev.QT5CORE ref: 00404ABE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404AE0
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404B02

Strings

^GRBL|GCARVIN\s\d\.\d., xrefs: 00404A64

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCaretCaseExp7indexModePatternQt15S_13SensitivityStringString14toString16fromStringiSyntaxUpper_helper
String ID: ^GRBL|GCARVIN\s\d\.\d.
API String ID: 1535780433-1806128931
Opcode ID: e75c70acc9cbd50f4021f804f1010b95535627d1d44c2f3fbdfbe6fbae1d6160
Instruction ID: 082118d0f57a72f17e6ac0ae851475bb2ccda77e5dac9715c1a97fc64cc2e04a
Opcode Fuzzy Hash: e75c70acc9cbd50f4021f804f1010b95535627d1d44c2f3fbdfbe6fbae1d6160
Instruction Fuzzy Hash: 41317AB05083059FDB00EF68D89839EBBF0FF84354F50862DE995A7290D7399989CF5A

Function 00432180 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

_ZNK11QListWidget4itemEi.QT5WIDGETS ref: 0043219D
_ZNK8QVariant8toStringEv.QT5CORE ref: 004321C0
_Z20qt_qFindChild_helperPK7QObjectRK7QStringRK11QMetaObject6QFlagsIN2Qt15FindChildOptionEE.QT5CORE ref: 004321E1
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00432205
_ZN8QVariantD1Ev.QT5CORE ref: 0043220D
_ZN11QScrollArea19ensureWidgetVisibleEP7QWidgetii.QT5WIDGETS ref: 00432230

Strings

2, xrefs: 00432225
2, xrefs: 0043221D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: FindString$Area19ensureArrayChildChild_helperData10deallocateFlagsListMetaObjectObject6OptionQt15S_jjScrollVariantVariant8toVisibleWidgetWidget4itemWidgetiiZ20qt_q
String ID: 2$2
API String ID: 1410313547-3784399050
Opcode ID: ae001745c5135db7a4c0bb5548846625fb824ecec396aa62e9d2d52aa13c186c
Instruction ID: a763655aa02bc6b877a647317c2b5b0098a9fdae0178b46fade03bf20eac95cc
Opcode Fuzzy Hash: ae001745c5135db7a4c0bb5548846625fb824ecec396aa62e9d2d52aa13c186c
Instruction Fuzzy Hash: 552139B49043009FC704AF69D98869EBBF0FF88314F50862EE89597361DB749889CB96

Function 00404A3C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_ZN7QString14toUpper_helperERKS_.QT5CORE ref: 00404A56
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00404A6B
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 00404A8D
_ZNK7QRegExp7indexInERK7QStringiNS_9CaretModeE.QT5CORE ref: 00404AAC
_ZN7QRegExpD1Ev.QT5CORE ref: 00404ABE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404AE0
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404B02

Strings

^GRBL|GCARVIN\s\d\.\d., xrefs: 00404A64

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperCaretCaseExp7indexModePatternQt15S_13SensitivityStringString14toString16fromStringiSyntaxUpper_helper
String ID: ^GRBL|GCARVIN\s\d\.\d.
API String ID: 1535780433-1806128931
Opcode ID: f8516c89f547e1133012a3df1c50d3d48df5037488685506333b494775e8f003
Instruction ID: 9de5701cb0778ff0403898ed2e81524304a1c0eece32fda549ccc6968fe347b6
Opcode Fuzzy Hash: f8516c89f547e1133012a3df1c50d3d48df5037488685506333b494775e8f003
Instruction Fuzzy Hash: 052135B08043059FDB00EF68D99879EBBF0FF88344F50892DE985A3250D7799848CF96

Function 0041326C Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00413294
_ZN9QLineEdit7setTextERK7QString.QT5WIDGETS ref: 004132A9
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 004132DA
_ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS ref: 004132EF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00413314
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00413343

Strings

background-color: palette(button); color: palette(text);, xrefs: 004132D3
Port opened, xrefs: 00413283
8, xrefs: 004132CB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jjString$Ascii_helperEdit7setLineMetaObject2trS1_iSheetString16fromStyleTextWidget13set
String ID: 8$Port opened$background-color: palette(button); color: palette(text);
API String ID: 3676935821-1369377024
Opcode ID: 651d9c2b5e5281dadcddde806dad505c89d9d407284d17436487676b46000734
Instruction ID: 7e2522119fe41f8b504bd47d51584863069357899eade76bf8cc56aa62bb114b
Opcode Fuzzy Hash: 651d9c2b5e5281dadcddde806dad505c89d9d407284d17436487676b46000734
Instruction Fuzzy Hash: A2115EB49043009FCB00EF68D49829EBBB1FF84315F54C6ADE8995B390DB399945CF8A

Function 0040C870 Relevance: 13.6, APIs: 9, Instructions: 142COMMON

Download Yara Rule

APIs

_ZNK7QObject6senderEv.QT5CORE ref: 0040C881
_ZNK7QObject10objectNameEv.QT5CORE ref: 0040C88C
_ZNK7QString5rightEi.QT5CORE ref: 0040C8A3
_ZNK7QString5toIntEPbi.QT5CORE ref: 0040C8BE

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040C8E7

Part of subcall function 00433010: _ZN7QString16fromAscii_helperEPKci.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,004115F8), ref: 00433030
Part of subcall function 00433010: _ZNK7QString3argExii5QChar.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00433066
Part of subcall function 00433010: _Z20qt_qFindChild_helperPK7QObjectRK7QStringRK11QMetaObject6QFlagsIN2Qt15FindChildOptionEE.QT5CORE ref: 0043308A
Part of subcall function 00433010: _ZNK9QLineEdit4textEv.QT5WIDGETS ref: 00433095
Part of subcall function 00433010: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004330BA
Part of subcall function 00433010: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004330DC

_ZNK7QString5splitERKS_NS_13SplitBehaviorEN2Qt15CaseSensitivityE.QT5CORE ref: 0040C924
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040C987
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040C9B4
_ZN7QString14trimmed_helperERKS_.QT5CORE ref: 0040CA0E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperFindQt15String16from$BehaviorCaseCharChildChild_helperEdit4textExii5FlagsLineMetaNameObjectObject10objectObject6Object6senderOptionS_13SensitivitySplitStringString14trimmed_helperString3argString5rightString5splitString5toZ20qt_q
String ID:
API String ID: 2776095069-0
Opcode ID: 233c5017907c90f5b83be505d1bef29cd48646c81ea3228db60fc08ee94776cb
Instruction ID: 56842c5d4efa8fef4e9fbba6ebb297380f5f13ca4c48eb7d0cdfdd3d443212a9
Opcode Fuzzy Hash: 233c5017907c90f5b83be505d1bef29cd48646c81ea3228db60fc08ee94776cb
Instruction Fuzzy Hash: 2C5148B0904304DFCB04EFA9D5886AEBBF1FF44314F04862EE455A7290DB799949CF96

Function 00406050 Relevance: 13.6, APIs: 9, Instructions: 123COMMON

Download Yara Rule

APIs

_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 00406082
_ZNK7QString8toDoubleEPb.QT5CORE ref: 00406097
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004060C7
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 00406104
_ZNK7QString8toDoubleEPb.QT5CORE ref: 00406113
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00406163

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateDoubleEdit4textLineS_jjString8to
String ID:
API String ID: 3459737250-0
Opcode ID: 423761209936f0ed3280fecb558121884f343f1e4d3e526abb211f2b5066434b
Instruction ID: fcadb1be34a119727e0188e8b66e1adbf9054e1cc0b5ce69adfde0b45b401482
Opcode Fuzzy Hash: 423761209936f0ed3280fecb558121884f343f1e4d3e526abb211f2b5066434b
Instruction Fuzzy Hash: FD41B2B0904209DBDF00EF64D8886AEBBF0FF44340F158569D886673D4E7399C6ACB96

Function 0041EDE0 Relevance: 13.6, APIs: 9, Instructions: 81timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041E6F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E846

_ZN5QTime5startEv.QT5CORE ref: 0041EE35
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0041EE5F
_ZN15QAbstractButton10setCheckedEb.QT5WIDGETS ref: 0041EE77
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0041EE89

Part of subcall function 004042F0: _ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00404310
Part of subcall function 004042F0: _ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE.QT5CORE ref: 0040432E
Part of subcall function 004042F0: _ZN7QString7replaceERK7QRegExpRKS_.QT5CORE ref: 00404360
Part of subcall function 004042F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404387
Part of subcall function 004042F0: _ZN7QStringaSERKS_.QT5CORE ref: 00404396
Part of subcall function 004042F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043BB
Part of subcall function 004042F0: _ZN7QRegExpD1Ev.QT5CORE ref: 004043C3
Part of subcall function 004042F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004043E5

_ZN8QSysInfo14windowsVersionEv.QT5CORE ref: 0041EE92
_ZN19QWinTaskbarProgress10setMaximumEi.QT5WINEXTRAS ref: 0041EEE8
_ZN19QWinTaskbarProgress8setValueEi.QT5WINEXTRAS ref: 0041EEFE
_ZN19QWinTaskbarProgress4showEv.QT5WINEXTRAS ref: 0041EF0D
_ZN7QWidget8setFocusEN2Qt11FocusReasonE.QT5WIDGETS ref: 0041EF2A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$AbstractCheckedTaskbar$Button9isFocus$Ascii_helperButton10setCaseInfo14windowsMaximumPatternProgress10setProgress4showProgress8setQt11Qt15ReasonS_13SensitivityStringString16fromString7replaceStringaSyntaxTime5startValueVersionWidget8set
String ID:
API String ID: 3615984582-0
Opcode ID: 80c883c81ad438820e58d911ca7635b5ff9cf62957a5ba8ef00942a6f72b6462
Instruction ID: 2934e70c84d1f2cbed25a0d4b3249bd1c32da0d327acd6be5f47f5761074fa01
Opcode Fuzzy Hash: 80c883c81ad438820e58d911ca7635b5ff9cf62957a5ba8ef00942a6f72b6462
Instruction Fuzzy Hash: 6F3180B42042418FD704EF29D5E87AA7BB4EF84310F4406BDEC954B3E6CB74A909CB96

Function 0043E360 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 004414D0: _ZN5QChar7toUpperEj.QT5CORE ref: 0044154B
Part of subcall function 004414D0: _Z5qQNaNv.QT5CORE ref: 00441598

_ZN9QListData6detachEi.QT5CORE ref: 0043E482
memcpy.MSVCRT ref: 0043E4B5

Part of subcall function 004729B0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 004729BE

_ZN9QListData6detachEi.QT5CORE ref: 0043E5EA
memcpy.MSVCRT ref: 0043E635

Strings

P, xrefs: 0043E431
G, xrefs: 0043E502

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$Data6detachmemcpy$Char7toDataData7disposeUpper
String ID: G$P
API String ID: 1869317941-270004741
Opcode ID: 933447fc676d984f03699d02c78d63813d40a35223fd1a71234ad91d566585bb
Instruction ID: 592caeccc5ee3589c4dee403da918fd7bd3546ea00e1f9587b51b4a8a0f54399
Opcode Fuzzy Hash: 933447fc676d984f03699d02c78d63813d40a35223fd1a71234ad91d566585bb
Instruction Fuzzy Hash: 0FB128B0D01209DFCF14EFA9D4848ADBBF1FF88314F15856AE845A7391EB34A896CB45

Function 00403AAC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00403533
_ZN15QAbstractButton7setTextERK7QString.QT5WIDGETS ref: 00403548
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00403571
_ZN7QWidget15setMinimumWidthEi.QT5WIDGETS ref: 00403591
_ZN7QWidget7repaintEv.QT5WIDGETS ref: 0040367F
__cxa_guard_release.LIBSTDC++-6 ref: 00403ACA

Strings

Check, xrefs: 00403524

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractArrayButton7setData10deallocateMetaMinimumObject2trS1_iS_jjStringTextWidget15setWidget7repaintWidth__cxa_guard_release
String ID: Check
API String ID: 143180855-4249846551
Opcode ID: 2d6ae9abdc8592d7589fbe4635874687d285d4ba67d69cea8929a4088c5074b1
Instruction ID: c6276543e5cb3a1abc732b39cba4c9b359f5e7cc6077406659477a6fc200b30a
Opcode Fuzzy Hash: 2d6ae9abdc8592d7589fbe4635874687d285d4ba67d69cea8929a4088c5074b1
Instruction Fuzzy Hash: 30610DB5A00204CFCB48EF68C498999BBF1FF88314F1585B9D8469B766CB34E845CF91

Function 0042E350 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

_ZN11QFileDialog15getSaveFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE.QT5WIDGETS ref: 0042E3E8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042E40E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042E434
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0042E4AC

Strings

G-Code files (*.nc *.ncc *.ngc *.tap *.txt), xrefs: 0042E37B
Save file as, xrefs: 0042E3A8

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$File$Dialog15getFlagsNameOptionS2_6SaveStringWidget
String ID: G-Code files (*.nc *.ncc *.ngc *.tap *.txt)$Save file as
API String ID: 4017155732-2175381733
Opcode ID: 54080e5a4c75a0e81acc49966884bde5b902bdd8094b27e1f765dfb8c9313aea
Instruction ID: 6d86541849c5fb36edb5bea4cc8482151a62933d66ecf35f92f1c13a8c45b12a
Opcode Fuzzy Hash: 54080e5a4c75a0e81acc49966884bde5b902bdd8094b27e1f765dfb8c9313aea
Instruction Fuzzy Hash: 65514BB0A043119FCB00EF69D48879EBBF1FF84314F548A1EE4985B394D77A9845CB86

Function 0041C1B9 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 106timeCOMMON

Download Yara Rule

APIs

_ZN7QWidget5closeEv.QT5WIDGETS ref: 0041C1C6

Part of subcall function 00443460: _ZdlPv.LIBSTDC++-6 ref: 004434BC
Part of subcall function 00443460: _ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 00443536

Part of subcall function 004326F0: _ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS(?,0041B169), ref: 004326FF

Part of subcall function 00403F70: _ZNK9QVector3D6lengthEv.QT5GUI ref: 00403FE8
Part of subcall function 00403F70: _Z6qIsNaNd.QT5CORE ref: 00403FF5
Part of subcall function 00403F70: _ZN9QListData6detachEi.QT5CORE ref: 00404029

Part of subcall function 00471AA0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471AAE

Part of subcall function 00449A80: _Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449AA8
Part of subcall function 00449A80: _Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449AD0
Part of subcall function 00449A80: _Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449AF8
Part of subcall function 00449A80: _Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449B20
Part of subcall function 00449A80: _Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449B48
Part of subcall function 00449A80: _Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449B70

_ZNK5QTime7elapsedEv.QT5CORE ref: 0041C290
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041C33E
_ZN11QTextStreamlsEi.QT5CORE ref: 0041C357
_ZN15QProgressDialogD1Ev.QT5WIDGETS ref: 0041C384

Strings

default, xrefs: 0041C2CC
Update parser time: , xrefs: 0041C2F0

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayList$AbstractAllocationButton9isCheckedD6lengthDataData10deallocateData6detachData7disposeData8allocateDialogEjjj6FlagsOptionProgressS_16S_jjStreamlsTextTime7elapsedVector3Widget5close
String ID: Update parser time: $default
API String ID: 1854842719-2908768034
Opcode ID: d3a06dd792fcdbd741b1c253bd6d3fa2e987e4dfe77e04c440dc50278254e046
Instruction ID: d2c0d067afae4a444eb2a613e474cd036ed9cd8b2db09611215aedb665f783e6
Opcode Fuzzy Hash: d3a06dd792fcdbd741b1c253bd6d3fa2e987e4dfe77e04c440dc50278254e046
Instruction Fuzzy Hash: FF511C74904319CFDB24EF24C8957EEBBB1BF84304F0085ADD88A57251DB74AA89CF56

Function 00433010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,004115F8), ref: 00433030
_ZNK7QString3argExii5QChar.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00433066
_Z20qt_qFindChild_helperPK7QObjectRK7QStringRK11QMetaObject6QFlagsIN2Qt15FindChildOptionEE.QT5CORE ref: 0043308A
_ZNK9QLineEdit4textEv.QT5WIDGETS ref: 00433095
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004330BA
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004330DC

Strings

txtUserCommand%1, xrefs: 00433029

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateFindS_jj$Ascii_helperCharChildChild_helperEdit4textExii5FlagsLineMetaObjectObject6OptionQt15StringString16fromString3argZ20qt_q
String ID: txtUserCommand%1
API String ID: 3452890311-1882453919
Opcode ID: 6a2180e9ba6624648f45e712baefc1badf3188088ac00f75bea800ab326080d6
Instruction ID: be01dbf89a083609326435172f16de0d7207e25e557f81aaf8e1922b46da1e2a
Opcode Fuzzy Hash: 6a2180e9ba6624648f45e712baefc1badf3188088ac00f75bea800ab326080d6
Instruction Fuzzy Hash: 27315CB05083059FDB00AF68D88825EBBF0FF88315F108A2EE4889B350D7799945CB86

Function 00433140 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 00433160
_ZNK7QString3argExii5QChar.QT5CORE ref: 00433196
_Z20qt_qFindChild_helperPK7QObjectRK7QStringRK11QMetaObject6QFlagsIN2Qt15FindChildOptionEE.QT5CORE ref: 004331B7
_ZN9QLineEdit7setTextERK7QString.QT5WIDGETS ref: 004331C5
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004331EA
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043320C

