Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
4WRYCj0Ea4.exe

Overview

General Information

Sample name:4WRYCj0Ea4.exe
renamed because original name is a hash value
Original sample name:0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd.exe
Analysis ID:1530951
MD5:ed60b3913e6694f4a0ed2fe25551bd1f
SHA1:18a2ee2fcd433f0fe27e0b6fc13bdfc890fc637b
SHA256:0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd
Tags:185-235-241-208exeuser-JAMESWT_MHT

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected potential crypto function
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • 4WRYCj0Ea4.exe (PID: 3524 cmdline: "C:\Users\user\Desktop\4WRYCj0Ea4.exe" MD5: ED60B3913E6694F4A0ED2FE25551BD1F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: 4WRYCj0Ea4.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: 4WRYCj0Ea4.exeReversingLabs: Detection: 62%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 91.3% probability
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC54580 ?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?copy@QFile@@SA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??0QString@@QEAA@PEBD@Z,?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z,??1QString@@QEAA@XZ,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QSqlDatabase@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlDatabase@@QEAA@XZ,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z,??0QString@@QEAA@PEBD@Z,?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z,??1QString@@QEAA@XZ,?exec@QSqlQuery@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlQuery@@QEAA@XZ,?next@QSqlQuery@@QEAA_NXZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ,??1QVariant@@QEAA@XZ,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?left@QByteArray@@QEHAA?AV1@_J@Z,??1QByteArray@@QEAA@XZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?length@QByteArray@@QEBA_JXZ,EVP_DecryptInit_ex,?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QFile@@QEAA@AEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,??1QString@@QEAA@XZ,??1QSt0_2_00007FF67DC54580
Source: 4WRYCj0Ea4.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 4WRYCj0Ea4.exeString found in binary or memory: http://185.235.241.208:1224
Source: 4WRYCj0Ea4.exeString found in binary or memory: https://hello.freeconference.com/login/access-code
Source: 4WRYCj0Ea4.exeString found in binary or memory: https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:1
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC52B300_2_00007FF67DC52B30
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC532A00_2_00007FF67DC532A0
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC525C00_2_00007FF67DC525C0
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC545800_2_00007FF67DC54580
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC568800_2_00007FF67DC56880
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC554600_2_00007FF67DC55460
Source: 4WRYCj0Ea4.exeBinary or memory string: OriginalFilename vs 4WRYCj0Ea4.exe
Source: 4WRYCj0Ea4.exe, 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameFCCCall.exe0 vs 4WRYCj0Ea4.exe
Source: 4WRYCj0Ea4.exeBinary or memory string: OriginalFilenameFCCCall.exe0 vs 4WRYCj0Ea4.exe
Source: classification engineClassification label: mal60.winEXE@1/0@0/0
Source: 4WRYCj0Ea4.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 4WRYCj0Ea4.exeReversingLabs: Detection: 62%
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: libcrypto-1_1-x64.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: qt6webuserwidgets.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: qt6widgets.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: qt6webusercore.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: qt6gui.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: qt6sql.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: qt6network.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: qt6core.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeSection loaded: vcruntime140.dllJump to behavior
Source: 4WRYCj0Ea4.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: 4WRYCj0Ea4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 4WRYCj0Ea4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 4WRYCj0Ea4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 4WRYCj0Ea4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 4WRYCj0Ea4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 4WRYCj0Ea4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 4WRYCj0Ea4.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 4WRYCj0Ea4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 4WRYCj0Ea4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 4WRYCj0Ea4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 4WRYCj0Ea4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 4WRYCj0Ea4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 4WRYCj0Ea4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC59438 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF67DC59438
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC5961C SetUnhandledExceptionFilter,0_2_00007FF67DC5961C
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC59438 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF67DC59438
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC58FD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF67DC58FD4
Source: C:\Users\user\Desktop\4WRYCj0Ea4.exeCode function: 0_2_00007FF67DC59688 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF67DC59688

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
DLL Side-Loading		1
DLL Side-Loading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager2
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
4WRYCj0Ea4.exe62%ReversingLabsWin64.Trojan.Generic
4WRYCj0Ea4.exe100%AviraTR/AVI.Agent.bfgkj

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:14WRYCj0Ea4.exefalse
    		unknown
    http://185.235.241.208:12244WRYCj0Ea4.exefalse
      		unknown
      https://hello.freeconference.com/login/access-code4WRYCj0Ea4.exefalse
        		unknown

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1530951
        Start date and time:2024-10-10 18:12:06 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 3m 47s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:6
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:4WRYCj0Ea4.exe
        renamed because original name is a hash value
        Original Sample Name:0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd.exe
        Detection:MAL
        Classification:mal60.winEXE@1/0@0/0
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 24
        Cookbook Comments:
        • Found application associated with file extension: .exe

        Warnings

        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
        • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
        • Execution Graph export aborted for target 4WRYCj0Ea4.exe, PID 3524 because there are no executed function
        • VT rate limit hit for: 4WRYCj0Ea4.exe

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:PE32+ executable (GUI) x86-64, for MS Windows
        Entropy (8bit):5.9729752947432635
        TrID:
        • Win64 Executable GUI (202006/5) 92.65%
        • Win64 Executable (generic) (12005/4) 5.51%
        • Generic Win/DOS Executable (2004/3) 0.92%
        • DOS Executable Generic (2002/1) 0.92%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:4WRYCj0Ea4.exe
        File size:233'472 bytes
        MD5:ed60b3913e6694f4a0ed2fe25551bd1f
        SHA1:18a2ee2fcd433f0fe27e0b6fc13bdfc890fc637b
        SHA256:0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd
        SHA512:2861c7db0fc4c2f7e745c3d957115cc8c0a734088234a7cd217f1a32f3c511a297fcc0cc98dfee3bedaf314077ca61ee7dc7c4c256522eb4b5692dcf50d9c33b
        SSDEEP:3072:uXBxyWHmRNs2AoYObdeqZ0kLnPgK8+dP9VCgs83:ur/mRm2AoYCLZ02YK8+1b3
        TLSH:5F346B5E221B52E1E0A9C23FC24D0642E37EBC168722D7EF05357D2E1EF76912E79249
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E..H..............X......#.......#.......#.......#......................g...................t....$.......$4.......\......$.....

        File Icon

        Icon Hash:21c46db2b26dc421

        Static PE Info

        General

        Entrypoint:0x140008e1c
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x140000000
        Subsystem:windows gui
        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Time Stamp:0x6699C014 [Fri Jul 19 01:23:32 2024 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:6
        OS Version Minor:0
        File Version Major:6
        File Version Minor:0
        Subsystem Version Major:6
        Subsystem Version Minor:0
        Import Hash:928c951361d3a2211d9106bde4a3a971

        Entrypoint Preview

        Instruction
        dec eax
        sub esp, 28h
        call 00007EFFF8E53728h
        dec eax
        add esp, 28h
        jmp 00007EFFF8E52D3Fh
        int3
        int3
        retn 0000h
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000D7D1h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007EFFF8E538AEh
        dec eax
        lea eax, dword ptr [0000D7E4h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000D7DCh]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000D7C1h]
        dec eax
        mov dword ptr [ecx], eax
        dec eax
        mov eax, ecx
        ret
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000D775h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007EFFF8E53852h
        dec eax
        lea eax, dword ptr [0000D7B0h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000D7A8h]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000D78Dh]

