Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
TsrKUlTaYJ.exe

Overview

General Information

Sample name:TsrKUlTaYJ.exe
renamed because original name is a hash value
Original sample name:91f96f2ddfa293806ec3effb8e05bc6941660237de90215b23281d706a2bc706.exe
Analysis ID:1530952
MD5:f82510d541e56d7021f020f8b4d6a6d0
SHA1:f2c841c297568f7ac24c6277ea8b6fb3dd2a2a46
SHA256:91f96f2ddfa293806ec3effb8e05bc6941660237de90215b23281d706a2bc706
Tags:185-235-241-208exeuser-JAMESWT_MHT

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected potential crypto function
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • TsrKUlTaYJ.exe (PID: 5220 cmdline: "C:\Users\user\Desktop\TsrKUlTaYJ.exe" MD5: F82510D541E56D7021F020F8B4D6A6D0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: TsrKUlTaYJ.exeAvira: detected
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C0843C0 ?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?copy@QFile@@SA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??0QString@@QEAA@PEBD@Z,?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z,??1QString@@QEAA@XZ,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QSqlDatabase@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlDatabase@@QEAA@XZ,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z,??0QString@@QEAA@PEBD@Z,?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z,??1QString@@QEAA@XZ,?exec@QSqlQuery@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlQuery@@QEAA@XZ,?next@QSqlQuery@@QEAA_NXZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ,??1QVariant@@QEAA@XZ,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?left@QByteArray@@QEHAA?AV1@_J@Z,??1QByteArray@@QEAA@XZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?length@QByteArray@@QEBA_JXZ,EVP_DecryptInit_ex,?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QFile@@QEAA@AEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,??0QChar@@QEAA@D@Z,?size@QByteArray@@QEBA_JXZ,?isNull@QByteArray@@QEBA_NXZ,?data@QByteArray@@QEBAPEBDXZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QStrin0_2_00007FF78C0843C0
Source: TsrKUlTaYJ.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: TsrKUlTaYJ.exeString found in binary or memory: http://185.235.241.208:1224
Source: TsrKUlTaYJ.exeString found in binary or memory: https://hello.freeconference.com/login/access-code
Source: TsrKUlTaYJ.exeString found in binary or memory: https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:1
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C084E900_2_00007FF78C084E90
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C082AD00_2_00007FF78C082AD0
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C0833600_2_00007FF78C083360
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C0843C00_2_00007FF78C0843C0
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C0864C00_2_00007FF78C0864C0
Source: TsrKUlTaYJ.exeBinary or memory string: OriginalFilename vs TsrKUlTaYJ.exe
Source: TsrKUlTaYJ.exe, 00000000.00000000.1257613906.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameFCCCall.exe0 vs TsrKUlTaYJ.exe
Source: TsrKUlTaYJ.exeBinary or memory string: OriginalFilenameFCCCall.exe0 vs TsrKUlTaYJ.exe
Source: classification engineClassification label: mal48.winEXE@1/0@0/0
Source: TsrKUlTaYJ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: libcrypto-1_1-x64.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: qt6webenginewidgets.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: qt6widgets.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: qt6webenginecore.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: qt6gui.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: qt6sql.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: qt6network.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: qt6core.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeSection loaded: vcruntime140.dllJump to behavior
Source: TsrKUlTaYJ.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: TsrKUlTaYJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: TsrKUlTaYJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: TsrKUlTaYJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: TsrKUlTaYJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TsrKUlTaYJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: TsrKUlTaYJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: TsrKUlTaYJ.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: TsrKUlTaYJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TsrKUlTaYJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: TsrKUlTaYJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: TsrKUlTaYJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: TsrKUlTaYJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: TsrKUlTaYJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C0890B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF78C0890B4
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C089298 SetUnhandledExceptionFilter,0_2_00007FF78C089298
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C088C50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF78C088C50
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C0890B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF78C0890B4
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exeCode function: 0_2_00007FF78C089304 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF78C089304

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
DLL Side-Loading		1
DLL Side-Loading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager2
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
TsrKUlTaYJ.exe11%ReversingLabs
TsrKUlTaYJ.exe100%AviraOSX/GM.Agent.RV

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:1TsrKUlTaYJ.exefalse
    		unknown
    http://185.235.241.208:1224TsrKUlTaYJ.exefalse
      		unknown
      https://hello.freeconference.com/login/access-codeTsrKUlTaYJ.exefalse
        		unknown

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1530952
        Start date and time:2024-10-10 18:12:11 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 3m 51s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:14
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:TsrKUlTaYJ.exe
        renamed because original name is a hash value
        Original Sample Name:91f96f2ddfa293806ec3effb8e05bc6941660237de90215b23281d706a2bc706.exe
        Detection:MAL
        Classification:mal48.winEXE@1/0@0/0
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 28
        Cookbook Comments:
        • Found application associated with file extension: .exe

        Warnings

        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
        • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
        • Execution Graph export aborted for target TsrKUlTaYJ.exe, PID 5220 because there are no executed function
        • Not all processes where analyzed, report is missing behavior information
        • VT rate limit hit for: TsrKUlTaYJ.exe

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:PE32+ executable (GUI) x86-64, for MS Windows
        Entropy (8bit):5.976948275298926
        TrID:
        • Win64 Executable GUI (202006/5) 92.65%
        • Win64 Executable (generic) (12005/4) 5.51%
        • Generic Win/DOS Executable (2004/3) 0.92%
        • DOS Executable Generic (2002/1) 0.92%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:TsrKUlTaYJ.exe
        File size:233'472 bytes
        MD5:f82510d541e56d7021f020f8b4d6a6d0
        SHA1:f2c841c297568f7ac24c6277ea8b6fb3dd2a2a46
        SHA256:91f96f2ddfa293806ec3effb8e05bc6941660237de90215b23281d706a2bc706
        SHA512:4971735161433a0d025ca60e48268cad58e944784b4b12cf3b536ffc659bcba1d85477b40ea48e5ffaba4e3e2203838aa4b797d12b18d3fb83ce8e93cf5c23a1
        SSDEEP:3072:6XHBbDqTnxycA1feqZ0kLnGE/KyiOPdP9VCgs83:6XBynxOxLZ02GEKyiE1b3
        TLSH:0D346B5F220702E4E069C27FC68D0642D37EBC568722DBEF1175B81E1EF66E12E79189
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............[...[...[..\[...[.y.Z...[.y.Z...[.y.Z...[.y.Z...[z..Z...[z..Z...[...Z...[...Z...[...[...[.x.Z...[.x0[...[..X[...[.x.Z...

        File Icon

        Icon Hash:21c46db2b26dc421

        Static PE Info

        General

        Entrypoint:0x140008a9c
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x140000000
        Subsystem:windows gui
        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Time Stamp:0x66D1CA4B [Fri Aug 30 13:34:03 2024 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:6
        OS Version Minor:0
        File Version Major:6
        File Version Minor:0
        Subsystem Version Major:6
        Subsystem Version Minor:0
        Import Hash:1132bd17d5f73b3afe0cb6f52fa2e8de

        Entrypoint Preview

        Instruction
        dec eax
        sub esp, 28h
        call 00007EFCF0831C04h
        dec eax
        add esp, 28h
        jmp 00007EFCF083121Fh
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000DD75h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007EFCF0831D92h
        dec eax
        lea eax, dword ptr [0000DD88h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000DD80h]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000DD65h]
        dec eax
        mov dword ptr [ecx], eax
        dec eax
        mov eax, ecx
        ret
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000DD19h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007EFCF0831D36h
        dec eax
        lea eax, dword ptr [0000DD54h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000DD4Ch]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000DD31h]
        dec eax
        mov dword ptr [ecx], eax
        dec eax

        Rich Headers

        Programming Language:
        • [IMP] VS2008 SP1 build 30729

        Data Directories

        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x18a940x17c.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x200000x1c2c8.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1f0000x588.pdata
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x3d0000x234.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x16a100x1c.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x16a800x28.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x168d00x140.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0xb0000xbd8.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x94df0x9600eff0cbd4eaec444dc0cec75dd402f8dbFalse0.45830729166666667data6.042620045470873IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0xb0000x121c40x12200d538febb04e29599e01065005867b26cFalse0.7166891163793103data7.156578443044752IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x1e0000xb800x600406335df6f0d17089eb03a45dde8a3f3False0.2526041666666667data2.7892884724451092IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .pdata0x1f0000x5880x600e2d3f14e20ccd9219f8ed4b4d52ed3d8False0.4850260416666667data4.3370590357365915IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .rsrc0x200000x1c2c80x1c400c5efc6b843dd32bd88c09b3bd6986a2dFalse0.20460280696902655data3.977293660955606IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .reloc0x3d0000x2340x4008f2502c459c835abcab5108c8106bfc9False0.42578125data3.7157958194623815IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

