Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FsJfRO0W9w.exe

Overview

General Information

Sample name:FsJfRO0W9w.exe
renamed because original name is a hash value
Original sample name:c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97.exe
Analysis ID:1530950
MD5:efc41a0887fd65246cda9323035f9746
SHA1:a0280ffadcf844386f7cc656e5f46fb5941e0eae
SHA256:c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97
Tags:185-235-241-208exeuser-JAMESWT_MHT

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected potential crypto function
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • FsJfRO0W9w.exe (PID: 2716 cmdline: "C:\Users\user\Desktop\FsJfRO0W9w.exe" MD5: EFC41A0887FD65246CDA9323035F9746)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: FsJfRO0W9w.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: FsJfRO0W9w.exeReversingLabs: Detection: 55%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 87.4% probability
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C2343C0 ?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?copy@QFile@@SA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??0QString@@QEAA@PEBD@Z,?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z,??1QString@@QEAA@XZ,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QSqlDatabase@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlDatabase@@QEAA@XZ,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z,??0QString@@QEAA@PEBD@Z,?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z,??1QString@@QEAA@XZ,?exec@QSqlQuery@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlQuery@@QEAA@XZ,?next@QSqlQuery@@QEAA_NXZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ,??1QVariant@@QEAA@XZ,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?left@QByteArray@@QEHAA?AV1@_J@Z,??1QByteArray@@QEAA@XZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?length@QByteArray@@QEBA_JXZ,EVP_DecryptInit_ex,?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QFile@@QEAA@AEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,??0QChar@@QEAA@D@Z,?size@QByteArray@@QEBA_JXZ,?isNull@QByteArray@@QEBA_NXZ,?data@QByteArray@@QEBAPEBDXZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QStrin0_2_00007FF73C2343C0
Source: FsJfRO0W9w.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: FsJfRO0W9w.exeString found in binary or memory: http://185.235.241.208:1224
Source: FsJfRO0W9w.exeString found in binary or memory: https://hello.freeconference.com/login/access-code
Source: FsJfRO0W9w.exeString found in binary or memory: https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:1
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C234DF00_2_00007FF73C234DF0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C232AD00_2_00007FF73C232AD0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C2333600_2_00007FF73C233360
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C2343C00_2_00007FF73C2343C0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C2364200_2_00007FF73C236420
Source: FsJfRO0W9w.exeBinary or memory string: OriginalFilename vs FsJfRO0W9w.exe
Source: FsJfRO0W9w.exe, 00000000.00000000.2047422005.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameFCCCall.exe0 vs FsJfRO0W9w.exe
Source: FsJfRO0W9w.exeBinary or memory string: OriginalFilenameFCCCall.exe0 vs FsJfRO0W9w.exe
Source: classification engineClassification label: mal60.winEXE@1/0@0/0
Source: FsJfRO0W9w.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: FsJfRO0W9w.exeReversingLabs: Detection: 55%
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: libcrypto-1_1-x64.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: qt6webenginewidgets.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: qt6widgets.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: qt6webenginecore.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: qt6gui.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: qt6sql.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: qt6network.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: qt6core.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeSection loaded: vcruntime140.dllJump to behavior
Source: FsJfRO0W9w.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: FsJfRO0W9w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FsJfRO0W9w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FsJfRO0W9w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FsJfRO0W9w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FsJfRO0W9w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FsJfRO0W9w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: FsJfRO0W9w.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: FsJfRO0W9w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FsJfRO0W9w.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FsJfRO0W9w.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FsJfRO0W9w.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FsJfRO0W9w.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FsJfRO0W9w.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C239014 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73C239014
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C2391F8 SetUnhandledExceptionFilter,0_2_00007FF73C2391F8
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C238BB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF73C238BB0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C239014 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73C239014
Source: C:\Users\user\Desktop\FsJfRO0W9w.exeCode function: 0_2_00007FF73C239264 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF73C239264

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
DLL Side-Loading		1
DLL Side-Loading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager2
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
FsJfRO0W9w.exe55%ReversingLabsWin64.Trojan.Generic
FsJfRO0W9w.exe100%AviraOSX/GM.Agent.RV

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:1FsJfRO0W9w.exefalse
    		unknown
    http://185.235.241.208:1224FsJfRO0W9w.exefalse
      		unknown
      https://hello.freeconference.com/login/access-codeFsJfRO0W9w.exefalse
        		unknown

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1530950
        Start date and time:2024-10-10 18:12:06 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 3m 47s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:5
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:FsJfRO0W9w.exe
        renamed because original name is a hash value
        Original Sample Name:c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97.exe
        Detection:MAL
        Classification:mal60.winEXE@1/0@0/0
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 28
        Cookbook Comments:
        • Found application associated with file extension: .exe

        Warnings

        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
        • Execution Graph export aborted for target FsJfRO0W9w.exe, PID 2716 because there are no executed function
        • VT rate limit hit for: FsJfRO0W9w.exe

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:PE32+ executable (GUI) x86-64, for MS Windows
        Entropy (8bit):5.972938673374698
        TrID:
        • Win64 Executable GUI (202006/5) 92.65%
        • Win64 Executable (generic) (12005/4) 5.51%
        • Generic Win/DOS Executable (2004/3) 0.92%
        • DOS Executable Generic (2002/1) 0.92%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:FsJfRO0W9w.exe
        File size:233'472 bytes
        MD5:efc41a0887fd65246cda9323035f9746
        SHA1:a0280ffadcf844386f7cc656e5f46fb5941e0eae
        SHA256:c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97
        SHA512:6f14c54651ee2090c7808b493cd3f11d416586ee68d4cdcaf1b41b6660de00fb8474eff450546b79483f2b83303f139734d5f694ff680ee29b1b9d5b407e0de5
        SSDEEP:3072:fX1NTIuWGLmP2lo2rzeqZ0kLn3uESuoeKlRjdP9VCgs83:fF9IXGiP27LZ023F9K3j1b3
        TLSH:F2347C5E221702E1E169C63FC68D0642D37EBC168722DBEF0635791E1EF66E03E39589
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..Ha...a...a...h.X.k....#..b....#..k....#.......#..g.......`.......o.......c.......f...a.......r$..g...r$4.`...a.\.`...r$..`..

        File Icon

        Icon Hash:21c46db2b26dc421

        Static PE Info

        General

        Entrypoint:0x1400089fc
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x140000000
        Subsystem:windows gui
        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Time Stamp:0x66BF6272 [Fri Aug 16 14:30:10 2024 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:6
        OS Version Minor:0
        File Version Major:6
        File Version Minor:0
        Subsystem Version Major:6
        Subsystem Version Minor:0
        Import Hash:07121cf6a276278656c13634a45aa49a

        Entrypoint Preview

        Instruction
        dec eax
        sub esp, 28h
        call 00007F9184B16784h
        dec eax
        add esp, 28h
        jmp 00007F9184B15D9Fh
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000DE05h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007F9184B16912h
        dec eax
        lea eax, dword ptr [0000DE18h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000DE10h]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000DDF5h]
        dec eax
        mov dword ptr [ecx], eax
        dec eax
        mov eax, ecx
        ret
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000DDA9h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007F9184B168B6h
        dec eax
        lea eax, dword ptr [0000DDE4h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000DDDCh]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000DDC1h]
        dec eax
        mov dword ptr [ecx], eax
        dec eax

        Rich Headers

        Programming Language:
        • [IMP] VS2008 SP1 build 30729

        Data Directories

        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x18a740x17c.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x200000x1c2c8.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1f0000x588.pdata
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x3d0000x234.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x16a000x1c.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x16a800x28.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x168c00x140.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0xb0000xbd0.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x942f0x9600c978d53408082238ad2d209a5beed497False0.45653645833333334data6.02876169434905IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0xb0000x121740x122002b5ab093c3dc51720bb702e204449b9dFalse0.7159617456896552data7.152060419319483IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x1e0000xb800x6009be355ceb064cc79c4ad8a0f77916fb7False0.2532552083333333data2.7724314177577956IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .pdata0x1f0000x5880x6001979342e3ded08c0c3a3bde21982af47False0.4889322916666667data4.339129544270548IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .rsrc0x200000x1c2c80x1c400c5efc6b843dd32bd88c09b3bd6986a2dFalse0.20460280696902655data3.977293660955606IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .reloc0x3d0000x2340x400c28475ee2467d69c448a8ecbea9ac1d3False0.4248046875data3.699174737310689IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