        Rich Headers

        Programming Language:
        • [IMP] VS2008 SP1 build 30729

        Data Directories

        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x187940x17c.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1f0000x1c2c8.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1e0000x5a0.pdata
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x3c0000x234.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x167f00x1c.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x168800x28.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x166b00x140.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0xb0000xbc0.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x96ef0x98009d2f3b052e528eb0b184093ac71c3bebFalse0.4481136924342105data6.069533352042986IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0xb0000x11e400x12000f4f0928964ff8662ec22657d6ce8879dFalse0.7137315538194444data7.142826327457792IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x1d0000xb800x600d56a4b8cf76838715c78c74b4e3f229aFalse0.2545572916666667data2.755849135919546IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .pdata0x1e0000x5a00x60090d4d5244887ef013d7710a1441a3d6eFalse0.486328125data4.3749328168557575IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .rsrc0x1f0000x1c2c80x1c400a6627eb8c3d14019c45e88220595027fFalse0.20462009126106195data3.9772652649113573IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .reloc0x3c0000x2340x400cd77825546129c906da3de919aaee6c3False0.41015625data3.677304938163326IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

        Resources

        NameRVASizeTypeLanguageCountryZLIB Complexity
        RT_ICON0x1f2400x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/mEnglishUnited States0.36879432624113473
        RT_ICON0x1f6a80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/mEnglishUnited States0.19606003752345216
        RT_ICON0x207500x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/mEnglishUnited States0.14066390041493776
        RT_ICON0x22cf80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/mEnglishUnited States0.108171941426547
        RT_ICON0x26f200x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mEnglishUnited States0.06342422808470366
        RT_ICON0x377480x3619PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9919849808650444
        RT_GROUP_ICON0x3ad680x5adataEnglishUnited States0.7444444444444445
        RT_VERSION0x3adc80x27cdataEnglishUnited States0.470125786163522
        RT_MANIFEST0x3b0480x27eXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5501567398119123