        Resources

        NameRVASizeTypeLanguageCountryZLIB Complexity
        RT_ICON0x202400x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/mEnglishUnited States0.36879432624113473
        RT_ICON0x206a80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/mEnglishUnited States0.19606003752345216
        RT_ICON0x217500x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/mEnglishUnited States0.14066390041493776
        RT_ICON0x23cf80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/mEnglishUnited States0.108171941426547
        RT_ICON0x27f200x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mEnglishUnited States0.06342422808470366
        RT_ICON0x387480x3619PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9919849808650444
        RT_GROUP_ICON0x3bd680x5adataEnglishUnited States0.7444444444444445
        RT_VERSION0x3bdc80x27cdataEnglishUnited States0.470125786163522
        RT_MANIFEST0x3c0480x27eXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5501567398119123

        Imports

        DLLImport
        CRYPT32.dllCryptUnprotectData
        libcrypto-1_1-x64.dllEVP_CIPHER_CTX_free, EVP_CIPHER_CTX_new, EVP_DecryptUpdate, EVP_DecryptInit_ex, EVP_aes_256_gcm
        Qt6WebEngineWidgets.dll?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z, ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z, ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z, ??1QWebEngineView@@UEAA@XZ
        Qt6Widgets.dll?paintEvent@QMenu@@MEAAXPEAVQPaintEvent@@@Z, ?hideEvent@QMenu@@MEAAXPEAVQHideEvent@@@Z, ?leaveEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?enterEvent@QMenu@@MEAAXPEAVQEnterEvent@@@Z, ?wheelEvent@QMenu@@MEAAXPEAVQWheelEvent@@@Z, ?mouseMoveEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mousePressEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mouseReleaseEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?keyPressEvent@QMenu@@MEAAXPEAVQKeyEvent@@@Z, ?changeEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?sizeHint@QMenu@@UEBA?AVQSize@@XZ, ?qt_metacall@QMenu@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QMenu@@UEAAPEAXPEBD@Z, ?metaObject@QMenu@@UEBAPEBUQMetaObject@@XZ, ?inputMethodQuery@QWidget@@UEBA?AVQVariant@@W4InputMethodQuery@Qt@@@Z, ?inputMethodEvent@QWidget@@MEAAXPEAVQInputMethodEvent@@@Z, ?sharedPainter@QWidget@@MEBAPEAVQPainter@@XZ, ?redirected@QWidget@@MEBAPEAVQPaintDevice@@PEAVQPoint@@@Z, ?initPainter@QWidget@@MEBAXPEAVQPainter@@@Z, ?metric@QWidget@@MEBAHW4PaintDeviceMetric@QPaintDevice@@@Z, ?nativeEvent@QWidget@@MEAA_NAEBVQByteArray@@PEAXPEA_J@Z, ?showEvent@QWidget@@MEAAXPEAVQShowEvent@@@Z, ?dropEvent@QWidget@@MEAAXPEAVQDropEvent@@@Z, ?dragLeaveEvent@QWidget@@MEAAXPEAVQDragLeaveEvent@@@Z, ?dragMoveEvent@QWidget@@MEAAXPEAVQDragMoveEvent@@@Z, ?dragEnterEvent@QWidget@@MEAAXPEAVQDragEnterEvent@@@Z, ?tabletEvent@QWidget@@MEAAXPEAVQTabletEvent@@@Z, ?actionEvent@QMenu@@MEAAXPEAVQActionEvent@@@Z, ?closeEvent@QWidget@@MEAAXPEAVQCloseEvent@@@Z, ?resizeEvent@QWidget@@MEAAXPEAVQResizeEvent@@@Z, ?moveEvent@QWidget@@MEAAXPEAVQMoveEvent@@@Z, ?focusOutEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?focusInEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?keyReleaseEvent@QWidget@@MEAAXPEAVQKeyEvent@@@Z, ?mouseDoubleClickEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z, ?paintEngine@QWidget@@UEBAPEAVQPaintEngine@@XZ, ?event@QMenu@@MEAA_NPEAVQEvent@@@Z, ?hasHeightForWidth@QWidget@@UEBA_NXZ, ?heightForWidth@QWidget@@UEBAHH@Z, ?minimumSizeHint@QWidget@@UEBA?AVQSize@@XZ, ?setVisible@QWidget@@UEAAX_N@Z, ?devType@QWidget@@UEBAHXZ, ?setVisible@QSystemTrayIcon@@QEAAX_N@Z, ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z, ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z, ??1QSystemTrayIcon@@UEAA@XZ, ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z, ??1QMenu@@UEAA@XZ, ??0QMenu@@QEAA@PEAVQWidget@@@Z, ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z, ?resize@QWidget@@QEAAXHH@Z, ?hide@QWidget@@QEAAXXZ, ?show@QWidget@@QEAAXXZ, ?exec@QApplication@@SAHXZ, ??1QApplication@@UEAA@XZ, ??0QApplication@@QEAA@AEAHPEAPEADH@Z, ?contextMenuEvent@QWidget@@MEAAXPEAVQContextMenuEvent@@@Z, ?focusNextPrevChild@QMenu@@MEAA_N_N@Z, ?initStyleOption@QMenu@@MEBAXPEAVQStyleOptionMenuItem@@PEBVQAction@@@Z, ?timerEvent@QMenu@@MEAAXPEAVQTimerEvent@@@Z
        Qt6WebEngineCore.dll?qt_metacast@QWebEnginePage@@UEAAPEAXPEBD@Z, ?qt_metacall@QWebEnginePage@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?createWindow@QWebEnginePage@@MEAAPEAV1@W4WebWindowType@1@@Z, ?acceptNavigationRequest@QWebEnginePage@@MEAA_NAEBVQUrl@@W4NavigationType@1@_N@Z, ?javaScriptConsoleMessage@QWebEnginePage@@MEAAXW4JavaScriptConsoleMessageLevel@1@AEBVQString@@H1@Z, ?javaScriptPrompt@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@1PEAV3@@Z, ?javaScriptConfirm@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@@Z, ?javaScriptAlert@QWebEnginePage@@MEAAXAEBVQUrl@@AEBVQString@@@Z, ?chooseFiles@QWebEnginePage@@MEAA?AV?$QList@VQString@@@@W4FileSelectionMode@1@AEBV2@1@Z, ?staticMetaObject@QWebEnginePage@@2UQMetaObject@@B, ?event@QWebEnginePage@@UEAA_NPEAVQEvent@@@Z, ?triggerAction@QWebEnginePage@@UEAAXW4WebAction@1@_N@Z, ?featurePermissionRequested@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@@Z, ?setFeaturePermission@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@W4PermissionPolicy@1@@Z, ??1QWebEnginePage@@UEAA@XZ, ??0QWebEnginePage@@QEAA@PEAVQObject@@@Z
        Qt6Gui.dll?triggered@QAction@@QEAAX_N@Z, ??1QIcon@@QEAA@XZ, ??0QIcon@@QEAA@AEBVQString@@@Z, ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z, ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z, ?staticMetaObject@QAction@@2UQMetaObject@@B
        Qt6Sql.dll?removeDatabase@QSqlDatabase@@SAXAEBVQString@@@Z, ?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z, ?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ, ?open@QSqlDatabase@@QEAA_NXZ, ??1QSqlDatabase@@QEAA@XZ, ?text@QSqlError@@QEBA?AVQString@@XZ, ??1QSqlError@@QEAA@XZ, ??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z, ??1QSqlQuery@@QEAA@XZ, ?value@QSqlQuery@@QEBA?AVQVariant@@H@Z, ?next@QSqlQuery@@QEAA_NXZ, ?exec@QSqlQuery@@QEAA_NXZ, ?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z, ?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z
        Qt6Network.dll?get@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@@Z, ?localHostName@QHostInfo@@SA?AVQString@@XZ, ?setBoundary@QHttpMultiPart@@QEAAXAEBVQByteArray@@@Z, ?setContentType@QHttpMultiPart@@QEAAXW4ContentType@1@@Z, ?append@QHttpMultiPart@@QEAAXAEBVQHttpPart@@@Z, ??1QHttpMultiPart@@UEAA@XZ, ??0QHttpMultiPart@@QEAA@W4ContentType@0@PEAVQObject@@@Z, ?setBodyDevice@QHttpPart@@QEAAXPEAVQIODevice@@@Z, ?post@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@PEAVQHttpMultiPart@@@Z, ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z, ??1QHttpPart@@QEAA@XZ, ??0QHttpPart@@QEAA@XZ, ?setRawHeader@QNetworkRequest@@QEAAXAEBVQByteArray@@0@Z, ?setUrl@QNetworkRequest@@QEAAXAEBVQUrl@@@Z, ??1QNetworkAccessManager@@UEAA@XZ, ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z, ??1QNetworkRequest@@QEAA@XZ, ??0QNetworkRequest@@QEAA@XZ, ?error@QNetworkReply@@QEBA?AW4NetworkError@1@XZ, ?finished@QNetworkReply@@QEAAXXZ, ?metaObject@QHttpMultiPart@@UEBAPEBUQMetaObject@@XZ, ?qt_metacast@QHttpMultiPart@@UEAAPEAXPEBD@Z, ?qt_metacall@QHttpMultiPart@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?staticMetaObject@QNetworkReply@@2UQMetaObject@@B, ?setBody@QHttpPart@@QEAAXAEBVQByteArray@@@Z
