Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
LlDmBISVy0.exe

Overview

General Information

Sample name:LlDmBISVy0.exe
renamed because original name is a hash value
Original sample name:d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6.exe
Analysis ID:1530956
MD5:b9693b6541a22d01b100b867375279e6
SHA1:69a65e7a28be4f924f5fdf79ea08f050dac760ac
SHA256:d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6
Tags:95-164-17-24exeuser-JAMESWT_MHT

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected potential crypto function
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • LlDmBISVy0.exe (PID: 4488 cmdline: "C:\Users\user\Desktop\LlDmBISVy0.exe" MD5: B9693B6541A22D01B100B867375279E6)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: LlDmBISVy0.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: LlDmBISVy0.exeReversingLabs: Detection: 55%
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C24690 ?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?copy@QFile@@SA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??0QString@@QEAA@PEBD@Z,?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z,??1QString@@QEAA@XZ,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QSqlDatabase@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlDatabase@@QEAA@XZ,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z,??0QString@@QEAA@PEBD@Z,?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z,??1QString@@QEAA@XZ,?exec@QSqlQuery@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlQuery@@QEAA@XZ,?next@QSqlQuery@@QEAA_NXZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ,??1QVariant@@QEAA@XZ,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?left@QByteArray@@QEHAA?AV1@_J@Z,??1QByteArray@@QEAA@XZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?length@QByteArray@@QEBA_JXZ,EVP_DecryptInit_ex,?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QFile@@QEAA@AEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,??1QString@@QEAA@XZ,??1QSt0_2_00007FF755C24690
Source: LlDmBISVy0.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: LlDmBISVy0.exeString found in binary or memory: http://95.164.17.24:1224
Source: LlDmBISVy0.exeString found in binary or memory: https://hello.freeconference.com/login/access-code
Source: LlDmBISVy0.exeString found in binary or memory: https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://95.164.17.24:1224
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C246900_2_00007FF755C24690
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C269F00_2_00007FF755C269F0
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C225C00_2_00007FF755C225C0
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C255700_2_00007FF755C25570
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C233B00_2_00007FF755C233B0
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C22B200_2_00007FF755C22B20
Source: LlDmBISVy0.exeBinary or memory string: OriginalFilename vs LlDmBISVy0.exe
Source: LlDmBISVy0.exe, 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameFCCCall.exe0 vs LlDmBISVy0.exe
Source: LlDmBISVy0.exeBinary or memory string: OriginalFilenameFCCCall.exe0 vs LlDmBISVy0.exe
Source: classification engineClassification label: mal56.winEXE@1/0@0/0
Source: LlDmBISVy0.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\LlDmBISVy0.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: LlDmBISVy0.exeReversingLabs: Detection: 55%
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: libcrypto-1_1-x64.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: qt6webenginewidgets.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: qt6widgets.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: qt6webenginecore.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: qt6gui.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: qt6sql.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: qt6network.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: qt6core.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exeSection loaded: vcruntime140.dllJump to behavior
Source: LlDmBISVy0.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: LlDmBISVy0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: LlDmBISVy0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: LlDmBISVy0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: LlDmBISVy0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LlDmBISVy0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: LlDmBISVy0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: LlDmBISVy0.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: LlDmBISVy0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LlDmBISVy0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LlDmBISVy0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LlDmBISVy0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LlDmBISVy0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LlDmBISVy0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C295A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF755C295A8
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C295A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF755C295A8
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C29144 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF755C29144
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C2978C SetUnhandledExceptionFilter,0_2_00007FF755C2978C
Source: C:\Users\user\Desktop\LlDmBISVy0.exeCode function: 0_2_00007FF755C297F8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF755C297F8

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
DLL Side-Loading		1
DLL Side-Loading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager2
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
LlDmBISVy0.exe55%ReversingLabsWin64.Trojan.Malgent
LlDmBISVy0.exe100%AviraTR/PSW.Agent.qhtkl

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://95.164.17.24:1224LlDmBISVy0.exefalse
    		unknown
    https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://95.164.17.24:1224LlDmBISVy0.exefalse
      		unknown
      https://hello.freeconference.com/login/access-codeLlDmBISVy0.exefalse
        		unknown

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1530956
        Start date and time:2024-10-10 18:17:08 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 3m 42s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:5
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:LlDmBISVy0.exe
        renamed because original name is a hash value
        Original Sample Name:d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6.exe
        Detection:MAL
        Classification:mal56.winEXE@1/0@0/0
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 25
        Cookbook Comments:
        • Found application associated with file extension: .exe

        Warnings

        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
        • Execution Graph export aborted for target LlDmBISVy0.exe, PID 4488 because there are no executed function
        • Not all processes where analyzed, report is missing behavior information
        • VT rate limit hit for: LlDmBISVy0.exe