        Imports

        DLLImport
        CRYPT32.dllCryptUnprotectData
        libcrypto-1_1-x64.dllEVP_CIPHER_CTX_free, EVP_CIPHER_CTX_new, EVP_DecryptUpdate, EVP_DecryptInit_ex, EVP_aes_256_gcm
        Qt6WebEngineWidgets.dll?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z, ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z, ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z, ??1QWebEngineView@@UEAA@XZ
        Qt6Widgets.dll?paintEvent@QMenu@@MEAAXPEAVQPaintEvent@@@Z, ?hideEvent@QMenu@@MEAAXPEAVQHideEvent@@@Z, ?leaveEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?enterEvent@QMenu@@MEAAXPEAVQEnterEvent@@@Z, ?wheelEvent@QMenu@@MEAAXPEAVQWheelEvent@@@Z, ?mouseMoveEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mousePressEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mouseReleaseEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?keyPressEvent@QMenu@@MEAAXPEAVQKeyEvent@@@Z, ?changeEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?sizeHint@QMenu@@UEBA?AVQSize@@XZ, ?qt_metacall@QMenu@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QMenu@@UEAAPEAXPEBD@Z, ?metaObject@QMenu@@UEBAPEBUQMetaObject@@XZ, ?inputMethodQuery@QWidget@@UEBA?AVQVariant@@W4InputMethodQuery@Qt@@@Z, ?inputMethodEvent@QWidget@@MEAAXPEAVQInputMethodEvent@@@Z, ?sharedPainter@QWidget@@MEBAPEAVQPainter@@XZ, ?redirected@QWidget@@MEBAPEAVQPaintDevice@@PEAVQPoint@@@Z, ?initPainter@QWidget@@MEBAXPEAVQPainter@@@Z, ?metric@QWidget@@MEBAHW4PaintDeviceMetric@QPaintDevice@@@Z, ?nativeEvent@QWidget@@MEAA_NAEBVQByteArray@@PEAXPEA_J@Z, ?showEvent@QWidget@@MEAAXPEAVQShowEvent@@@Z, ?dropEvent@QWidget@@MEAAXPEAVQDropEvent@@@Z, ?dragLeaveEvent@QWidget@@MEAAXPEAVQDragLeaveEvent@@@Z, ?dragMoveEvent@QWidget@@MEAAXPEAVQDragMoveEvent@@@Z, ?dragEnterEvent@QWidget@@MEAAXPEAVQDragEnterEvent@@@Z, ?tabletEvent@QWidget@@MEAAXPEAVQTabletEvent@@@Z, ?actionEvent@QMenu@@MEAAXPEAVQActionEvent@@@Z, ?closeEvent@QWidget@@MEAAXPEAVQCloseEvent@@@Z, ?resizeEvent@QWidget@@MEAAXPEAVQResizeEvent@@@Z, ?moveEvent@QWidget@@MEAAXPEAVQMoveEvent@@@Z, ?focusOutEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?focusInEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?keyReleaseEvent@QWidget@@MEAAXPEAVQKeyEvent@@@Z, ?mouseDoubleClickEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z, ?paintEngine@QWidget@@UEBAPEAVQPaintEngine@@XZ, ?event@QMenu@@MEAA_NPEAVQEvent@@@Z, ?hasHeightForWidth@QWidget@@UEBA_NXZ, ?heightForWidth@QWidget@@UEBAHH@Z, ?minimumSizeHint@QWidget@@UEBA?AVQSize@@XZ, ?setVisible@QWidget@@UEAAX_N@Z, ?devType@QWidget@@UEBAHXZ, ?setVisible@QSystemTrayIcon@@QEAAX_N@Z, ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z, ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z, ??1QSystemTrayIcon@@UEAA@XZ, ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z, ??1QMenu@@UEAA@XZ, ??0QMenu@@QEAA@PEAVQWidget@@@Z, ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z, ?resize@QWidget@@QEAAXHH@Z, ?hide@QWidget@@QEAAXXZ, ?show@QWidget@@QEAAXXZ, ?exec@QApplication@@SAHXZ, ??1QApplication@@UEAA@XZ, ??0QApplication@@QEAA@AEAHPEAPEADH@Z, ?contextMenuEvent@QWidget@@MEAAXPEAVQContextMenuEvent@@@Z, ?focusNextPrevChild@QMenu@@MEAA_N_N@Z, ?initStyleOption@QMenu@@MEBAXPEAVQStyleOptionMenuItem@@PEBVQAction@@@Z, ?timerEvent@QMenu@@MEAAXPEAVQTimerEvent@@@Z
        Qt6WebEngineCore.dll?qt_metacast@QWebEnginePage@@UEAAPEAXPEBD@Z, ?qt_metacall@QWebEnginePage@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?createWindow@QWebEnginePage@@MEAAPEAV1@W4WebWindowType@1@@Z, ?acceptNavigationRequest@QWebEnginePage@@MEAA_NAEBVQUrl@@W4NavigationType@1@_N@Z, ?javaScriptConsoleMessage@QWebEnginePage@@MEAAXW4JavaScriptConsoleMessageLevel@1@AEBVQString@@H1@Z, ?javaScriptPrompt@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@1PEAV3@@Z, ?javaScriptConfirm@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@@Z, ?javaScriptAlert@QWebEnginePage@@MEAAXAEBVQUrl@@AEBVQString@@@Z, ?chooseFiles@QWebEnginePage@@MEAA?AV?$QList@VQString@@@@W4FileSelectionMode@1@AEBV2@1@Z, ?staticMetaObject@QWebEnginePage@@2UQMetaObject@@B, ?event@QWebEnginePage@@UEAA_NPEAVQEvent@@@Z, ?triggerAction@QWebEnginePage@@UEAAXW4WebAction@1@_N@Z, ?featurePermissionRequested@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@@Z, ?setFeaturePermission@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@W4PermissionPolicy@1@@Z, ??1QWebEnginePage@@UEAA@XZ, ??0QWebEnginePage@@QEAA@PEAVQObject@@@Z
        Qt6Gui.dll?triggered@QAction@@QEAAX_N@Z, ??1QIcon@@QEAA@XZ, ??0QIcon@@QEAA@AEBVQString@@@Z, ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z, ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z, ?staticMetaObject@QAction@@2UQMetaObject@@B
        Qt6Sql.dll?removeDatabase@QSqlDatabase@@SAXAEBVQString@@@Z, ?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z, ?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ, ?open@QSqlDatabase@@QEAA_NXZ, ??1QSqlDatabase@@QEAA@XZ, ?text@QSqlError@@QEBA?AVQString@@XZ, ??1QSqlError@@QEAA@XZ, ??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z, ??1QSqlQuery@@QEAA@XZ, ?value@QSqlQuery@@QEBA?AVQVariant@@H@Z, ?next@QSqlQuery@@QEAA_NXZ, ?exec@QSqlQuery@@QEAA_NXZ, ?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z, ?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z
        Qt6Network.dll?get@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@@Z, ?localHostName@QHostInfo@@SA?AVQString@@XZ, ?setBoundary@QHttpMultiPart@@QEAAXAEBVQByteArray@@@Z, ?setContentType@QHttpMultiPart@@QEAAXW4ContentType@1@@Z, ?append@QHttpMultiPart@@QEAAXAEBVQHttpPart@@@Z, ??1QHttpMultiPart@@UEAA@XZ, ??0QHttpMultiPart@@QEAA@W4ContentType@0@PEAVQObject@@@Z, ?setBodyDevice@QHttpPart@@QEAAXPEAVQIODevice@@@Z, ?post@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@PEAVQHttpMultiPart@@@Z, ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z, ??1QHttpPart@@QEAA@XZ, ??0QHttpPart@@QEAA@XZ, ?setRawHeader@QNetworkRequest@@QEAAXAEBVQByteArray@@0@Z, ?setUrl@QNetworkRequest@@QEAAXAEBVQUrl@@@Z, ??1QNetworkAccessManager@@UEAA@XZ, ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z, ??1QNetworkRequest@@QEAA@XZ, ??0QNetworkRequest@@QEAA@XZ, ?error@QNetworkReply@@QEBA?AW4NetworkError@1@XZ, ?finished@QNetworkReply@@QEAAXXZ, ?metaObject@QHttpMultiPart@@UEBAPEBUQMetaObject@@XZ, ?qt_metacast@QHttpMultiPart@@UEAAPEAXPEBD@Z, ?qt_metacall@QHttpMultiPart@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?staticMetaObject@QNetworkReply@@2UQMetaObject@@B, ?setBody@QHttpPart@@QEAAXAEBVQByteArray@@@Z