        Resources

        NameRVASizeTypeLanguageCountryZLIB Complexity
        RT_ICON0x202400x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/mEnglishUnited States0.36879432624113473
        RT_ICON0x206a80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/mEnglishUnited States0.19606003752345216
        RT_ICON0x217500x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/mEnglishUnited States0.14066390041493776
        RT_ICON0x23cf80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/mEnglishUnited States0.108171941426547
        RT_ICON0x27f200x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mEnglishUnited States0.06342422808470366
        RT_ICON0x387480x3619PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9919849808650444
        RT_GROUP_ICON0x3bd680x5adataEnglishUnited States0.7444444444444445
        RT_VERSION0x3bdc80x27cdataEnglishUnited States0.470125786163522
        RT_MANIFEST0x3c0480x27eXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5501567398119123

        Imports

        DLLImport
        CRYPT32.dllCryptUnprotectData
        libcrypto-1_1-x64.dllEVP_CIPHER_CTX_free, EVP_CIPHER_CTX_new, EVP_DecryptUpdate, EVP_DecryptInit_ex, EVP_aes_256_gcm
        Qt6WebEngineWidgets.dll?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z, ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z, ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z, ??1QWebEngineView@@UEAA@XZ
        Qt6Widgets.dll?paintEvent@QMenu@@MEAAXPEAVQPaintEvent@@@Z, ?hideEvent@QMenu@@MEAAXPEAVQHideEvent@@@Z, ?leaveEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?enterEvent@QMenu@@MEAAXPEAVQEnterEvent@@@Z, ?wheelEvent@QMenu@@MEAAXPEAVQWheelEvent@@@Z, ?mouseMoveEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mousePressEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mouseReleaseEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?keyPressEvent@QMenu@@MEAAXPEAVQKeyEvent@@@Z, ?changeEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?sizeHint@QMenu@@UEBA?AVQSize@@XZ, ?qt_metacall@QMenu@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QMenu@@UEAAPEAXPEBD@Z, ?metaObject@QMenu@@UEBAPEBUQMetaObject@@XZ, ?inputMethodQuery@QWidget@@UEBA?AVQVariant@@W4InputMethodQuery@Qt@@@Z, ?inputMethodEvent@QWidget@@MEAAXPEAVQInputMethodEvent@@@Z, ?sharedPainter@QWidget@@MEBAPEAVQPainter@@XZ, ?redirected@QWidget@@MEBAPEAVQPaintDevice@@PEAVQPoint@@@Z, ?initPainter@QWidget@@MEBAXPEAVQPainter@@@Z, ?metric@QWidget@@MEBAHW4PaintDeviceMetric@QPaintDevice@@@Z, ?nativeEvent@QWidget@@MEAA_NAEBVQByteArray@@PEAXPEA_J@Z, ?showEvent@QWidget@@MEAAXPEAVQShowEvent@@@Z, ?dropEvent@QWidget@@MEAAXPEAVQDropEvent@@@Z, ?dragLeaveEvent@QWidget@@MEAAXPEAVQDragLeaveEvent@@@Z, ?dragMoveEvent@QWidget@@MEAAXPEAVQDragMoveEvent@@@Z, ?dragEnterEvent@QWidget@@MEAAXPEAVQDragEnterEvent@@@Z, ?tabletEvent@QWidget@@MEAAXPEAVQTabletEvent@@@Z, ?actionEvent@QMenu@@MEAAXPEAVQActionEvent@@@Z, ?closeEvent@QWidget@@MEAAXPEAVQCloseEvent@@@Z, ?resizeEvent@QWidget@@MEAAXPEAVQResizeEvent@@@Z, ?moveEvent@QWidget@@MEAAXPEAVQMoveEvent@@@Z, ?focusOutEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?focusInEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?keyReleaseEvent@QWidget@@MEAAXPEAVQKeyEvent@@@Z, ?mouseDoubleClickEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z, ?paintEngine@QWidget@@UEBAPEAVQPaintEngine@@XZ, ?event@QMenu@@MEAA_NPEAVQEvent@@@Z, ?hasHeightForWidth@QWidget@@UEBA_NXZ, ?heightForWidth@QWidget@@UEBAHH@Z, ?minimumSizeHint@QWidget@@UEBA?AVQSize@@XZ, ?setVisible@QWidget@@UEAAX_N@Z, ?devType@QWidget@@UEBAHXZ, ?setVisible@QSystemTrayIcon@@QEAAX_N@Z, ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z, ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z, ??1QSystemTrayIcon@@UEAA@XZ, ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z, ??1QMenu@@UEAA@XZ, ??0QMenu@@QEAA@PEAVQWidget@@@Z, ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z, ?resize@QWidget@@QEAAXHH@Z, ?hide@QWidget@@QEAAXXZ, ?show@QWidget@@QEAAXXZ, ?exec@QApplication@@SAHXZ, ??1QApplication@@UEAA@XZ, ??0QApplication@@QEAA@AEAHPEAPEADH@Z, ?contextMenuEvent@QWidget@@MEAAXPEAVQContextMenuEvent@@@Z, ?focusNextPrevChild@QMenu@@MEAA_N_N@Z, ?initStyleOption@QMenu@@MEBAXPEAVQStyleOptionMenuItem@@PEBVQAction@@@Z, ?timerEvent@QMenu@@MEAAXPEAVQTimerEvent@@@Z
        Qt6WebEngineCore.dll?qt_metacast@QWebEnginePage@@UEAAPEAXPEBD@Z, ?qt_metacall@QWebEnginePage@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?createWindow@QWebEnginePage@@MEAAPEAV1@W4WebWindowType@1@@Z, ?acceptNavigationRequest@QWebEnginePage@@MEAA_NAEBVQUrl@@W4NavigationType@1@_N@Z, ?javaScriptConsoleMessage@QWebEnginePage@@MEAAXW4JavaScriptConsoleMessageLevel@1@AEBVQString@@H1@Z, ?javaScriptPrompt@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@1PEAV3@@Z, ?javaScriptConfirm@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@@Z, ?javaScriptAlert@QWebEnginePage@@MEAAXAEBVQUrl@@AEBVQString@@@Z, ?chooseFiles@QWebEnginePage@@MEAA?AV?$QList@VQString@@@@W4FileSelectionMode@1@AEBV2@1@Z, ?staticMetaObject@QWebEnginePage@@2UQMetaObject@@B, ?event@QWebEnginePage@@UEAA_NPEAVQEvent@@@Z, ?triggerAction@QWebEnginePage@@UEAAXW4WebAction@1@_N@Z, ?featurePermissionRequested@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@@Z, ?setFeaturePermission@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@W4PermissionPolicy@1@@Z, ??1QWebEnginePage@@UEAA@XZ, ??0QWebEnginePage@@QEAA@PEAVQObject@@@Z
        Qt6Gui.dll?triggered@QAction@@QEAAX_N@Z, ??1QIcon@@QEAA@XZ, ??0QIcon@@QEAA@AEBVQString@@@Z, ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z, ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z, ?staticMetaObject@QAction@@2UQMetaObject@@B
        Qt6Sql.dll?removeDatabase@QSqlDatabase@@SAXAEBVQString@@@Z, ?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z, ?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ, ?open@QSqlDatabase@@QEAA_NXZ, ??1QSqlDatabase@@QEAA@XZ, ?text@QSqlError@@QEBA?AVQString@@XZ, ??1QSqlError@@QEAA@XZ, ??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z, ??1QSqlQuery@@QEAA@XZ, ?value@QSqlQuery@@QEBA?AVQVariant@@H@Z, ?next@QSqlQuery@@QEAA_NXZ, ?exec@QSqlQuery@@QEAA_NXZ, ?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z, ?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z
        Qt6Network.dll?get@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@@Z, ?localHostName@QHostInfo@@SA?AVQString@@XZ, ?setBoundary@QHttpMultiPart@@QEAAXAEBVQByteArray@@@Z, ?setContentType@QHttpMultiPart@@QEAAXW4ContentType@1@@Z, ?append@QHttpMultiPart@@QEAAXAEBVQHttpPart@@@Z, ??1QHttpMultiPart@@UEAA@XZ, ??0QHttpMultiPart@@QEAA@W4ContentType@0@PEAVQObject@@@Z, ?setBodyDevice@QHttpPart@@QEAAXPEAVQIODevice@@@Z, ?post@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@PEAVQHttpMultiPart@@@Z, ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z, ??1QHttpPart@@QEAA@XZ, ??0QHttpPart@@QEAA@XZ, ?setRawHeader@QNetworkRequest@@QEAAXAEBVQByteArray@@0@Z, ?setUrl@QNetworkRequest@@QEAAXAEBVQUrl@@@Z, ??1QNetworkAccessManager@@UEAA@XZ, ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z, ??1QNetworkRequest@@QEAA@XZ, ??0QNetworkRequest@@QEAA@XZ, ?error@QNetworkReply@@QEBA?AW4NetworkError@1@XZ, ?finished@QNetworkReply@@QEAAXXZ, ?metaObject@QHttpMultiPart@@UEBAPEBUQMetaObject@@XZ, ?qt_metacast@QHttpMultiPart@@UEAAPEAXPEBD@Z, ?qt_metacall@QHttpMultiPart@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?staticMetaObject@QNetworkReply@@2UQMetaObject@@B, ?setBody@QHttpPart@@QEAAXAEBVQByteArray@@@Z