        Qt6Core.dll??6@YA?AVQDebug@@V0@AEBVQUrl@@@Z, ??5@YAAEAVQDataStream@@AEAV0@AEAVQUrl@@@Z, ??6@YAAEAVQDataStream@@AEAV0@AEBVQUrl@@@Z, ??8QUrl@@QEBA_NAEBV0@@Z, ??MQUrl@@QEBA_NAEBV0@@Z, ??0QUrl@@QEAA@$$QEAV0@@Z, ??0QUrl@@QEAA@AEBV0@@Z, ??0QUrl@@QEAA@XZ, ?qt_metacall@QThread@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QThread@@UEAAPEAXPEBD@Z, ?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ, ??0QMetaType@@QEAA@XZ, ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX@Z, ?staticMetaObject@QThread@@2UQMetaObject@@B, ?qResourceFeatureZlib@@YAEXZ, ?qUnregisterResourceData@@YA_NHPEBE00@Z, ?qRegisterResourceData@@YA_NHPEBE00@Z, ?id@QMetaType@@QEBAHH@Z, ?registerNormalizedTypedef@QMetaType@@SAXAEBVQByteArray@@V1@@Z, ??6QDataStream@@QEAAAEAV0@H@Z, ??5QDataStream@@QEAAAEAV0@AEAH@Z, ?append@QByteArray@@QEAAAEAV1@PEBD@Z, ?reserve@QByteArray@@QEAAX_J@Z, ?className@QMetaObject@@QEBAPEBDXZ, ?event@QObject@@UEAA_NPEAVQEvent@@@Z, ?setPermissions@QFile@@UEAA_NV?$QFlags@W4Permission@QFileDevice@@@@@Z, ?permissions@QFile@@UEBA?AV?$QFlags@W4Permission@QFileDevice@@@@XZ, ?resize@QFile@@UEAA_N_J@Z, ?size@QFile@@UEBA_JXZ, ?fileName@QFile@@UEBA?AVQString@@XZ, ?qt_metacall@QFile@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QFile@@UEAAPEAXPEBD@Z, ?metaObject@QFile@@UEBAPEBUQMetaObject@@XZ, ?readLineData@QFileDevice@@MEAA_JPEAD_J@Z, ?writeData@QFileDevice@@MEAA_JPEBD_J@Z, ?readData@QFileDevice@@MEAA_JPEAD_J@Z, ?atEnd@QFileDevice@@UEBA_NXZ, ?seek@QFileDevice@@UEAA_N_J@Z, ?pos@QFileDevice@@UEBA_JXZ, ?isSequential@QFileDevice@@UEBA_NXZ, ?skipData@QIODevice@@MEAA_J_J@Z, ?readLineData@QIODevice@@MEAA_JPEAD_J@Z, ?waitForBytesWritten@QIODevice@@UEAA_NH@Z, ?waitForReadyRead@QIODevice@@UEAA_NH@Z, ?canReadLine@QIODevice@@UEBA_NXZ, ?bytesToWrite@QIODevice@@UEBA_JXZ, ?bytesAvailable@QIODevice@@UEBA_JXZ, ?reset@QIODevice@@UEAA_NXZ, ?atEnd@QIODevice@@UEBA_NXZ, ?seek@QIODevice@@UEAA_N_J@Z, ?size@QIODevice@@UEBA_JXZ, ?pos@QIODevice@@UEBA_JXZ, ?setupChildProcess@QProcess@@EEAA?AUUse_setChildProcessModifier_Instead@1@XZ, ?writeData@QProcess@@MEAA_JPEBD_J@Z, ?readData@QProcess@@MEAA_JPEAD_J@Z, ?close@QProcess@@UEAAXXZ, ?isSequential@QProcess@@UEBA_NXZ, ?bytesToWrite@QProcess@@UEBA_JXZ, ?waitForBytesWritten@QProcess@@UEAA_NH@Z, ?waitForReadyRead@QProcess@@UEAA_NH@Z, ?open@QProcess@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?qt_metacall@QProcess@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QProcess@@UEAAPEAXPEBD@Z, ?metaObject@QProcess@@UEBAPEBUQMetaObject@@XZ, ??AQJsonDocument@@QEBA?BVQJsonValue@@AEBVQString@@@Z, ?fromJson@QJsonDocument@@SA?AV1@AEBVQByteArray@@PEAUQJsonParseError@@@Z, ??4QJsonDocument@@QEAAAEAV0@$$QEAV0@@Z, ??1QJsonDocument@@QEAA@XZ, ??0QJsonDocument@@QEAA@XZ, ??0QJsonParseError@@QEAA@XZ, ??AQJsonValue@@QEBA?BV0@AEBVQString@@@Z, ?toVariant@QJsonValue@@QEBA?AVQVariant@@XZ, ??1QJsonValue@@QEAA@XZ, ?currentType@QOperatingSystemVersion@@SA?AW4OSType@1@XZ, ?waitForFinished@QProcess@@QEAA_NH@Z, ?start@QProcess@@QEAAXAEBVQString@@AEBV?$QList@VQString@@@@V?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ??1QProcess@@UEAA@XZ, ??0QProcess@@QEAA@PEAVQObject@@@Z, ?homePath@QDir@@SA?AVQString@@XZ, ?exists@QDir@@QEBA_NXZ, ?removeRecursively@QDir@@QEAA_NXZ, ?mkdir@QDir@@QEBA_NAEBVQString@@@Z, ?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z, ??1QDir@@QEAA@XZ, ??0QDir@@QEAA@AEBVQString@@@Z, ?fileName@QFileInfo@@QEBA?AVQString@@XZ, ?filePath@QFileInfo@@QEBA?AVQString@@XZ, ??1QFileInfo@@QEAA@XZ, ??0QFileInfo@@QEAA@AEBV0@@Z, ?currentMSecsSinceEpoch@QDateTime@@SA_JXZ, ?toString@QVariant@@QEBA?AVQString@@XZ, ?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ, ??0QVariant@@QEAA@PEBD@Z, ??0QVariant@@QEAA@AEBVQString@@@Z, ??1QVariant@@QEAA@XZ, ?qt_QMetaEnum_debugOperator@@YA?AVQDebug@@AEAV1@_JPEBUQMetaObject@@PEBD@Z, ??6QDebug@@QEAAAEAV0@AEBVQByteArray@@@Z, ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z, ??6QDebug@@QEAAAEAV0@PEBD@Z, ??1QDebug@@QEAA@XZ, ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?copy@QFile@@SA_NAEBVQString@@0@Z, ?remove@QFile@@SA_NAEBVQString@@@Z, ?exists@QFile@@QEBA_NXZ, ??1QFile@@UEAA@XZ, ??0QFile@@QEAA@AEBVQString@@@Z, ?close@QFileDevice@@UEAAXXZ, ?allocate@QArrayData@@SAPEAXPEAPEAU1@_J11W4AllocationOption@1@@Z, ??0QString@@QEAA@AEBV0@@Z, ??1QString@@QEAA@XZ, ??0QString@@QEAA@PEBD@Z, ??1Connection@QMetaObject@@QEAA@XZ, ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z, ?exit@QCoreApplication@@SAXH@Z, ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z, ??1QUrl@@QEAA@XZ, ??0QThread@@QEAA@PEAVQObject@@@Z, ??1QThread@@UEAA@XZ, ?start@QThread@@QEAAXW4Priority@1@@Z, ?event@QThread@@UEAA_NPEAVQEvent@@@Z, ?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z, ?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z, ?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z, ?customEvent@QObject@@MEAAXPEAVQEvent@@@Z, ?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?qBadAlloc@@YAXXZ, ??0QMessageLogger@@QEAA@PEBDH0@Z, ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ, ??0QChar@@QEAA@_S@Z, ??0QChar@@QEAA@D@Z, ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z, ?castHelper@QByteArrayView@@CAPEBDPEBD@Z, ?size@QByteArrayView@@QEBA_JXZ, ?data@QByteArrayView@@QEBAPEBDXZ, ??0QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@PEBD_J@Z, ??0QByteArray@@QEAA@AEBV0@@Z, ??1QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@$$QEAV0@@Z, ??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z, ?data@QByteArray@@QEAAPEADXZ, ?data@QByteArray@@QEBAPEBDXZ, ?left@QByteArray@@QEHAA?AV1@_J@Z, ?right@QByteArray@@QEGBA?AV1@_J@Z, ?append@QByteArray@@QEAAAEAV1@AEBV1@@Z, ??YQByteArray@@QEAAAEAV0@PEBD@Z, ?setNum@QByteArray@@QEAAAEAV1@_KH@Z, ?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z, ?fromBase64@QByteArray@@SA?AV1@AEBV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z, ?size@QByteArray@@QEBA_JXZ, ?length@QByteArray@@QEBA_JXZ, ?isNull@QByteArray@@QEBA_NXZ, ??0QString@@QEAA@$$QEAV0@@Z, ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z, ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z, ?indexOf@QString@@QEBA_JAEBV1@_JW4CaseSensitivity@Qt@@@Z, ?append@QString@@QEAAAEAV1@VQChar@@@Z, ?append@QString@@QEAAAEAV1@AEBV1@@Z, ?append@QString@@QEAAAEAV1@V?$QBasicUtf8StringView@$0A@@@@Z, ?split@QString@@QEBA?AV?$QList@VQString@@@@AEBV1@V?$QFlags@W4SplitBehaviorFlags@Qt@@@@W4CaseSensitivity@Qt@@@Z, ?toUtf8@QString@@QEHAA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEGBA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ, ?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z, ?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z, ?toInt@QString@@QEBAHPEA_NH@Z, ??YQString@@QEAAAEAV0@PEBD@Z, ??8QString@@QEBA_NPEBD@Z, ?QStringList_join@QtPrivate@@YA?AVQString@@PEBV?$QList@VQString@@@@PEBVQChar@@_J@Z, ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ, ?write@QIODevice@@QEAA_JAEBVQByteArray@@@Z
        KERNEL32.dllWideCharToMultiByte, LocalFree, GetCommandLineW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleW, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext
        VCRUNTIME140_1.dll__CxxFrameHandler4
        VCRUNTIME140.dll_CxxThrowException, memcpy, memcmp, memmove, __std_terminate, memset, __current_exception, __current_exception_context, __C_specific_handler, __std_exception_copy, __std_exception_destroy
        api-ms-win-crt-heap-l1-1-0.dll_set_new_mode, free, _callnewh, malloc
        api-ms-win-crt-runtime-l1-1-0.dll_register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _initialize_onexit_table, _get_narrow_winmain_command_line, _initterm, _initterm_e, exit, _exit, _initialize_narrow_environment, _c_exit, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, __p___argc, terminate, __p___argv
        api-ms-win-crt-math-l1-1-0.dll__setusermatherr
        api-ms-win-crt-stdio-l1-1-0.dll_set_fmode, __p__commode
        api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
        SHELL32.dllCommandLineToArgvW