        Qt6Core.dll??6@YA?AVQDebug@@V0@AEBVQUrl@@@Z, ??5@YAAEAVQDataStream@@AEAV0@AEAVQUrl@@@Z, ??6@YAAEAVQDataStream@@AEAV0@AEBVQUrl@@@Z, ??8QUrl@@QEBA_NAEBV0@@Z, ??MQUrl@@QEBA_NAEBV0@@Z, ??0QUrl@@QEAA@$$QEAV0@@Z, ??0QUrl@@QEAA@AEBV0@@Z, ??0QUrl@@QEAA@XZ, ?qt_metacall@QThread@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QThread@@UEAAPEAXPEBD@Z, ?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ, ??0QMetaType@@QEAA@XZ, ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX@Z, ?staticMetaObject@QThread@@2UQMetaObject@@B, ?qResourceFeatureZlib@@YAEXZ, ?qUnregisterResourceData@@YA_NHPEBE00@Z, ?qRegisterResourceData@@YA_NHPEBE00@Z, ?id@QMetaType@@QEBAHH@Z, ?registerNormalizedTypedef@QMetaType@@SAXAEBVQByteArray@@V1@@Z, ??6QDataStream@@QEAAAEAV0@H@Z, ??5QDataStream@@QEAAAEAV0@AEAH@Z, ?append@QByteArray@@QEAAAEAV1@PEBD@Z, ?reserve@QByteArray@@QEAAX_J@Z, ?className@QMetaObject@@QEBAPEBDXZ, ?event@QObject@@UEAA_NPEAVQEvent@@@Z, ?setPermissions@QFile@@UEAA_NV?$QFlags@W4Permission@QFileDevice@@@@@Z, ?permissions@QFile@@UEBA?AV?$QFlags@W4Permission@QFileDevice@@@@XZ, ?resize@QFile@@UEAA_N_J@Z, ?size@QFile@@UEBA_JXZ, ?fileName@QFile@@UEBA?AVQString@@XZ, ?qt_metacall@QFile@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QFile@@UEAAPEAXPEBD@Z, ?metaObject@QFile@@UEBAPEBUQMetaObject@@XZ, ?readLineData@QFileDevice@@MEAA_JPEAD_J@Z, ?writeData@QFileDevice@@MEAA_JPEBD_J@Z, ?readData@QFileDevice@@MEAA_JPEAD_J@Z, ?atEnd@QFileDevice@@UEBA_NXZ, ?seek@QFileDevice@@UEAA_N_J@Z, ?pos@QFileDevice@@UEBA_JXZ, ?isSequential@QFileDevice@@UEBA_NXZ, ?skipData@QIODevice@@MEAA_J_J@Z, ?readLineData@QIODevice@@MEAA_JPEAD_J@Z, ?waitForBytesWritten@QIODevice@@UEAA_NH@Z, ?waitForReadyRead@QIODevice@@UEAA_NH@Z, ?canReadLine@QIODevice@@UEBA_NXZ, ?bytesToWrite@QIODevice@@UEBA_JXZ, ?bytesAvailable@QIODevice@@UEBA_JXZ, ?reset@QIODevice@@UEAA_NXZ, ?atEnd@QIODevice@@UEBA_NXZ, ?seek@QIODevice@@UEAA_N_J@Z, ?size@QIODevice@@UEBA_JXZ, ?pos@QIODevice@@UEBA_JXZ, ?setupChildProcess@QProcess@@EEAA?AUUse_setChildProcessModifier_Instead@1@XZ, ?writeData@QProcess@@MEAA_JPEBD_J@Z, ?readData@QProcess@@MEAA_JPEAD_J@Z, ?close@QProcess@@UEAAXXZ, ?isSequential@QProcess@@UEBA_NXZ, ?bytesToWrite@QProcess@@UEBA_JXZ, ?waitForBytesWritten@QProcess@@UEAA_NH@Z, ?waitForReadyRead@QProcess@@UEAA_NH@Z, ?open@QProcess@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?qt_metacall@QProcess@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QProcess@@UEAAPEAXPEBD@Z, ?metaObject@QProcess@@UEBAPEBUQMetaObject@@XZ, ??AQJsonDocument@@QEBA?BVQJsonValue@@AEBVQString@@@Z, ?fromJson@QJsonDocument@@SA?AV1@AEBVQByteArray@@PEAUQJsonParseError@@@Z, ??4QJsonDocument@@QEAAAEAV0@$$QEAV0@@Z, ??1QJsonDocument@@QEAA@XZ, ??0QJsonDocument@@QEAA@XZ, ??0QJsonParseError@@QEAA@XZ, ??AQJsonValue@@QEBA?BV0@AEBVQString@@@Z, ?toVariant@QJsonValue@@QEBA?AVQVariant@@XZ, ??1QJsonValue@@QEAA@XZ, ?currentType@QOperatingSystemVersion@@SA?AW4OSType@1@XZ, ?waitForFinished@QProcess@@QEAA_NH@Z, ?start@QProcess@@QEAAXAEBVQString@@AEBV?$QList@VQString@@@@V?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ??1QProcess@@UEAA@XZ, ??0QProcess@@QEAA@PEAVQObject@@@Z, ?homePath@QDir@@SA?AVQString@@XZ, ?exists@QDir@@QEBA_NXZ, ?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z, ?setNameFilters@QDir@@QEAAXAEBV?$QList@VQString@@@@@Z, ??1QDir@@QEAA@XZ, ??0QDir@@QEAA@AEBVQString@@@Z, ?fileName@QFileInfo@@QEBA?AVQString@@XZ, ?filePath@QFileInfo@@QEBA?AVQString@@XZ, ??1QFileInfo@@QEAA@XZ, ??0QFileInfo@@QEAA@AEBV0@@Z, ?toString@QVariant@@QEBA?AVQString@@XZ, ?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ, ??0QVariant@@QEAA@PEBD@Z, ??0QVariant@@QEAA@AEBVQString@@@Z, ??1QVariant@@QEAA@XZ, ?qt_QMetaEnum_debugOperator@@YA?AVQDebug@@AEAV1@_JPEBUQMetaObject@@PEBD@Z, ??6QDebug@@QEAAAEAV0@AEBVQByteArray@@@Z, ??6QDebug@@QEAAAEAV0@PEBD@Z, ??1QDebug@@QEAA@XZ, ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?copy@QFile@@SA_NAEBVQString@@0@Z, ?remove@QFile@@SA_NAEBVQString@@@Z, ?exists@QFile@@QEBA_NXZ, ??1QFile@@UEAA@XZ, ??0QFile@@QEAA@AEBVQString@@@Z, ?close@QFileDevice@@UEAAXXZ, ?write@QIODevice@@QEAA_JAEBVQByteArray@@@Z, ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ, ?deleteLater@QObject@@QEAAXXZ, ?allocate@QArrayData@@SAPEAXPEAPEAU1@_J11W4AllocationOption@1@@Z, ??0QString@@QEAA@AEBV0@@Z, ??1QString@@QEAA@XZ, ??0QString@@QEAA@PEBD@Z, ??1Connection@QMetaObject@@QEAA@XZ, ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z, ?exit@QCoreApplication@@SAXH@Z, ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z, ??1QUrl@@QEAA@XZ, ??0QThread@@QEAA@PEAVQObject@@@Z, ??1QThread@@UEAA@XZ, ?start@QThread@@QEAAXW4Priority@1@@Z, ?event@QThread@@UEAA_NPEAVQEvent@@@Z, ?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z, ?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z, ?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z, ?customEvent@QObject@@MEAAXPEAVQEvent@@@Z, ?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?qBadAlloc@@YAXXZ, ??0QMessageLogger@@QEAA@PEBDH0@Z, ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ, ??0QChar@@QEAA@_S@Z, ??0QChar@@QEAA@D@Z, ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z, ?castHelper@QByteArrayView@@CAPEBDPEBD@Z, ?size@QByteArrayView@@QEBA_JXZ, ?data@QByteArrayView@@QEBAPEBDXZ, ??0QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@PEBD_J@Z, ??0QByteArray@@QEAA@AEBV0@@Z, ??1QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@$$QEAV0@@Z, ??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z, ?data@QByteArray@@QEAAPEADXZ, ?data@QByteArray@@QEBAPEBDXZ, ?left@QByteArray@@QEHAA?AV1@_J@Z, ?right@QByteArray@@QEGBA?AV1@_J@Z, ?append@QByteArray@@QEAAAEAV1@AEBV1@@Z, ??YQByteArray@@QEAAAEAV0@PEBD@Z, ?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z, ?fromBase64@QByteArray@@SA?AV1@AEBV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z, ?size@QByteArray@@QEBA_JXZ, ?length@QByteArray@@QEBA_JXZ, ?isNull@QByteArray@@QEBA_NXZ, ??0QString@@QEAA@$$QEAV0@@Z, ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z, ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z, ?indexOf@QString@@QEBA_JAEBV1@_JW4CaseSensitivity@Qt@@@Z, ?append@QString@@QEAAAEAV1@VQChar@@@Z, ?append@QString@@QEAAAEAV1@AEBV1@@Z, ?append@QString@@QEAAAEAV1@V?$QBasicUtf8StringView@$0A@@@@Z, ?split@QString@@QEBA?AV?$QList@VQString@@@@AEBV1@V?$QFlags@W4SplitBehaviorFlags@Qt@@@@W4CaseSensitivity@Qt@@@Z, ?toUtf8@QString@@QEHAA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEGBA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ, ?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z, ?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z, ?toInt@QString@@QEBAHPEA_NH@Z, ??YQString@@QEAAAEAV0@PEBD@Z, ??8QString@@QEBA_NPEBD@Z, ?QStringList_join@QtPrivate@@YA?AVQString@@PEBV?$QList@VQString@@@@PEBVQChar@@_J@Z
        KERNEL32.dllWideCharToMultiByte, LocalFree, GetCommandLineW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleW, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext
        VCRUNTIME140_1.dll__CxxFrameHandler4
        VCRUNTIME140.dll_CxxThrowException, memcpy, memcmp, memmove, __std_terminate, memset, __current_exception, __current_exception_context, __C_specific_handler, __std_exception_copy, __std_exception_destroy
        api-ms-win-crt-heap-l1-1-0.dll_set_new_mode, free, _callnewh, malloc
        api-ms-win-crt-runtime-l1-1-0.dll_register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _initialize_onexit_table, _get_narrow_winmain_command_line, _initterm, _initterm_e, exit, _exit, _initialize_narrow_environment, _c_exit, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, __p___argc, terminate, __p___argv
        api-ms-win-crt-math-l1-1-0.dll__setusermatherr
        api-ms-win-crt-stdio-l1-1-0.dll_set_fmode, __p__commode
        api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
        SHELL32.dllCommandLineToArgvW