Strings

txtUserCommand%1, xrefs: 00433159

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateFindS_jjString$Ascii_helperCharChildChild_helperEdit7setExii5FlagsLineMetaObjectObject6OptionQt15String16fromString3argTextZ20qt_q
String ID: txtUserCommand%1
API String ID: 1224941544-1882453919
Opcode ID: cd9160d7e863a3816dbd2db34b93577cbb8bd460593f486ee0dd5c618262a818
Instruction ID: 4d8daef8793b669f9863a337fb515e2287920bb495ba7f9d665f479c58341a2a
Opcode Fuzzy Hash: cd9160d7e863a3816dbd2db34b93577cbb8bd460593f486ee0dd5c618262a818
Instruction Fuzzy Hash: B4314DB49043059FDB009F68D48865EBBF0FF88315F50C62EE49497360D7799945CB56

Function 0044D680 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0044D3E0: _ZN7QWidget7repaintEv.QT5WIDGETS(?,0044D6A4,?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D3EF

_ZNK8QSpinBox5valueEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6AD
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6C1
_ZN7QString16fromAscii_helperEPKci.QT5CORE(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6E7
_ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6FC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044D721

Strings

color: palette(text);, xrefs: 0044D6C9, 0044D74A
color: red;, xrefs: 0044D6D8

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractArrayAscii_helperBox5valueButton9isCheckedData10deallocateS_jjSheetSpinStringString16fromStyleWidget13setWidget7repaint
String ID: color: palette(text);$color: red;
API String ID: 3101016212-1387309593
Opcode ID: 36f252f8e9a893dc62f9a35281237eff89647f8e186fa9a9c119d74974b4f2d2
Instruction ID: 188badc03d401b648fd9d4add4c4f1e6f0a7e57e4ed4050b077493577ff8b4ed
Opcode Fuzzy Hash: 36f252f8e9a893dc62f9a35281237eff89647f8e186fa9a9c119d74974b4f2d2
Instruction Fuzzy Hash: 1221A1B4A002048FDB08EF68D8C899EBBB1FF84344F118569E8458B365DB35EC45CF89

Function 0040CBCA Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040CBD6
_ZN8QVariantC1Eb.QT5CORE ref: 0040CBFB
_ZN7QObject11setPropertyEPKcRK8QVariant.QT5CORE ref: 0040CC18
_ZN8QVariantD1Ev.QT5CORE ref: 0040CC23
_ZNK7QWidget5styleEv.QT5WIDGETS ref: 0040CC2B
_ZNK7QWidget14ensurePolishedEv.QT5WIDGETS ref: 0040CC50
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040CCAF
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040CCF1
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040CD3D

Strings

overrided, xrefs: 0040CC11

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayAscii_helperData10deallocateS_jjString16from$Object11setPolishedPropertyResumeUnwind_Widget14ensureWidget5style
String ID: overrided
API String ID: 2632582772-1212112701
Opcode ID: 6e468ee542df08ea522a0165b9089540c6be9978875376d47274b82c9c111bee
Instruction ID: 62813573c8096cbeb3908a086cc559c1c636bf99e4dcd270d496fcc73a295a37
Opcode Fuzzy Hash: 6e468ee542df08ea522a0165b9089540c6be9978875376d47274b82c9c111bee
Instruction Fuzzy Hash: 3821E4757002008FCF04AF78D8985ADBBB1EF88301F44457EED469B362CB38A859CB99

Function 004051B2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 004051BE
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0040520A
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 0040521F
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00405248
_ZN7QWidget6updateEv.QT5WIDGETS ref: 00405253
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 00405260
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0040528D
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004052D0
_ZNK7QString3argExii5QChar.QT5CORE ref: 00405306
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00405331
_ZN7QString6appendERKS_.QT5CORE ref: 00405358
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 0040536D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00405396
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004053BC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004053DE

Strings

Spindle, xrefs: 004051F9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$MetaObject2trS1_i$Box8setEventsGroupStringTitle$AbstractApplication13processButton9isCharCheckedCoreEventExii5FlagFlagsLoop17ProcessResumeString3argString6appendUnwind_Widget6update
String ID: Spindle
API String ID: 565202139-1894147609
Opcode ID: c02b19049f76e1ec9954b6e70533c3a5df903a3fd45d7b08d74a3bf5c7d415b3
Instruction ID: 4439bd4ee06e11428aa0142e98da4118bbfe58443dc8381f7d889f9d607d4a01
Opcode Fuzzy Hash: c02b19049f76e1ec9954b6e70533c3a5df903a3fd45d7b08d74a3bf5c7d415b3
Instruction Fuzzy Hash: 8C2160B56043009FC700AF64D4987AEBBF0FF84314F058A6DE99557361D778A449CF86

Function 00404659 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_ZN8QVariantC1Eb.QT5CORE ref: 0040467B
_ZN7QObject11setPropertyEPKcRK8QVariant.QT5CORE ref: 00404698
_ZN8QVariantD1Ev.QT5CORE ref: 004046A3
_ZNK7QWidget5styleEv.QT5WIDGETS ref: 004046AB
_ZNK7QWidget14ensurePolishedEv.QT5WIDGETS ref: 004046D0
_ZNK9QGroupBox9isCheckedEv.QT5WIDGETS ref: 004046E5
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00404721
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00404736
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040475B
_ZNK7QString3argExii5QChar.QT5CORE ref: 00404800
_ZN7QString6appendERKS_.QT5CORE ref: 00404850
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00404865
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040488E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004048B4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004048D6

Strings

overrided, xrefs: 00404691

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$GroupVariant$Box8setStringTitle$Box9isCharCheckedExii5MetaObject11setObject2trPolishedPropertyS1_iString3argString6appendWidget14ensureWidget5style
String ID: overrided
API String ID: 3883570626-1212112701
Opcode ID: ef9ee6073e7ef741f3b7c82d9d15188be884296a66a8a44c820386ef1e900e1a
Instruction ID: 61c08a02cf1d6933a9c51b0c5b13231fcc4d15ba6ef16f9397a861a19ecd6245
Opcode Fuzzy Hash: ef9ee6073e7ef741f3b7c82d9d15188be884296a66a8a44c820386ef1e900e1a
Instruction Fuzzy Hash: 97113375610200DFCB04EFA8E89C9A9BBB5FF88311F444579ED469B362CB34A815CB95

Function 00446080 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

_ZNK8QVariant5toIntEPb.QT5CORE ref: 004460F1
_ZN18QAbstractItemModel11dataChangedERK11QModelIndexS2_RK7QVectorIiE.QT5CORE ref: 00446115
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044613E
_ZNK8QVariant8toStringEv.QT5CORE ref: 0044615E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004461BB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$AbstractChangedIndexItemModelModel11dataStringVariant5toVariant8toVector
String ID:
API String ID: 1391285557-0
Opcode ID: 2e997fcf2aac3020233d8938e023cea54e4f08a76677ca8192363633d2b9aa3f
Instruction ID: 535c55e06ddcc4176fcb091c8d8adefeb1ef77a65f2fb80d5d69c1c0a17ec394
Opcode Fuzzy Hash: 2e997fcf2aac3020233d8938e023cea54e4f08a76677ca8192363633d2b9aa3f
Instruction Fuzzy Hash: 318127B4A04206CFDB04EF69C48495ABBF1FF85304F16C66AD8599B321D735E845CF86

Function 0040F270 Relevance: 12.1, APIs: 8, Instructions: 143windowCOMMON

Download Yara Rule

APIs

_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0040F2A4
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F38E

Part of subcall function 0046F2E0: _ZN9QListData6detachEi.QT5CORE(?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F2F9
Part of subcall function 0046F2E0: _Znwj.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F328

_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F2D2

Part of subcall function 00472140: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,004086DF), ref: 0047214E

_ZNK19QAbstractScrollArea8viewportEv.QT5WIDGETS ref: 0040F3BF
_ZNK7QWidget11mapToGlobalERK6QPoint.QT5WIDGETS ref: 0040F3CD
_ZN5QMenu5popupERK6QPointP7QAction.QT5WIDGETS ref: 0040F3ED
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F400
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F435

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Widget7actions$ListPoint$AbstractActionArea8viewportDataData6detachData7disposeGlobalItemMenu5popupModel12selectedRowsScrollSelectionWidget11mapZnwj
String ID:
API String ID: 2916371295-0
Opcode ID: d45e21848b44b7e75ee8b86bafa996b6c671ecfb81fe1286dd8c55d8f113cd0d
Instruction ID: f1798daec4dde15dd27168254fc022ab50bdb890d5639a47f73dbe925ab15477
Opcode Fuzzy Hash: d45e21848b44b7e75ee8b86bafa996b6c671ecfb81fe1286dd8c55d8f113cd0d
Instruction Fuzzy Hash: 4551F9B5A00204CFCB04EFB8D59899DBBF1FF88310F05466AE855AB365DB34A845CF96

Function 004214AC Relevance: 12.1, APIs: 8, Instructions: 67COMMON

Download Yara Rule

APIs

_ZN7QStringaSERKS_.QT5CORE ref: 004214BF
_ZN11QTextStreamC1EP9QIODevice.QT5CORE ref: 004214D0
_ZNK11QTextStream5atEndEv.QT5CORE ref: 004214F2
_ZN11QTextStream8readLineEx.QT5CORE ref: 00421511

Part of subcall function 00470650: _ZN9QListData11detach_growEPii.QT5CORE ref: 00470686

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00421543
_ZNK11QTextStream5atEndEv.QT5CORE ref: 0042154B
_ZN11QTextStreamD1Ev.QT5CORE ref: 00421583
_ZN5QFileD1Ev.QT5CORE ref: 0042158C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Text$StreamStream5at$ArrayData10deallocateData11detach_growDeviceFileLineListS_jjStream8readStringa
String ID:
API String ID: 1213247097-0
Opcode ID: f121501413bf62275c89e3b9e01313e56211848ed24cdcb5219b9bdb2a8f367e
Instruction ID: 2aeae716f303c7bdb6030dddd774b9036b4ed5648fad678ddda75e612aeab56d
Opcode Fuzzy Hash: f121501413bf62275c89e3b9e01313e56211848ed24cdcb5219b9bdb2a8f367e
Instruction Fuzzy Hash: 1D2130B1A002158FDF04BF78E4A86ADBBB1FF94304F40453DE446A7260DB386959CB8A

Function 00443270 Relevance: 12.1, APIs: 8, Instructions: 53COMMON

Download Yara Rule

APIs

_ZN7QObjectC2EPS_.QT5CORE(?,?,?,?,?,?,00000002,?,00429A6F), ref: 0044327E
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,00000002,?,00429A6F), ref: 004432F5
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,00000002,?,00429A6F), ref: 004432FB
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,00000002,?,00429A6F), ref: 00443301
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,00000002,?,00429A6F), ref: 00443314
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,00000002,?,00429A6F), ref: 0044331A
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,00000002,?,00429A6F), ref: 00443320
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,00000002,?,00429A6F), ref: 00443333

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: 9e758e5028568e10e9a9f0d0f7366b83f2d1f792977a3f79345c56cac69d1929
Instruction ID: 5ff04c1d35116a1e058c3c107f39fd5ab09c69faa6175a63fc637c9ecb58587c
Opcode Fuzzy Hash: 9e758e5028568e10e9a9f0d0f7366b83f2d1f792977a3f79345c56cac69d1929
Instruction Fuzzy Hash: 662190B0505254CFDB549F14E9D831A7FB0BF54304F8545A9D8845E2AAC3BAC8B8CFEA

Function 004033F0 Relevance: 12.0, APIs: 8, Instructions: 46COMMON

Download Yara Rule

APIs

_ZNK10QTableView16horizontalHeaderEv.QT5WIDGETS(?,?,?,0041D719), ref: 00403404
_ZNK11QHeaderView18defaultSectionSizeEv.QT5WIDGETS ref: 00403408
_ZNK10QTableView16horizontalHeaderEv.QT5WIDGETS ref: 00403416
_ZNK11QHeaderView5countEv.QT5WIDGETS ref: 0040341A
_ZNK10QTableView16horizontalHeaderEv.QT5WIDGETS ref: 00403439
_ZN11QHeaderView20setSectionResizeModeENS_10ResizeModeE.QT5WIDGETS ref: 00403444
_ZNK10QTableView16horizontalHeaderEv.QT5WIDGETS ref: 00403454
_ZN11QHeaderView20setSectionResizeModeENS_10ResizeModeE.QT5WIDGETS ref: 0040345F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Header$ModeResizeTableView16horizontal$Section$S_10View20set$SizeView18defaultView5count
String ID:
API String ID: 1455340251-0
Opcode ID: 409ca12b0cdc30bbc74f86f079ec7bc7ab8c5e85e3929c2b3ddecb783dfaa32a
Instruction ID: 0ae5a48ec4e37e0d6ee38a46238d2a8197e8d9aaee0d4b8b60881ae45342a434
Opcode Fuzzy Hash: 409ca12b0cdc30bbc74f86f079ec7bc7ab8c5e85e3929c2b3ddecb783dfaa32a
Instruction Fuzzy Hash: F10175726002008FD718BF7CE99995EBBF5FB94200B510A6DD842C73A5DE35E8468B85

Function 004737C0 Relevance: 10.8, APIs: 7, Instructions: 287COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00473843
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004738AC
memcpy.MSVCRT ref: 00473A05

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$memcpy
String ID:
API String ID: 2929742026-0
Opcode ID: 4a864458f9acf349d61817e3bb0ee4aa7cdcdcf65264b822ec7473ce473cd6f0
Instruction ID: 12aa07123557c66fec345b2ef8078f9c7d77b01d2f1ee011910ce616e7b2abd2
Opcode Fuzzy Hash: 4a864458f9acf349d61817e3bb0ee4aa7cdcdcf65264b822ec7473ce473cd6f0
Instruction Fuzzy Hash: 49C18AB0608242CFC710DF28C580A9AFBE1BF85316F19C52EE5988B351D739EE45DB86

Function 00451480 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 176COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00451714
Mingw-w64 runtime failure:, xrefs: 004512FD
VirtualQuery failed for %d bytes at address %p, xrefs: 00451700
Unknown pseudo relocation bit size %d., xrefs: 00451574

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$ VirtualQuery failed for %d bytes at address %p$Mingw-w64 runtime failure:
API String ID: 0-1068558636
Opcode ID: f3041292eaebadafbbdb344e855932b31dc112cafff104ef43a6d46bfc2c9c7f
Instruction ID: 155c29f241d9e4624166fc541b84943b5143b784766c8f7a33df62642477c892
Opcode Fuzzy Hash: f3041292eaebadafbbdb344e855932b31dc112cafff104ef43a6d46bfc2c9c7f
Instruction Fuzzy Hash: 6F718E74A01204ABCB10CF69D98076EBBF5EF85345F68852BEC4597326E738D808CB59

Function 00440DB0 Relevance: 10.7, APIs: 7, Instructions: 169COMMON

Download Yara Rule

APIs

_ZN7QString15toLatin1_helperERKS_.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041AE46), ref: 00440DD8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440E52
_ZN7QString6appendE5QChar.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041AE46), ref: 00440EB7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440F0E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00440F34
_ZN7QString6appendE5QChar.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041AE46), ref: 00440F51

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$CharString6append$Latin1_helperString15to
String ID:
API String ID: 4225502300-0
Opcode ID: f035a5dc6805b64a50c6df97a860994964a83e85f010b674f6d86e6a92dad533
Instruction ID: 714e91ba88a595ce387a740736354ad32d94b6ebaf7445c52e30c3c97d0d432e
Opcode Fuzzy Hash: f035a5dc6805b64a50c6df97a860994964a83e85f010b674f6d86e6a92dad533
Instruction Fuzzy Hash: FA61C375A00209CFEF10DF68C88469EB7F1FF48314F55862AE958AB360D739E865CB49

Function 004414D0 Relevance: 10.6, APIs: 7, Instructions: 139COMMON

Download Yara Rule

APIs

_ZN5QChar7toUpperEj.QT5CORE ref: 0044154B
_Z5qQNaNv.QT5CORE ref: 00441598

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Char7toUpper
String ID:
API String ID: 830358617-0
Opcode ID: f6cc953657f134986aa13e8b927a908282de7af3f94c48f6b0a058c9ac4fced8
Instruction ID: 0efbc687d99d025c965f7a22fdabb2b61c57a87e60160b1e57c62be9b605b15b
Opcode Fuzzy Hash: f6cc953657f134986aa13e8b927a908282de7af3f94c48f6b0a058c9ac4fced8
Instruction Fuzzy Hash: 64518E74900209DFEF10DFA8D888AEEBBB0FF84314F18855AE855A7364D739D885CB59

Function 00404480 Relevance: 10.6, APIs: 7, Instructions: 118COMMON

Download Yara Rule

APIs

_ZNK7QString5rightEi.QT5CORE ref: 004044B5
_ZNK7QString8toDoubleEPb.QT5CORE ref: 004044CD
_ZNK7QString5rightEi.QT5CORE ref: 004044F4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404535
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040455B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040457D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040459F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$String5right$DoubleString8to
String ID:
API String ID: 3361197361-0
Opcode ID: 0c94592b4ef672f4cecc0d7d0ed02034c990f90cfc4d2497b7ff8eafba73f802
Instruction ID: e2290bc265e2d58ae9b7e734d479fef3592aa8ce2a7ca1d751e8372a6e7dbb90
Opcode Fuzzy Hash: 0c94592b4ef672f4cecc0d7d0ed02034c990f90cfc4d2497b7ff8eafba73f802
Instruction Fuzzy Hash: 814184F4904205EFDB00EF64D88869EBBF0FF84314F144529EA44A7390E739989ACF86

Function 0041CCB0 Relevance: 10.6, APIs: 7, Instructions: 112COMMON

Download Yara Rule

APIs

_ZNK17QAbstractItemView14selectionModelEv.QT5WIDGETS ref: 0041CCC7
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041CCDD
_ZNK17QAbstractItemView14selectionModelEv.QT5WIDGETS ref: 0041CD0C
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041CD1C
_ZN8QVariantC1Ei.QT5CORE ref: 0041CD9C
_ZN8QVariantD1Ev.QT5CORE ref: 0041CE0A
_ZN10QTableView9selectRowEi.QT5WIDGETS ref: 0041CE27