        Possible Origin

        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States

        Network Behavior

        ⊘No network behavior found

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:12:13:08
        Start date:10/10/2024
        Path:C:\Users\user\Desktop\TsrKUlTaYJ.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\TsrKUlTaYJ.exe"
        Imagebase:0x7ff78c080000
        File size:233'472 bytes
        MD5 hash:F82510D541E56D7021F020F8B4D6A6D0
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Disassembly

        Reset < >

          Non-executed Functions

          Function 00007FF78C083360 Relevance: 305.5, APIs: 158, Strings: 16, Instructions: 978windowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$V0@@$A@$$$Char@@Char@@@$Dir@@$Byte$?arg@$?append@$Debug@@Path@$ArrayFileFlags@V1@@View@@$List@String@@@$?homeArray@@File@@Logger@@Message$?file?size@Info@@$Database@@$?data@?debug@?entryDir@@@@Dir@@@@@Filter@Flag@InfoInfo@@@@Name@SortString@@0@$?cast?copy@?exists@CaseDatabase@Helper@Qt@@@Sensitivity@$?add?index?open@?remove?remove@?set?split@A@@@@Array@@@BasicBehaviorDatabaseInt@Null@Qt@@@@SplitStringString@@@@Utf8V1@_View@$0memcmp
          • String ID: %1_%2$%1_%2_%3$%1_%2_%3_%4$%1_%2_%3_%4_%5$/.n3/pwd$/Library/Keychains/login.keychain-db$/Local Extension Settings/$/Local State$/Login Data$Default$Profile $key$logkc_db$lst$pld$pwd
          • API String ID: 924144151-3707578411
          • Opcode ID: a3650e9194d9d3ed615a6560a674aff35e709a21af049443aa41757766700720
          • Instruction ID: e821b48de94a76eab3924049b72cbd330c754a0aef7842021a2e7955b64075e3
          • Opcode Fuzzy Hash: a3650e9194d9d3ed615a6560a674aff35e709a21af049443aa41757766700720
          • Instruction Fuzzy Hash: 91A28332A14A4696EB10EF64ED546EDB760FF85B89FD09031DA0E87AA9DF3CD548C310
          Function 00007FF78C0843C0 Relevance: 249.1, APIs: 132, Strings: 10, Instructions: 607windowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$Debug@@$Logger@@Message$Database@@Error@@$?debug@Query@@$?home?last?text@A@$$Dir@@Error@Path@String@@0@String@@@V0@@$?add?copy@?exec@?open@?prepare@?setArray@@ByteDatabaseDatabase@Database@@@File@@Name@
          • String ID: %s.$/.n3/pwd$/Login Data$Error occurred opening the database.$Error occurred querying.$QSQLITE$origin_url: $password: $select username_value, password_value, origin_url from logins order by date_created$username:
          • API String ID: 3116649450-3610353273
          • Opcode ID: c5b3745803345946cf6e9e71cabb0e375b63272609f151e4f634f794fa66b6d1
          • Instruction ID: ded1a78fb9b7ff9fd04bbad677479b18dddc971de16cfdb1d4a5169ad617f30e
          • Opcode Fuzzy Hash: c5b3745803345946cf6e9e71cabb0e375b63272609f151e4f634f794fa66b6d1
          • Instruction Fuzzy Hash: A4526231A18A4A96EB10EF64ED542A9B370FF85785FE0A031D64E87A78EF3CD549C710
          Function 00007FF78C082AD0 Relevance: 150.9, APIs: 77, Strings: 9, Instructions: 363networktimeCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: Http$Byte$Part@@$Array@@$?setVariant@@$Header@Headers@KnownNetworkRequest@@String@@Variant@@@$Multi$?append@$Array@@@$Body@Part@@@$ContentV0@@$HostString@@@V1@@$?arg@?current?localA@$$Bit@BodyBoundary@Char@@Char@@@DateDevice@Device@@@Epoch@File@@Info@@Local8Name@Num@Object@@@SecsSinceTime@@Type@Type@0@Type@1@@Utf8@V1@_malloc
          • String ID: ---------------------------99614912995$Call_$application/json$application/octet-stream$form-data; name="hid";$form-data; name="multi_file"; filename="%1"$form-data; name="type";$form-data; name="uts";${"options":{"filename":"
          • API String ID: 1558666637-725218759
          • Opcode ID: f332de2bef868d2036ef6f3752ea6ebc4712f08fee13c1a73f6139e6f8246d35
          • Instruction ID: 2380e2cafc4edf224b0cefea4ff44fff6515a27738c9240f8c0c842b718cddc0
          • Opcode Fuzzy Hash: f332de2bef868d2036ef6f3752ea6ebc4712f08fee13c1a73f6139e6f8246d35
          • Instruction Fuzzy Hash: 80F10131B08A4AA6EB00EF60ED541BDA331FB85799BD19131DA1E97AB8DF3CD509C350
          Function 00007FF78C084E90 Relevance: 133.8, APIs: 70, Strings: 6, Instructions: 784windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$?homeDir@@Path@Process@@memmove$Base@@@@@ByteDebug@@DeviceDevice@@File@@Flag@Flags@ModeOpen$?start@Array@@List@Logger@@MessageNetworkObject@@@String@@@@free$?close@?debug@?error@?open@?read?wait?write@All@Array@@@Error@1@FileFinished@Reply@@String@@@
          • String ID: --directory$-xf$/.pyp/python.exe$/99$Download Python Success!$tar
          • API String ID: 1279688832-1090138706
          • Opcode ID: 49093651bed3e426e29305a92f063e0323da413b8fd08af28b307949858c64a6
          • Instruction ID: 64333bf287597c7e1eadd591e2db9803aa49d544a7619ee24568ea24bd974b3b
          • Opcode Fuzzy Hash: 49093651bed3e426e29305a92f063e0323da413b8fd08af28b307949858c64a6
          • Instruction Fuzzy Hash: E562E332B18A4682EE10EB64ED545A9A360FB85BD4FE09132FA8E477E4DF3CE545C710
          Function 00007FF78C0864C0 Relevance: 116.4, APIs: 54, Strings: 12, Instructions: 879COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove$?currentOperatingSystemType@Type@1@Version@@free
          • String ID: /.config/BraveSoftware/Brave-Browser$/.config/google-chrome$/.config/opera$/AppData/Local/BraveSoftware/Brave-Browser/User Data$/AppData/Local/Google/Chrome/User Data$/AppData/Roaming/Opera Software/Opera Stable$/Library/Application Support/BraveSoftware/Brave-Browser$/Library/Application Support/Google/Chrome$/Library/Application Support/com.operasoftware.opera$/Users$/home$C:\Users
          • API String ID: 283656904-339602194
          • Opcode ID: 11f54e0d68c5c43c186a4d8e7b2b1590b21fcdde9e4e4c142b8130d8f1b59f71
          • Instruction ID: 036aaa550592b56f3d94b88810cfea29eed5791e670649b4fd127197cfec9046
          • Opcode Fuzzy Hash: 11f54e0d68c5c43c186a4d8e7b2b1590b21fcdde9e4e4c142b8130d8f1b59f71
          • Instruction Fuzzy Hash: D9828232F08A4686EF10ABA4DE516ECA371FB41BD8BE18132CA1D57799DF38E549C350
          Function 00007FF78C0890B4 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
          • String ID:
          • API String ID: 313767242-0
          • Opcode ID: 143957c753240dffd0a0645ce9364822e6ceda7207cdd9ccedb6f1cccfa09498
          • Instruction ID: 7012a9ef6c58c79fdefc1c378c855a58ec4294333879084d18f8e79803dac87d
          • Opcode Fuzzy Hash: 143957c753240dffd0a0645ce9364822e6ceda7207cdd9ccedb6f1cccfa09498
          • Instruction Fuzzy Hash: 8C313372609B8589EB60AF60EC407EDB364FB84784F94803ADA4D47B99DF3DD548CB14
          Function 00007FF78C089304 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
          • String ID:
          • API String ID: 2933794660-0
          • Opcode ID: 8486ae3a0eabbc1233fb2e1ffc062ea3750577be5d2f77ce4c9bff976a35d59f
          • Instruction ID: 7cc030a0c619e12e63ab0e1322936d699cf03153456cceb09790766e25e6c61f
          • Opcode Fuzzy Hash: 8486ae3a0eabbc1233fb2e1ffc062ea3750577be5d2f77ce4c9bff976a35d59f
          • Instruction Fuzzy Hash: B7111C22B15B058AEB009B60EC542B873A4F759798F940E31DA6D867A4EF78D5A8C350
          Function 00007FF78C089298 Relevance: .0, Instructions: 2COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 136e180591b10097a95c1a84523f819068e9e2009ff74bcbc6659b5a1320d083
          • Instruction ID: c28b68b57b186eab6d8272a2b1157251dbab1398245c01c0607db2f641ff08f7
          • Opcode Fuzzy Hash: 136e180591b10097a95c1a84523f819068e9e2009ff74bcbc6659b5a1320d083
          • Instruction Fuzzy Hash: 13A0012290881AA4E604AB80AE50160A264FB50391BA08131C11D81470EF3DA540C624
          Function 00007FF78C0816D0 Relevance: 107.0, APIs: 55, Strings: 6, Instructions: 298windownetworkthreadCOMMON
          Download Yara Rule
          APIs
          • ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF78C081706
          • ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF78C08170F
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C081721
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF78C081734
          • ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF78C08173E
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF78C08174C
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C081758
            • Part of subcall function 00007FF78C081040: ??0QThread@@QEAA@PEAVQObject@@@Z.QT6CORE ref: 00007FF78C081078
            • Part of subcall function 00007FF78C081040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF78C08108F
            • Part of subcall function 00007FF78C081040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF78C08109C
            • Part of subcall function 00007FF78C081040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF78C0810A9
            • Part of subcall function 00007FF78C081040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF78C0810B4
            • Part of subcall function 00007FF78C081040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF78C0810BF
            • Part of subcall function 00007FF78C081040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF78C0810CA
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0810DC
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C081145
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C081158
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08116B
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08117D
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08118F
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0811A1
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0811B3
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0811C5
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0811D7
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0811E9
            • Part of subcall function 00007FF78C081040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0811FB
          • ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF78C081771
            • Part of subcall function 00007FF78C088474: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF78C08179D), ref: 00007FF78C08848E
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF78C0817F9
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF78C081804
          • ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF78C081810
            • Part of subcall function 00007FF78C088474: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF78C0884A4
            • Part of subcall function 00007FF78C087830: ??0QWebEnginePage@@QEAA@PEAVQObject@@@Z.QT6WEBENGINECORE(?,?,?,?,?,?,?,?,?,?,?,00007FF78C081832), ref: 00007FF78C087841
            • Part of subcall function 00007FF78C087830: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,?,?,00007FF78C081832), ref: 00007FF78C0878D6
            • Part of subcall function 00007FF78C087830: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,?,?,?,?,?,00007FF78C081832), ref: 00007FF78C0878E1
          • ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF78C08183A
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08184C
          • ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF78C081862
          • ?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF78C081870
          • ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF78C08187E
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C08188A
          • ?resize@QWidget@@QEAAXHH@Z.QT6WIDGETS ref: 00007FF78C08189F
          • ?show@QWidget@@QEAAXXZ.QT6WIDGETS ref: 00007FF78C0818A9
          • ??0QMenu@@QEAA@PEAVQWidget@@@Z.QT6WIDGETS ref: 00007FF78C0818C8
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0818EE
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF78C0818FC
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C081909
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF78C08199C
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF78C0819A9
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0819BA
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF78C0819C8
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C0819D5
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF78C081A61
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF78C081A6E
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C081A7F
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF78C081A8D
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C081A9A
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF78C081B0E
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF78C081B1B
          • ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z.QT6WIDGETS ref: 00007FF78C081B27
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C081B39
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF78C081B4B
          • ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z.QT6WIDGETS ref: 00007FF78C081B59
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF78C081B67
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C081B72
          • ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z.QT6WIDGETS ref: 00007FF78C081B7F
          • ?setVisible@QSystemTrayIcon@@QEAAX_N@Z.QT6WIDGETS ref: 00007FF78C081B8B
          • ?exec@QApplication@@SAHXZ.QT6WIDGETS ref: 00007FF78C081B91
          • ??1QSystemTrayIcon@@UEAA@XZ.QT6WIDGETS ref: 00007FF78C081B9D
          • ??1QWebEngineView@@UEAA@XZ.QT6WEBENGINEWIDGETS ref: 00007FF78C081BA8
            • Part of subcall function 00007FF78C081430: ??1QString@@QEAA@XZ.QT6CORE(?,?,?,00007FF78C081408), ref: 00007FF78C081473
            • Part of subcall function 00007FF78C081430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF78C081408), ref: 00007FF78C081485
            • Part of subcall function 00007FF78C0813C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF78C081414
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C081BEC
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF78C081BF6
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF78C081C00
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF78C081C0A
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF78C081C14
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF78C081C1E
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF78C081C28
          • ??1QThread@@UEAA@XZ.QT6CORE ref: 00007FF78C081C32
          • ??1QApplication@@UEAA@XZ.QT6WIDGETS ref: 00007FF78C081C3D
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$Object@@$Network$Connection@Meta$Icon@@$?setAccessEngineManager@@Object@@@Request@@$?connectApplication@@Base@ConnectionImpl@ObjectPrivate@@Qt@@SlotString@@@SystemTrayType@U3@@Widget@@$View@@$?addAction@Action@@Thread@@$Icon@Icon@@@Url@@Widget@@@Windowfree$?exec@?load@?resize@?show@?start@Closed@Concurrency::cancel_current_taskContextLastMenu@Menu@@Menu@@@Mode@0@@Page@Page@@Page@@@ParsingPriority@1@@QuitUrl@@@Visible@malloc
          • String ID: &Close$&Hide$:/logo.ico$:/logo.png$Sho&w$https://hello.freeconference.com/login/access-code
          • API String ID: 90596291-1651899464
          • Opcode ID: 8346426bf2379e4e1760812f4b0fe1f71e492e161dc8707a76d959c6b26523a5
          • Instruction ID: 3f8c9032ae5ae258e5550774d9beaedfb0d09deb9b36035c2dbfb3f1e95f2309
          • Opcode Fuzzy Hash: 8346426bf2379e4e1760812f4b0fe1f71e492e161dc8707a76d959c6b26523a5
          • Instruction Fuzzy Hash: EFF12332A18A8A96E710EF60ED501EDB374FB88789F909131D64E83A79DF7CD649C350
          Function 00007FF78C081040 Relevance: 98.2, APIs: 33, Strings: 23, Instructions: 188networkmemorythreadCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$Network$Object@@@$AccessManager@@Request@@$?allocate@AllocationArrayData@@Option@1@@Thread@@U1@_V0@@