        Possible Origin

        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States

        Network Behavior

        ⊘No network behavior found

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:12:13:00
        Start date:10/10/2024
        Path:C:\Users\user\Desktop\4WRYCj0Ea4.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\4WRYCj0Ea4.exe"
        Imagebase:0x7ff67dc50000
        File size:233'472 bytes
        MD5 hash:ED60B3913E6694F4A0ED2FE25551BD1F
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Disassembly

        Reset < >

          Non-executed Functions

          Function 00007FF67DC532A0 Relevance: 333.7, APIs: 172, Strings: 18, Instructions: 1152windowmemoryCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$V0@@$Char@@Char@@@$A@$$$?arg@Byte$Dir@@$?append@$Array$FileFlags@List@View@@$V1@@$?file?size@Array@@Info@@Path@String@@@$Debug@@$?data@?entryDir@@@@Dir@@@@@Filter@Flag@InfoInfo@@@@Sort$?cast?homeCaseHelper@Logger@@MessageName@Qt@@@Sensitivity@$?allocate@?debug@?exists@?index?remove?remove@?set?split@A@@@@AllocationArray@@@BasicBehaviorData@@Database@Database@@File@@Filters@Int@NameNull@Option@1@@Qt@@@@SplitStringString@@@@String@@@@@U1@_Utf8V1@_View@$0freememcmp
          • String ID: %1_%2$%1_%2_%3$%1_%2_%3_%4$%1_%2_%3_%4_%5$*.ldb$*.log$/Library/Keychains/login.keychain-db$/Local Extension Settings/$/Local State$/Login Data$/pwd$Default$Profile $key$logkc_db$lst$pld$pwd
          • API String ID: 2470095737-179149765
          • Opcode ID: e75ed72665c7e715ec93b6a158da1c2838241fed183d27a37c92389dd65e0937
          • Instruction ID: 0cbd361a3b77f3a0623376c39fbfe79fcba0d0a3a648727153c9a323629cd9c0
          • Opcode Fuzzy Hash: e75ed72665c7e715ec93b6a158da1c2838241fed183d27a37c92389dd65e0937
          • Instruction Fuzzy Hash: C7C26233A28A4296EB10CF60E8546BD7B75FB95784F905631DA0F87A64EF3CD58AC700
          Function 00007FF67DC54580 Relevance: 261.7, APIs: 138, Strings: 11, Instructions: 925windowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$Debug@@$Logger@@Message$Database@@Error@@$?debug@Query@@$?home?last?text@A@$$Dir@@Error@Path@String@@0@String@@@V0@@$?add?copy@?exec@?open@?prepare@?setArray@@ByteDatabaseDatabase@Database@@@File@@Name@
          • String ID: %s.$/Login Data$/pwd$@$Error occurred opening the database.$Error occurred querying.$QSQLITE$origin_url: $password: $select username_value, password_value, origin_url from logins order by date_created$username:
          • API String ID: 3116649450-68594496
          • Opcode ID: 87eb3524cc2902ae8cb3a7b0eecf3ab74b57156cef26986fe3b052fb04e4b5de
          • Instruction ID: 619e5e12daac0e7d0e3f369b36eb934ffb7e5fff4586df5042e17f4c73fe4d71
          • Opcode Fuzzy Hash: 87eb3524cc2902ae8cb3a7b0eecf3ab74b57156cef26986fe3b052fb04e4b5de
          • Instruction Fuzzy Hash: 6D929333B28A4695EB10CF64D8542B92B75FB95794FA01631EA4F876A4FF3CD58AC300
          Function 00007FF67DC55460 Relevance: 139.0, APIs: 73, Strings: 6, Instructions: 788windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$?homeDir@@Path@Process@@memmove$Base@@@@@ByteDebug@@DeviceDevice@@File@@Flag@Flags@ModeOpen$?start@Array@@List@Logger@@MessageNetworkObject@@@String@@@@free$?close@?debug@?delete?error@?open@?read?wait?write@All@Array@@@Error@1@FileFinished@Later@Object@@Reply@@String@@@
          • String ID: --directory$-xf$/.pyp/python.exe$/99$Download Python Success!$tar
          • API String ID: 2657583961-1090138706
          • Opcode ID: 4e7919c302c0a20793cb69706c1d2db654ec3416f7813958a1fba0900339d679
          • Instruction ID: e8d9c05f2a8ea9ead038ff2a7a8b5f83ff5e29d775cc63cc94502c40d0f89f2f
          • Opcode Fuzzy Hash: 4e7919c302c0a20793cb69706c1d2db654ec3416f7813958a1fba0900339d679
          • Instruction Fuzzy Hash: 9E628F23B38A4682EE108F54D4446B96775FB95B94FA40632EA4F877A4FF3CE586C700
          Function 00007FF67DC56880 Relevance: 119.9, APIs: 56, Strings: 12, Instructions: 881COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove$?currentOperatingSystemType@Type@1@Version@@free
          • String ID: /.config/BraveSoftware/Brave-Browser$/.config/google-chrome$/.config/opera$/AppData/Local/BraveSoftware/Brave-Browser/User Data$/AppData/Local/Google/Chrome/User Data$/AppData/Roaming/Opera Software/Opera Stable$/Library/Application Support/BraveSoftware/Brave-Browser$/Library/Application Support/Google/Chrome$/Library/Application Support/com.operasoftware.opera$/Users$/home$C:\Users
          • API String ID: 283656904-339602194
          • Opcode ID: 82db9339f0e1eaa9adff96c3968b96f3d9e0805db4bdf7fe9cfc3cb564ea333a
          • Instruction ID: 347d0ac69ec871d9b1cb0e08fe6f4398b123c6ace69155915ff7a37955a77ede
          • Opcode Fuzzy Hash: 82db9339f0e1eaa9adff96c3968b96f3d9e0805db4bdf7fe9cfc3cb564ea333a
          • Instruction Fuzzy Hash: 33827173F68A5685EF10CB64D4456FC3375EB41788BA44A32DA0F97694EF28E98BC340
          Function 00007FF67DC52B30 Relevance: 114.0, APIs: 58, Strings: 7, Instructions: 300networkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: Http$Part@@$Byte$Array@@$?setVariant@@$String@@$Header@Headers@KnownMultiNetworkRequest@@Variant@@@$?append@Array@@@$Body@ContentPart@@@$HostString@@@V0@@$?arg@?localA@$$Bit@BodyBoundary@Char@@Char@@@Device@Device@@@File@@Info@@Local8Name@Object@@@Type@Type@0@Type@1@@Utf8@V1@@malloc
          • String ID: ---------------------------99614912995$application/json$application/octet-stream$form-data; name="hid";$form-data; name="multi_file"; filename="%1"$form-data; name="type";${"options":{"filename":"
          • API String ID: 3221083236-1343757518
          • Opcode ID: 2257e73bf23889e1784f3b77e52d35b799edd8af56a0dea0958602e55cc705bf
          • Instruction ID: 3c94a076c47979c4f7d7c7892e34188893649f279d16276ce8b8b011a6a8dfb9
          • Opcode Fuzzy Hash: 2257e73bf23889e1784f3b77e52d35b799edd8af56a0dea0958602e55cc705bf
          • Instruction Fuzzy Hash: 93D15022B15A46A6EB04CFA0D8542BC3B36FB85749B915A31DA0FD7664FF3CD58AC340
          Function 00007FF67DC525C0 Relevance: 70.3, APIs: 37, Strings: 3, Instructions: 340windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$ByteDebug@@Device@@File@@$?homeArray@@Base@@@@@DeviceDir@@Flag@Flags@Logger@@MessageModeNetworkOpenPath@Process@@memmove$?close@?debug@?delete?error@?open@?read?start@?write@All@Array@@@Error@1@FileLater@List@Object@@Object@@@Reply@@String@@@String@@@@free
          • String ID: /99$Download Client Success!$python
          • API String ID: 1790123882-3274328065
          • Opcode ID: c90c708b8ad0910d8b37935de952eafb61b5d47e074f2be3ff5df6e6c0b9aa0d
          • Instruction ID: 7237f1b3a528f0f708113fbe9064549bb5e813f5f009161644395fed90c137d0
          • Opcode Fuzzy Hash: c90c708b8ad0910d8b37935de952eafb61b5d47e074f2be3ff5df6e6c0b9aa0d
          • Instruction Fuzzy Hash: 7AE18E33B24A4696EF10CB64D4542AC67B5EB55B94BA00632DA0FD7794FF38D58BC340
          Function 00007FF67DC59438 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
          • String ID:
          • API String ID: 313767242-0
          • Opcode ID: e87d12d99385042d4949b8c5bd1c22cd590a47647924f4e3f52ec0849df090fd
          • Instruction ID: b6b3a74481801418c48930b258960ebceb846dc8a490dcb10a083e19ea54511c
          • Opcode Fuzzy Hash: e87d12d99385042d4949b8c5bd1c22cd590a47647924f4e3f52ec0849df090fd
          • Instruction Fuzzy Hash: 6C315073618B8186EB608F60E8403ED7779FB84744F54467ADA4E87B95EF38D589C700
          Function 00007FF67DC59688 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
          • String ID:
          • API String ID: 2933794660-0
          • Opcode ID: 4f157ab6a1cb89a4cbdce1cc7f0321ce9b935f935ff9ceaa8a9d96a86b26a37f