Part of subcall function 0046F2E0: _ZN9QListData6detachEi.QT5CORE(?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F2F9
Part of subcall function 0046F2E0: _Znwj.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F328

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Item$AbstractModelModel12selectedRowsSelectionVariantView14selection$Data6detachListTableView9selectZnwj
String ID:
API String ID: 3939498389-0
Opcode ID: 5eac46d6288aa2b03e75dc8d89d879bb19493894158c6f9d853af8bebaac3328
Instruction ID: 8af9366d14400a372e016656ef9cc37c36a0de9cb2a5e261d4dce29b17324496
Opcode Fuzzy Hash: 5eac46d6288aa2b03e75dc8d89d879bb19493894158c6f9d853af8bebaac3328
Instruction Fuzzy Hash: 38511BB19042088FCB04EF68D594ADDBBF0FF88324F14466DD8556B3A1DB74A849CF96

Function 0041CCA9 Relevance: 10.6, APIs: 7, Instructions: 105COMMON

Download Yara Rule

APIs

_ZNK17QAbstractItemView14selectionModelEv.QT5WIDGETS ref: 0041CCC7
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041CCDD
_ZNK17QAbstractItemView14selectionModelEv.QT5WIDGETS ref: 0041CD0C
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041CD1C
_ZN8QVariantC1Ei.QT5CORE ref: 0041CD9C
_ZN8QVariantD1Ev.QT5CORE ref: 0041CE0A
_ZN10QTableView9selectRowEi.QT5WIDGETS ref: 0041CE27

Part of subcall function 0046F2E0: _ZN9QListData6detachEi.QT5CORE(?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F2F9
Part of subcall function 0046F2E0: _Znwj.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F328

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Item$AbstractModelModel12selectedRowsSelectionVariantView14selection$Data6detachListTableView9selectZnwj
String ID:
API String ID: 3939498389-0
Opcode ID: 0a66d2520393775fac5c53238b944e150524d0a02bd58789776da002d8dfccc1
Instruction ID: 7405b679288201111cababd25edd338fc77eaf9cf8c7313ba8eae3e9df32ffc2
Opcode Fuzzy Hash: 0a66d2520393775fac5c53238b944e150524d0a02bd58789776da002d8dfccc1
Instruction Fuzzy Hash: 0B411AB09042088FCB04EF68D594A9EBBF1FF88324F05466DD8556B3A1DB74A849CF96

Function 00446460 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_ZN7QString6numberEdci.QT5CORE ref: 00446511
_ZN8QVariantC1ERK7QString.QT5CORE ref: 0044651C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00446541
_ZN8QVariantC1Ei.QT5CORE ref: 00446579
_ZN8QVariantC1Ed.QT5CORE ref: 004465A3

Strings

f, xrefs: 004464FA

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayData10deallocateEdciS_jjStringString6number
String ID: f
API String ID: 2681256453-1993550816
Opcode ID: e1d54e1a67cc26ed3d89c9ad770678ee77ab387fe07e3eff9b6b2f76a798d1ee
Instruction ID: 7b9690de22b17cbcc5e12ed6506146f6b255ea1d6d549ea82a1bd0c6cad32b7d
Opcode Fuzzy Hash: e1d54e1a67cc26ed3d89c9ad770678ee77ab387fe07e3eff9b6b2f76a798d1ee
Instruction Fuzzy Hash: 0741D570900205DFEF14CF28D488A5ABBF1FF45324F16866AD8545B368DB39EC59CB8A

Function 00404472 Relevance: 10.6, APIs: 7, Instructions: 88COMMON

Download Yara Rule

APIs

_ZNK7QString5rightEi.QT5CORE ref: 004044B5
_ZNK7QString8toDoubleEPb.QT5CORE ref: 004044CD
_ZNK7QString5rightEi.QT5CORE ref: 004044F4
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404535
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040455B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040457D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040459F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$String5right$DoubleString8to
String ID:
API String ID: 3361197361-0
Opcode ID: 026c94085337970a061152fdb5848cc9bfe9af3d6b578b9b329032de4b99ae84
Instruction ID: ca52126e15cbf702b03abfd8dd78165cf058b44dac268d078e1222136c7b2ab5
Opcode Fuzzy Hash: 026c94085337970a061152fdb5848cc9bfe9af3d6b578b9b329032de4b99ae84
Instruction Fuzzy Hash: 4C3108B49042059FDB00EF68D98879EBBF0FF84704F10892CE985A7354E779A949CF86

Function 00405E70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

_ZNK14QMessageLogger5debugEv.QT5CORE ref: 00405EBA
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 00405ED6
_ZN11QTextStreamlsERK7QString.QT5CORE ref: 00405EE2
_ZN6QDebugD1Ev.QT5CORE ref: 00405F10

Strings

updating border drawer, xrefs: 00405ECB
default, xrefs: 00405EB0

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: DebugLogger5debugMessageStreamlsStringString15fromTextUtf8_helper
String ID: default$updating border drawer
API String ID: 503439215-529061905
Opcode ID: 8cffb0edf0db74d4b7197464c09649383ce0c8dab6c6b226e06049262877465d
Instruction ID: 1935ac792e95e871f0db08a282f516b5b3b3ed68c5afc4d3efdc7c3b8183e413
Opcode Fuzzy Hash: 8cffb0edf0db74d4b7197464c09649383ce0c8dab6c6b226e06049262877465d
Instruction Fuzzy Hash: E1216DB18046049FDB04EFA8D8887EEBBB5FF40314F44412DE4456B290DB79194ACF8A

Function 00406220 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_ZN8QVariantC1Eb.QT5CORE ref: 00406249
_ZN7QObject11setPropertyEPKcRK8QVariant.QT5CORE ref: 00406266
_ZN8QVariantD1Ev.QT5CORE ref: 00406271
_ZNK7QWidget5styleEv.QT5WIDGETS ref: 00406279
_ZNK7QWidget14ensurePolishedEv.QT5WIDGETS ref: 0040629E

Strings

overrided, xrefs: 0040625F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$Object11setPolishedPropertyWidget14ensureWidget5style
String ID: overrided
API String ID: 2442626109-1212112701
Opcode ID: 1acbdbf4c75997c0ee7045c0af8adf423b26f251da92002b1c012f74dbd10dd5
Instruction ID: 7e061de74e49f8910b4ca3c72b1ca7fa835cb345b573d041a59d12c14bf15dc2
Opcode Fuzzy Hash: 1acbdbf4c75997c0ee7045c0af8adf423b26f251da92002b1c012f74dbd10dd5
Instruction Fuzzy Hash: 9D114674601100CFCB48EF68D49C9697BB5EF48301F4141BDED069B362CB39A856CB99

Function 00404B89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00404BC8
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00404BDD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00404C06
_ZN7QWidget6updateEv.QT5WIDGETS ref: 00404C4A
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 00404C57

Strings

Overriding, xrefs: 00404BB7

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Events$Application13processArrayBox8setCoreData10deallocateEventFlagFlagsGroupLoop17MetaObject2trProcessS1_iS_jjStringTitleWidget6update
String ID: Overriding
API String ID: 1194972151-3848043014
Opcode ID: 3c53ed29d2c8b3991151d17ecc9a2fc335b55845a9e0f990b00090900e1cc6d3
Instruction ID: 2fd6c1efd42831c5e21512a2586d35124f8424445afd1829d721ee0ea53b5a9d
Opcode Fuzzy Hash: 3c53ed29d2c8b3991151d17ecc9a2fc335b55845a9e0f990b00090900e1cc6d3
Instruction Fuzzy Hash: 0111C4B5605300CFD704EF58D4886AEBBF0FF84310F41856DE9959B3A1C778A845CB96

Function 0044D8C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51timeCOMMON

Download Yara Rule

APIs

_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0044D8D0
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0044D8F5
_ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS ref: 0044D907
_ZN6QTimer5startEv.QT5CORE ref: 0044D92C

Strings

color: red;, xrefs: 0044D8EB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractAscii_helperButton9isCheckedSheetStringString16fromStyleTimer5startWidget13set
String ID: color: red;
API String ID: 2648379722-296104473
Opcode ID: 2e6e8cdc2ebc2ec641880d6676de08cfb57d2a8c93db766848951e7342b2d672
Instruction ID: 97dff4f28b3d05008005b35eaaa0a042f7f270c4fb09519a2d4cdab566868531
Opcode Fuzzy Hash: 2e6e8cdc2ebc2ec641880d6676de08cfb57d2a8c93db766848951e7342b2d672
Instruction Fuzzy Hash: 2711CEF0904200DFEB04EF68E888AAEBBB0FF49321F508169E95497361C7369855CF89

Function 0044A550 Relevance: 9.2, APIs: 6, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 004527C0: _errno.MSVCRT ref: 004527F7

Part of subcall function 00452880: _errno.MSVCRT ref: 004528B7

_ZNK9QVector3D10normalizedEv.QT5GUI ref: 0044A749
_ZN10QMatrix4x46lookAtERK9QVector3DS2_S2_.QT5GUI ref: 0044A767
_ZN10QMatrix4x49translateEfff.QT5GUI ref: 0044A78C
_ZN10QMatrix4x45scaleEfff.QT5GUI ref: 0044A7AC
_ZN10QMatrix4x49translateEfff.QT5GUI ref: 0044A7E9
_ZN10QMatrix4x46rotateEffff.QT5GUI ref: 0044A80F

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Efff$Matrix4x49translateVector3_errno$D10normalizedEffffMatrix4x45scaleMatrix4x46lookMatrix4x46rotate
String ID:
API String ID: 2814583391-0
Opcode ID: d0835053ff2589e1728c1e400fbb44768641e500d9826dfe8a92d14b4601ee7a
Instruction ID: 987448bd570659b6891b53ac4aef17bbc62b12739281b51fd625d82c56a8ce31
Opcode Fuzzy Hash: d0835053ff2589e1728c1e400fbb44768641e500d9826dfe8a92d14b4601ee7a
Instruction Fuzzy Hash: 06913F71A09605DBD7027F54E148199BFB0FF84784F614D9CE4C4661AEEB3284798F87

Function 0043D0B0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 440COMMON

Download Yara Rule

APIs

_Znwj.LIBSTDC++-6 ref: 0043D0DD

Part of subcall function 00444820: _Znwj.LIBSTDC++-6 ref: 00444880

Part of subcall function 004410D0: _Z5qQNaNv.QT5CORE ref: 004410EE
Part of subcall function 004410D0: _Z5qQNaNv.QT5CORE ref: 004410F3
Part of subcall function 004410D0: _Z5qQNaNv.QT5CORE ref: 004410F8
Part of subcall function 004410D0: _Z5qQNaNv.QT5CORE ref: 004410FD
Part of subcall function 004410D0: _Z6qIsNaNd.QT5CORE ref: 004413A4

Part of subcall function 004414D0: _ZN5QChar7toUpperEj.QT5CORE ref: 0044154B
Part of subcall function 004414D0: _Z5qQNaNv.QT5CORE ref: 00441598

_Z6qIsNaNd.QT5CORE ref: 0043D1A2
_ZN10QMatrix4x46rotateEffff.QT5GUI ref: 0043D25D
_ZN10QMatrix4x46rotateEffff.QT5GUI ref: 0043D5B6

Strings

R, xrefs: 0043D182

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: EffffMatrix4x46rotateZnwj$Char7toUpper
String ID: R
API String ID: 2136949353-1466425173
Opcode ID: 48edd372f1763a950a61d71975ecca4a3c1354f0ac18277468aedc135162eb56
Instruction ID: 92734ff8c66f9e5b8dbf5a20d406568452d4df5b04286727587d60c952cf7b08
Opcode Fuzzy Hash: 48edd372f1763a950a61d71975ecca4a3c1354f0ac18277468aedc135162eb56
Instruction Fuzzy Hash: 0A026AB2E002089BCB06BF94D5592CDBFB0FB04794F215C49D889B626AFB3659648FC5

Function 00449A80 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

_Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449AA8
_Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449AD0
_Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449AF8
_Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449B20
_Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449B48
_Z6qIsNaNf.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,000B2260,000B3094,0044A8B1), ref: 00449B70

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5dfdc44c179876a7a840fea57df98314d1bd06c8598c5aa5789db8300853d4
Instruction ID: d97057f013840333af2bbc0dce35c50f6c3525b0e55a930d3eb15645cd4f20a8
Opcode Fuzzy Hash: eb5dfdc44c179876a7a840fea57df98314d1bd06c8598c5aa5789db8300853d4
Instruction Fuzzy Hash: BA51C5B0108A02CFDB14EF24E5C8A6ABBF0FF81704F06499DE4D656255DB31A869CB17

Function 004201BC Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041FFEA
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE.QT5CORE ref: 00420069
_ZNK7QString3midEii.QT5CORE ref: 00420090
_ZNK7QString8toDoubleEPb.QT5CORE ref: 004200A6
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004200D8
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE.QT5CORE ref: 004200F8
_ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0042020E
_ZN7QString6appendERKS_.QT5CORE ref: 0042021D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00420249

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$CaseChariQt15SensitivityString7index$DoubleString15fromString3midString6appendString8toUtf8_helper
String ID:
API String ID: 2635586883-0
Opcode ID: dd71c067c252a21c407b814dd780d187efd7c23f03510cafbbb692a433560404
Instruction ID: 187c558114d79af8fa6fd06cbff03cf04e5a99e05cc8b7fdee44f25ba399a4bd
Opcode Fuzzy Hash: dd71c067c252a21c407b814dd780d187efd7c23f03510cafbbb692a433560404
Instruction Fuzzy Hash: F551EDB0A04316CBDF10AF14D8983997BF0BF41354F54889AC489A7395EB798C89CF8A

Function 004744D0 Relevance: 9.1, APIs: 6, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 0047451A
memcpy.MSVCRT ref: 0047455D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004745D5

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$AllocationData10deallocateData8allocateEjjj6FlagsOptionS_16S_jjmemcpy
String ID:
API String ID: 3654953330-0
Opcode ID: 8628432a7319ff4df1233ea5f28b361c13091e336f8fdb7f45c1fdb20351b43f
Instruction ID: 4544868eba9573dac0d5926632cb4d646bafa017fb4cdb6e4fc3d1fc777be72d
Opcode Fuzzy Hash: 8628432a7319ff4df1233ea5f28b361c13091e336f8fdb7f45c1fdb20351b43f
Instruction Fuzzy Hash: BD414A70208241DFC750DF18C4C0A6ABBE1FB85310F68C96EE5888B355D739D845CB56

Function 0040F25C Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0040F2A4
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F2D2
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F38E
_ZNK19QAbstractScrollArea8viewportEv.QT5WIDGETS ref: 0040F3BF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Widget7actions$AbstractArea8viewportItemModel12selectedRowsScrollSelection
String ID:
API String ID: 1719238399-0
Opcode ID: 1fc8f9502846006610ea86bcededabe56b10fc86e1d8efdff635e606de639ffa
Instruction ID: 1d80b278ad086fb3b5fe675fd175d4e69262a242576348e003e8e87f105479d5
Opcode Fuzzy Hash: 1fc8f9502846006610ea86bcededabe56b10fc86e1d8efdff635e606de639ffa
Instruction Fuzzy Hash: AE511BB5900204CFCB04EFA8D59499DBBF1FF48310F45826AE855AB361DB34A849CF95

Function 0040F26C Relevance: 9.1, APIs: 6, Instructions: 118windowCOMMON

Download Yara Rule

APIs

_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0040F2A4
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F2D2

Part of subcall function 00472140: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,004086DF), ref: 0047214E

_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F38E

Part of subcall function 0046F2E0: _ZN9QListData6detachEi.QT5CORE(?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F2F9
Part of subcall function 0046F2E0: _Znwj.LIBSTDC++-6(?,?,?,?,?,?,?,?,?,000BA158,?,0040F332), ref: 0046F328

_ZNK19QAbstractScrollArea8viewportEv.QT5WIDGETS ref: 0040F3BF
_ZNK7QWidget11mapToGlobalERK6QPoint.QT5WIDGETS ref: 0040F3CD
_ZN5QMenu5popupERK6QPointP7QAction.QT5WIDGETS ref: 0040F3ED
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F400
_ZNK7QWidget7actionsEv.QT5WIDGETS ref: 0040F435

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Widget7actions$ListPoint$AbstractActionArea8viewportDataData6detachData7disposeGlobalItemMenu5popupModel12selectedRowsScrollSelectionWidget11mapZnwj
String ID:
API String ID: 2916371295-0
Opcode ID: 9c3c7fcf2a2a09a9c2401283965c5b83575844324075397ae28af49db8d8e920
Instruction ID: 9c98247144ffc28fbc71ecbca75fc3e9f8a79019f36303f426b6489b9b12b18b
Opcode Fuzzy Hash: 9c3c7fcf2a2a09a9c2401283965c5b83575844324075397ae28af49db8d8e920
Instruction Fuzzy Hash: C7511AB5A00204CFCB04EFACD59499DBBF1FF48310F05866AE855AB361DB34A845CF95

Function 0040A830 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0040A849
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A936

Part of subcall function 00447B90: _ZNK9QComboBox5countEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447B9B
Part of subcall function 00447B90: _ZNK9QComboBox8maxCountEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447BAB
Part of subcall function 00447B90: _ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00447BD1
Part of subcall function 00447B90: _ZN5QIconC1Ev.QT5GUI ref: 00447BE2
Part of subcall function 00447B90: _ZN9QComboBox10insertItemEiRK5QIconRK7QStringRK8QVariant.QT5WIDGETS ref: 00447C00
Part of subcall function 00447B90: _ZN5QIconD1Ev.QT5GUI ref: 00447C0B
Part of subcall function 00447B90: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00447C2D
Part of subcall function 00447B90: _ZN8QVariantD1Ev.QT5CORE ref: 00447C35
Part of subcall function 00447B90: _ZN9QComboBox15setCurrentIndexEi.QT5WIDGETS ref: 00447C44