          • String ID: acmacodkjbdgmoleebolmdjonilkdbch$aeachknmefphepccionboohckonoeemg$afbcbjpbpfadlkmhmclhkeeodmamcflc$agoakfejjabomempkjlepdflaleeobhb$aholpfdialjgjfhomihkjbmgjidlcdno$bfnaelmomeimhlpmgjnjophhpkkoljpa$bhhhlbepdkbapadjdnnojkbgioiodbic$dlcobpjiigpikoobohmabehhmhfoodbb$ejbalbakoplchlghecdalmeeeajnimhm$fhbohimaelbohpjbbldcngcnapndodjp$fldfpgipfncgndfolcbkdeeknbbbnhcc$gjnckgkfmgmibbkoficdidcljeaaaheg$hifafgmccdpekplomjjkcfgodnhcellj$hnfanknocfeofbddgcijnmhnfnkdnaad$http://185.235.241.208:1224$ibnejdfjmmkpcnlpebklmnkoeoihofec$jblndlipeogpafnldhgmapagcccfchpi$lgmpcpglpngdoalbgeoldeajfclnhafa$mcohilncbfahbmgdjkbpemcciiolgcge$nkbihfbeogaeaoehlefnkodbefgpgknn$nphplpgoakhhjchkkhmiggakijnkhfnd$omaabbefbmiijedngplfjmnooppbclkk$penjlddjkjgpnkllboccdgccekpkcbin
          • API String ID: 2244258320-1925799802
          • Opcode ID: 12ad1786b44b464edf5d236c700ab56950f950009916620179baa3238b751ab2
          • Instruction ID: 824f3a76503afd4a58304166611b367553bb6df0374422a231bc223b901e69a9
          • Opcode Fuzzy Hash: 12ad1786b44b464edf5d236c700ab56950f950009916620179baa3238b751ab2
          • Instruction Fuzzy Hash: 2CA11131614A4AA6EB14AF60ED442E8B374FB89789FD0A032D24E87675DF3CE55DC310
          Function 00007FF78C087450 Relevance: 80.7, APIs: 41, Strings: 5, Instructions: 231networkwindowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$Network$Debug@@$Object@@$Meta$Connection@Dir@@Logger@@MessageReply@@Url@@$ByteV0@@$?append@?connect?debug@?error@?get@?setA@@@@AccessArray@@Base@BasicConnectionError@1@Impl@Manager@@Mode@0@@ObjectParsingPrivate@@Qt@@Request@@Request@@@SlotStringType@U3@@Url@Url@@@Utf8View@$0$?home?qt_?read?removeA@$$All@Array@@@Device@@Enum_debugOperator@@Path@Recursively@String@@@V1@_malloc
          • String ID: /.n3$/client/99$/pdown$Error: $NetworkError
          • API String ID: 188155667-2729814421
          • Opcode ID: b20cb5663a7c782b17d56b552c13abf53b13548a3add43ed87e0c5c44fab37f7
          • Instruction ID: 34592029ac0a8328d96d52414ba7b47aa3ab2329f083ce14fe0fbbad45670682
          • Opcode Fuzzy Hash: b20cb5663a7c782b17d56b552c13abf53b13548a3add43ed87e0c5c44fab37f7
          • Instruction Fuzzy Hash: 7BC10D32A04B0A9AEB00EF64ED501AD73B4FB45789F909131DA4E92A78EF3CE559C350
          Function 00007FF78C0830A0 Relevance: 73.7, APIs: 40, Strings: 2, Instructions: 163COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: Byte$Array@@$Json$Document@@String@@Value@@$File@@$String@@@V0@$$V0@@Variant@@$?fromFlags@Parse$?data@?exists@?length@?open@?read?right@?size@All@Array@Array@@@@@Base64Base64@Base@@@@@DeviceDevice@@Error@@Error@@@Flag@Json@ModeOpenOption@V1@_Variant@
          • String ID: encrypted_key$os_crypt
          • API String ID: 2100764627-2981665407
          • Opcode ID: 57637ef2731021afc079172beb1743b178af13a21f217edae1cd83e504ea8c51
          • Instruction ID: 705b0e0ca3689d0143e33307cc15386151f2350afcc7e9d6b32cff8dbe25c656
          • Opcode Fuzzy Hash: 57637ef2731021afc079172beb1743b178af13a21f217edae1cd83e504ea8c51
          • Instruction Fuzzy Hash: F2811131A08A4A96EB00AF60ED542ADB330FB95799F905032D60E82AB8EF3CD54DC750
          Function 00007FF78C082780 Relevance: 54.4, APIs: 28, Strings: 3, Instructions: 149windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$A@$$ByteDebug@@Device@@File@@V0@@$?homeArray@@Base@@@@@DeviceDir@@Flag@Flags@Logger@@MessageModeNetworkOpenPath@Process@@$?close@?debug@?error@?open@?read?start@?write@All@Array@@@Error@1@FileList@Object@@@Reply@@String@@@String@@@@free
          • String ID: /99$Download Client Success!$python
          • API String ID: 2506431097-3274328065
          • Opcode ID: a1224354c09b1fba868e76a5796f39a3dbd4f689c4d99c551bf46e07308598e8
          • Instruction ID: 16aa2683cc469ce0a130163b0ac52c3fb0f90b7c12c231d88c3cfc033dc0e969
          • Opcode Fuzzy Hash: a1224354c09b1fba868e76a5796f39a3dbd4f689c4d99c551bf46e07308598e8
          • Instruction Fuzzy Hash: 70610231F08A0A96EB00EF65ED542BC7371FB95B99B909031DA0E93669DF3CD949C360
          Function 00007FF78C087A62 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 121COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: Byte$Array@@$ArrayView@@$?size@$?append@?data@Meta$?castHelper@Type@@$?class?id@?register?reserve@Name@NormalizedNull@Object@@Typedef@V1@@memcmp
          • String ID: Feature
          • API String ID: 2588427355-3496627450
          • Opcode ID: 5d8d30416ffe1deda994dd920eeddaad80f1fe866f60b6edad553dba996cc3c5
          • Instruction ID: e312df36ba6e9b1fde31f13a3f53f0e746bd4683d52a3fe82592be770a8f0542
          • Opcode Fuzzy Hash: 5d8d30416ffe1deda994dd920eeddaad80f1fe866f60b6edad553dba996cc3c5
          • Instruction Fuzzy Hash: B7515131A08A8982EA10AB15FD4427AE361FF94BD0FE49235D99E83769EF3CD549C710
          Function 00007FF78C087820 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 111COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: Byte$Array@@$ArrayView@@$?size@$?append@?data@Meta$?castHelper@Type@@$?class?id@?register?reserve@Name@NormalizedNull@Object@@Typedef@V1@@memcmp
          • String ID: Feature
          • API String ID: 2588427355-3496627450
          • Opcode ID: 7b139abce5f3e80cd66187ffb5915dff75f0710b4f04aaea3b83ad312ff54d86
          • Instruction ID: 538ec12f68e41b388ffc68f5183d62ea234e34cd8168456709b4d5c54482a4ca
          • Opcode Fuzzy Hash: 7b139abce5f3e80cd66187ffb5915dff75f0710b4f04aaea3b83ad312ff54d86
          • Instruction Fuzzy Hash: 31515231A08A8982EA10AB15FE4417AE361FF94BD0FE49235D99E83779EF3CD549C710
          Function 00007FF78C085A60 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 105COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$V0@@$A@$$$?append@?homeDir@@Path@V1@@$?copy@File@@String@@0@
          • String ID: /.n3/
          • API String ID: 2243516418-3635227014
          • Opcode ID: 7737bba52d631934641daaa2fca4191b571833086ec344a9cac4f58a48aa29db
          • Instruction ID: d3c2428964163983c87ecac201c517706e65467fa96b88266e6de0e383cb3acc
          • Opcode Fuzzy Hash: 7737bba52d631934641daaa2fca4191b571833086ec344a9cac4f58a48aa29db
          • Instruction Fuzzy Hash: 1B414032A18A4592EA10AB65FD542AAF320FF95BC1FE0D031EA8F83675DF2CD548C710
          Function 00007FF78C087120 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 98networkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: ByteNetwork$Array@@String@@$Object@@Request@@$?setConnection@MetaUrl@@$?append@?connect?post@A@@@@AccessArray@@0@Base@BasicConnectionHeader@HttpImpl@Manager@@Mode@0@@MultiObjectParsingPart@@@Private@@Qt@@Reply@@SlotStringType@U3@@Url@Url@@@Utf8V0@@View@$0malloc
          • String ID: /uploads$Content-Type$multipart/form-data; boundary=---------------------------99614912995
          • API String ID: 1290966195-1692235574
          • Opcode ID: 81565d091fecc4c9f0d275064ea67d5cf5fcc852bc2f3e40bf0327428b2ee6ec
          • Instruction ID: 0530891ed0a0598ae94b1c39413f6d529ddffb42deef7b1d3d5f26974c7d9fd3
          • Opcode Fuzzy Hash: 81565d091fecc4c9f0d275064ea67d5cf5fcc852bc2f3e40bf0327428b2ee6ec
          • Instruction Fuzzy Hash: 83415332604F45AAE700EF60ED402ECB374FB44798F909271DA5DA3AA8EF38D659C350
          Function 00007FF78C086420 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 37COMMON
          Download Yara Rule
          APIs
          • ?homePath@QDir@@SA?AVQString@@XZ.QT6CORE ref: 00007FF78C08642E
          • ??0QDir@@QEAA@AEBVQString@@@Z.QT6CORE ref: 00007FF78C08643D
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C086449
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08645B
          • ?mkdir@QDir@@QEBA_NAEBVQString@@@Z.QT6CORE ref: 00007FF78C08646C
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C086478
            • Part of subcall function 00007FF78C0864C0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0864F9
            • Part of subcall function 00007FF78C0864C0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C08653E
            • Part of subcall function 00007FF78C0864C0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08654F
            • Part of subcall function 00007FF78C0864C0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C08658A
            • Part of subcall function 00007FF78C0864C0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08659B