        Qt6Core.dll??6@YA?AVQDebug@@V0@AEBVQUrl@@@Z, ??5@YAAEAVQDataStream@@AEAV0@AEAVQUrl@@@Z, ??6@YAAEAVQDataStream@@AEAV0@AEBVQUrl@@@Z, ??8QUrl@@QEBA_NAEBV0@@Z, ??MQUrl@@QEBA_NAEBV0@@Z, ??0QUrl@@QEAA@$$QEAV0@@Z, ??0QUrl@@QEAA@AEBV0@@Z, ??0QUrl@@QEAA@XZ, ?qt_metacall@QThread@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QThread@@UEAAPEAXPEBD@Z, ?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ, ??0QMetaType@@QEAA@XZ, ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX@Z, ?staticMetaObject@QThread@@2UQMetaObject@@B, ?qResourceFeatureZlib@@YAEXZ, ?qUnregisterResourceData@@YA_NHPEBE00@Z, ?qRegisterResourceData@@YA_NHPEBE00@Z, ?id@QMetaType@@QEBAHH@Z, ?registerNormalizedTypedef@QMetaType@@SAXAEBVQByteArray@@V1@@Z, ??6QDataStream@@QEAAAEAV0@H@Z, ??5QDataStream@@QEAAAEAV0@AEAH@Z, ?append@QByteArray@@QEAAAEAV1@PEBD@Z, ?reserve@QByteArray@@QEAAX_J@Z, ?className@QMetaObject@@QEBAPEBDXZ, ?event@QObject@@UEAA_NPEAVQEvent@@@Z, ?setPermissions@QFile@@UEAA_NV?$QFlags@W4Permission@QFileDevice@@@@@Z, ?permissions@QFile@@UEBA?AV?$QFlags@W4Permission@QFileDevice@@@@XZ, ?resize@QFile@@UEAA_N_J@Z, ?size@QFile@@UEBA_JXZ, ?fileName@QFile@@UEBA?AVQString@@XZ, ?qt_metacall@QFile@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QFile@@UEAAPEAXPEBD@Z, ?metaObject@QFile@@UEBAPEBUQMetaObject@@XZ, ?readLineData@QFileDevice@@MEAA_JPEAD_J@Z, ?writeData@QFileDevice@@MEAA_JPEBD_J@Z, ?readData@QFileDevice@@MEAA_JPEAD_J@Z, ?atEnd@QFileDevice@@UEBA_NXZ, ?seek@QFileDevice@@UEAA_N_J@Z, ?pos@QFileDevice@@UEBA_JXZ, ?isSequential@QFileDevice@@UEBA_NXZ, ?skipData@QIODevice@@MEAA_J_J@Z, ?readLineData@QIODevice@@MEAA_JPEAD_J@Z, ?waitForBytesWritten@QIODevice@@UEAA_NH@Z, ?waitForReadyRead@QIODevice@@UEAA_NH@Z, ?canReadLine@QIODevice@@UEBA_NXZ, ?bytesToWrite@QIODevice@@UEBA_JXZ, ?bytesAvailable@QIODevice@@UEBA_JXZ, ?reset@QIODevice@@UEAA_NXZ, ?atEnd@QIODevice@@UEBA_NXZ, ?seek@QIODevice@@UEAA_N_J@Z, ?size@QIODevice@@UEBA_JXZ, ?pos@QIODevice@@UEBA_JXZ, ?setupChildProcess@QProcess@@EEAA?AUUse_setChildProcessModifier_Instead@1@XZ, ?writeData@QProcess@@MEAA_JPEBD_J@Z, ?readData@QProcess@@MEAA_JPEAD_J@Z, ?close@QProcess@@UEAAXXZ, ?isSequential@QProcess@@UEBA_NXZ, ?bytesToWrite@QProcess@@UEBA_JXZ, ?waitForBytesWritten@QProcess@@UEAA_NH@Z, ?waitForReadyRead@QProcess@@UEAA_NH@Z, ?open@QProcess@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?qt_metacall@QProcess@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QProcess@@UEAAPEAXPEBD@Z, ?metaObject@QProcess@@UEBAPEBUQMetaObject@@XZ, ??AQJsonDocument@@QEBA?BVQJsonValue@@AEBVQString@@@Z, ?fromJson@QJsonDocument@@SA?AV1@AEBVQByteArray@@PEAUQJsonParseError@@@Z, ??4QJsonDocument@@QEAAAEAV0@$$QEAV0@@Z, ??1QJsonDocument@@QEAA@XZ, ??0QJsonDocument@@QEAA@XZ, ??0QJsonParseError@@QEAA@XZ, ??AQJsonValue@@QEBA?BV0@AEBVQString@@@Z, ?toVariant@QJsonValue@@QEBA?AVQVariant@@XZ, ??1QJsonValue@@QEAA@XZ, ?currentType@QOperatingSystemVersion@@SA?AW4OSType@1@XZ, ?waitForFinished@QProcess@@QEAA_NH@Z, ?start@QProcess@@QEAAXAEBVQString@@AEBV?$QList@VQString@@@@V?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ??1QProcess@@UEAA@XZ, ??0QProcess@@QEAA@PEAVQObject@@@Z, ?homePath@QDir@@SA?AVQString@@XZ, ?exists@QDir@@QEBA_NXZ, ?removeRecursively@QDir@@QEAA_NXZ, ?mkdir@QDir@@QEBA_NAEBVQString@@@Z, ?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z, ??1QDir@@QEAA@XZ, ??0QDir@@QEAA@AEBVQString@@@Z, ?fileName@QFileInfo@@QEBA?AVQString@@XZ, ?filePath@QFileInfo@@QEBA?AVQString@@XZ, ??1QFileInfo@@QEAA@XZ, ??0QFileInfo@@QEAA@AEBV0@@Z, ?currentMSecsSinceEpoch@QDateTime@@SA_JXZ, ?toString@QVariant@@QEBA?AVQString@@XZ, ?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ, ??0QVariant@@QEAA@PEBD@Z, ??0QVariant@@QEAA@AEBVQString@@@Z, ??1QVariant@@QEAA@XZ, ?qt_QMetaEnum_debugOperator@@YA?AVQDebug@@AEAV1@_JPEBUQMetaObject@@PEBD@Z, ??6QDebug@@QEAAAEAV0@AEBVQByteArray@@@Z, ??6QDebug@@QEAAAEAV0@PEBD@Z, ??1QDebug@@QEAA@XZ, ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?copy@QFile@@SA_NAEBVQString@@0@Z, ?remove@QFile@@SA_NAEBVQString@@@Z, ?exists@QFile@@QEBA_NXZ, ??1QFile@@UEAA@XZ, ??0QFile@@QEAA@AEBVQString@@@Z, ?close@QFileDevice@@UEAAXXZ, ?write@QIODevice@@QEAA_JAEBVQByteArray@@@Z, ?allocate@QArrayData@@SAPEAXPEAPEAU1@_J11W4AllocationOption@1@@Z, ??0QString@@QEAA@AEBV0@@Z, ??1QString@@QEAA@XZ, ??0QString@@QEAA@PEBD@Z, ??1Connection@QMetaObject@@QEAA@XZ, ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z, ?exit@QCoreApplication@@SAXH@Z, ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z, ??1QUrl@@QEAA@XZ, ??0QThread@@QEAA@PEAVQObject@@@Z, ??1QThread@@UEAA@XZ, ?start@QThread@@QEAAXW4Priority@1@@Z, ?event@QThread@@UEAA_NPEAVQEvent@@@Z, ?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z, ?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z, ?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z, ?customEvent@QObject@@MEAAXPEAVQEvent@@@Z, ?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?qBadAlloc@@YAXXZ, ??0QMessageLogger@@QEAA@PEBDH0@Z, ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ, ??0QChar@@QEAA@_S@Z, ??0QChar@@QEAA@D@Z, ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z, ?castHelper@QByteArrayView@@CAPEBDPEBD@Z, ?size@QByteArrayView@@QEBA_JXZ, ?data@QByteArrayView@@QEBAPEBDXZ, ??0QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@PEBD_J@Z, ??0QByteArray@@QEAA@AEBV0@@Z, ??1QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@$$QEAV0@@Z, ??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z, ?data@QByteArray@@QEAAPEADXZ, ?data@QByteArray@@QEBAPEBDXZ, ?left@QByteArray@@QEHAA?AV1@_J@Z, ?right@QByteArray@@QEGBA?AV1@_J@Z, ?append@QByteArray@@QEAAAEAV1@AEBV1@@Z, ??YQByteArray@@QEAAAEAV0@PEBD@Z, ?setNum@QByteArray@@QEAAAEAV1@_KH@Z, ?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z, ?fromBase64@QByteArray@@SA?AV1@AEBV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z, ?size@QByteArray@@QEBA_JXZ, ?length@QByteArray@@QEBA_JXZ, ?isNull@QByteArray@@QEBA_NXZ, ??0QString@@QEAA@$$QEAV0@@Z, ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z, ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z, ?indexOf@QString@@QEBA_JAEBV1@_JW4CaseSensitivity@Qt@@@Z, ?append@QString@@QEAAAEAV1@VQChar@@@Z, ?append@QString@@QEAAAEAV1@AEBV1@@Z, ?append@QString@@QEAAAEAV1@V?$QBasicUtf8StringView@$0A@@@@Z, ?split@QString@@QEBA?AV?$QList@VQString@@@@AEBV1@V?$QFlags@W4SplitBehaviorFlags@Qt@@@@W4CaseSensitivity@Qt@@@Z, ?toUtf8@QString@@QEHAA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEGBA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ, ?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z, ?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z, ?toInt@QString@@QEBAHPEA_NH@Z, ??YQString@@QEAAAEAV0@PEBD@Z, ??8QString@@QEBA_NPEBD@Z, ?QStringList_join@QtPrivate@@YA?AVQString@@PEBV?$QList@VQString@@@@PEBVQChar@@_J@Z, ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ
        KERNEL32.dllWideCharToMultiByte, LocalFree, GetCommandLineW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleW, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext
        VCRUNTIME140_1.dll__CxxFrameHandler4
        VCRUNTIME140.dll_CxxThrowException, memcpy, memcmp, memmove, __std_terminate, memset, __current_exception, __current_exception_context, __C_specific_handler, __std_exception_copy, __std_exception_destroy
        api-ms-win-crt-heap-l1-1-0.dll_set_new_mode, free, _callnewh, malloc
        api-ms-win-crt-runtime-l1-1-0.dll_register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _initialize_onexit_table, _get_narrow_winmain_command_line, _initterm, _initterm_e, exit, _exit, _initialize_narrow_environment, _c_exit, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, __p___argc, terminate, __p___argv
        api-ms-win-crt-math-l1-1-0.dll__setusermatherr
        api-ms-win-crt-stdio-l1-1-0.dll_set_fmode, __p__commode
        api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
        SHELL32.dllCommandLineToArgvW