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040A87D
_ZN9QComboBox14setCurrentTextERK7QString.QT5WIDGETS ref: 0040A895
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A8BE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A914

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$ArrayData10deallocateS_jj$IconText$Box11currentCurrentStringVariant$Ascii_helperBox10insertBox14setBox15setBox5countBox8maxCountIndexItemString16from
String ID:
API String ID: 436334179-0
Opcode ID: ac9ea4bfd308a7f64739833cca120108e6bbab5332ddce599db0cfa0bbdc84f5
Instruction ID: 0696b0f37001b215b65a261b980df13cce6043faf368dda74316f6044fe5aeb9
Opcode Fuzzy Hash: ac9ea4bfd308a7f64739833cca120108e6bbab5332ddce599db0cfa0bbdc84f5
Instruction Fuzzy Hash: 1C416DB4A043019FDB14EF68C48865EBBB1FF80314F15CA69E8546B3A4D73A9C56CB46

Function 0040B980 Relevance: 9.1, APIs: 6, Instructions: 96COMMON

Download Yara Rule

APIs

_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0040B999
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040B9BF
_ZN9QComboBox14setCurrentTextERK7QString.QT5WIDGETS ref: 0040B9D7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BA00
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BA56
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040BA78

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$ComboText$Ascii_helperBox11currentBox14setCurrentStringString16from
String ID:
API String ID: 2409670204-0
Opcode ID: b5963723eaef2308cc70044d6df1ac1f2f290848428dacfc3efb09fbf1c83202
Instruction ID: e343861c51bbba07e51f47281e6796af6d168b466613994d08656fb74d121144
Opcode Fuzzy Hash: b5963723eaef2308cc70044d6df1ac1f2f290848428dacfc3efb09fbf1c83202
Instruction Fuzzy Hash: AA415EB4A04305DFDB14DF68C48866EBBB1FF80314F14C669E8546B3A4D73A9945CF8A

Function 00440060 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_Z6qIsNaNd.QT5CORE ref: 004400B1
_Z6qIsNaNd.QT5CORE ref: 004400C9
_Z6qIsNaNd.QT5CORE ref: 004400DD
_Z6qIsNaNd.QT5CORE ref: 00440107
_Z6qIsNaNd.QT5CORE ref: 00440130
_Z6qIsNaNd.QT5CORE ref: 0044014E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cad4bfe446e423c93e424b2512113f38dc05b738e3e65832d5d7511a2573d0b
Instruction ID: 1dc741c5953e62c9da19c780657aa9c731f4862c06f36105a12fabb1e0ef5a1e
Opcode Fuzzy Hash: 6cad4bfe446e423c93e424b2512113f38dc05b738e3e65832d5d7511a2573d0b
Instruction Fuzzy Hash: 28313A70609645CBDB01AF00F58825AFFB0FF88784F554CC9E5C5261AACB35C879CB9A

Function 004510C0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 004510FB
signal.MSVCRT ref: 00451152
signal.MSVCRT ref: 0045119D
signal.MSVCRT ref: 004511C5

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: ed02623f9f9ea33c10627bb6363fcf7cf73d12fd6aa1a098db85f0315eda1cef
Instruction ID: 81f22786daf9d95947ca89c7cc1c2dc43633ef1b9f74b7cc4f4508d15cd6cc39
Opcode Fuzzy Hash: ed02623f9f9ea33c10627bb6363fcf7cf73d12fd6aa1a098db85f0315eda1cef
Instruction Fuzzy Hash: ED2171704046009EEB206F65C54036F7690AB097A6F15498BDED487363C7BD9C8CD75F

Function 0040A829 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0040A849
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A936

Part of subcall function 00447B90: _ZNK9QComboBox5countEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447B9B
Part of subcall function 00447B90: _ZNK9QComboBox8maxCountEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040A86E), ref: 00447BAB
Part of subcall function 00447B90: _ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00447BD1
Part of subcall function 00447B90: _ZN5QIconC1Ev.QT5GUI ref: 00447BE2
Part of subcall function 00447B90: _ZN9QComboBox10insertItemEiRK5QIconRK7QStringRK8QVariant.QT5WIDGETS ref: 00447C00
Part of subcall function 00447B90: _ZN5QIconD1Ev.QT5GUI ref: 00447C0B
Part of subcall function 00447B90: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00447C2D
Part of subcall function 00447B90: _ZN8QVariantD1Ev.QT5CORE ref: 00447C35
Part of subcall function 00447B90: _ZN9QComboBox15setCurrentIndexEi.QT5WIDGETS ref: 00447C44

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040A87D
_ZN9QComboBox14setCurrentTextERK7QString.QT5WIDGETS ref: 0040A895
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A8BE
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040A914

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$ArrayData10deallocateS_jj$IconText$Box11currentCurrentStringVariant$Ascii_helperBox10insertBox14setBox15setBox5countBox8maxCountIndexItemString16from
String ID:
API String ID: 436334179-0
Opcode ID: e83c8c2e4c4ba2a5609b1b333ee09b48abdd4e686986db13c1345248cb626af2
Instruction ID: b7d0d5d420744d52403ae7e0d49f0f7ab01185763ee2c92745f27ead5fef7d09
Opcode Fuzzy Hash: e83c8c2e4c4ba2a5609b1b333ee09b48abdd4e686986db13c1345248cb626af2
Instruction Fuzzy Hash: 433114B4A043059FDB00EF68C48869EBBF1FF84304F11C96DE8946B365D739A845CB86

Function 00403CE0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00403280: _ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 004032C0
Part of subcall function 00403280: _ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 004032F1
Part of subcall function 00403280: _ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 00403337
Part of subcall function 00403280: _ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 0040337A

_ZN8QSysInfo14windowsVersionEv.QT5CORE ref: 00403CEF
_Znwj.LIBSTDC++-6 ref: 00403D37
_ZN17QWinTaskbarButtonC1EP7QObject.QT5WINEXTRAS ref: 00403D43
_ZNK7QWidget12windowHandleEv.QT5WIDGETS ref: 00403D54
_ZN17QWinTaskbarButton9setWindowEP7QWindow.QT5WINEXTRAS ref: 00403D63
_ZNK17QWinTaskbarButton8progressEv.QT5WINEXTRAS ref: 00403D72

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: PointWidget4move$Taskbar$Window$ButtonButton8progressButton9setHandleInfo14windowsObjectVersionWidget12windowZnwj
String ID:
API String ID: 1518945770-0
Opcode ID: 3b8d393ae1d71d759b1ee2e84859385415be9bdad3b9c429fd2e34ca8ececdf7
Instruction ID: b9214213e01cceb10ee1e146f33c6b55dac43d678d3e6ade39834c106db72767
Opcode Fuzzy Hash: 3b8d393ae1d71d759b1ee2e84859385415be9bdad3b9c429fd2e34ca8ececdf7
Instruction Fuzzy Hash: A30140B06001408FDB04BFA9E5E966E7FA8FF44341F40067EEC468B296DB789954CB66

Function 0040F88B Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E
_ZN7QRegExpD1Ev.QT5CORE ref: 0040F89E
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8CC
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayData10deallocateFormatResumeS_jjSettingsUnwind_
String ID:
API String ID: 1695743215-0
Opcode ID: 384303928fd4c32c6cd1e1bd877cf7f8a219365cfe276243c76423843ee3173c
Instruction ID: 1326457d191d020e2d3517292ddfd3834b584c23de17cd01f7aa60df4df61fdb
Opcode Fuzzy Hash: 384303928fd4c32c6cd1e1bd877cf7f8a219365cfe276243c76423843ee3173c
Instruction Fuzzy Hash: 6501AD34E00608CBCB28EFB6C5944ECF7B1AF4C304B54816EE826A7362DBB85945DF49

Function 0040F8DF Relevance: 9.0, APIs: 6, Instructions: 39COMMON

Download Yara Rule

APIs

_ZN7QRegExpD1Ev.QT5CORE ref: 0040F89E

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8CC
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayData10deallocateFormatResumeS_jjSettingsUnwind_
String ID:
API String ID: 1695743215-0
Opcode ID: 86d1bc57d1ff1a88023f80cdacf060567a1d669dab6391b3cdbf303584bf3b59
Instruction ID: 303caeb5d398a690ff75a1c9c72a6f2923cb8e506ecd71dbf0fb0c8a34b43822
Opcode Fuzzy Hash: 86d1bc57d1ff1a88023f80cdacf060567a1d669dab6391b3cdbf303584bf3b59
Instruction Fuzzy Hash: 4501DE35E006048BCB28EFB5C4A44ECB7B1AF4C304B54417ED816A7362DB7859459F49

Function 0041FBD3 Relevance: 9.0, APIs: 6, Instructions: 17COMMON

Download Yara Rule

APIs

__cxa_begin_catch.LIBSTDC++-6 ref: 0041FBD6
__cxa_rethrow.LIBSTDC++-6 ref: 0041FBDB
_ZNSt9exceptionD2Ev.LIBSTDC++-6 ref: 0041FBF2

Part of subcall function 00452AC0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE(?,?,?,?,?,?,?,?,?,00406496), ref: 00452ADE

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041FC05
_ZNSt9exceptionD2Ev.LIBSTDC++-6 ref: 0041FC16
__cxa_end_catch.LIBSTDC++-6 ref: 0041FC1B

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: St9exception$ArrayData10deallocateResumeS_jjUnwind___cxa_begin_catch__cxa_end_catch__cxa_rethrow
String ID:
API String ID: 697205320-0
Opcode ID: f32fe3cc68e374d25f946e5aefa42742a2e08e8625414e8bde0d488c50341bb6
Instruction ID: 5def9db77dda775c848a538ff12257b2e77f883db6b18963e58b42344e1cbb7e
Opcode Fuzzy Hash: f32fe3cc68e374d25f946e5aefa42742a2e08e8625414e8bde0d488c50341bb6
Instruction Fuzzy Hash: D2E0BF709072048ADB10FFB6CA916DD7AB06F55309F0105AFA94553243DFBC198DCE6A

Function 0040561C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_ZNK9QGroupBox9isCheckedEv.QT5WIDGETS ref: 00405634
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00405666
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 0040567B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004056A0
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 004056D4
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 004056E7
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00405702
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00405716
_ZNK7QString8toDoubleEPb.QT5CORE ref: 00405725
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 00405750
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0040577D
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004057FD
_ZN7QString6appendERKS_.QT5CORE ref: 00405821
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 00405836

Strings

Jog, xrefs: 00405655

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Box11currentCheckedComboGroupMetaObject2trS1_iText$AbstractBox8setButton9isStringTitle$ArrayBox9isData10deallocateDoubleS_jjString6appendString8to
String ID: Jog
API String ID: 70142446-3019854487
Opcode ID: ad6d0f3afdb2c3f9f9872e0a9cd268423b031c3f302a343cb6d4b9da25128ad1
Instruction ID: d4b3fd41a5610159c4ee2e60359134230131eab13dca24daa426cb08bb0095f7
Opcode Fuzzy Hash: ad6d0f3afdb2c3f9f9872e0a9cd268423b031c3f302a343cb6d4b9da25128ad1
Instruction Fuzzy Hash: 9F0180B15042009FCB00AF54D8486ABBBB4FB80314F40C96DE9585B391C739A809CB89

Function 004015AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 004015BD
GetProcAddress.KERNEL32 ref: 004015DA
FreeLibrary.KERNEL32 ref: 004015FE

Strings

libgcc_s_dw2-1.dll, xrefs: 004015B6
__deregister_frame_info, xrefs: 004015CF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: __deregister_frame_info$libgcc_s_dw2-1.dll
API String ID: 4061214504-2468945734
Opcode ID: 95a46238dd6fd8d8216cf124d60d073914001e4491105daa260e90d1e1ee2592
Instruction ID: a50b370b727f79d6a9d10c83d962b8a5a8dc3081e3d586a2ae2333f83507794a
Opcode Fuzzy Hash: 95a46238dd6fd8d8216cf124d60d073914001e4491105daa260e90d1e1ee2592
Instruction Fuzzy Hash: 43F012719046004BC7007FBC991911B7AE4BB85305F45853DD886D7265EB79E808C79A

Function 004015B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 004015BD
GetProcAddress.KERNEL32 ref: 004015DA
FreeLibrary.KERNEL32 ref: 004015FE

Strings

libgcc_s_dw2-1.dll, xrefs: 004015B6
__deregister_frame_info, xrefs: 004015CF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: __deregister_frame_info$libgcc_s_dw2-1.dll
API String ID: 4061214504-2468945734
Opcode ID: 3630f7f101a6a2b9aa535b997e9dde9bf075640f45351bbb75c9735f596820fa
Instruction ID: 7075c7dc402dea5a4b96fbc97c9f8986dc731d9fcb70b8d16867739564d93037
Opcode Fuzzy Hash: 3630f7f101a6a2b9aa535b997e9dde9bf075640f45351bbb75c9735f596820fa
Instruction Fuzzy Hash: A3F030B09046004BC7007FBC9A1D11B7EE4BB81309F44853DC886D7365EBB9E808C79A

Function 004707E0 Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

_ZN9QListData6detachEi.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00470842
_ZeqRK7QStringS1_.QT5CORE ref: 004708E6
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00470930
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00470957

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Data6detachListString
String ID:
API String ID: 2903882118-0
Opcode ID: fb247ee316b20dd238cb0d63f3cd5026cfa6235dea2ef799b83995a8bfbdb0b8
Instruction ID: 2a5d3cee46fdb401d65d05cf09ed6b4301faf412c9caaf9bc3ae0680814e0ad5
Opcode Fuzzy Hash: fb247ee316b20dd238cb0d63f3cd5026cfa6235dea2ef799b83995a8bfbdb0b8
Instruction Fuzzy Hash: BB51AAB4906205CFDB10DF68D4C4A9EB7B1FF80320F19C26AD5595B361D73AAC46CB86

Function 0040EAC9 Relevance: 7.6, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

_ZN9QListData6detachEi.QT5CORE ref: 0040EB08
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0040EB44
_Znwj.LIBSTDC++-6 ref: 0040EB92
_ZN9QListData6detachEi.QT5CORE ref: 0040EBC3
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0040EBFB
memcpy.MSVCRT ref: 0040ECB1

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData6detachData7dispose$Znwjmemcpy
String ID:
API String ID: 3920168834-0
Opcode ID: 365a657ba61a030ccfbb050301d07c5022a5f2cb47727126ceea21a9abb568ae
Instruction ID: 9746b5e401904ed91787c9dbb65e908ebcb6a564668d461bae80fa333119fd71
Opcode Fuzzy Hash: 365a657ba61a030ccfbb050301d07c5022a5f2cb47727126ceea21a9abb568ae
Instruction Fuzzy Hash: 67517BB4A04205CFCB04EF69D088959BBF1FF84350F2589AAD846AB366E734EC55CF85

Function 004062F0 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0044D680: _ZNK8QSpinBox5valueEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6AD
Part of subcall function 0044D680: _ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6C1
Part of subcall function 0044D680: _ZN7QString16fromAscii_helperEPKci.QT5CORE(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6E7
Part of subcall function 0044D680: _ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6FC
Part of subcall function 0044D680: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044D721

_ZN10QByteArrayC1Eic.QT5CORE ref: 0040636C
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 00406392
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004063D4
_ZN10QByteArrayC1Eic.QT5CORE ref: 00406432
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 00406458

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$ByteData10deallocateDevice5writeS_jj$AbstractAscii_helperBox5valueButton9isCheckedSheetSpinStringString16fromStyleWidget13set
String ID:
API String ID: 3407907801-0
Opcode ID: 40d36e68da1786be1aff332e908d6ab7c7fc67585dd6b72d7eb253f505b30262
Instruction ID: 6b2696becdb9c9f79d3dc369803c488008cfefa0dbcf97f0c20df4e9c551aad3
Opcode Fuzzy Hash: 40d36e68da1786be1aff332e908d6ab7c7fc67585dd6b72d7eb253f505b30262
Instruction Fuzzy Hash: C041C574A042048BCB04EF79C4C46AEBBF1AFC4341F05C53EE85697396DA3C98198B99

Function 0040C3F0 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040C410

Part of subcall function 00432C50: _ZNK9QLineEdit4textEv.QT5WIDGETS(?,?,?,?,?,00410EEB), ref: 00432C66

_ZNK7QString5splitERKS_NS_13SplitBehaviorEN2Qt15CaseSensitivityE.QT5CORE ref: 0040C44E

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040C4B3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040C4E0
_ZN7QString14trimmed_helperERKS_.QT5CORE ref: 0040C53A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperBehaviorCaseEdit4textLineQt15S_13SensitivitySplitString14trimmed_helperString16fromString5split
String ID:
API String ID: 4253653670-0
Opcode ID: 8fd0accbea6f943620c0a394d00927d50e8fb52ab80d07e2e34dd687d6ad735b
Instruction ID: a1689f97f7a9341dd5d81918fb74108d307d454cdaee712806e4eee36a3a3da7
Opcode Fuzzy Hash: 8fd0accbea6f943620c0a394d00927d50e8fb52ab80d07e2e34dd687d6ad735b
Instruction Fuzzy Hash: 995168B4904204DFCB00EFA9D4C46AEBBF1FF88314F14862EE455AB390D739A844CB95

Function 0040C630 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040C650

Part of subcall function 004327D0: _ZNK9QLineEdit4textEv.QT5WIDGETS(?,?,?,?,?,00410F64), ref: 004327E6

_ZNK7QString5splitERKS_NS_13SplitBehaviorEN2Qt15CaseSensitivityE.QT5CORE ref: 0040C68E