          • Instruction ID: e4b580d2ddb68f445543a6979d75dcb8e516e873081c064f31bb63789317fdf2
          • Opcode Fuzzy Hash: 4f157ab6a1cb89a4cbdce1cc7f0321ce9b935f935ff9ceaa8a9d96a86b26a37f
          • Instruction Fuzzy Hash: 14115E22B25F018AEB00CF60E8442B837B8FB58758F040F31DA2D867A4EF3CD1A98340
          Function 00007FF67DC5961C Relevance: .0, Instructions: 2COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 402c445b4f9602fece9a39d84b891af1783bdcb3ee13c96a4a503dfc8b4cffa6
          • Instruction ID: 9cb6a7b77825d548b4aa2c82bfbc1d4c2ff4df4db87d402acaecdb52235b8c87
          • Opcode Fuzzy Hash: 402c445b4f9602fece9a39d84b891af1783bdcb3ee13c96a4a503dfc8b4cffa6
          • Instruction Fuzzy Hash: EEA001A292880690EA448B50A8606612A39BB94300B604BB1D01EC1060BE2CA5868301
          Function 00007FF67DC51610 Relevance: 107.0, APIs: 55, Strings: 6, Instructions: 298windownetworkthreadCOMMON
          Download Yara Rule
          APIs
          • ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF67DC51646
          • ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF67DC5164F
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51661
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF67DC51674
          • ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF67DC5167E
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF67DC5168C
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC51698
            • Part of subcall function 00007FF67DC51040: ??0QThread@@QEAA@PEAVQObject@@@Z.QT6CORE ref: 00007FF67DC51074
            • Part of subcall function 00007FF67DC51040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF67DC5108B
            • Part of subcall function 00007FF67DC51040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF67DC51098
            • Part of subcall function 00007FF67DC51040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF67DC510A5
            • Part of subcall function 00007FF67DC51040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF67DC510B0
            • Part of subcall function 00007FF67DC51040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF67DC510BB
            • Part of subcall function 00007FF67DC51040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF67DC510C6
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC510D8
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51141
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51154
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51167
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC5117D
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51193
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC511A9
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC511BF
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC511D5
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC511EB
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51201
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51217
            • Part of subcall function 00007FF67DC51040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC5122D
          • ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF67DC516B1
            • Part of subcall function 00007FF67DC587F4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67DC516DD), ref: 00007FF67DC5880E
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF67DC51739
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF67DC51744
          • ??0QWebuserView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF67DC51750
            • Part of subcall function 00007FF67DC587F4: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF67DC58824
            • Part of subcall function 00007FF67DC57BE0: ??0QWebuserPage@@QEAA@PEAVQObject@@@Z.QT6WEBENGINECORE(?,?,?,?,?,?,?,?,?,?,?,00007FF67DC51772), ref: 00007FF67DC57BF2
            • Part of subcall function 00007FF67DC57BE0: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF67DC57C8F
            • Part of subcall function 00007FF67DC57BE0: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF67DC57C9A
          • ?setPage@QWebuserView@@QEAAXPEAVQWebuserPage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF67DC5177A
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC5178C
          • ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF67DC517A2
          • ?load@QWebuserView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF67DC517B0
          • ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF67DC517BE
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC517CA
          • ?resize@QWidget@@QEAAXHH@Z.QT6WIDGETS ref: 00007FF67DC517DF
          • ?show@QWidget@@QEAAXXZ.QT6WIDGETS ref: 00007FF67DC517E9
          • ??0QMenu@@QEAA@PEAVQWidget@@@Z.QT6WIDGETS ref: 00007FF67DC51808
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC5182E
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF67DC5183C
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC51849
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF67DC518DC
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF67DC518E9
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC518FA
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF67DC51908
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC51915
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF67DC519A1
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF67DC519AE
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC519BF
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF67DC519CD
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC519DA
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF67DC51A4E
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF67DC51A5B
          • ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z.QT6WIDGETS ref: 00007FF67DC51A67
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51A79
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF67DC51A8B
          • ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z.QT6WIDGETS ref: 00007FF67DC51A99
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF67DC51AA7
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC51AB2
          • ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z.QT6WIDGETS ref: 00007FF67DC51ABF
          • ?setVisible@QSystemTrayIcon@@QEAAX_N@Z.QT6WIDGETS ref: 00007FF67DC51ACB
          • ?exec@QApplication@@SAHXZ.QT6WIDGETS ref: 00007FF67DC51AD1
          • ??1QSystemTrayIcon@@UEAA@XZ.QT6WIDGETS ref: 00007FF67DC51ADD
          • ??1QWebuserView@@UEAA@XZ.QT6WEBENGINEWIDGETS ref: 00007FF67DC51AE8
            • Part of subcall function 00007FF67DC51370: ??1QString@@QEAA@XZ.QT6CORE(?,?,?,00007FF67DC51348), ref: 00007FF67DC513B3
            • Part of subcall function 00007FF67DC51370: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67DC51348), ref: 00007FF67DC513C5
            • Part of subcall function 00007FF67DC51300: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67DC51354
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC51B2C
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF67DC51B36
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF67DC51B40
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF67DC51B4A
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF67DC51B54
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF67DC51B5E
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF67DC51B68
          • ??1QThread@@UEAA@XZ.QT6CORE ref: 00007FF67DC51B72
          • ??1QApplication@@UEAA@XZ.QT6WIDGETS ref: 00007FF67DC51B7D