        Possible Origin

        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States

        Network Behavior

        ⊘No network behavior found

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:12:12:57
        Start date:10/10/2024
        Path:C:\Users\user\Desktop\FsJfRO0W9w.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\FsJfRO0W9w.exe"
        Imagebase:0x7ff73c230000
        File size:233'472 bytes
        MD5 hash:EFC41A0887FD65246CDA9323035F9746
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Disassembly

        Reset < >

          Non-executed Functions

          Function 00007FF73C233360 Relevance: 305.5, APIs: 158, Strings: 16, Instructions: 978windowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$V0@@$A@$$$Char@@Char@@@$Dir@@$Byte$?arg@$?append@$Debug@@Path@$ArrayFileFlags@V1@@View@@$List@String@@@$?homeArray@@File@@Logger@@Message$?file?size@Info@@$Database@@$?data@?debug@?entryDir@@@@Dir@@@@@Filter@Flag@InfoInfo@@@@Name@SortString@@0@$?cast?copy@?exists@CaseDatabase@Helper@Qt@@@Sensitivity@$?add?index?open@?remove?remove@?set?split@A@@@@Array@@@BasicBehaviorDatabaseInt@Null@Qt@@@@SplitStringString@@@@Utf8V1@_View@$0memcmp
          • String ID: %1_%2$%1_%2_%3$%1_%2_%3_%4$%1_%2_%3_%4_%5$/.n3/pwd$/Library/Keychains/login.keychain-db$/Local Extension Settings/$/Local State$/Login Data$Default$Profile $key$logkc_db$lst$pld$pwd
          • API String ID: 924144151-3707578411
          • Opcode ID: 5498a414714c4881230e5a4efb085abad9f2768ac97c26d52f0d4b3c198da0e9
          • Instruction ID: e311d3c4406b42c5d748c4aafd942ec2bd4ca15d7312e524ab5fc2031acbab95
          • Opcode Fuzzy Hash: 5498a414714c4881230e5a4efb085abad9f2768ac97c26d52f0d4b3c198da0e9
          • Instruction Fuzzy Hash: E8A28F32B14A46A6EB50EF20E8546EDB7A0FB85B49FC05031EA0E57B68DF3DD549D320
          Function 00007FF73C2343C0 Relevance: 231.6, APIs: 122, Strings: 10, Instructions: 571windowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$Debug@@$Logger@@Message$Database@@Error@@$?debug@Query@@$?home?last?text@A@$$Dir@@Error@Path@String@@0@String@@@V0@@$?add?copy@?exec@?open@?prepare@?setArray@@ByteDatabaseDatabase@Database@@@File@@Name@
          • String ID: %s.$/.n3/pwd$/Login Data$Error occurred opening the database.$Error occurred querying.$QSQLITE$origin_url: $password: $select username_value, password_value, origin_url from logins order by date_created$username:
          • API String ID: 3116649450-3610353273
          • Opcode ID: 0a32ce738b4f668c77064df6140b91884c9552fac7f2bde5f8f9eecd3059d7ac
          • Instruction ID: 4340183a71a21c124026a85289adb78c8f2a89d4a638eec98fabc38aff0faaef
          • Opcode Fuzzy Hash: 0a32ce738b4f668c77064df6140b91884c9552fac7f2bde5f8f9eecd3059d7ac
          • Instruction Fuzzy Hash: 55525232A18A46A6EB10EF64E8542EDB3B0FB85745F805031EA4E87778EF3DD549D720
          Function 00007FF73C232AD0 Relevance: 150.9, APIs: 77, Strings: 9, Instructions: 363networktimeCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: Http$Byte$Part@@$Array@@$?setVariant@@$Header@Headers@KnownNetworkRequest@@String@@Variant@@@$Multi$?append@$Array@@@$Body@Part@@@$ContentV0@@$HostString@@@V1@@$?arg@?current?localA@$$Bit@BodyBoundary@Char@@Char@@@DateDevice@Device@@@Epoch@File@@Info@@Local8Name@Num@Object@@@SecsSinceTime@@Type@Type@0@Type@1@@Utf8@V1@_malloc
          • String ID: ---------------------------99614912995$Call_$application/json$application/octet-stream$form-data; name="hid";$form-data; name="multi_file"; filename="%1"$form-data; name="type";$form-data; name="uts";${"options":{"filename":"
          • API String ID: 1558666637-725218759
          • Opcode ID: fc58217c4ad2aeeea1c801826940d0b0e9ef839485294e1b85286edc4f71ac17
          • Instruction ID: f41bde952dbcaea4dfd7068de11a5c7b9d8e7959f8a770e976bff1ec330e1527
          • Opcode Fuzzy Hash: fc58217c4ad2aeeea1c801826940d0b0e9ef839485294e1b85286edc4f71ac17
          • Instruction Fuzzy Hash: 88F10F22B08A46BAEB00EF60E8541ADB3B1FB85759BC15132EA0E977A4DF3DD50DD350
          Function 00007FF73C234DF0 Relevance: 133.8, APIs: 70, Strings: 6, Instructions: 784windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$?homeDir@@Path@Process@@memmove$Base@@@@@ByteDebug@@DeviceDevice@@File@@Flag@Flags@ModeOpen$?start@Array@@List@Logger@@MessageNetworkObject@@@String@@@@free$?close@?debug@?error@?open@?read?wait?write@All@Array@@@Error@1@FileFinished@Reply@@String@@@
          • String ID: --directory$-xf$/.pyp/python.exe$/99$Download Python Success!$tar
          • API String ID: 1279688832-1090138706
          • Opcode ID: 0c640a573739567e2cf51267f3a6e97e095acf4466c0ac9e9295cef50f1959f4
          • Instruction ID: d873ff086a46773b03b0de852c94e9117c41875c84af43136981d5a7ffe46dc5
          • Opcode Fuzzy Hash: 0c640a573739567e2cf51267f3a6e97e095acf4466c0ac9e9295cef50f1959f4
          • Instruction Fuzzy Hash: C362E632B18B46A6EF10EF64D8545B9A3A0FB84B94FC00232EA4E477A4DF3DE545D760
          Function 00007FF73C236420 Relevance: 116.4, APIs: 54, Strings: 12, Instructions: 879COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove$?currentOperatingSystemType@Type@1@Version@@free
          • String ID: /.config/BraveSoftware/Brave-Browser$/.config/google-chrome$/.config/opera$/AppData/Local/BraveSoftware/Brave-Browser/User Data$/AppData/Local/Google/Chrome/User Data$/AppData/Roaming/Opera Software/Opera Stable$/Library/Application Support/BraveSoftware/Brave-Browser$/Library/Application Support/Google/Chrome$/Library/Application Support/com.operasoftware.opera$/Users$/home$C:\Users
          • API String ID: 283656904-339602194
          • Opcode ID: bd6026dee58514d6e7503571e16f13d7e544588f6f3291e3bcb69cb051618e5a
          • Instruction ID: 6724bbcdd473a9dede83059def152534e08ec33d605f1f7ff91fd9abce0decad
          • Opcode Fuzzy Hash: bd6026dee58514d6e7503571e16f13d7e544588f6f3291e3bcb69cb051618e5a
          • Instruction Fuzzy Hash: 87829F32F08A46A6EF50EFA4C4556AC63B5FB45798BC04132DA0E5B798DF3EE409D360
          Function 00007FF73C239014 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
          • String ID:
          • API String ID: 313767242-0
          • Opcode ID: 3c5082cf27a913f4ddd56dbf02428519abd1f916ccd26cb49d39ca215caeea03
          • Instruction ID: 3c4f4689c5e9f1bc5fa2cfce2db2bff863d7d12414aeec52603303c7c0714b5a
          • Opcode Fuzzy Hash: 3c5082cf27a913f4ddd56dbf02428519abd1f916ccd26cb49d39ca215caeea03
          • Instruction Fuzzy Hash: 68315072608B8196EB60AF61E8803EDB3A0FB85744F84403ADB4D47B99EF3DD548D724
          Function 00007FF73C239264 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
          • String ID:
          • API String ID: 2933794660-0
          • Opcode ID: 4d5f2d8e2c108dd07a8e13d9932baff34241489c4b7d70a66409c1d88bc647f3
          • Instruction ID: efd1c4901d8815d6253d0176ea408b1120bb6c2da4d61cd9966859c46b6d6df5
          • Opcode Fuzzy Hash: 4d5f2d8e2c108dd07a8e13d9932baff34241489c4b7d70a66409c1d88bc647f3
          • Instruction Fuzzy Hash: A8113C22B15F059AFB00EF60E8542B873A4FB19758F840E31EA6D467A4DF7CD1989350
          Function 00007FF73C2391F8 Relevance: .0, Instructions: 2COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: b3da815f58c421175aadfb416ab3de72625a9c35ff41543ba1248dc535df5f3c
          • Instruction ID: 9bd04c1d77ba73d4cd71fba41cf10952fdc9a4a16ee356baffa320065a514851
          • Opcode Fuzzy Hash: b3da815f58c421175aadfb416ab3de72625a9c35ff41543ba1248dc535df5f3c
          • Instruction Fuzzy Hash: 82A00121908D06A0EA04AB01A950161A2A0AB51310B800131D42D81664AE3EA540A228
          Function 00007FF73C2316D0 Relevance: 107.0, APIs: 55, Strings: 6, Instructions: 298windownetworkthreadCOMMON
          Download Yara Rule
          APIs
          • ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF73C231706
          • ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF73C23170F
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C231721