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040C6F3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040C720
_ZN7QString14trimmed_helperERKS_.QT5CORE ref: 0040C77A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Ascii_helperBehaviorCaseEdit4textLineQt15S_13SensitivitySplitString14trimmed_helperString16fromString5split
String ID:
API String ID: 4253653670-0
Opcode ID: 26d60aa439141f0fd5098640bc96fd644d9eb5e2e82ebd6a96eb3e13877df542
Instruction ID: 1bfd637c7b1852a467a6272579b9fab08ea9975654a0c2e4bd65cef1d5d9bc93
Opcode Fuzzy Hash: 26d60aa439141f0fd5098640bc96fd644d9eb5e2e82ebd6a96eb3e13877df542
Instruction Fuzzy Hash: D8514670900205DFCB00EFA9D4C46AEBBF1FF88314F14862AE455AB391DB799845CF9A

Function 0040D2FC Relevance: 7.6, APIs: 5, Instructions: 121COMMON

Download Yara Rule

APIs

_ZN7QObject11eventFilterEPS_P6QEvent.QT5CORE ref: 0040D1AC
_ZN15QAbstractButton10setCheckedEb.QT5WIDGETS ref: 0040D2C0
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0040D309
_ZN15QAbstractButton8releasedEv.QT5WIDGETS ref: 0040D4E1
_ZN15QAbstractButton7pressedEv.QT5WIDGETS ref: 0040D500
_ZNK19QAbstractScrollArea17verticalScrollBarEv.QT5WIDGETS ref: 0040D5A8
_ZNK9QSplitter11handleWidthEv.QT5WIDGETS ref: 0040D5D3
_ZN9QSplitter8setSizesERK5QListIiE.QT5WIDGETS ref: 0040D64E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Abstract$CheckedScroll$Area17verticalButton10setButton7pressedButton8releasedButton9isEventFilterListObject11eventSizesSplitter11handleSplitter8setWidth
String ID:
API String ID: 1159920165-0
Opcode ID: eb131fbd57f07251e70c9353703ceb8cd118699653fdd9eedac67682b8331eeb
Instruction ID: 9c6bac95285f7575b4f408498a5e8b3143d091266f3d093f36e66ee9192c7c9a
Opcode Fuzzy Hash: eb131fbd57f07251e70c9353703ceb8cd118699653fdd9eedac67682b8331eeb
Instruction Fuzzy Hash: 0F414F70A046009FCB34DF98D598AAAB7B1FB44300F14467BD846AB791D738F88DCB5A

Function 0040EC9C Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0040EB44
_Znwj.LIBSTDC++-6 ref: 0040EB92
_ZN9QListData6detachEi.QT5CORE ref: 0040EBC3
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0040EBFB
memcpy.MSVCRT ref: 0040ECB1

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData7dispose$Data6detachZnwjmemcpy
String ID:
API String ID: 2200726570-0
Opcode ID: 5415483ed33d634466a3655bddcbfbf424db51433d9e75755e7c01212be4889e
Instruction ID: a0dfd64a04d84894379ce4c1ae5fc1c4f48391dcf1e9fed8c20f07ed6eb70fae
Opcode Fuzzy Hash: 5415483ed33d634466a3655bddcbfbf424db51433d9e75755e7c01212be4889e
Instruction Fuzzy Hash: A54159B4A04201CFCB04EF69D18485DBBF0FF84350F21896AE88A9B366E734E855CF85

Function 004416D0 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00441736
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00441763
_ZN5QChar7toUpperEj.QT5CORE ref: 004417B6
_ZNK7QString3midEii.QT5CORE ref: 004417DB
_ZNK7QString8toDoubleEPb.QT5CORE ref: 004417EE

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Char7toDoubleString3midString8toUpper
String ID:
API String ID: 833767260-0
Opcode ID: 7196c421cb084dee22e66d1c7dce2cef5fbfa0b23afbe5ae6803211f632fca3c
Instruction ID: eabdb18023968e4d4ee02b20241ddda4bff8b69f654dd15d49fdc8ea68342791
Opcode Fuzzy Hash: 7196c421cb084dee22e66d1c7dce2cef5fbfa0b23afbe5ae6803211f632fca3c
Instruction Fuzzy Hash: 4B419D74900209DFDB10EF68D484AEEBBF1FF44314F14851AE845AB361E739A985CF96

Function 00403280 Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

_ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 004032C0
_ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 004032F1
_ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 00403337
_ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 0040337A
_ZN7QWidget4moveERK6QPoint.QT5WIDGETS ref: 004033B4

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: PointWidget4move
String ID:
API String ID: 3082182115-0
Opcode ID: fad24af7232e162d362097a60ba5fe63b7aad96865837b3fc9f65dc38b04cc7e
Instruction ID: 19dad2beeb300dc92935be57b2c0f0a6f6b06171ec5be51c2b93ab0e4b94bed9
Opcode Fuzzy Hash: fad24af7232e162d362097a60ba5fe63b7aad96865837b3fc9f65dc38b04cc7e
Instruction Fuzzy Hash: 6841D4B960020A8FCB08DF28D68481ABFF1FF88304F114659E8549B716D730F996CFA6

Function 0040D347 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00405500: _ZNK7QWidget12contentsRectEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,0040D357), ref: 00405520
Part of subcall function 00405500: _ZNK7QWidget6layoutEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040D357), ref: 00405566
Part of subcall function 00405500: _ZNK7QLayout6marginEv.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040D357), ref: 0040556E

_ZN7QObject11eventFilterEPS_P6QEvent.QT5CORE ref: 0040D1AC
_ZNK7QWidget11minimumSizeEv.QT5WIDGETS ref: 0040D385

Part of subcall function 00472AD0: _ZN9QListData6appendEv.QT5CORE(?,?,?,?,?,?,?,?,?,0040D0FE), ref: 00472B07

_ZN9QSplitter8setSizesERK5QListIiE.QT5WIDGETS ref: 0040D40D

Part of subcall function 00472C50: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,00443248), ref: 00472C5E

_ZNK9QSplitter11handleWidthEv.QT5WIDGETS ref: 0040D452
_ZN7QWidget16setMinimumHeightEi.QT5WIDGETS ref: 0040D474
_ZNK19QAbstractScrollArea17verticalScrollBarEv.QT5WIDGETS ref: 0040D5A8
_ZNK9QSplitter11handleWidthEv.QT5WIDGETS ref: 0040D5D3
_ZN9QSplitter8setSizesERK5QListIiE.QT5WIDGETS ref: 0040D64E
_ZN7QWidget16setMinimumHeightEi.QT5WIDGETS ref: 0040D688

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$HeightMinimumScrollSizesSplitter11handleSplitter8setWidget16setWidth$AbstractArea17verticalDataData6appendData7disposeEventFilterLayout6marginObject11eventRectSizeWidget11minimumWidget12contentsWidget6layout
String ID:
API String ID: 1387568830-0
Opcode ID: 1bba0ae9ee12ca9148fe58d6fff17d12aa99435f74eac7ba4b0b6e9cb64a2e28
Instruction ID: 8d6af24f0b2b5cf3c0ef5b8bb9ad9fce0c275b28283e330afc5d3e12e35dcced
Opcode Fuzzy Hash: 1bba0ae9ee12ca9148fe58d6fff17d12aa99435f74eac7ba4b0b6e9cb64a2e28
Instruction Fuzzy Hash: D341E675A006058FCB14DFA8D58899EFBF1FF48300B50867AD84AAB355DB34E846CF99

Function 004517D0 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00451808
GetCurrentProcessId.KERNEL32 ref: 00451819
GetCurrentThreadId.KERNEL32 ref: 00451821
GetTickCount.KERNEL32 ref: 0045182A
QueryPerformanceCounter.KERNEL32 ref: 00451839

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: ff65558b2ed8dee453585ad13dbd9d60dc665dd3a428bf7baf23b0185b45d368
Instruction ID: a50efaecf7b6c0c7230a3759fd25a85f6e024e7d0290bf38aa2b29cda43f4317
Opcode Fuzzy Hash: ff65558b2ed8dee453585ad13dbd9d60dc665dd3a428bf7baf23b0185b45d368
Instruction Fuzzy Hash: 23110776D002188BCF10AFB9E8485CEFBB4FB0C265F854676EC05B7220DB35A9548BA5

Function 00405449 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00405248
_ZN7QWidget6updateEv.QT5WIDGETS ref: 00405253
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 00405260
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0040528D
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 004052D0
_ZNK7QString3argExii5QChar.QT5CORE ref: 00405306
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00405331
_ZN7QString6appendERKS_.QT5CORE ref: 00405358
_ZN9QGroupBox8setTitleERK7QString.QT5WIDGETS ref: 0040536D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00405396
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004053BC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004053DE

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$EventsMetaObject2trS1_i$AbstractApplication13processBox8setButton9isCharCheckedCoreEventExii5FlagFlagsGroupLoop17ProcessStringString3argString6appendTitleWidget6update
String ID:
API String ID: 2124586462-0
Opcode ID: fa517bb1335b777c05ba313da53fc4114f0028461e4ddd6fa9e33f6e90b581df
Instruction ID: 442310094518be233c8d2103f67163159f797ae4078230c5fab1ad9420691c59
Opcode Fuzzy Hash: fa517bb1335b777c05ba313da53fc4114f0028461e4ddd6fa9e33f6e90b581df
Instruction Fuzzy Hash: F02136B46047008FDB00DF64D48879EBBF0FF84355F148669E895A72A4C77A9889CF06

Function 0041EA59 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EA7C
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EA91
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EAA6
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EABB
_ZdlPv.LIBSTDC++-6 ref: 0041EAF0
_ZN11QTextStreamlsEc.QT5CORE ref: 0041ED1E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: EnabledWidget10set$StreamlsText
String ID:
API String ID: 4031625570-0
Opcode ID: da26cfa19525cbdbe8b4d9206ecec8c67b8ecb57b70a4c0138bd8399b81d9caf
Instruction ID: d141479979c51f6ac98ef1fa6a7426f2593618832348063da823ced5e3fab29c
Opcode Fuzzy Hash: da26cfa19525cbdbe8b4d9206ecec8c67b8ecb57b70a4c0138bd8399b81d9caf
Instruction Fuzzy Hash: 0E115E742002008FD714EF69D4847AEB7F1BF84304F05456DD88A4B391DB79A899CB97

Function 0044E4D0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044E503
_ZNK9QComboBox5countEv.QT5WIDGETS ref: 0044E50F
_ZNK9QComboBox12currentIndexEv.QT5WIDGETS ref: 0044E518
_ZN9QComboBox15setCurrentIndexEi.QT5WIDGETS ref: 0044E527
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0044E537

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$Index$ArrayBox11currentBox12currentBox15setBox5countCurrentData10deallocateS_jjText
String ID:
API String ID: 2275530497-0
Opcode ID: 6847eca45b22e2ec39fa70e9a6747ebe1919ae23a8647cc9c0ff5cd08909da5d
Instruction ID: a0f54347647c10017ea0337f48da03108cc1b43135ac611dde9894b6747a47e5
Opcode Fuzzy Hash: 6847eca45b22e2ec39fa70e9a6747ebe1919ae23a8647cc9c0ff5cd08909da5d
Instruction Fuzzy Hash: 8E01A1B12043008FDB14AF7AE8D851A7BA5FFC4708F114A39E54587260E635A849CB86

Function 0040B6F5 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040B701
_ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS ref: 0040B727
_ZN10QByteArrayC1Eic.QT5CORE ref: 0040B747
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 0040B76D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B796
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040B7D9
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B81E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$Data10deallocateS_jj$AbstractAscii_helperButton9isByteCheckedDevice5writeResumeString16fromUnwind_
String ID:
API String ID: 891393539-0
Opcode ID: 452825d0d8269914daa1f99a6b99935598414af462128e85bc6652db97de3f7e
Instruction ID: 946327c79f650188a806fecd6fe6e4286e9c3ce9d40666d35653fd08ac918ca8
Opcode Fuzzy Hash: 452825d0d8269914daa1f99a6b99935598414af462128e85bc6652db97de3f7e
Instruction Fuzzy Hash: C8118F75A003059FCB04EF64C88869EBBF0FF84354F05C52DE9459B355C774A806CB99

Function 00472D60 Relevance: 7.6, APIs: 5, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00472D7A
_ZN7QString15fromUtf8_helperEPKci.QT5CORE(?,?,?,?,?,?,?,?,?,?,0041D7BC), ref: 00472D8D
_ZN11QTextStreamlsERK7QString.QT5CORE(?,?,?,?,?,?,?,?,?,?,0041D7BC), ref: 00472D98
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472DBD
_ZN11QTextStreamlsEc.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0041D7BC), ref: 00472DD2

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: StreamlsText$ArrayData10deallocateS_jjStringString15fromUtf8_helperstrlen
String ID:
API String ID: 76058871-0
Opcode ID: 87cbf47382d09412745ad5c05ffaaa43e5676379e660403fbbec408082d51bb5
Instruction ID: 462a490ab7523b69d89550735ee48b950555c9352381f40dec73fea9a2d71565
Opcode Fuzzy Hash: 87cbf47382d09412745ad5c05ffaaa43e5676379e660403fbbec408082d51bb5
Instruction Fuzzy Hash: 5B1186B19046009FD710AF68D5C87AEBFB1FF81310F10862EE85487364D7B99889CB96

Function 00447CF0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

_ZN9QComboBox13keyPressEventEP9QKeyEvent.QT5WIDGETS ref: 00447D0C
_ZNK9QComboBox5countEv.QT5WIDGETS ref: 00447D50
_ZNK9QComboBox8maxCountEv.QT5WIDGETS ref: 00447D61
_ZNK9QComboBox8maxCountEv.QT5WIDGETS ref: 00447D6A
_ZN9QComboBox10removeItemEi.QT5WIDGETS ref: 00447D74

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$Box8maxCountEvent$Box10removeBox13keyBox5countItemPress
String ID:
API String ID: 3757367114-0
Opcode ID: 6bbe36bbfd5e3193f6285b53d50162b7caab20e083dd2c3e5111e7199119237d
Instruction ID: 6918e7c6c201f815e8049b4e3973556482b312dafec4f3c7bab0b291b4dc4680
Opcode Fuzzy Hash: 6bbe36bbfd5e3193f6285b53d50162b7caab20e083dd2c3e5111e7199119237d
Instruction Fuzzy Hash: B001F571E141048BCF04AF7DE85806EBB69FB84364F40423BE911C7290DB34A956CBC9

Function 0040F8E1 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8CC
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayData10deallocateFormatResumeS_jjSettingsUnwind_
String ID:
API String ID: 1695743215-0
Opcode ID: df5bccb8842e1aa39e058efb6cb5da709a8f116f399d4425b7ba6d910d917cfb
Instruction ID: 22139fb0266d5e2f82ebb85e50f489497f2d10474909a1745bb9620058062367
Opcode Fuzzy Hash: df5bccb8842e1aa39e058efb6cb5da709a8f116f399d4425b7ba6d910d917cfb
Instruction Fuzzy Hash: AAF0CD35E006048BCB28FBB5C5D04ECB771AF4C304B54457ED816A7262DBB859469F59

Function 0040F8E5 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8CC
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayData10deallocateFormatResumeS_jjSettingsUnwind_
String ID:
API String ID: 1695743215-0
Opcode ID: 3f5832e7138d23ac160cfceba81ab4027b9d5ed1701f3bc94287bc0124e11a39
Instruction ID: 97a0633d503d22aa8cdf331064dd1576bb99cbe50e7e88f332ba8add7f6a880f
Opcode Fuzzy Hash: 3f5832e7138d23ac160cfceba81ab4027b9d5ed1701f3bc94287bc0124e11a39
Instruction Fuzzy Hash: 65F0EC35E006048BCB28EFB5C8D04ECF7B0AF0C304B54457ED816A7262DBB859469F59

Function 00403D2C Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_Znwj.LIBSTDC++-6 ref: 00403D37
_ZN17QWinTaskbarButtonC1EP7QObject.QT5WINEXTRAS ref: 00403D43
_ZNK7QWidget12windowHandleEv.QT5WIDGETS ref: 00403D54
_ZN17QWinTaskbarButton9setWindowEP7QWindow.QT5WINEXTRAS ref: 00403D63
_ZNK17QWinTaskbarButton8progressEv.QT5WINEXTRAS ref: 00403D72

Part of subcall function 00403470: __cxa_guard_acquire.LIBSTDC++-6 ref: 00403498
Part of subcall function 00403470: _ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 00403533
Part of subcall function 00403470: _ZN15QAbstractButton7setTextERK7QString.QT5WIDGETS ref: 00403548
Part of subcall function 00403470: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00403571
Part of subcall function 00403470: _ZN7QWidget15setMinimumWidthEi.QT5WIDGETS ref: 00403591

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Taskbar$Window$AbstractArrayButtonButton7setButton8progressButton9setData10deallocateHandleMetaMinimumObjectObject2trS1_iS_jjStringTextWidget12windowWidget15setWidthZnwj__cxa_guard_acquire
String ID:
API String ID: 350790332-0
Opcode ID: 47999cf8e7d62eea7b92bc10fdfb4638d7cd5dcab0447f57df81fa2cbfbe78c6
Instruction ID: f2da5d230460204b84bc1c40a4573bee89853f8e0e254070c30a8de47fb7d6e2
Opcode Fuzzy Hash: 47999cf8e7d62eea7b92bc10fdfb4638d7cd5dcab0447f57df81fa2cbfbe78c6
Instruction Fuzzy Hash: EDF031B55001008FDB04BF64D4A95ADBBB4BF44341F41067EDC468B295DB786558CB56