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$Object@@$Network$Connection@Meta$Icon@@$?setAccessuserManager@@Object@@@Request@@$?connectApplication@@Base@ConnectionImpl@ObjectPrivate@@Qt@@SlotString@@@SystemTrayType@U3@@Widget@@$View@@$?addAction@Action@@Thread@@$Icon@Icon@@@Url@@Widget@@@Windowfree$?exec@?load@?resize@?show@?start@Closed@Concurrency::cancel_current_taskContextLastMenu@Menu@@Menu@@@Mode@0@@Page@Page@@Page@@@ParsingPriority@1@@QuitUrl@@@Visible@malloc
          • String ID: &Close$&Hide$:/logo.ico$:/logo.png$Sho&w$https://hello.freeconference.com/login/access-code
          • API String ID: 90596291-1651899464
          • Opcode ID: 8a53b885654be96117fcf3efd818479e41000409e70cfc6ff78aceead7eee886
          • Instruction ID: deb823eb5de43ecebda0942e6338f0d03f479e7aea23c833f30f14b1faec4b7c
          • Opcode Fuzzy Hash: 8a53b885654be96117fcf3efd818479e41000409e70cfc6ff78aceead7eee886
          • Instruction Fuzzy Hash: 67F12F32A28A8696EB10DF60E8542FD7B75FB85745F504631D64F83A68EF3CD68AC700
          Function 00007FF67DC57810 Relevance: 79.0, APIs: 40, Strings: 5, Instructions: 227networkwindowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$Network$Debug@@$Object@@$Meta$Connection@Logger@@MessageReply@@Url@@$ByteV0@@$?append@?connect?debug@?error@?get@?setA@@@@AccessArray@@Base@BasicConnectionError@1@Impl@Manager@@Mode@0@@ObjectParsingPrivate@@Qt@@Request@@Request@@@SlotStringType@U3@@Url@Url@@@Utf8View@$0$?delete?home?qt_?read?remove@A@$$All@Array@@@Device@@Dir@@Enum_debugFile@@Later@Operator@@Path@String@@@V1@_malloc
          • String ID: /client/99$/pdown$/pwd$Error: $NetworkError
          • API String ID: 933619888-2378683402
          • Opcode ID: 8c97c84bfd681f1d82e4be2f28a5058a4d5eedc67e659c35fbee2bdc4dd354d4
          • Instruction ID: add1b4a12edd67bd1d0a3c57024e0e2cd9edf86040d85c928b07094e7f2ef87a
          • Opcode Fuzzy Hash: 8c97c84bfd681f1d82e4be2f28a5058a4d5eedc67e659c35fbee2bdc4dd354d4
          • Instruction Fuzzy Hash: 06B11033614B469AEB108F60E8542BD77B9FB45749F504A31DA4F93A68FF38E58AC340
          Function 00007FF67DC52FE0 Relevance: 73.7, APIs: 40, Strings: 2, Instructions: 163COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: Byte$Array@@$Json$Document@@String@@Value@@$File@@$String@@@V0@$$V0@@Variant@@$?fromFlags@Parse$?data@?exists@?length@?open@?read?right@?size@All@Array@Array@@@@@Base64Base64@Base@@@@@DeviceDevice@@Error@@Error@@@Flag@Json@ModeOpenOption@V1@_Variant@
          • String ID: encrypted_key$os_crypt
          • API String ID: 2100764627-2981665407
          • Opcode ID: 462a6ca5deb5cf58c25dcf3a445c5d071fcec225adf52fa920e4bd3c65771705
          • Instruction ID: efc26f1a6ad2302ee7282fa87ccee48059a4baae05a8afa1e813bceed71c624a
          • Opcode Fuzzy Hash: 462a6ca5deb5cf58c25dcf3a445c5d071fcec225adf52fa920e4bd3c65771705
          • Instruction Fuzzy Hash: 7B811F32A24A4696EB009F60E8542BD7B35FB95755F901631D64FC2678FF3CD58AC700
          Function 00007FF67DC51040 Relevance: 61.4, APIs: 22, Strings: 13, Instructions: 141networkmemorythreadCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$Network$Object@@@$AccessManager@@Request@@$?allocate@AllocationArrayData@@Option@1@@Thread@@U1@_V0@@
          • String ID: acmacodkjbdgmoleebolmdjonilkdbch$aeachknmefphepccionboohckonoeemg$aholpfdialjgjfhomihkjbmgjidlcdno$bfnaelmomeimhlpmgjnjophhpkkoljpa$dlcobpjiigpikoobohmabehhmhfoodbb$ejbalbakoplchlghecdalmeeeajnimhm$fhbohimaelbohpjbbldcngcnapndodjp$hifafgmccdpekplomjjkcfgodnhcellj$hnfanknocfeofbddgcijnmhnfnkdnaad$http://185.235.241.208:1224$ibnejdfjmmkpcnlpebklmnkoeoihofec$jblndlipeogpafnldhgmapagcccfchpi$nkbihfbeogaeaoehlefnkodbefgpgknn
          • API String ID: 2244258320-141366666
          • Opcode ID: 04edd7c80f13656f44833435c98dc11b7eaceffac6a0fcf3fa6fbd189730e77b
          • Instruction ID: f1a8332d2432b3ba471ec7d2ea37dc4d3209ae7b80b567c45f0b54ae8b85de1b
          • Opcode Fuzzy Hash: 04edd7c80f13656f44833435c98dc11b7eaceffac6a0fcf3fa6fbd189730e77b
          • Instruction Fuzzy Hash: 11712132628F46A2E7148B20E9403B97B79FB99745F505632D64FC3664EF3CE5AAC700
          Function 00007FF67DC57BD0 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 111COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: Byte$Array@@$ArrayView@@$?size@$?append@?data@Meta$?castHelper@Type@@$?class?id@?register?reserve@Name@NormalizedNull@Object@@Typedef@V1@@memcmp
          • String ID: Feature
          • API String ID: 2588427355-3496627450
          • Opcode ID: 1a8172886d55ae340d4fc53b7cf1db0fa770636e8abb76dff8d5fbebb6e29fa5
          • Instruction ID: cce163d62811dc37ca5f35db6229f5949e78d1ca94c5bd8058f875e3362d8d05
          • Opcode Fuzzy Hash: 1a8172886d55ae340d4fc53b7cf1db0fa770636e8abb76dff8d5fbebb6e29fa5
          • Instruction Fuzzy Hash: F1514823629A4682EA10CF11E84427AA779FF94B90F644731D98FC36A4FF7CD586C700
          Function 00007FF67DC574E0 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 98networkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: ByteNetwork$Array@@String@@$Object@@Request@@$?setConnection@MetaUrl@@$?append@?connect?post@A@@@@AccessArray@@0@Base@BasicConnectionHeader@HttpImpl@Manager@@Mode@0@@MultiObjectParsingPart@@@Private@@Qt@@Reply@@SlotStringType@U3@@Url@Url@@@Utf8V0@@View@$0malloc
          • String ID: /uploads$Content-Type$multipart/form-data; boundary=---------------------------99614912995
          • API String ID: 1290966195-1692235574
          • Opcode ID: e41848515c30137a5d582768e0bedd6adad1b03687c5d8700f91241f336b0804
          • Instruction ID: e0167d8352d9115fc2bcbeb31bfb5f7a4b6ca7b751c624c882533cd4a4d410d1
          • Opcode Fuzzy Hash: e41848515c30137a5d582768e0bedd6adad1b03687c5d8700f91241f336b0804
          • Instruction Fuzzy Hash: 07414033614B46AAEB10DF60E8402EC7B75FB44759F504631DA5EA3AA4FF38D69AC340
          Function 00007FF67DC56570 Relevance: 10.7, APIs: 7, Instructions: 182memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE ref: 00007FF67DC56630
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF67DC56640
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF67DC56676
          • ??0QString@@QEAA@$$QEAV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF67DC51FFB), ref: 00007FF67DC56706
          • ??0QString@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF67DC51FFB), ref: 00007FF67DC56776
          • ??1QString@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF67DC51FFB), ref: 00007FF67DC56803
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF67DC51FFB), ref: 00007FF67DC56817
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$Alloc@@ArrayData@@V0@@$?reallocateA@$$AllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 2195022652-0
          • Opcode ID: 7e6024c6fd6ce686134064f5e663040e2ce46f345414f692286dbbd2c441937c
          • Instruction ID: a3d27566221514f71c579fcf159add04dfb43d6f655873caad8ea1decea623b7
          • Opcode Fuzzy Hash: 7e6024c6fd6ce686134064f5e663040e2ce46f345414f692286dbbd2c441937c
          • Instruction Fuzzy Hash: B9717B73B29B4682DE54CF09E4402A977B8FB54B84FA44A36DA4E83754EF3CD4A6C700
          Function 00007FF67DC56320 Relevance: 10.7, APIs: 7, Instructions: 160memoryCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: FileInfo@@$Alloc@@ArrayData@@V0@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 1506373291-0
          • Opcode ID: 72faf5c7bb74e416513515e29e26c92ef6f2e4889ef977e0e00335d1ea80eee7
          • Instruction ID: b5a54aeb423f34427fa71788ab8e0297aa338c57fc96d72bda056ba65c8a912a
          • Opcode Fuzzy Hash: 72faf5c7bb74e416513515e29e26c92ef6f2e4889ef977e0e00335d1ea80eee7
          • Instruction Fuzzy Hash: 77617933B69B8582EA10CF05E44462977B9FB54B94B694A31DE5F83798EF38D492C700
          Function 00007FF67DC51E40 Relevance: 10.7, APIs: 7, Instructions: 160COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove
          • String ID:
          • API String ID: 349968220-0