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF73C231734
          • ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF73C23173E
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF73C23174C
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C231758
            • Part of subcall function 00007FF73C231040: ??0QThread@@QEAA@PEAVQObject@@@Z.QT6CORE ref: 00007FF73C231078
            • Part of subcall function 00007FF73C231040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF73C23108F
            • Part of subcall function 00007FF73C231040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF73C23109C
            • Part of subcall function 00007FF73C231040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF73C2310A9
            • Part of subcall function 00007FF73C231040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF73C2310B4
            • Part of subcall function 00007FF73C231040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF73C2310BF
            • Part of subcall function 00007FF73C231040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF73C2310CA
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2310DC
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C231145
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C231158
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C23116B
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C23117D
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C23118F
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2311A1
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2311B3
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2311C5
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2311D7
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2311E9
            • Part of subcall function 00007FF73C231040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2311FB
          • ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF73C231771
            • Part of subcall function 00007FF73C2383D4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73C23179D), ref: 00007FF73C2383EE
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF73C2317F9
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF73C231804
          • ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF73C231810
            • Part of subcall function 00007FF73C2383D4: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73C238404
            • Part of subcall function 00007FF73C237790: ??0QWebEnginePage@@QEAA@PEAVQObject@@@Z.QT6WEBENGINECORE(?,?,?,?,?,?,?,?,?,?,?,00007FF73C231832), ref: 00007FF73C2377A1
            • Part of subcall function 00007FF73C237790: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,?,?,00007FF73C231832), ref: 00007FF73C237836
            • Part of subcall function 00007FF73C237790: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,?,?,?,?,?,00007FF73C231832), ref: 00007FF73C237841
          • ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF73C23183A
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C23184C
          • ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF73C231862
          • ?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF73C231870
          • ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF73C23187E
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C23188A
          • ?resize@QWidget@@QEAAXHH@Z.QT6WIDGETS ref: 00007FF73C23189F
          • ?show@QWidget@@QEAAXXZ.QT6WIDGETS ref: 00007FF73C2318A9
          • ??0QMenu@@QEAA@PEAVQWidget@@@Z.QT6WIDGETS ref: 00007FF73C2318C8
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2318EE
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF73C2318FC
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C231909
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF73C23199C
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF73C2319A9
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2319BA
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF73C2319C8
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C2319D5
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF73C231A61
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF73C231A6E
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C231A7F
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF73C231A8D
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C231A9A
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF73C231B0E
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF73C231B1B
          • ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z.QT6WIDGETS ref: 00007FF73C231B27
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C231B39
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF73C231B4B
          • ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z.QT6WIDGETS ref: 00007FF73C231B59
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF73C231B67
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C231B72
          • ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z.QT6WIDGETS ref: 00007FF73C231B7F
          • ?setVisible@QSystemTrayIcon@@QEAAX_N@Z.QT6WIDGETS ref: 00007FF73C231B8B
          • ?exec@QApplication@@SAHXZ.QT6WIDGETS ref: 00007FF73C231B91
          • ??1QSystemTrayIcon@@UEAA@XZ.QT6WIDGETS ref: 00007FF73C231B9D
          • ??1QWebEngineView@@UEAA@XZ.QT6WEBENGINEWIDGETS ref: 00007FF73C231BA8
            • Part of subcall function 00007FF73C231430: ??1QString@@QEAA@XZ.QT6CORE(?,?,?,00007FF73C231408), ref: 00007FF73C231473
            • Part of subcall function 00007FF73C231430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73C231408), ref: 00007FF73C231485
            • Part of subcall function 00007FF73C2313C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73C231414
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C231BEC
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF73C231BF6
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF73C231C00
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF73C231C0A
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF73C231C14
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF73C231C1E
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF73C231C28
          • ??1QThread@@UEAA@XZ.QT6CORE ref: 00007FF73C231C32
          • ??1QApplication@@UEAA@XZ.QT6WIDGETS ref: 00007FF73C231C3D
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$Object@@$Network$Connection@Meta$Icon@@$?setAccessEngineManager@@Object@@@Request@@$?connectApplication@@Base@ConnectionImpl@ObjectPrivate@@Qt@@SlotString@@@SystemTrayType@U3@@Widget@@$View@@$?addAction@Action@@Thread@@$Icon@Icon@@@Url@@Widget@@@Windowfree$?exec@?load@?resize@?show@?start@Closed@Concurrency::cancel_current_taskContextLastMenu@Menu@@Menu@@@Mode@0@@Page@Page@@Page@@@ParsingPriority@1@@QuitUrl@@@Visible@malloc
          • String ID: &Close$&Hide$:/logo.ico$:/logo.png$Sho&w$https://hello.freeconference.com/login/access-code
          • API String ID: 90596291-1651899464
          • Opcode ID: 731fc9e951405f6d4ef4e380def783ab7737936ab0cdaf26b3cfe7fcab006d98
          • Instruction ID: 9ea341db3c587021cb6ba4eeb6cf4a19337ac51a8f8e3aa15c70ed24e0ff1110
          • Opcode Fuzzy Hash: 731fc9e951405f6d4ef4e380def783ab7737936ab0cdaf26b3cfe7fcab006d98
          • Instruction Fuzzy Hash: 44F11232A18A86A6EB10EF60E8541EDB3B0FB84749F805132E64E47778DF7DD549D710
          Function 00007FF73C231040 Relevance: 98.2, APIs: 33, Strings: 23, Instructions: 188networkmemorythreadCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$Network$Object@@@$AccessManager@@Request@@$?allocate@AllocationArrayData@@Option@1@@Thread@@U1@_V0@@