            • Part of subcall function 00007FF78C0864C0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C0865D6
            • Part of subcall function 00007FF78C0864C0: ?currentType@QOperatingSystemVersion@@SA?AW4OSType@1@XZ.QT6CORE ref: 00007FF78C0865DC
            • Part of subcall function 00007FF78C0864C0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C086631
            • Part of subcall function 00007FF78C083360: ??0QDir@@QEAA@AEBVQString@@@Z.QT6CORE ref: 00007FF78C0833D0
            • Part of subcall function 00007FF78C083360: ?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z.QT6CORE ref: 00007FF78C0833EB
            • Part of subcall function 00007FF78C083360: ?filePath@QFileInfo@@QEBA?AVQString@@XZ.QT6CORE ref: 00007FF78C083476
            • Part of subcall function 00007FF78C083360: ??YQString@@QEAAAEAV0@PEBD@Z.QT6CORE ref: 00007FF78C083487
            • Part of subcall function 00007FF78C083360: ??0QString@@QEAA@$$QEAV0@@Z.QT6CORE ref: 00007FF78C083494
            • Part of subcall function 00007FF78C083360: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C0834AF
            • Part of subcall function 00007FF78C083360: ??0QChar@@QEAA@_S@Z.QT6CORE ref: 00007FF78C0834C4
            • Part of subcall function 00007FF78C083360: ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z.QT6CORE ref: 00007FF78C0834E7
            • Part of subcall function 00007FF78C083360: ??0QChar@@QEAA@_S@Z.QT6CORE ref: 00007FF78C0834FC
            • Part of subcall function 00007FF78C082AD0: ??0QHttpMultiPart@@QEAA@W4ContentType@0@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF78C082B29
            • Part of subcall function 00007FF78C082AD0: ??0QHttpPart@@QEAA@XZ.QT6NETWORK ref: 00007FF78C082B3F
            • Part of subcall function 00007FF78C082AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C082B51
            • Part of subcall function 00007FF78C082AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF78C082B63
            • Part of subcall function 00007FF78C082AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF78C082B6E
            • Part of subcall function 00007FF78C082AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C082B7F
            • Part of subcall function 00007FF78C082AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF78C082B94
            • Part of subcall function 00007FF78C082AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF78C082B9F
            • Part of subcall function 00007FF78C082AD0: ??0QByteArray@@QEAA@PEBD_J@Z.QT6CORE ref: 00007FF78C082BB7
            • Part of subcall function 00007FF78C082AD0: ?setBody@QHttpPart@@QEAAXAEBVQByteArray@@@Z.QT6NETWORK ref: 00007FF78C082BC7
            • Part of subcall function 00007FF78C082AD0: ??1QByteArray@@QEAA@XZ.QT6CORE ref: 00007FF78C082BD2
            • Part of subcall function 00007FF78C082AD0: ?append@QHttpMultiPart@@QEAAXAEBVQHttpPart@@@Z.QT6NETWORK ref: 00007FF78C082BE0
            • Part of subcall function 00007FF78C082AD0: ??0QHttpPart@@QEAA@XZ.QT6NETWORK ref: 00007FF78C082BEB
            • Part of subcall function 00007FF78C082AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C082BFD
            • Part of subcall function 00007FF78C082AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF78C082C0F
            • Part of subcall function 00007FF78C082AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF78C082C1A
            • Part of subcall function 00007FF78C082AD0: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C082C2B
            • Part of subcall function 00007FF78C082AD0: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF78C082C40
            • Part of subcall function 00007FF78C082AD0: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF78C082C4B
            • Part of subcall function 00007FF78C082AD0: ?localHostName@QHostInfo@@SA?AVQString@@XZ.QT6NETWORK ref: 00007FF78C082C55
            • Part of subcall function 00007FF78C082AD0: ?toUtf8@QString@@QEHAA?AVQByteArray@@XZ.QT6CORE ref: 00007FF78C082C63
          • ??1QDir@@QEAA@XZ.QT6CORE ref: 00007FF78C0864AB
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$Http$Part@@$Variant@@$Dir@@$?set$ByteHeader@Headers@KnownNetworkRequest@@Variant@@@$Array@@String@@@$Char@@FileFlags@HostInfo@@List@MultiPath@$?append@?arg@?current?entry?file?home?local?mkdir@A@$$Array@@@Body@Char@@@ContentDir@@@@Dir@@@@@Filter@Flag@InfoInfo@@@@Name@Object@@@OperatingPart@@@SortSystemType@Type@0@Type@1@Utf8@V0@@Version@@
          • String ID: .n3
          • API String ID: 4083719557-2302449095
          • Opcode ID: 55ef80e2b435b296388f448d0cb86d2d54f1fb26f868003e9fae84635005d45e
          • Instruction ID: 2480ecbfda5a9a5ba19ae626474e0ae5e642d78cfc7bf05d801250f7fec040ee
          • Opcode Fuzzy Hash: 55ef80e2b435b296388f448d0cb86d2d54f1fb26f868003e9fae84635005d45e
          • Instruction Fuzzy Hash: CF012131A1CA4A92DA00BB21FD550BAB321FFD9B85F94A031E64F86676DF2CD54CC720
          Function 00007FF78C086150 Relevance: 10.7, APIs: 7, Instructions: 182memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE ref: 00007FF78C086210
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF78C086220
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF78C086256
          • ??0QString@@QEAA@$$QEAV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF78C082AB4), ref: 00007FF78C0862E6
          • ??0QString@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF78C082AB4), ref: 00007FF78C086356
          • ??1QString@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF78C082AB4), ref: 00007FF78C0863E3
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF78C082AB4), ref: 00007FF78C0863F7
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$Alloc@@ArrayData@@V0@@$?reallocateA@$$AllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 2195022652-0
          • Opcode ID: 2f7d4b35bef594b48291b71d3d05c427406719608caabbc0b46e10d16fc76e72
          • Instruction ID: a552561a3f600cf5be08e9a17572a108a86f84318960f5b94b334c5a424dd41e
          • Opcode Fuzzy Hash: 2f7d4b35bef594b48291b71d3d05c427406719608caabbc0b46e10d16fc76e72
          • Instruction Fuzzy Hash: 36717832B19B4682DE44DF09EA442A9B3A0FB55BC4FA58136DB6E477A4DF3CD065C310
          Function 00007FF78C085F00 Relevance: 10.7, APIs: 7, Instructions: 160memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE ref: 00007FF78C085FA2
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF78C085FB2
          • ?qBadAlloc@@YAXXZ.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF78C08362C), ref: 00007FF78C085FEA
          • ??0QFileInfo@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF78C08362C), ref: 00007FF78C086047
          • ??0QFileInfo@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF78C08362C), ref: 00007FF78C086087
          • ??1QFileInfo@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,00000000,00000000,00000002,00007FF78C08362C), ref: 00007FF78C086113
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000002,00007FF78C08362C), ref: 00007FF78C086127
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: FileInfo@@$Alloc@@ArrayData@@V0@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 1506373291-0
          • Opcode ID: b105eced78072380ceb70a4529c4aaafb50d65ec9e745e1698ac4a3dc6607745
          • Instruction ID: cacd52133350de9168b2517b514d2f83989d78aa334f21792c2b7af8d276f224
          • Opcode Fuzzy Hash: b105eced78072380ceb70a4529c4aaafb50d65ec9e745e1698ac4a3dc6607745
          • Instruction Fuzzy Hash: F4619B72B19B5682EA00DF05EE4452AA3A5FB44BD4FAA8131EE9E43795DF38D410C710
          Function 00007FF78C0820C0 Relevance: 10.6, APIs: 7, Instructions: 118COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove
          • String ID:
          • API String ID: 349968220-0
          • Opcode ID: ca9ee1045e7a58d9e206f9a398fcb136a9d1b38a6006add39d166b7b6665799c
          • Instruction ID: 66ea9376cda9232cd37beb2e8b432fbceb7f062e4352332b2cad49608beaa0cc
          • Opcode Fuzzy Hash: ca9ee1045e7a58d9e206f9a398fcb136a9d1b38a6006add39d166b7b6665799c