Function 0040F8EB Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8CC
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayData10deallocateFormatResumeS_jjSettingsUnwind_
String ID:
API String ID: 1695743215-0
Opcode ID: b2674ebd15015f76c049df446332574736a21b6a66984d449a80022e69fb7b92
Instruction ID: 4ad38d79a29f3900fe6f6dd9bb6392c2afa52914384e9c26cf1f62e246f3db1f
Opcode Fuzzy Hash: b2674ebd15015f76c049df446332574736a21b6a66984d449a80022e69fb7b92
Instruction Fuzzy Hash: 3BF0F935E002088BCB28EFB5C8D04ECB7B0AF0C300B50453ED816A7262EB785946DF59

Function 0040F8EF Relevance: 7.5, APIs: 5, Instructions: 27COMMON

Download Yara Rule

APIs

_ZN8QVariantD1Ev.QT5CORE ref: 0040F8CC

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Variant$ArrayData10deallocateFormatResumeS_jjSettingsUnwind_
String ID:
API String ID: 1695743215-0
Opcode ID: ed16a72fd94359f7d550167b04be889123fb6c827449b401f4c7be87bc76826e
Instruction ID: 9c79761076acdf2177a865d9cedac8644a7615e81d2764fe9b97a5b7f31bc3d1
Opcode Fuzzy Hash: ed16a72fd94359f7d550167b04be889123fb6c827449b401f4c7be87bc76826e
Instruction Fuzzy Hash: 09F0B735E002088BCB28EBA5C8949ECB7B0AF0C304B54453ED416A7262EB7459469F59

Function 0041E604 Relevance: 7.5, APIs: 5, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5CD
_ZN8QVariantD1Ev.QT5CORE ref: 0041E5D7
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5E0
_ZN6QDebugD1Ev.QT5CORE ref: 0041E5F2
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5FB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$ArrayData10deallocateDebugS_jjVariant
String ID:
API String ID: 367796544-0
Opcode ID: 552f9f30e011e0f8a6c836f1d44f8009dac41ea9a5d3018e1a1419f9d8d83e55
Instruction ID: 10d10dfdb579f67cef048295c27901b78fbb1281eb6f8ff4fe6d1195b65fe67d
Opcode Fuzzy Hash: 552f9f30e011e0f8a6c836f1d44f8009dac41ea9a5d3018e1a1419f9d8d83e55
Instruction Fuzzy Hash: 72E0C9346047148BC708BFB2D9950ADB771BF08349B40092EE9475B267EEF849489A99

Function 0041E617 Relevance: 7.5, APIs: 5, Instructions: 21COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5CD
_ZN8QVariantD1Ev.QT5CORE ref: 0041E5D7
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5E0
_ZN6QDebugD1Ev.QT5CORE ref: 0041E5F2
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5FB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$ArrayData10deallocateDebugS_jjVariant
String ID:
API String ID: 367796544-0
Opcode ID: 9f24ac588fe12dd8dd6929a7a8f9ef6b9c4ff10004318469b260d58197e43256
Instruction ID: ae671c733138efdc1d87e8cf266012a9428fbf9670fc0efcf3f231d75b053433
Opcode Fuzzy Hash: 9f24ac588fe12dd8dd6929a7a8f9ef6b9c4ff10004318469b260d58197e43256
Instruction Fuzzy Hash: 66E012342047148BC704BFB2D9D50AC7771BF08345B40092FE9434B223EEBC4945D75A

Function 0041E5BD Relevance: 7.5, APIs: 5, Instructions: 20COMMON

Download Yara Rule

APIs

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5CD
_ZN8QVariantD1Ev.QT5CORE ref: 0041E5D7
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5E0

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN6QDebugD1Ev.QT5CORE ref: 0041E5F2
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5FB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$ArrayData10deallocateDebugS_jjVariant
String ID:
API String ID: 367796544-0
Opcode ID: 2e18e197b5bee19a507151425534179b35c79d35dc239f284c53ba7bd096396e
Instruction ID: 7260e3c322be1b6fb5a29e92b92cd991d826bbf8e757a1eaaf29374b5e1fb598
Opcode Fuzzy Hash: 2e18e197b5bee19a507151425534179b35c79d35dc239f284c53ba7bd096396e
Instruction Fuzzy Hash: 10E0C2346003188BC704AFB1D8D85ADB7B1BF09305B00092EA9469B222EEB85D88CB55

Function 0040ED2D Relevance: 7.5, APIs: 5, Instructions: 19COMMON

Download Yara Rule

APIs

_ZN6QDebugD1Ev.QT5CORE ref: 0040ED39
_ZN6QDebugD1Ev.QT5CORE ref: 0040ED41
_ZN6QDebugD1Ev.QT5CORE ref: 0040ED49

Part of subcall function 00471AA0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471AAE

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040ED18
_ZdlPv.LIBSTDC++-6 ref: 0040ED22

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Debug$DataData7disposeListResumeUnwind_
String ID:
API String ID: 2102612617-0
Opcode ID: 7a3556d95154b5c956965c546cbf931ffea6faec70680f7d56dbfc8c81749b21
Instruction ID: 14c3609d191ed7963fe10a57c94cfee84fb8a8706a90e2ac46a0c73ba231209c
Opcode Fuzzy Hash: 7a3556d95154b5c956965c546cbf931ffea6faec70680f7d56dbfc8c81749b21
Instruction Fuzzy Hash: DAE0E63160461987CB14BF76999016CB3A5AF85344F16093FC94663263DE785D468F49

Function 0041E61B Relevance: 7.5, APIs: 5, Instructions: 18COMMON

Download Yara Rule

APIs

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5CD
_ZN8QVariantD1Ev.QT5CORE ref: 0041E5D7
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5E0

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN6QDebugD1Ev.QT5CORE ref: 0041E5F2
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041E5FB

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$ArrayData10deallocateDebugS_jjVariant
String ID:
API String ID: 367796544-0
Opcode ID: 46dc1a9173641ba133883b4f62e8c5305eddb1172c65d339e3f796219a6dfd49
Instruction ID: 40af3bc8427ca9c3b872f45dbe403a1d990c5d2ed394322881e088f666578845
Opcode Fuzzy Hash: 46dc1a9173641ba133883b4f62e8c5305eddb1172c65d339e3f796219a6dfd49
Instruction Fuzzy Hash: 0CE0B6346147049BC704BFB2D9D90ADB7B5BF09345B40092EA9439B223EAB84888CB69

Function 00403C9E Relevance: 7.5, APIs: 5, Instructions: 17COMMON

Download Yara Rule

APIs

__cxa_guard_abort.LIBSTDC++-6 ref: 00403CA7
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00403CAF
__cxa_guard_abort.LIBSTDC++-6 ref: 00403CBD
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00403CC5

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00403C44

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$__cxa_guard_abort$ArrayData10deallocateS_jj
String ID:
API String ID: 686600420-0
Opcode ID: 9d7563915399124858c7657f2b47da127ce16a0ff84a2a6d3b135c6efd279ec9
Instruction ID: 7d1f9a6832e59f2c90329d1b85d6245e0e053dec88c80f50c0c528e1ae1add02
Opcode Fuzzy Hash: 9d7563915399124858c7657f2b47da127ce16a0ff84a2a6d3b135c6efd279ec9
Instruction Fuzzy Hash: 9DD0677121C7008AC3517FB696C222EB9E0AF1A30AF05583FA5C796243DBFC4589579F

Function 0041E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175timeCOMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E846
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041E8C3
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0041E9A9
_ZN9QListData6detachEi.QT5CORE ref: 0041EA0A
memcpy.MSVCRT ref: 0041EA4F

Part of subcall function 00472C50: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,00443248), ref: 00472C5E

_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EA7C
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EA91
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EAA6
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 0041EABB
_ZdlPv.LIBSTDC++-6 ref: 0041EAF0
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041EBD6
_ZN17QAbstractItemView14clearSelectionEv.QT5WIDGETS ref: 0041EC79
_ZN10QTableView9selectRowEi.QT5WIDGETS ref: 0041EC8C
_ZN5QTimeC1Eiiii.QT5CORE ref: 0041ECB9
_ZN11QTextStreamlsEc.QT5CORE ref: 0041ED4B
_ZN11QTextStreamlsEc.QT5CORE ref: 0041ED60

Strings

drawn false:, xrefs: 0041E803
default, xrefs: 0041E7E1

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: EnabledWidget10set$ArrayData10deallocateListS_jj$DataData7disposeStreamlsText$AbstractData6detachEiiiiItemSelectionTableTimeView14clearView9selectmemcpy
String ID: default$drawn false:
API String ID: 3219745582-2854321336
Opcode ID: 8b3926e73c84fcb31f91de82918b917d65a3a1ca46be9a3f879e065c955ebc88
Instruction ID: 597e6840d17911550d2e406f6e58514aabe136527df302f2407407a0e3629173
Opcode Fuzzy Hash: 8b3926e73c84fcb31f91de82918b917d65a3a1ca46be9a3f879e065c955ebc88
Instruction Fuzzy Hash: 818117B49002058FDB04EFB9C498B9EBBF1BF48304F14866DD8599B355DB39A889CF49

Function 0040AA65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040AA71

Part of subcall function 004099C0: _ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AAFC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AB60

Strings

G92X0Y0, xrefs: 0040AAAF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Device6isOpenResumeUnwind_
String ID: G92X0Y0
API String ID: 1081410857-2200321382
Opcode ID: 08c8079f88866395896a3af863c5efb1eff8d2824d775bf68f1036f9cfbe66b2
Instruction ID: 05d43be39d05276576ffb215f090a78ae2c1ed88ab2cea73ea2597f1f539c091
Opcode Fuzzy Hash: 08c8079f88866395896a3af863c5efb1eff8d2824d775bf68f1036f9cfbe66b2
Instruction Fuzzy Hash: B7214BB1A043059FC700EF69C48439EBBF5FF84718F10892EE4989B392D7B95845CB8A

Function 0040B839 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040B81E
_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040B862
_ZNK7QString3argExii5QChar.QT5CORE ref: 0040B898

Part of subcall function 004099C0: _ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6

Strings

M3 S%1, xrefs: 0040B85B

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayAscii_helperCharData10deallocateDevice6isExii5OpenS_jjString16fromString3arg
String ID: M3 S%1
API String ID: 303445844-2472580429
Opcode ID: b1ec2519a2cbc752f49c9ce34137a608565fe1ba067ffe28576c6463333fd7b5
Instruction ID: 19986c6c2bae075201501cdd8ee1174d74ddf4081f16f14e5552301ce75251c4
Opcode Fuzzy Hash: b1ec2519a2cbc752f49c9ce34137a608565fe1ba067ffe28576c6463333fd7b5
Instruction Fuzzy Hash: 1A112BB19043058FDB00EF68D44839EBBF1FF84314F11892EE494A7391D7799805CB96

Function 00403160 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040317A
_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00403191
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004031B9

Strings

.map, xrefs: 00403173

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayAscii_helperCaseData10deallocateQt15S_jjSensitivityString16fromString8endsWith
String ID: .map
API String ID: 3934386200-222655672
Opcode ID: 370b2312bd48e57a6fa0f14c56afdf83f3fc1d678b4a1720dec6a841406a6136
Instruction ID: 5e214b16000d546432187dbfd3d7cfdba7c4f50830ba22b1225be98401ef7fb6
Opcode Fuzzy Hash: 370b2312bd48e57a6fa0f14c56afdf83f3fc1d678b4a1720dec6a841406a6136
Instruction Fuzzy Hash: 1001D4B4804345DFDB009F64C4986AFBFB4FF45356F00C52DE4955B290D3394A44CB86

Function 0040315C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_ZN7QString16fromAscii_helperEPKci.QT5CORE ref: 0040317A
_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00403191
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004031B9

Strings

.map, xrefs: 00403173

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayAscii_helperCaseData10deallocateQt15S_jjSensitivityString16fromString8endsWith
String ID: .map
API String ID: 3934386200-222655672
Opcode ID: 22cf56a2d902c590ab61b5a37c4114bac9867f8a663a644c42a96773d4db78b1
Instruction ID: b8fb13408b364b0cc04cbe213405fc12c61d6127d62a5bb0ec10ca19f320ba36
Opcode Fuzzy Hash: 22cf56a2d902c590ab61b5a37c4114bac9867f8a663a644c42a96773d4db78b1
Instruction Fuzzy Hash: D9F087B1804348EFDB00AFA8C8882AEFFF4FF44345F00882DE98957210D3345548CB9A

Function 004091C0 Relevance: 6.2, APIs: 4, Instructions: 239COMMON

Download Yara Rule

APIs

Part of subcall function 004707E0: _ZN9QListData6detachEi.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00470842
Part of subcall function 004707E0: _ZeqRK7QStringS1_.QT5CORE ref: 004708E6

Part of subcall function 00470650: _ZN9QListData11detach_growEPii.QT5CORE ref: 00470686

_ZN9QListData6detachEi.QT5CORE ref: 00409228

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$Data6detach$Data11detach_growString
String ID:
API String ID: 2123326895-0
Opcode ID: 87f95834a03ccaffed9d7009a96ff79512ae4b2cde02a90f6c41ceff65cd2875
Instruction ID: 829386e83e2f673e1daf33c3e21d5e375746c1698cec1c5b548dbaa9b5abee35
Opcode Fuzzy Hash: 87f95834a03ccaffed9d7009a96ff79512ae4b2cde02a90f6c41ceff65cd2875
Instruction Fuzzy Hash: E8A1A074604202CFCB14DF28D4C4A5AB7B2FF84314F1986AED51AAB3A6D735AC46CF45

Function 00473460 Relevance: 6.2, APIs: 4, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0047352A
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE.QT5CORE ref: 00473572

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$AllocationData10deallocateData8allocateEjjj6FlagsOptionS_16S_jj
String ID:
API String ID: 1338957267-0
Opcode ID: 9fe5ba8159348035915b1bf27ffd1311fabc865d0bb5398dcbc8e649e06e36e9
Instruction ID: 30a35ee3bb1cc3ff57a4789f3462069869a84a6b8724c69a9f92507579cc2531
Opcode Fuzzy Hash: 9fe5ba8159348035915b1bf27ffd1311fabc865d0bb5398dcbc8e649e06e36e9
Instruction Fuzzy Hash: 71816F71A04216EFCF24CF58C480AEEB7B1BF44355F18C16AD419AB311D739EA46DB85

Function 004466B0 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b132f1ea278f71fc6ebe854dc65c5aa090041d178dfd50f8b9cec6c74ce95d
Instruction ID: 246e3a2d7c3e0edcb7cb89d4ce5290f16d2204b0eff596c248bd2171a5afa2cc
Opcode Fuzzy Hash: 77b132f1ea278f71fc6ebe854dc65c5aa090041d178dfd50f8b9cec6c74ce95d
Instruction Fuzzy Hash: 44612D74504202DFE714DF28C48461AFBE1BF85364F2AC61EE8A88B3A1D739ED45CB56

Function 0041BDCC Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041BDE3
_ZN15QProgressDialog8setValueEi.QT5WIDGETS ref: 0041BE55
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE.QT5CORE ref: 0041BE65
_ZNK15QProgressDialog11wasCanceledEv.QT5WIDGETS ref: 0041BE71

Part of subcall function 00470CF0: _ZN9QListData6detachEi.QT5CORE ref: 00470D0D
Part of subcall function 00470CF0: _Znwj.LIBSTDC++-6 ref: 00470D3C

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041C08E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041C0B7

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$EventsProgress$Application13processCanceledCoreData6detachDialog11wasDialog8setEventFlagFlagsListLoop17ProcessValueZnwj
String ID:
API String ID: 3922179343-0
Opcode ID: a04e1fe3f257e05ccb5658a89610420e8c744eb421887ff8edec01fb55987c19
Instruction ID: 87aadd030f0025d5a14440acf9761ba47d5649edb0bac55c14de9a171333f9c9
Opcode Fuzzy Hash: a04e1fe3f257e05ccb5658a89610420e8c744eb421887ff8edec01fb55987c19
Instruction Fuzzy Hash: 96612D70A00215CFCB14EF29C894B9ABBF2FF84304F5586A9D4499B366DB34AD85CF85

Function 00431BD0 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

_ZNK7QObject6senderEv.QT5CORE ref: 00431BDA
_ZNK7QAction4textEv.QT5WIDGETS ref: 00431BE8
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431C76
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00431CD8

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Action4textObject6sender
String ID:
API String ID: 1163864997-0
Opcode ID: 0e34d69e709a072eac28eb435f959dda2e86412382aa8b659a3f4fe8e1749190
Instruction ID: 2c3d57e12cd5455a1c4b36c22157971f742e5ffe54de190c28bed97ae8566188
Opcode Fuzzy Hash: 0e34d69e709a072eac28eb435f959dda2e86412382aa8b659a3f4fe8e1749190
Instruction Fuzzy Hash: B23103B4E042118FDB10AF69C4C426FBBF1FF89310F18A16AD8584B364D7399D45CB8A

Function 004062DC Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

_ZN8QVariantD1Ev.QT5CORE ref: 004062E0
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 004062E9

Part of subcall function 0044D680: _ZNK8QSpinBox5valueEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6AD
Part of subcall function 0044D680: _ZNK15QAbstractButton9isCheckedEv.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6C1
Part of subcall function 0044D680: _ZN7QString16fromAscii_helperEPKci.QT5CORE(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6E7
Part of subcall function 0044D680: _ZN7QWidget13setStyleSheetERK7QString.QT5WIDGETS(?,?,?,?,?,00000002,000B2260,?,0042B238), ref: 0044D6FC
Part of subcall function 0044D680: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044D721

_ZN10QByteArrayC1Eic.QT5CORE ref: 0040636C
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 00406392
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004063D4
_ZN10QByteArrayC1Eic.QT5CORE ref: 00406432
_ZN9QIODevice5writeEPKcx.QT5CORE ref: 00406458