          • String ID: acmacodkjbdgmoleebolmdjonilkdbch$aeachknmefphepccionboohckonoeemg$afbcbjpbpfadlkmhmclhkeeodmamcflc$agoakfejjabomempkjlepdflaleeobhb$aholpfdialjgjfhomihkjbmgjidlcdno$bfnaelmomeimhlpmgjnjophhpkkoljpa$bhhhlbepdkbapadjdnnojkbgioiodbic$dlcobpjiigpikoobohmabehhmhfoodbb$ejbalbakoplchlghecdalmeeeajnimhm$fhbohimaelbohpjbbldcngcnapndodjp$fldfpgipfncgndfolcbkdeeknbbbnhcc$gjnckgkfmgmibbkoficdidcljeaaaheg$hifafgmccdpekplomjjkcfgodnhcellj$hnfanknocfeofbddgcijnmhnfnkdnaad$http://185.235.241.208:1224$ibnejdfjmmkpcnlpebklmnkoeoihofec$jblndlipeogpafnldhgmapagcccfchpi$lgmpcpglpngdoalbgeoldeajfclnhafa$mcohilncbfahbmgdjkbpemcciiolgcge$nkbihfbeogaeaoehlefnkodbefgpgknn$nphplpgoakhhjchkkhmiggakijnkhfnd$omaabbefbmiijedngplfjmnooppbclkk$penjlddjkjgpnkllboccdgccekpkcbin
          • API String ID: 2244258320-1925799802
          • Opcode ID: 94212b812700271b44099ede49e89de5d4e2a952e433fee333c9a7406dd32b87
          • Instruction ID: 200259c8eea9f8f439adb037d9f1ae49bab84aa58a4ccbd034a95aeeca350bba
          • Opcode Fuzzy Hash: 94212b812700271b44099ede49e89de5d4e2a952e433fee333c9a7406dd32b87
          • Instruction Fuzzy Hash: EBA10D31B18A46B6EB04AF64EC542A8B3A0FB89749F805032E64E87774DF7DE55DE310
          Function 00007FF73C2373B0 Relevance: 80.7, APIs: 41, Strings: 5, Instructions: 231networkwindowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$Network$Debug@@$Object@@$Meta$Connection@Dir@@Logger@@MessageReply@@Url@@$ByteV0@@$?append@?connect?debug@?error@?get@?setA@@@@AccessArray@@Base@BasicConnectionError@1@Impl@Manager@@Mode@0@@ObjectParsingPrivate@@Qt@@Request@@Request@@@SlotStringType@U3@@Url@Url@@@Utf8View@$0$?home?qt_?read?removeA@$$All@Array@@@Device@@Enum_debugOperator@@Path@Recursively@String@@@V1@_malloc
          • String ID: /.n3$/client/99$/pdown$Error: $NetworkError
          • API String ID: 188155667-2729814421
          • Opcode ID: 35325a1c383d77adee6fcc67b436e75a9154524aa25d2178f92b1bb730aa75c5
          • Instruction ID: 8630da740f7ef23eee27becb9dce861365474ff84ff9a61c1f526f01fb401e57
          • Opcode Fuzzy Hash: 35325a1c383d77adee6fcc67b436e75a9154524aa25d2178f92b1bb730aa75c5
          • Instruction Fuzzy Hash: 1DC11D32B04B46AAEB00EF64E8541EDB3B4FB45749F805132EA4E53B28EF79E549D350
          Function 00007FF73C2330A0 Relevance: 73.7, APIs: 40, Strings: 2, Instructions: 163COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: Byte$Array@@$Json$Document@@String@@Value@@$File@@$String@@@V0@$$V0@@Variant@@$?fromFlags@Parse$?data@?exists@?length@?open@?read?right@?size@All@Array@Array@@@@@Base64Base64@Base@@@@@DeviceDevice@@Error@@Error@@@Flag@Json@ModeOpenOption@V1@_Variant@
          • String ID: encrypted_key$os_crypt
          • API String ID: 2100764627-2981665407
          • Opcode ID: 288e34dbb71860899f52883b0c520fc0a6ce77327bc4290bf9d48bc6783cc761
          • Instruction ID: 7210b869c3d0ad42f4e0606149b00f0926bd64f9221fec4fbb7ccbe1e055714e
          • Opcode Fuzzy Hash: 288e34dbb71860899f52883b0c520fc0a6ce77327bc4290bf9d48bc6783cc761
          • Instruction Fuzzy Hash: 2C811E32A08A46A6EB00AF61E8541EDB370FB95759F801132EA0E86778EF3DD54DD750
          Function 00007FF73C232780 Relevance: 54.4, APIs: 28, Strings: 3, Instructions: 149windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$A@$$ByteDebug@@Device@@File@@V0@@$?homeArray@@Base@@@@@DeviceDir@@Flag@Flags@Logger@@MessageModeNetworkOpenPath@Process@@$?close@?debug@?error@?open@?read?start@?write@All@Array@@@Error@1@FileList@Object@@@Reply@@String@@@String@@@@free
          • String ID: /99$Download Client Success!$python
          • API String ID: 2506431097-3274328065
          • Opcode ID: 0fd255ec9deb0b0cef8490d1fb32d88a883da3ff453a0efda6692eb6db676643
          • Instruction ID: b5757f1d29b3479e5e91d5dd481839c6d7a3240185907f62a70618d21fae3f8f
          • Opcode Fuzzy Hash: 0fd255ec9deb0b0cef8490d1fb32d88a883da3ff453a0efda6692eb6db676643
          • Instruction Fuzzy Hash: B861FF32F08A06A6EB00EF65E8541FC63B1FB95B49B805031DA0E57769DF3EE549D360
          Function 00007FF73C2379C2 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 121COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: Byte$Array@@$ArrayView@@$?size@$?append@?data@Meta$?castHelper@Type@@$?class?id@?register?reserve@Name@NormalizedNull@Object@@Typedef@V1@@memcmp
          • String ID: Feature
          • API String ID: 2588427355-3496627450
          • Opcode ID: a648fd2e09ca8e56032a7fb751d3bd3b08f0f31a5c59a5838e192e21bedeb188
          • Instruction ID: 7d530047dbc7f53479245090856a0f0f5d2e00051e4e6daf6e06af0be8c8e75f
          • Opcode Fuzzy Hash: a648fd2e09ca8e56032a7fb751d3bd3b08f0f31a5c59a5838e192e21bedeb188
          • Instruction Fuzzy Hash: 17514222A08A86A2EB10AF15E85417AF3E1FF94B90F840135EA8E83764EF7DD505D710
          Function 00007FF73C237780 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 111COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: Byte$Array@@$ArrayView@@$?size@$?append@?data@Meta$?castHelper@Type@@$?class?id@?register?reserve@Name@NormalizedNull@Object@@Typedef@V1@@memcmp
          • String ID: Feature
          • API String ID: 2588427355-3496627450
          • Opcode ID: 5240cc61f276c603711c87909df798f2566c59d2d11ceb47447dbbc621ed9777
          • Instruction ID: 28a7bc68b9984ff932b9c2eb03dad0bd673d89e6e2d1d4e1ca14c12d74ad7cc4
          • Opcode Fuzzy Hash: 5240cc61f276c603711c87909df798f2566c59d2d11ceb47447dbbc621ed9777
          • Instruction Fuzzy Hash: 84514222A08A86A2EF10EF15E95417AF3E1FF94B90F840136EA8E83764EF7DD505D710
          Function 00007FF73C2359C0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 105COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$V0@@$A@$$$?append@?homeDir@@Path@V1@@$?copy@File@@String@@0@
          • String ID: /.n3/
          • API String ID: 2243516418-3635227014
          • Opcode ID: 1a31415be5b831315bd1c6d94ddfe76e1d0a89741fa0b8083cd3e70b5f69829f
          • Instruction ID: eb15154b85697135164b1dcc6c79d58ff44cfc72d1b5277aea834a7869b81ff8
          • Opcode Fuzzy Hash: 1a31415be5b831315bd1c6d94ddfe76e1d0a89741fa0b8083cd3e70b5f69829f
          • Instruction Fuzzy Hash: 0C411232B18A41A6EB10AF51E8542AAB3A0FF96B81FC05031EA4F87774DF3DD549D760
          Function 00007FF73C237080 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 98networkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: ByteNetwork$Array@@String@@$Object@@Request@@$?setConnection@MetaUrl@@$?append@?connect?post@A@@@@AccessArray@@0@Base@BasicConnectionHeader@HttpImpl@Manager@@Mode@0@@MultiObjectParsingPart@@@Private@@Qt@@Reply@@SlotStringType@U3@@Url@Url@@@Utf8V0@@View@$0malloc
          • String ID: /uploads$Content-Type$multipart/form-data; boundary=---------------------------99614912995
          • API String ID: 1290966195-1692235574
          • Opcode ID: 5f91c830383a2831114b0b36317ca055fc1ff3a02556a362e69e8bfafdd792ea
          • Instruction ID: a97ca3d769000e69f08a15b113e753a1c9316c8ffc1d69245fe87a1e00c92dad
          • Opcode Fuzzy Hash: 5f91c830383a2831114b0b36317ca055fc1ff3a02556a362e69e8bfafdd792ea
          • Instruction Fuzzy Hash: CD413E72B04B45AAEB00EF60E8502ECB3B0FB45758F805231EA5D63BA4EF39D659D350
          Function 00007FF73C236380 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 37COMMON
          Download Yara Rule
          APIs
          • ?homePath@QDir@@SA?AVQString@@XZ.QT6CORE ref: 00007FF73C23638E
          • ??0QDir@@QEAA@AEBVQString@@@Z.QT6CORE ref: 00007FF73C23639D
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C2363A9
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2363BB
          • ?mkdir@QDir@@QEBA_NAEBVQString@@@Z.QT6CORE ref: 00007FF73C2363CC
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C2363D8
            • Part of subcall function 00007FF73C236420: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C236459
            • Part of subcall function 00007FF73C236420: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C23649E
            • Part of subcall function 00007FF73C236420: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2364AF
            • Part of subcall function 00007FF73C236420: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C2364EA
            • Part of subcall function 00007FF73C236420: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2364FB