          • Instruction Fuzzy Hash: EC417A72B14A4681EE149F26ED046A8A360FB94FE4FA48232DE6E473D8DF3CD546C350
          Function 00007FF78C081F00 Relevance: 10.6, APIs: 7, Instructions: 118COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$V0@@$A@$$$memmove
          • String ID:
          • API String ID: 3031525755-0
          • Opcode ID: c10b9a747df61d4ac98d4f3cc6fd31afb5f63f0d04a019b5d79bc8e52a744493
          • Instruction ID: ed3d6e21b72d615508b60eac40d1ee9154292037f140aae031c251976a611eb5
          • Opcode Fuzzy Hash: c10b9a747df61d4ac98d4f3cc6fd31afb5f63f0d04a019b5d79bc8e52a744493
          • Instruction Fuzzy Hash: 85416D72B14A4681DE14AF29DD046A9A360FB44BE5FA48232DE6E473EADF3CD545C310
          Function 00007FF78C089570 Relevance: 10.6, APIs: 7, Instructions: 117COMMON
          Download Yara Rule
          APIs
          • __p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF78C089577
          • __p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF78C089586
          • GetCommandLineW.KERNEL32 ref: 00007FF78C0895B2
          • CommandLineToArgvW.SHELL32 ref: 00007FF78C0895C3
            • Part of subcall function 00007FF78C0816D0: ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF78C081706
            • Part of subcall function 00007FF78C0816D0: ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF78C08170F
            • Part of subcall function 00007FF78C0816D0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C081721
            • Part of subcall function 00007FF78C0816D0: ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF78C081734
            • Part of subcall function 00007FF78C0816D0: ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF78C08173E
            • Part of subcall function 00007FF78C0816D0: ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF78C08174C
            • Part of subcall function 00007FF78C0816D0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C081758
            • Part of subcall function 00007FF78C0816D0: ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF78C081771
            • Part of subcall function 00007FF78C0816D0: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF78C0817F9
            • Part of subcall function 00007FF78C0816D0: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF78C081804
            • Part of subcall function 00007FF78C0816D0: ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF78C081810
            • Part of subcall function 00007FF78C0816D0: ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF78C08183A
            • Part of subcall function 00007FF78C0816D0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF78C08184C
            • Part of subcall function 00007FF78C0816D0: ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF78C081862
            • Part of subcall function 00007FF78C0816D0: ?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF78C081870
            • Part of subcall function 00007FF78C0816D0: ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF78C08187E
            • Part of subcall function 00007FF78C0816D0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF78C08188A
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: String@@$Engine$?setApplication@@Object@@View@@$CommandConnection@Icon@@LineMetaUrl@@Window$?connect?load@?start@ArgvBase@Closed@ConnectionIcon@Icon@@@Impl@LastMode@0@@ObjectPage@Page@@@ParsingPriority@1@@Private@@Qt@@QuitSlotString@@@Thread@@Type@U3@@Url@@@Widget@@@__p___argc__p___argv
          • String ID:
          • API String ID: 1766454188-0
          • Opcode ID: 0c9b826a39879bb4717c6040f2d0f12e201eb727dacf051a74b3607abf8ea877
          • Instruction ID: 71765071f9209652e05420f90f74f31c5ce4e862fccf801f08eccdcf08b2a599
          • Opcode Fuzzy Hash: 0c9b826a39879bb4717c6040f2d0f12e201eb727dacf051a74b3607abf8ea877
          • Instruction Fuzzy Hash: D2514C36608B8186D620AF55FD4036AB7A5FB88BD4FA48135EADD83B69DF3CD014CB14
          Function 00007FF78C088928 Relevance: 10.6, APIs: 7, Instructions: 94COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
          • String ID:
          • API String ID: 3995423050-0
          • Opcode ID: f7e6e570644ea3c906be73a7b06b5c09e982d6f4f8949b9c024e72f1f56c5213
          • Instruction ID: 64543ec8cab89dea3f1f72bf3ac33581b4649120c62bca2ca174963d265e33b3
          • Opcode Fuzzy Hash: f7e6e570644ea3c906be73a7b06b5c09e982d6f4f8949b9c024e72f1f56c5213
          • Instruction Fuzzy Hash: 36313D21A0C60786FA54BBA59E513B9A291FF417C4FE4C534D64E476D3DF2CA904D231
          Function 00007FF78C0814C0 Relevance: 10.5, APIs: 7, Instructions: 31networkCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: Network$AccessManager@@Request@@$String@@free
          • String ID:
          • API String ID: 2366384267-0
          • Opcode ID: b055371d3d992b7b9f19601adbdcf7a1de94a9123696e641c76ff7338eb46b51
          • Instruction ID: 1e5a711f279ff888d0d6aace61663278532ab9a235c498b492b19cb902a759e9
          • Opcode Fuzzy Hash: b055371d3d992b7b9f19601adbdcf7a1de94a9123696e641c76ff7338eb46b51
          • Instruction Fuzzy Hash: FD01A921A2484A93EB04FF60DD652BC6324FF50B89FD49031CA1E861BADF2CD559C370
          Function 00007FF78C08A41A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: __current_exception__current_exception_contextterminate
          • String ID: csm
          • API String ID: 2542180945-1018135373
          • Opcode ID: 4415411d15063a15b52e183c6001ef54e57adbf0684e0ed45ed66d6346dd2235
          • Instruction ID: 3262c0c881bc874efaba703d56eef98e038c805c5d74fc2b0f7889e1b6776d0a
          • Opcode Fuzzy Hash: 4415411d15063a15b52e183c6001ef54e57adbf0684e0ed45ed66d6346dd2235
          • Instruction Fuzzy Hash: 8DF0F437609B84CAC714AF61EC805AC3364FB8CB98B99A130FA8D47B55CF38D891C350
          Function 00007FF78C087960 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: Debug@@$Meta$?qt_Enum_debugObject@@Operator@@V1@_
          • String ID: Feature
          • API String ID: 1967151937-3496627450
          • Opcode ID: c58c18ad1a58fe61d578f95b00067cf648741b94699dcf8a00c3d5a9b1715350
          • Instruction ID: 9e77dd0abc99f27c7c62d6f2bbe55733ec561e2edb474991ca4f95e68a79d6c0
          • Opcode Fuzzy Hash: c58c18ad1a58fe61d578f95b00067cf648741b94699dcf8a00c3d5a9b1715350
          • Instruction Fuzzy Hash: B5F0B232508F4A95CA00AF84EC800A9B774FB85B99BA05032D78D82738DF7CD299CB10
          Function 00007FF78C085C10 Relevance: 6.2, APIs: 4, Instructions: 197memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF78C081E58), ref: 00007FF78C085CC6
          • ?qBadAlloc@@YAXXZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF78C081E58), ref: 00007FF78C085CD6
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF78C085D17
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF78C081E58), ref: 00007FF78C085EE6
          Memory Dump Source
          • Source File: 00000000.00000002.2506684609.00007FF78C081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78C080000, based on PE: true
          • Associated: 00000000.00000002.2506631985.00007FF78C080000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506743009.00007FF78C08B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506786664.00007FF78C08C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506862049.00007FF78C09E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2506925092.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff78c080000_TsrKUlTaYJ.jbxd
          Similarity
          • API ID: Alloc@@ArrayData@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 915963882-0
          • Opcode ID: bbc73bbdad086c4e9bdf0a91563f514b5a5d8488271d84e64eabccda79fde440
          • Instruction ID: 89e477ce6191f1f9de78dbeeb4ffa04de00a2b3809f2330e30b0c0483fb34da1
          • Opcode Fuzzy Hash: bbc73bbdad086c4e9bdf0a91563f514b5a5d8488271d84e64eabccda79fde440
          • Instruction Fuzzy Hash: 33817A32719F4A82EE54DF09E9806A8B3A5FB58BC4FA08122EB9D43764DF39D561C710