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Array$ByteData10deallocateDevice5writeS_jj$AbstractAscii_helperBox5valueButton9isCheckedResumeSheetSpinStringString16fromStyleUnwind_VariantWidget13set
String ID:
API String ID: 3301784748-0
Opcode ID: 89008ac7dd08f7ac15e871c915f276fde8e989560dcd2db442734d8eaf5aecc6
Instruction ID: 33c2d679b289490abc07f1420a22f22fbf1eb16d25688ded08983406ab1151e6
Opcode Fuzzy Hash: 89008ac7dd08f7ac15e871c915f276fde8e989560dcd2db442734d8eaf5aecc6
Instruction Fuzzy Hash: 2421B674B042044FCB08EF79D8845AEBBF1EF88310F05C53EEC4697391DA3898188B99

Function 004722C0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_ZN9QListData11detach_growEPii.QT5CORE ref: 004722E1
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0047232E
memcpy.MSVCRT ref: 00472380

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData11detach_growData7disposememcpy
String ID:
API String ID: 2917024604-0
Opcode ID: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction ID: 3cf3e9bacb589583d33c8547e6c5711796b6d9393fc9b8c615e2cba9598d852a
Opcode Fuzzy Hash: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction Fuzzy Hash: 21318F35108306DFC714DF28D9C099AB7E1FF84304F548A5EE88987311E779E94ACB96

Function 00472860 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_ZN9QListData11detach_growEPii.QT5CORE ref: 00472881
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 004728CE
memcpy.MSVCRT ref: 00472920

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData11detach_growData7disposememcpy
String ID:
API String ID: 2917024604-0
Opcode ID: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction ID: 69ce107900fdb7eb2fecfe607bedfae5f5069ef9dbbc477fda5e5dbbfc4db5f8
Opcode Fuzzy Hash: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction Fuzzy Hash: AB31C170108306DFC710EF28D5C099AB7E0FF84304F598A9EE48987311E771E989CB96

Function 004718D0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_ZN9QListData11detach_growEPii.QT5CORE ref: 004718F1
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 0047193E
memcpy.MSVCRT ref: 00471990

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData11detach_growData7disposememcpy
String ID:
API String ID: 2917024604-0
Opcode ID: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction ID: 1deb742aa92665e27bad0b97549372db2293d52546f28bbc0af3bba6be9eec44
Opcode Fuzzy Hash: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction Fuzzy Hash: CB317CB5108206DFC710DF2CD49099AB7E1FF85308F548A5EE58987321E735E94ACB95

Function 004729F0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_ZN9QListData11detach_growEPii.QT5CORE ref: 00472A11
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00472A5E
memcpy.MSVCRT ref: 00472AB0

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData11detach_growData7disposememcpy
String ID:
API String ID: 2917024604-0
Opcode ID: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction ID: 147fce939c00ff50df84f27ca8fd881d3fd1bc266ae8d99bbda569195ddbe311
Opcode Fuzzy Hash: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction Fuzzy Hash: DA318935108306DFC720DF28D5C099AB7E0FF84304F588AAEE48987312E775E94ACB86

Function 00471AE0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_ZN9QListData11detach_growEPii.QT5CORE ref: 00471B01
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471B4E
memcpy.MSVCRT ref: 00471BA0

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData11detach_growData7disposememcpy
String ID:
API String ID: 2917024604-0
Opcode ID: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction ID: 53ab785938a24535ec37ebb065ddb8da5918095584d42fbd01a2658b7bf8fc5f
Opcode Fuzzy Hash: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction Fuzzy Hash: C1314A75108206DFC710DF2CD8C499AB7E5FF85304F548A6EE8898B321E735E95ACB86

Function 00471CF0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_ZN9QListData11detach_growEPii.QT5CORE ref: 00471D11
_ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471D5E
memcpy.MSVCRT ref: 00471DB0

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: List$DataData11detach_growData7disposememcpy
String ID:
API String ID: 2917024604-0
Opcode ID: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction ID: eabcf679a57216a553adeb27ddf5c8c6f003ccd1ef5aa5a0f73965994f988bfa
Opcode Fuzzy Hash: d2ee38979a1057fd3028f68c405df3994cadcb06fc33c5335dccb8a6e55b8bef
Instruction Fuzzy Hash: 79313675108306DBC720DF2CD48499AB7E1FB84304F588A6EE48987321E735E95ACF86

Function 00445420 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_ZN7QString6numberEii.QT5CORE ref: 00445453
_ZN8QVariantC1ERK7QString.QT5CORE ref: 0044545E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00445483
_ZN8QVariantC1ERK7QString.QT5CORE ref: 004454E3

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: StringVariant$ArrayData10deallocateS_jjString6number
String ID:
API String ID: 2024941470-0
Opcode ID: 8cf1636da0926f2f749b93042275378dbe3a766c95c65035bcb71b00ac133633
Instruction ID: e0f16fbeb2e1a216a418eb8b791f32565dd026d4246060e34c7d167bbf33038e
Opcode Fuzzy Hash: 8cf1636da0926f2f749b93042275378dbe3a766c95c65035bcb71b00ac133633
Instruction Fuzzy Hash: 932174716046059FDF00DF68E88878EBBB0FF44329F14866AE8548B351D336D995CB81

Function 004064A0 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 004064E3
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00406500
_ZdlPv.LIBSTDC++-6 ref: 00406509
_ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,?,?,?,?,?,?,?,00470FE8), ref: 0040655C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$DataData7disposeList
String ID:
API String ID: 955637761-0
Opcode ID: 1fbc4da203d1d4719697c7ebace2f0512131ed2c3bff6ad9ae977f38bf651939
Instruction ID: ac1b37e6b69ba1b7d93056536e153e441bbf14dfdb3471a678ed0697e996b6d0
Opcode Fuzzy Hash: 1fbc4da203d1d4719697c7ebace2f0512131ed2c3bff6ad9ae977f38bf651939
Instruction Fuzzy Hash: 9F21D170104302EBD718DF29E8D462AF7B0FF80318F26462EE45657394D739E8A6CB89

Function 0041D4AC Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_ZNK19QAbstractTableModel5indexEiiRK11QModelIndex.QT5CORE ref: 0041D4E6
_ZNK8QVariant8toDoubleEPb.QT5CORE ref: 0041D513
_Z6qIsNaNd.QT5CORE ref: 0041D51F
_ZN8QVariantD1Ev.QT5CORE ref: 0041D52E

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: AbstractDoubleIndexModelModel5indexTableVariantVariant8to
String ID:
API String ID: 1617609351-0
Opcode ID: 9063cff368adfc0121ff7d2a22af78da973b2d04c99fbeb8e8047160a922cfc3
Instruction ID: 524098fb18da0589a07cf4ce73186cf7abd1c032f96231df2f5bef4ba342c16b
Opcode Fuzzy Hash: 9063cff368adfc0121ff7d2a22af78da973b2d04c99fbeb8e8047160a922cfc3
Instruction Fuzzy Hash: B92157B0804318DFDB20AFA9D8883ADBBB1BF01328F10475EE4A5A72D0D7744989CF46

Function 0043DB40 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_ZN7QObjectC2EPS_.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0041A713), ref: 0043DB50
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,0041A713), ref: 0043DBC1
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,0041A713), ref: 0043DBC6
_Z5qQNaNv.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,0041A713), ref: 0043DBCB

Part of subcall function 0043D8F0: _ZNK14QMessageLogger5debugEv.QT5CORE ref: 0043D92A
Part of subcall function 0043D8F0: _ZN7QString15fromUtf8_helperEPKci.QT5CORE ref: 0043D946
Part of subcall function 0043D8F0: _ZN11QTextStreamlsERK7QString.QT5CORE ref: 0043D952
Part of subcall function 0043D8F0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0043D97B
Part of subcall function 0043D8F0: _Zls6QDebugRK9QVector3D.QT5GUI ref: 0043D9A8
Part of subcall function 0043D8F0: _ZdlPv.LIBSTDC++-6 ref: 0043DA27

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateDebugLogger5debugMessageObjectS_jjStreamlsStringString15fromTextUtf8_helperVector3Zls6
String ID:
API String ID: 1772529278-0
Opcode ID: 66b936fdb33979da88bc46252d9dbe17818dab67238a979c37bf50fb22ad4732
Instruction ID: 2f58376f93edd7ae0e8142b09a4b39bba4a761e58bad712a0c4ce8e314ace5ef
Opcode Fuzzy Hash: 66b936fdb33979da88bc46252d9dbe17818dab67238a979c37bf50fb22ad4732
Instruction Fuzzy Hash: 02212C70905258CFDF04AF69E8C92997FB4FF04300F8140E9DD806A25ED77698B4CBAA

Function 00433CC0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 00433CE3
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 00433CFC
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 00433D15
_ZN7QWidget10setEnabledEb.QT5WIDGETS ref: 00433D53

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: EnabledWidget10set
String ID:
API String ID: 1934139091-0
Opcode ID: 70f40e71fbed3af597efd3f181543a2c1b24b0886cf85fe95d543d39014c6ec3
Instruction ID: 05e91eff9cafba1a944e41f7eb513eec24cd23431c13d9b91f91bc19cb56d0e9
Opcode Fuzzy Hash: 70f40e71fbed3af597efd3f181543a2c1b24b0886cf85fe95d543d39014c6ec3
Instruction Fuzzy Hash: BE112E75A042048FC714EF7AD4949AAB7F0FF58310F41467ADC8587361DA34E948CB91

Function 004087CC Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00408713
_ZN7QWidget12removeActionEP7QAction.QT5WIDGETS ref: 0040872C
_ZNK7QAction4textEv.QT5WIDGETS ref: 00408765
_ZN7QString14compare_helperEPK5QChariPKciN2Qt15CaseSensitivityE.QT5CORE ref: 00408796

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Action$Action4textArrayCaseChariData10deallocateQt15S_jjSensitivityString14compare_helperWidget12remove
String ID:
API String ID: 1464183043-0
Opcode ID: 88213b1acb656ba4a0a9f9c7a105d11fb9c37d0183a6036c8a5056ae2e3da3bb
Instruction ID: 98d4816d7f6b6d2d1e8db8cb6e8c3b0621b276b1ed8e5ea9350694c37763a5e9
Opcode Fuzzy Hash: 88213b1acb656ba4a0a9f9c7a105d11fb9c37d0183a6036c8a5056ae2e3da3bb
Instruction Fuzzy Hash: 2F213BB8904605CFCB04DF68C58869EBBF0BF88314F25C66EE89567395CB39A845CF49

Function 0044E570 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0044E596
_ZNK9QComboBox12currentIndexEv.QT5WIDGETS ref: 0044E5A2
_ZN9QComboBox15setCurrentIndexEi.QT5WIDGETS ref: 0044E5AF
_ZNK9QComboBox11currentTextEv.QT5WIDGETS ref: 0044E5BF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Combo$Index$ArrayBox11currentBox12currentBox15setCurrentData10deallocateS_jjText
String ID:
API String ID: 1953980557-0
Opcode ID: d517374c47c59dc2e684c98188498496fb1fedf4d580bc2df9da90ecda4d9c95
Instruction ID: 4006ef99c003fbb68c90ad87f0c71755f90af39ef439fa85739b4ab190098496
Opcode Fuzzy Hash: d517374c47c59dc2e684c98188498496fb1fedf4d580bc2df9da90ecda4d9c95
Instruction Fuzzy Hash: B301F7B12043009FDB14AFB9D89856B7BB5FBC4318F118A3ED44587260F735E85ACB86

Function 0041CE50 Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041CE5D
_ZN8QVariantD1Ev.QT5CORE ref: 0041CE66
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041CE6F
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041CEAF
_ZNK11QMetaObject2trEPKcS1_i.QT5CORE ref: 0041CF04
_ZNK7QWidget11windowTitleEv.QT5WIDGETS ref: 0041CF13
_ZN11QMessageBox7warningEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_.QT5WIDGETS ref: 0041CF3A
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041CF84
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041CFB7
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041D002
_ZNK19QItemSelectionModel12selectedRowsEi.QT5CORE ref: 0041D033

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ItemModel12selectedRowsSelection$ResumeUnwind_$ArrayBox7warningButtonData10deallocateFlagsMessageMetaObject2trS1_iS4_6S_14S_jjStandardStringTitleVariantWidgetWidget11window
String ID:
API String ID: 928396375-0
Opcode ID: 79807c14cbbece80765b4fb72adb29fb58a342ba1fb9b21cf4f507256ec9fcd2
Instruction ID: b50a47556a5abcafc90e8ad02380fe530fbfd71f6af4f6c1613853f04f2e64f9
Opcode Fuzzy Hash: 79807c14cbbece80765b4fb72adb29fb58a342ba1fb9b21cf4f507256ec9fcd2
Instruction Fuzzy Hash: 8E01DE71A003049FCB04EFA9E884B9EBBB4FF44310F04056EE805A7322DB34A948CF99

Function 0042159C Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_ZNK11QTextStream5atEndEv.QT5CORE ref: 004214F2
_ZN11QTextStream8readLineEx.QT5CORE ref: 00421511
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00421543
_ZNK11QTextStream5atEndEv.QT5CORE ref: 0042154B
_ZN11QTextStreamD1Ev.QT5CORE ref: 00421583
_ZN5QFileD1Ev.QT5CORE ref: 0042158C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Text$Stream5at$ArrayData10deallocateFileLineS_jjStreamStream8read
String ID:
API String ID: 1829919948-0
Opcode ID: 1b19b5d1f22fa310a4e4ff60f4463312b7330657d32afc889aaadc58f63aba98
Instruction ID: 7fac2b679204f3719014b9b52f0106a2409eb0a2e9d55025c9e8234aaf653832
Opcode Fuzzy Hash: 1b19b5d1f22fa310a4e4ff60f4463312b7330657d32afc889aaadc58f63aba98
Instruction Fuzzy Hash: 1601D871604210CBCF04BF74F4546ADB771EF90304F40412DE44A572A1CB39294ACB8A

Function 0041A459 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A3C7
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A3E9
_ZNK9QIODevice6isOpenEv.QT5CORE ref: 0041A3F1
_ZN11QSerialPort5closeEv.QT5SERIALPORT ref: 0041A3FD
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0041A433

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Device6isOpenPort5closeSerial
String ID:
API String ID: 2407417817-0
Opcode ID: 33a057bc612dbaf7cb80e68b875eff5711eef054dd9f1914619f551f6474afab
Instruction ID: 6c05c087c812cd229c31244b02bacbab43627ce46d0ab2f0601d1b34a04a4352
Opcode Fuzzy Hash: 33a057bc612dbaf7cb80e68b875eff5711eef054dd9f1914619f551f6474afab
Instruction Fuzzy Hash: BD0162B4605300CBDB009F24D88C3AEB7F1FF80359F14852DE9A5573A5D7395859CB4A

Function 00405D70 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405D8B
_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DA0
_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DB4
_ZNK14QDoubleSpinBox5valueEv.QT5WIDGETS ref: 00405DC2

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Box5valueDoubleSpin
String ID:
API String ID: 2520306058-0
Opcode ID: ba7f673c35ed10eb4cb62c2d46acdda329394d046d58d3a0105583b98ade452f
Instruction ID: 11d3f6d723edaa48f72da7e552f2d24eb200f52b38e36094b7b0792261f30302
Opcode Fuzzy Hash: ba7f673c35ed10eb4cb62c2d46acdda329394d046d58d3a0105583b98ade452f
Instruction Fuzzy Hash: 2EF01931A045199BC704EF18E8D4966BBB0FF88210B4589A9D88887366CE31AC70CBD5

Function 004020DC Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040204D
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402072
_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040207E
_ZN12QApplicationD1Ev.QT5WIDGETS ref: 0040208A

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$ApplicationFormat
String ID:
API String ID: 4074272059-0
Opcode ID: c8aaac8fe9dc0e665a1f4830af7227e4a01cf4127eea7379b65c289f16f1987d
Instruction ID: 89f02b3451e4682b104b201f39d150fcb675ee269f1b8b2a66f704a4d00bbbe0
Opcode Fuzzy Hash: c8aaac8fe9dc0e665a1f4830af7227e4a01cf4127eea7379b65c289f16f1987d
Instruction Fuzzy Hash: BD016DB1904206CFDB109F24D98C39EB7B0FF80359F1085ADE259572A0DB76598ACF49

Function 00408E10 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 00470080: _ZN4QUrlD1Ev.QT5CORE(?,?,?,00000000,?,?,00408DEB), ref: 004700B5
Part of subcall function 00470080: _ZN9QListData7disposeEPNS_4DataE.QT5CORE(?,?,?,00000000,?,?,00408DEB), ref: 004700BE

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00408E1D
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00408E3D
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00408E4F
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00408E61

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$DataData7disposeList
String ID:
API String ID: 1860730466-0
Opcode ID: 4e6977c6235e4c68ad5b6a76fd9fc508b2d4bb4d9c1acf703838a7c305218afd
Instruction ID: d1042c1afddc62f6d8da207a4510525dadf09224b29252604df4a239254443d6
Opcode Fuzzy Hash: 4e6977c6235e4c68ad5b6a76fd9fc508b2d4bb4d9c1acf703838a7c305218afd
Instruction Fuzzy Hash: EBF0D070A007048ACB04FFB1D6D15EDB3B0AF18308B04486FE98667257DEFC5905D6A9

Function 004026AF Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040257C
_ZN12QApplicationD1Ev.QT5WIDGETS ref: 00402588
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00402591

Part of subcall function 00412E30: _ZdlPv.LIBSTDC++-6(00000000,?,?,00401FD8), ref: 00412E5F
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412E9D
Part of subcall function 00412E30: _ZN11QBasicTimer4stopEv.QT5CORE(00000000,?,?,00401FD8), ref: 00412EF5
Part of subcall function 00412E30: _ZN6QTimerD1Ev.QT5CORE(00000000,?,?,00401FD8), ref: 00412F07
Part of subcall function 00412E30: _ZN6QTimerD1Ev.QT5CORE ref: 00412F0F
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412F34
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412F5D
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412F86
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412FAF
Part of subcall function 00412E30: _ZN11QSerialPortD1Ev.QT5SERIALPORT ref: 00412FC6
Part of subcall function 00412E30: _ZN19QAbstractTableModelD2Ev.QT5CORE ref: 00413008