            • Part of subcall function 00007FF73C236420: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C236536
            • Part of subcall function 00007FF73C236420: ?currentType@QOperatingSystemVersion@@SA?AW4OSType@1@XZ.QT6CORE ref: 00007FF73C23653C
            • Part of subcall function 00007FF73C236420: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C236591
            • Part of subcall function 00007FF73C233360: ??0QDir@@QEAA@AEBVQString@@@Z.QT6CORE ref: 00007FF73C2333D0
            • Part of subcall function 00007FF73C233360: ?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z.QT6CORE ref: 00007FF73C2333EB
            • Part of subcall function 00007FF73C233360: ?filePath@QFileInfo@@QEBA?AVQString@@XZ.QT6CORE ref: 00007FF73C233476
            • Part of subcall function 00007FF73C233360: ??YQString@@QEAAAEAV0@PEBD@Z.QT6CORE ref: 00007FF73C233487
            • Part of subcall function 00007FF73C233360: ??0QString@@QEAA@$$QEAV0@@Z.QT6CORE ref: 00007FF73C233494
            • Part of subcall function 00007FF73C233360: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C2334AF
            • Part of subcall function 00007FF73C233360: ??0QChar@@QEAA@_S@Z.QT6CORE ref: 00007FF73C2334C4
            • Part of subcall function 00007FF73C233360: ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z.QT6CORE ref: 00007FF73C2334E7
            • Part of subcall function 00007FF73C233360: ??0QChar@@QEAA@_S@Z.QT6CORE ref: 00007FF73C2334FC
            • Part of subcall function 00007FF73C232AD0: ??0QHttpMultiPart@@QEAA@W4ContentType@0@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF73C232B29
            • Part of subcall function 00007FF73C232AD0: ??0QHttpPart@@QEAA@XZ.QT6NETWORK ref: 00007FF73C232B3F
            • Part of subcall function 00007FF73C232AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C232B51
            • Part of subcall function 00007FF73C232AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF73C232B63
            • Part of subcall function 00007FF73C232AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF73C232B6E
            • Part of subcall function 00007FF73C232AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C232B7F
            • Part of subcall function 00007FF73C232AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF73C232B94
            • Part of subcall function 00007FF73C232AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF73C232B9F
            • Part of subcall function 00007FF73C232AD0: ??0QByteArray@@QEAA@PEBD_J@Z.QT6CORE ref: 00007FF73C232BB7
            • Part of subcall function 00007FF73C232AD0: ?setBody@QHttpPart@@QEAAXAEBVQByteArray@@@Z.QT6NETWORK ref: 00007FF73C232BC7
            • Part of subcall function 00007FF73C232AD0: ??1QByteArray@@QEAA@XZ.QT6CORE ref: 00007FF73C232BD2
            • Part of subcall function 00007FF73C232AD0: ?append@QHttpMultiPart@@QEAAXAEBVQHttpPart@@@Z.QT6NETWORK ref: 00007FF73C232BE0
            • Part of subcall function 00007FF73C232AD0: ??0QHttpPart@@QEAA@XZ.QT6NETWORK ref: 00007FF73C232BEB
            • Part of subcall function 00007FF73C232AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C232BFD
            • Part of subcall function 00007FF73C232AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF73C232C0F
            • Part of subcall function 00007FF73C232AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF73C232C1A
            • Part of subcall function 00007FF73C232AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C232C2B
            • Part of subcall function 00007FF73C232AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF73C232C40
            • Part of subcall function 00007FF73C232AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF73C232C4B
            • Part of subcall function 00007FF73C232AD0: ?localHostName@QHostInfo@@SA?AVQString@@XZ.QT6NETWORK ref: 00007FF73C232C55
            • Part of subcall function 00007FF73C232AD0: ?toUtf8@QString@@QEHAA?AVQByteArray@@XZ.QT6CORE ref: 00007FF73C232C63
          • ??1QDir@@QEAA@XZ.QT6CORE ref: 00007FF73C23640B
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$Http$Part@@$Variant@@$Dir@@$?set$ByteHeader@Headers@KnownNetworkRequest@@Variant@@@$Array@@String@@@$Char@@FileFlags@HostInfo@@List@MultiPath@$?append@?arg@?current?entry?file?home?local?mkdir@A@$$Array@@@Body@Char@@@ContentDir@@@@Dir@@@@@Filter@Flag@InfoInfo@@@@Name@Object@@@OperatingPart@@@SortSystemType@Type@0@Type@1@Utf8@V0@@Version@@
          • String ID: .n3
          • API String ID: 4083719557-2302449095
          • Opcode ID: d5f3b3f108f3aa34d69051a193aa0781863f4f1c0503d1fd4a6b29cbf07a3a13
          • Instruction ID: 7909150fa12bc39966c46ef7fceb06668e635543ab14f3d0aace308e8cfefaab
          • Opcode Fuzzy Hash: d5f3b3f108f3aa34d69051a193aa0781863f4f1c0503d1fd4a6b29cbf07a3a13
          • Instruction Fuzzy Hash: AC015A31A18A4AB2DB00BF20E8600BAA3A0FFD5B45F841031F64F4A375DF2DE549D720
          Function 00007FF73C2360B0 Relevance: 10.7, APIs: 7, Instructions: 182memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE ref: 00007FF73C236170
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF73C236180
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF73C2361B6
          • ??0QString@@QEAA@$$QEAV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF73C232AB4), ref: 00007FF73C236246
          • ??0QString@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF73C232AB4), ref: 00007FF73C2362B6
          • ??1QString@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF73C232AB4), ref: 00007FF73C236343
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73C232AB4), ref: 00007FF73C236357
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$Alloc@@ArrayData@@V0@@$?reallocateA@$$AllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 2195022652-0
          • Opcode ID: 29e2f41032ac6e321820d3860766fb60a843b3ee14517d504cc3441c69c90b92
          • Instruction ID: 6b28fd4e78b052aff15556766a16fc7ef4ba47899314c7541ab6686f83794af0
          • Opcode Fuzzy Hash: 29e2f41032ac6e321820d3860766fb60a843b3ee14517d504cc3441c69c90b92
          • Instruction Fuzzy Hash: 30717932B19B4692DE84DF0AE4442A9B3E8FB85B84F884536EB9D47764DF3DE064C710
          Function 00007FF73C235E60 Relevance: 10.7, APIs: 7, Instructions: 160memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE ref: 00007FF73C235F02
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF73C235F12
          • ?qBadAlloc@@YAXXZ.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF73C23362C), ref: 00007FF73C235F4A
          • ??0QFileInfo@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF73C23362C), ref: 00007FF73C235FA7
          • ??0QFileInfo@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF73C23362C), ref: 00007FF73C235FE7
          • ??1QFileInfo@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF73C23362C), ref: 00007FF73C236073
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000002,00007FF73C23362C), ref: 00007FF73C236087
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: FileInfo@@$Alloc@@ArrayData@@V0@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 1506373291-0
          • Opcode ID: 97a0a2f05db0e139333e215ca51834bd6495390d1053a287cd1a4b1a492931b5
          • Instruction ID: 74cdcc543f1220f292293a7d6d4af576d085c2a1fe415306506270f5ad060420
          • Opcode Fuzzy Hash: 97a0a2f05db0e139333e215ca51834bd6495390d1053a287cd1a4b1a492931b5
          • Instruction Fuzzy Hash: B261DC72B19B8696EA40EF05E544529B3A8FB45BD4F998231EE8E43B98DF3DD010D710
          Function 00007FF73C2320C0 Relevance: 10.6, APIs: 7, Instructions: 118COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove
          • String ID:
          • API String ID: 349968220-0
          • Opcode ID: b81b9adeff7374bba9817c7d097aa8cb3dcde858bf4931da5f9a48b079091920
          • Instruction ID: abca7ebf5dc29499b3882b42a1213e411897df84e951cfceb1ddcc7bbb7bc61f
          • Opcode Fuzzy Hash: b81b9adeff7374bba9817c7d097aa8cb3dcde858bf4931da5f9a48b079091920