          • Opcode ID: 848a3dbfe2dcae86932bd82157d5e6cf95c7da8895e1f03381ac82001943abb5
          • Instruction ID: 61688feb778cb95729deb983dafe89f46d1559e2c1a2a6b17a48e0e55ee7f387
          • Opcode Fuzzy Hash: 848a3dbfe2dcae86932bd82157d5e6cf95c7da8895e1f03381ac82001943abb5
          • Instruction Fuzzy Hash: 59517173B2564692DE548B19D54827863B4FB54BA0BA44B32EE3E873D0EF3CE596C310
          Function 00007FF67DC598F0 Relevance: 10.6, APIs: 7, Instructions: 117COMMON
          Download Yara Rule
          APIs
          • __p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67DC598F7
          • __p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67DC59906
          • GetCommandLineW.KERNEL32 ref: 00007FF67DC59932
          • CommandLineToArgvW.SHELL32 ref: 00007FF67DC59943
            • Part of subcall function 00007FF67DC51610: ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF67DC51646
            • Part of subcall function 00007FF67DC51610: ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF67DC5164F
            • Part of subcall function 00007FF67DC51610: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC51661
            • Part of subcall function 00007FF67DC51610: ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF67DC51674
            • Part of subcall function 00007FF67DC51610: ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF67DC5167E
            • Part of subcall function 00007FF67DC51610: ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF67DC5168C
            • Part of subcall function 00007FF67DC51610: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC51698
            • Part of subcall function 00007FF67DC51610: ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF67DC516B1
            • Part of subcall function 00007FF67DC51610: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF67DC51739
            • Part of subcall function 00007FF67DC51610: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF67DC51744
            • Part of subcall function 00007FF67DC51610: ??0QWebuserView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF67DC51750
            • Part of subcall function 00007FF67DC51610: ?setPage@QWebuserView@@QEAAXPEAVQWebuserPage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF67DC5177A
            • Part of subcall function 00007FF67DC51610: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF67DC5178C
            • Part of subcall function 00007FF67DC51610: ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF67DC517A2
            • Part of subcall function 00007FF67DC51610: ?load@QWebuserView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF67DC517B0
            • Part of subcall function 00007FF67DC51610: ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF67DC517BE
            • Part of subcall function 00007FF67DC51610: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF67DC517CA
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: String@@$user$?setApplication@@Object@@View@@$CommandConnection@Icon@@LineMetaUrl@@Window$?connect?load@?start@ArgvBase@Closed@ConnectionIcon@Icon@@@Impl@LastMode@0@@ObjectPage@Page@@@ParsingPriority@1@@Private@@Qt@@QuitSlotString@@@Thread@@Type@U3@@Url@@@Widget@@@__p___argc__p___argv
          • String ID:
          • API String ID: 1766454188-0
          • Opcode ID: e991f30005aa828bd03c6dbb383bd67c2b100cd4932cae1a3dd4b1ae0cfad87a
          • Instruction ID: 8c7e01d894469423085b6f0d45892c12f97f37f54f7cb2f6998d95ee271e57aa
          • Opcode Fuzzy Hash: e991f30005aa828bd03c6dbb383bd67c2b100cd4932cae1a3dd4b1ae0cfad87a
          • Instruction Fuzzy Hash: 14515F36A18B8186DA609F15F84036AB7B9FB89BD0F644635DADE83B59DF3CD045CB00
          Function 00007FF67DC58CA8 Relevance: 10.6, APIs: 7, Instructions: 94COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
          • String ID:
          • API String ID: 3995423050-0
          • Opcode ID: 6492ea15be36c43a8f233bd2290bdf9b5a362876fb1c542352af1a1946b46795
          • Instruction ID: 7491756fd2d7e63e6389c5158b774d9a9506c7e351811adfbdb6749e3a9f391f
          • Opcode Fuzzy Hash: 6492ea15be36c43a8f233bd2290bdf9b5a362876fb1c542352af1a1946b46795
          • Instruction Fuzzy Hash: 22315C23E2D20381FA14AB2595513B926B9AF51344FA80FB5D50FC72D7FE2CA8C78250
          Function 00007FF67DC51400 Relevance: 10.5, APIs: 7, Instructions: 31networkCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: Network$AccessManager@@Request@@$String@@free
          • String ID:
          • API String ID: 2366384267-0
          • Opcode ID: 4aa6d46d15a11fa202d5f173bcdb341ed8c268c763fb1a77932c93dfd6bdd6ba
          • Instruction ID: 79446e0251086ad5c144e688e7bf3aef4c7eb4a24fe5c6b1dbbf8e4765f03919
          • Opcode Fuzzy Hash: 4aa6d46d15a11fa202d5f173bcdb341ed8c268c763fb1a77932c93dfd6bdd6ba
          • Instruction Fuzzy Hash: 3E015922A65806A1DB44EF60D8657BC3B39FF51B49F940531C90F860A5BE28D5CEC360
          Function 00007FF67DC5A62A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: __current_exception__current_exception_contextterminate
          • String ID: csm
          • API String ID: 2542180945-1018135373
          • Opcode ID: 35399df40d6b3399d44909a634f2974c5ed6b350caa197db1af6e49fc2e85eba
          • Instruction ID: b5816d1b6680307301014f4c2fd340fd3e87afa04fe8083ba2bed1148b257cf3
          • Opcode Fuzzy Hash: 35399df40d6b3399d44909a634f2974c5ed6b350caa197db1af6e49fc2e85eba
          • Instruction Fuzzy Hash: C9F0E737515A45CAC7159F61EC800AC3378F748B88F5956A0FA4E87756DF38D892C740
          Function 00007FF67DC57D10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: Debug@@$Meta$?qt_Enum_debugObject@@Operator@@V1@_
          • String ID: Feature
          • API String ID: 1967151937-3496627450
          • Opcode ID: 1fb5dfc4f22b017d969a121f60f38bebc694afb9b34a8a70a40863820ec4024f
          • Instruction ID: c2af70fefa70a66178c2e0c05ee134aab4340467a6853be42d2f3267ada2530a
          • Opcode Fuzzy Hash: 1fb5dfc4f22b017d969a121f60f38bebc694afb9b34a8a70a40863820ec4024f
          • Instruction Fuzzy Hash: 40F0FE33518F86D1CB009F44E840169BB78FB85755BA00132E68E53738EF7CD19ACB00
          Function 00007FF67DC56030 Relevance: 6.2, APIs: 4, Instructions: 197memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF67DC51D98), ref: 00007FF67DC560E6
          • ?qBadAlloc@@YAXXZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF67DC51D98), ref: 00007FF67DC560F6
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF67DC56137
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF67DC51D98), ref: 00007FF67DC56306
          Memory Dump Source
          • Source File: 00000000.00000002.3379317427.00007FF67DC51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67DC50000, based on PE: true
          • Associated: 00000000.00000002.3379300804.00007FF67DC50000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379333328.00007FF67DC5B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379348518.00007FF67DC5C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379367090.00007FF67DC6D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.3379383849.00007FF67DC6E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff67dc50000_4WRYCj0Ea4.jbxd
          Similarity
          • API ID: Alloc@@ArrayData@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 915963882-0
          • Opcode ID: fe54435791b4a9b4a9e0debac3381adb84b639cdd26930953992a399eca1f3e5
          • Instruction ID: d70e9a253485c8bb7edf973242f9dff97bb3346c7ce0b53591721e7e0085f551
          • Opcode Fuzzy Hash: fe54435791b4a9b4a9e0debac3381adb84b639cdd26930953992a399eca1f3e5
          • Instruction Fuzzy Hash: C4818D33765F4A82DE54CF49E440669B3B4FB54B94BA04632DB9E83764EF39D1A6C300