_ZN6QDebugD1Ev.QT5CORE ref: 004025DC

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Timer$AbstractApplicationBasicDebugFormatModelPortResumeSerialTableTimer4stopUnwind_
String ID:
API String ID: 1546850959-0
Opcode ID: 1b806a1c2776faac7dda02282128708cfd82513f10a014d94b77467242934008
Instruction ID: 8fc7533131639fc95aa1582fd3b8ba13d49f5f3daee5d53deb1de121b36ef1d7
Opcode Fuzzy Hash: 1b806a1c2776faac7dda02282128708cfd82513f10a014d94b77467242934008
Instruction Fuzzy Hash: A9F0F4309005258BCB18EB21DEA9AEDB334AF04309F5040FEE10E621B2DFB81E85DE5C

Function 0040F8F3 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateFormatResumeS_jjSettingsUnwind_Variant
String ID:
API String ID: 4229398312-0
Opcode ID: 7e3ab155e25a597a127aeefffaa79ac3c316631324d68a037e4a63b23fedf2d3
Instruction ID: 051d983ac3215e84bd488ac29eff5d67ad24932e2eefaf95e086aaf65a53398d
Opcode Fuzzy Hash: 7e3ab155e25a597a127aeefffaa79ac3c316631324d68a037e4a63b23fedf2d3
Instruction Fuzzy Hash: A0F09835E10608CBCB28EFB5D8945ECB7B0BF0C304B54417ED416E7262EB7859469F59

Function 0040F8FD Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

_ZN9QSettingsD1Ev.QT5CORE ref: 0040F875
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040F87E

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040F86C
_ZN8QVariantD1Ev.QT5CORE ref: 0040F8D9

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateFormatResumeS_jjSettingsUnwind_Variant
String ID:
API String ID: 4229398312-0
Opcode ID: 4d1386f5bc8880ca4ba48da5c6b5321af0088b2a746a2d7c38e4b6580c61aa9c
Instruction ID: 7061f602af03db0f9f946fa6b40b0a7bbbe4eb7f61211d1e7d53dd1d732bce9c
Opcode Fuzzy Hash: 4d1386f5bc8880ca4ba48da5c6b5321af0088b2a746a2d7c38e4b6580c61aa9c
Instruction Fuzzy Hash: 39F0A535E00208CBCB28EFB5D8945ACB7B0BF0C300B60423ED416E7262EB7858469F49

Function 0041CC6A Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041CC39

Part of subcall function 00471AA0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471AAE

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041CC4B
_ZN8QVariantD1Ev.QT5CORE ref: 0041CC6F
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041CC78

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$DataData7disposeListVariant
String ID:
API String ID: 3500325730-0
Opcode ID: 8eb5cdf55ff726b77d79e74eaec4e1947b85ad6ec8242e121bc0b130f814421f
Instruction ID: 2cef93a76ab7acc5da3a175ef431aee1d86beef0f56595eac64b04c1b8f85ec1
Opcode Fuzzy Hash: 8eb5cdf55ff726b77d79e74eaec4e1947b85ad6ec8242e121bc0b130f814421f
Instruction Fuzzy Hash: 85F09270A143088BCB14EFB5D9D05ADBBB0BF48344B14152ED446A7222DA785C45CF85

Function 004025D4 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

_ZN6QDebugD1Ev.QT5CORE ref: 004025DC

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_ZN9QGLFormatD1Ev.QT5OPENGL ref: 0040257C
_ZN12QApplicationD1Ev.QT5WIDGETS ref: 00402588
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00402591

Part of subcall function 00412E30: _ZdlPv.LIBSTDC++-6(00000000,?,?,00401FD8), ref: 00412E5F
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412E9D
Part of subcall function 00412E30: _ZN11QBasicTimer4stopEv.QT5CORE(00000000,?,?,00401FD8), ref: 00412EF5
Part of subcall function 00412E30: _ZN6QTimerD1Ev.QT5CORE(00000000,?,?,00401FD8), ref: 00412F07
Part of subcall function 00412E30: _ZN6QTimerD1Ev.QT5CORE ref: 00412F0F
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412F34
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412F5D
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412F86
Part of subcall function 00412E30: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00412FAF
Part of subcall function 00412E30: _ZN11QSerialPortD1Ev.QT5SERIALPORT ref: 00412FC6
Part of subcall function 00412E30: _ZN19QAbstractTableModelD2Ev.QT5CORE ref: 00413008

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Timer$AbstractApplicationBasicDebugFormatModelPortResumeSerialTableTimer4stopUnwind_
String ID:
API String ID: 1546850959-0
Opcode ID: d5a52fddc1aeed9ebdd524b1ab20affbfd30a261151b1235fa116b6739664e22
Instruction ID: e68ebd617720265adb6840afc78db60fbd312b70a659ef70a224bd92c658d960
Opcode Fuzzy Hash: d5a52fddc1aeed9ebdd524b1ab20affbfd30a261151b1235fa116b6739664e22
Instruction Fuzzy Hash: 5BF0B7705005158BC758EB21DEA5AEEB730AF14309F5041FEE10A561B2DFB41E85DE58

Function 0040852E Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

_ZN8QVariantD1Ev.QT5CORE ref: 00408533
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040853C

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 004084EB
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00408505

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$ArrayData10deallocateS_jjVariant
String ID:
API String ID: 826207278-0
Opcode ID: 7abd1a11294ed49f170c16781467d88604482955d3a153f8b6013777e2cb8699
Instruction ID: b23ddd3176733fc88172c785cf5f72faa58cc066e8e84eceff012e44b5e5703c
Opcode Fuzzy Hash: 7abd1a11294ed49f170c16781467d88604482955d3a153f8b6013777e2cb8699
Instruction Fuzzy Hash: 32E0E5306047008BC708BFB1D6D14AD76B0AF08318B04592FE4866B263EEB858449BA9

Function 00409835 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00409841

Part of subcall function 00452AC0: _ZN10QArrayData10deallocateEPS_jj.QT5CORE(?,?,?,?,?,?,?,?,?,00406496), ref: 00452ADE

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 00409852
_ZN6QDebugD1Ev.QT5CORE ref: 00409863
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040986C

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$ArrayData10deallocateS_jj$Debug
String ID:
API String ID: 2250920564-0
Opcode ID: 37d31f62dad40e4165a7f726f02b4a89790c16270c92747567f879342ed8e9fb
Instruction ID: 8654787699ab3be3d6a075c39f38f7d871e2ac9ac94a7bcffb2ee800fee8fdf3
Opcode Fuzzy Hash: 37d31f62dad40e4165a7f726f02b4a89790c16270c92747567f879342ed8e9fb
Instruction Fuzzy Hash: 09E0EC303047004BC704BF7696D216DA5A59F49349B04082FA5478B363DEFC4C049799

Function 0041D31F Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

_ZN6QDebugD1Ev.QT5CORE ref: 0041D30D
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041D316
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041D32C
_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041D33D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ResumeUnwind_$Debug
String ID:
API String ID: 441678417-0
Opcode ID: 0ca6da3df44b95408d9b26ac493b4fa7ee520d34bb4425266193240c073e5a2a
Instruction ID: 956e8c7e7bb0db1b6f467ce2ab912736db527ecfb6efeb6b88c4c52b525654d0
Opcode Fuzzy Hash: 0ca6da3df44b95408d9b26ac493b4fa7ee520d34bb4425266193240c073e5a2a
Instruction Fuzzy Hash: DFE0ECB06057049BC700BFB5E5D116E76A0AF0D345B10183EAD8387313EABC4C85879A

Function 00419642 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

_ZN8QVariantD1Ev.QT5CORE ref: 00419648
_ZN7QRegExpD1Ev.QT5CORE ref: 00419650
_ZN11QTextCursorD1Ev.QT5GUI ref: 0041965C

Part of subcall function 00472F40: _ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00472F5E

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0041967B

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayCursorData10deallocateResumeS_jjTextUnwind_Variant
String ID:
API String ID: 1130623818-0
Opcode ID: 531b1df58a7b40a48fd82dfc17b7e4f8c526bb8483a3cb324edf8fb4472e3668
Instruction ID: ef3894fbc069f777392c1430a066e6e158fb28cf1d13c33ace3919e16b608903
Opcode Fuzzy Hash: 531b1df58a7b40a48fd82dfc17b7e4f8c526bb8483a3cb324edf8fb4472e3668
Instruction Fuzzy Hash: 1CE0E6347015108FC758BF25D9A816C77B2AB48355F5442FDE40A97371CFB40D81DB89

Function 0040ED4D Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

_ZN6QDebugD1Ev.QT5CORE ref: 0040ED41
_ZN6QDebugD1Ev.QT5CORE ref: 0040ED49

Part of subcall function 00471AA0: _ZN9QListData7disposeEPNS_4DataE.QT5CORE ref: 00471AAE

_Unwind_Resume.LIBGCC_S_DW2-1 ref: 0040ED18
_ZdlPv.LIBSTDC++-6 ref: 0040ED22

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: Debug$DataData7disposeListResumeUnwind_
String ID:
API String ID: 2102612617-0
Opcode ID: 9b690e5010a3666afbe98599e4a87182097593efbfbcad2751292020a9cbb798
Instruction ID: 864e0655da1a8fb964207abc4c2b669a9991a3879734aff64a901b2a60ee2cfe
Opcode Fuzzy Hash: 9b690e5010a3666afbe98599e4a87182097593efbfbcad2751292020a9cbb798
Instruction Fuzzy Hash: 50E01230604509CBCB24BF76E9902ACB3B1AF84344F250C3FD546672A3DA7C5D569F4A

Function 0040AA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 004099C0: _ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AAFC
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AB60

Strings

G92X0Y0, xrefs: 0040AAAF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Device6isOpen
String ID: G92X0Y0
API String ID: 1265076484-2200321382
Opcode ID: d0ecb57223a8e03039a8d2479405267a9ada98f7ad412c402d6d2fd762e054dd
Instruction ID: ccdca4f154a62c280f104a38282ee2fd60f98ec63956186843c7c3a4075ff460
Opcode Fuzzy Hash: d0ecb57223a8e03039a8d2479405267a9ada98f7ad412c402d6d2fd762e054dd
Instruction Fuzzy Hash: 213150B19043059FC700EF69C48869EBBF1FF84714F14862EE5A89B391D7795C49CB8A

Function 0040ABC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 004099C0: _ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AC3C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040ACA0

Strings

G92Z0, xrefs: 0040ABEF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Device6isOpen
String ID: G92Z0
API String ID: 1265076484-3769659619
Opcode ID: c07df4af916b558eeafe4969968a454d8a73f3ee8ba2acf0915692fc5a86084a
Instruction ID: 38b4a18adb173463edb7433c37fbff02bb960a2a291345131e090d3530b0bdb4
Opcode Fuzzy Hash: c07df4af916b558eeafe4969968a454d8a73f3ee8ba2acf0915692fc5a86084a
Instruction Fuzzy Hash: 433181B09083059FD7009F69C48469EBBF1FF84314F15C62DE4A89B391D7794C45CB8A

Function 0040ABB9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 004099C0: _ZNK9QIODevice6isOpenEv.QT5CORE ref: 004099D6

_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040AC3C
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 0040ACA0

Strings

G92Z0, xrefs: 0040ABEF

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: ArrayData10deallocateS_jj$Device6isOpen
String ID: G92Z0
API String ID: 1265076484-3769659619
Opcode ID: 02b4a77bf2184e0d9b27ed9c5008f51823082e6235a4535d6294883d4826cb7f
Instruction ID: d7a0ee9ab56022bcd7970e8a7b5c5f21cfb67b0e16cbe657b736594e734568b1
Opcode Fuzzy Hash: 02b4a77bf2184e0d9b27ed9c5008f51823082e6235a4535d6294883d4826cb7f
Instruction Fuzzy Hash: FC2119B1A043159FC700AF69C44829EBBF5FF84714F11892DE498AB391D7795845CB8A

Function 004527C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 004527F7
_errno.MSVCRT ref: 00452844

Strings

cos, xrefs: 0045280C, 00452861

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: _errno
String ID: cos
API String ID: 2918714741-2662988677
Opcode ID: 4148a63806ed11938131784bf744e636b09443dcaccd543c934d5d1c129a5721
Instruction ID: b478ac35fe82ba750bc63965cfb0353f0d1bca69d4b5ea1dce8d80e73fd8c022
Opcode Fuzzy Hash: 4148a63806ed11938131784bf744e636b09443dcaccd543c934d5d1c129a5721
Instruction Fuzzy Hash: 3C0139B000CB0296D7006F44D44821EBEE0FF89389F850D8EF4D8112A6CBB985A8D74B

Function 00452880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 004528B7
_errno.MSVCRT ref: 00452904

Strings

sin, xrefs: 004528CC, 00452921

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: _errno
String ID: sin
API String ID: 2918714741-3083047850
Opcode ID: 52ff61fd0afb25780d488ecb3a4076fee5aac178c245f7c980ae94dc0a32ff63
Instruction ID: 8cb0d210b76f9f34a7e7cce58a99414437a7ac39e64946faee174159917a9874
Opcode Fuzzy Hash: 52ff61fd0afb25780d488ecb3a4076fee5aac178c245f7c980ae94dc0a32ff63
Instruction Fuzzy Hash: 92011BB400CB02D6D7016F44D54822EBEE0FF85399F855D9EF4D4112A6CBBA85B8D70B

Function 00402E42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00402E8E
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402EC4
_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00402F57
_ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE.QT5CORE ref: 00402F8B
_ZN10QArrayData10deallocateEPS_jj.QT5CORE ref: 00402FBF

Strings

.txt, xrefs: 00402E69

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: CaseQt15SensitivityString8endsWith$ArrayData10deallocateS_jj
String ID: .txt
API String ID: 2043502143-2195685702
Opcode ID: 2f2be091450d89a3572e74e8d81cfbc970a3bc7d15998867d1f1af34e136fe34
Instruction ID: 7009e8a656b1b3d4c99d215f1ec36cc1ec66bf3269b75c09327244ced650d610
Opcode Fuzzy Hash: 2f2be091450d89a3572e74e8d81cfbc970a3bc7d15998867d1f1af34e136fe34
Instruction Fuzzy Hash: 78015EB1A043059BDB00DF68D84879AFBF4FB88354F04853AE984A7350D7B5A809CF95

Function 00451A20 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00451A47
free.MSVCRT ref: 00451A91
LeaveCriticalSection.KERNEL32 ref: 00451A9D

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: bc70994fe394371387e119612b96c93e50a184592f1493c4f2722e82367b61a8
Instruction ID: 63ccdfce74584dce1a3070e2b35c36b6188cae2d3c1a687bd65facda3fba4758
Opcode Fuzzy Hash: bc70994fe394371387e119612b96c93e50a184592f1493c4f2722e82367b61a8
Instruction Fuzzy Hash: 2E011E707012018F8701EF68E58561ABBE0BB6A305B54467ADC4AC7322E778DC89DB5A

Function 00451910 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00451920
TlsGetValue.KERNEL32 ref: 00451945
GetLastError.KERNEL32 ref: 00451950
LeaveCriticalSection.KERNEL32 ref: 00451970

Memory Dump Source

Source File: 00000003.00000002.2965539817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2965495481.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965607377.000000000047E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965646070.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965698040.00000000004B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965733110.00000000004B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004B2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2965766953.00000000004BE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_test.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 007d0d7a4af39be9c944f9360ab6402fadb39fcc0f32c3f1dfc5419ad1f0ccf1
Instruction ID: 06f1cc86c72ee35421070a0badc03c878f23b4df5f4cf662c1556ec397f36f5e
Opcode Fuzzy Hash: 007d0d7a4af39be9c944f9360ab6402fadb39fcc0f32c3f1dfc5419ad1f0ccf1
Instruction Fuzzy Hash: 74F081B65006008BC700BFB9A95865BBBB4FB95351F05063ADC9993321E774E81DCBAA

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report test.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\5F25.tmp

C:\Users\user\AppData\Local\Temp\@AE2AF6.tmp.exe

C:\Users\user\AppData\Local\Temp\Se3578.tmp

C:\Users\user\AppData\Local\Temp\Sp3577.tmp

C:\Users\user\AppData\Local\Temp\tmp2F3C.tmp

C:\Users\user\AppData\Local\Temp\tmp3588.tmp

C:\Users\user\AppData\Local\Temp\tmp3A29.tmp

C:\Users\user\AppData\Local\Temp\tmp3AB6.tmp

C:\Users\user\AppData\Local\Temp\tmp3B63.tmp

C:\Users\user\AppData\Local\Temp\tmp3D0A.tmp

C:\Users\user\AppData\Local\Temp\tmp3D4A.tmp

C:\Users\user\AppData\Local\Temp\tmp3D99.tmp

C:\Users\user\AppData\Local\Temp\tmp3DE8.tmp

C:\Users\user\AppData\Local\Temp\tmp3E56.tmp

C:\Users\user\AppData\Local\Temp\wtmps.exe

C:\Users\user\AppData\Roaming\Microsoft\Caches\Files\usd.dll

C:\Users\user\AppData\Roaming\Microsoft\Common\Shared\dis.dll

C:\Users\user\AppData\Roaming\Microsoft\Defender\launch.exe

C:\Users\user\AppData\Roaming\Microsoft\Identities\user\arc.dll

C:\Users\user\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

C:\Users\user\AppData\Roaming\Microsoft\Repairs\sha.dll

Windows Analysis Report
test.exe