          • Instruction Fuzzy Hash: 8341C472B14A46A1DF14DF2AD8046A8A3A0FB44FA4F948232DE6E073D9DF3DE546D350
          Function 00007FF73C231F00 Relevance: 10.6, APIs: 7, Instructions: 118COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$V0@@$A@$$$memmove
          • String ID:
          • API String ID: 3031525755-0
          • Opcode ID: 6f0a04690eee506567eeb374d3c615f1eb2d615dd7b759641a9e423a67dd57b4
          • Instruction ID: 9b18b891b0320ceff56f625ab2aeac00b177fea7449fe1a0d1daba8b5d1f3e2e
          • Opcode Fuzzy Hash: 6f0a04690eee506567eeb374d3c615f1eb2d615dd7b759641a9e423a67dd57b4
          • Instruction Fuzzy Hash: 7841AF72B14B4691DE14EF2AD414668A3A0FB54FA4F948232DE6E073E9DF3EE445D310
          Function 00007FF73C2394D0 Relevance: 10.6, APIs: 7, Instructions: 117COMMON
          Download Yara Rule
          APIs
          • __p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73C2394D7
          • __p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73C2394E6
          • GetCommandLineW.KERNEL32 ref: 00007FF73C239512
          • CommandLineToArgvW.SHELL32 ref: 00007FF73C239523
            • Part of subcall function 00007FF73C2316D0: ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF73C231706
            • Part of subcall function 00007FF73C2316D0: ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF73C23170F
            • Part of subcall function 00007FF73C2316D0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C231721
            • Part of subcall function 00007FF73C2316D0: ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF73C231734
            • Part of subcall function 00007FF73C2316D0: ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF73C23173E
            • Part of subcall function 00007FF73C2316D0: ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF73C23174C
            • Part of subcall function 00007FF73C2316D0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C231758
            • Part of subcall function 00007FF73C2316D0: ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF73C231771
            • Part of subcall function 00007FF73C2316D0: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF73C2317F9
            • Part of subcall function 00007FF73C2316D0: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF73C231804
            • Part of subcall function 00007FF73C2316D0: ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF73C231810
            • Part of subcall function 00007FF73C2316D0: ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF73C23183A
            • Part of subcall function 00007FF73C2316D0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF73C23184C
            • Part of subcall function 00007FF73C2316D0: ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF73C231862
            • Part of subcall function 00007FF73C2316D0: ?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF73C231870
            • Part of subcall function 00007FF73C2316D0: ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF73C23187E
            • Part of subcall function 00007FF73C2316D0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF73C23188A
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: String@@$Engine$?setApplication@@Object@@View@@$CommandConnection@Icon@@LineMetaUrl@@Window$?connect?load@?start@ArgvBase@Closed@ConnectionIcon@Icon@@@Impl@LastMode@0@@ObjectPage@Page@@@ParsingPriority@1@@Private@@Qt@@QuitSlotString@@@Thread@@Type@U3@@Url@@@Widget@@@__p___argc__p___argv
          • String ID:
          • API String ID: 1766454188-0
          • Opcode ID: 4a36ba82502acc88ab3fcbe860c4d4756d5f87953150b10b1e5803b1727d4115
          • Instruction ID: c4b5da7648aeee8fce2f448ef8ea700d43170658a96afb400f793a797a48ca15
          • Opcode Fuzzy Hash: 4a36ba82502acc88ab3fcbe860c4d4756d5f87953150b10b1e5803b1727d4115
          • Instruction Fuzzy Hash: 5D515A36A08B8186D720AF26B84036AB7E1FB89BD0F844135EE9D43B58CF3DD014DB10
          Function 00007FF73C238888 Relevance: 10.6, APIs: 7, Instructions: 94COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
          • String ID:
          • API String ID: 3995423050-0
          • Opcode ID: 0fdffd3cff90843bb218ba27072cfe385dbbd6ec36657e1cfb47b893a0bae4b3
          • Instruction ID: 3b841516e0b7f72dbda4b67075da0750fe4cece0624e2ef995b3956f66cf4bcb
          • Opcode Fuzzy Hash: 0fdffd3cff90843bb218ba27072cfe385dbbd6ec36657e1cfb47b893a0bae4b3
          • Instruction Fuzzy Hash: 44313C12E0C243A6FB64BB6694513B9E2D1AF42744FC44436EA4D4F3D3DE6FA504A271
          Function 00007FF73C2314C0 Relevance: 10.5, APIs: 7, Instructions: 31networkCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: Network$AccessManager@@Request@@$String@@free
          • String ID:
          • API String ID: 2366384267-0
          • Opcode ID: a8ec4160b1383245c624dc8e43705d74c0fb4958722e41f56ac5788e883bb036
          • Instruction ID: 699fdb90f9d014e1ee5366e6d68d41ce020620f6384dc734ffd8b860579978c5
          • Opcode Fuzzy Hash: a8ec4160b1383245c624dc8e43705d74c0fb4958722e41f56ac5788e883bb036
          • Instruction Fuzzy Hash: DD01A921A25846A2EB44FF20D8652BC63A4FF50B09FC41031DA4E462B6DF2ED58ED730
          Function 00007FF73C23A36A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: __current_exception__current_exception_contextterminate
          • String ID: csm
          • API String ID: 2542180945-1018135373
          • Opcode ID: 4415411d15063a15b52e183c6001ef54e57adbf0684e0ed45ed66d6346dd2235
          • Instruction ID: 65eb996f6923a4161b7d21e9251b8f354c6e9e55bb73c96f5649969093436629
          • Opcode Fuzzy Hash: 4415411d15063a15b52e183c6001ef54e57adbf0684e0ed45ed66d6346dd2235
          • Instruction Fuzzy Hash: 1AF0F437609B44CAD715AF62E8805AC33A4F749B88B8A6130FB4D4BB55CF39D8919720
          Function 00007FF73C2378C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: Debug@@$Meta$?qt_Enum_debugObject@@Operator@@V1@_
          • String ID: Feature
          • API String ID: 1967151937-3496627450
          • Opcode ID: f8bfc365ba60ae0f7d4b3b8696262ce4585107cc93b0e4d1ed27b897953d5d40
          • Instruction ID: a4ae596b2aef2ae8137cd2852a0aa38c145573e35b6a6993116cbb0a7aa6f9fc
          • Opcode Fuzzy Hash: f8bfc365ba60ae0f7d4b3b8696262ce4585107cc93b0e4d1ed27b897953d5d40
          • Instruction Fuzzy Hash: DFF0F832608E86E5CA00AF84E8800A9B7B4FB85796FD01132E68D47B34DF7DC199DB00
          Function 00007FF73C235B70 Relevance: 6.2, APIs: 4, Instructions: 197memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF73C231E58), ref: 00007FF73C235C26
          • ?qBadAlloc@@YAXXZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF73C231E58), ref: 00007FF73C235C36
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF73C235C77
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73C231E58), ref: 00007FF73C235E46
          Memory Dump Source
          • Source File: 00000000.00000002.3310872654.00007FF73C231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73C230000, based on PE: true
          • Associated: 00000000.00000002.3310841027.00007FF73C230000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310891960.00007FF73C23B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310908324.00007FF73C23C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310928756.00007FF73C24E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3310945070.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff73c230000_FsJfRO0W9w.jbxd
          Similarity
          • API ID: Alloc@@ArrayData@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 915963882-0
          • Opcode ID: 5cbb1e88a1a8929674383cfc7502a7c8de2323249954a1e50712a5e40c99d09d
          • Instruction ID: ebaf5d8ab5af4bde6a5d29cf242827cdaf49aaed1ea8fba2042d1eaa58d26710
          • Opcode Fuzzy Hash: 5cbb1e88a1a8929674383cfc7502a7c8de2323249954a1e50712a5e40c99d09d
          • Instruction Fuzzy Hash: AE819D36719F4A96DE45EF4AE0806ACB3E0FB98B84B904532EB5D477A4DF3AD160C300