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:PE32+ executable (GUI) x86-64, for MS Windows
        Entropy (8bit):5.978299260387949
        TrID:
        • Win64 Executable GUI (202006/5) 92.65%
        • Win64 Executable (generic) (12005/4) 5.51%
        • Generic Win/DOS Executable (2004/3) 0.92%
        • DOS Executable Generic (2002/1) 0.92%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:LlDmBISVy0.exe
        File size:233'984 bytes
        MD5:b9693b6541a22d01b100b867375279e6
        SHA1:69a65e7a28be4f924f5fdf79ea08f050dac760ac
        SHA256:d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6
        SHA512:07338a44be0f312ec9ef65d896cd90690efd1139d6d78c4dccaa0509677120e0ddc7356fc4b98e039cb5270ce018bfaf21d9a60a3fe342894bb987bdc1f44d73
        SSDEEP:3072:0Xp9xOeXTmPmXvUeqZ0kLnQTN+JNecKPCIdP9VCgs83:07xOgTmPRLZ02QTN+JNvKPCI1b3
        TLSH:90345B6E220B12E5E069C73FC24D0642D3BEBC164722D7EF0635792E1EF76A12E78159
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..Ha...a...a...h.X.k....#..b....#..k....#.......#..g.......`.......o.......c.......f...a.......r$..g...r$4.`...a.\.`...r$..`..

        File Icon

        Icon Hash:21c46db2b26dc421

        Static PE Info

        General

        Entrypoint:0x140008f8c
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x140000000
        Subsystem:windows gui
        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Time Stamp:0x66B43CD3 [Thu Aug 8 03:34:43 2024 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:6
        OS Version Minor:0
        File Version Major:6
        File Version Minor:0
        Subsystem Version Major:6
        Subsystem Version Minor:0
        Import Hash:3d3c54a1893ef4ecc2c2c202285b4013

        Entrypoint Preview

        Instruction
        dec eax
        sub esp, 28h
        call 00007FF3C924DBB8h
        dec eax
        add esp, 28h
        jmp 00007FF3C924D1CFh
        int3
        int3
        retn 0000h
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000D6A1h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007FF3C924DD3Eh
        dec eax
        lea eax, dword ptr [0000D6B4h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000D6ACh]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000D691h]
        dec eax
        mov dword ptr [ecx], eax
        dec eax
        mov eax, ecx
        ret
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        dec eax
        mov eax, edx
        dec eax
        lea ecx, dword ptr [0000D645h]
        xorps xmm0, xmm0
        dec eax
        mov dword ptr [ebx], ecx
        dec eax
        lea edx, dword ptr [ebx+08h]
        dec eax
        lea ecx, dword ptr [eax+08h]
        movups dqword ptr [edx], xmm0
        call 00007FF3C924DCE2h
        dec eax
        lea eax, dword ptr [0000D680h]
        dec eax
        mov dword ptr [ebx], eax
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        and dword ptr [ecx+10h], 00000000h
        dec eax
        lea eax, dword ptr [0000D678h]
        dec eax
        mov dword ptr [ecx+08h], eax
        dec eax
        lea eax, dword ptr [0000D65Dh]

        Rich Headers

        Programming Language:
        • [IMP] VS2008 SP1 build 30729

        Data Directories

        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x187f40x17c.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1f0000x1c2c8.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1e0000x5a0.pdata
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x3c0000x234.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x168300x1c.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x168800x28.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x166f00x140.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0xb0000xbd0.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x98bf0x9a005d8b3c1f358450e555f6975b8d120d66False0.44635247564935066data6.055243253523373IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0xb0000x11efc0x12000b3a2841f01d91c94a41641b84b38283fFalse0.7157660590277778data7.152548625651864IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x1d0000xb800x600f148e5df1586d2885b0e688749a215acFalse0.2552083333333333data2.7954466424783204IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .pdata0x1e0000x5a00x6009c9af11bc856675559ccbcd0a283cdaeFalse0.4876302083333333data4.3789121949938075IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .rsrc0x1f0000x1c2c80x1c400a6627eb8c3d14019c45e88220595027fFalse0.20462009126106195data3.9772652649113573IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .reloc0x3c0000x2340x400d40db29b847275feeb6d202ee01cdb1dFalse0.4111328125data3.6790155814282715IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

        Resources

        NameRVASizeTypeLanguageCountryZLIB Complexity
        RT_ICON0x1f2400x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/mEnglishUnited States0.36879432624113473
        RT_ICON0x1f6a80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/mEnglishUnited States0.19606003752345216
        RT_ICON0x207500x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/mEnglishUnited States0.14066390041493776
        RT_ICON0x22cf80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/mEnglishUnited States0.108171941426547
        RT_ICON0x26f200x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mEnglishUnited States0.06342422808470366
        RT_ICON0x377480x3619PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9919849808650444
        RT_GROUP_ICON0x3ad680x5adataEnglishUnited States0.7444444444444445
        RT_VERSION0x3adc80x27cdataEnglishUnited States0.470125786163522
        RT_MANIFEST0x3b0480x27eXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5501567398119123

        Imports

        DLLImport
        CRYPT32.dllCryptUnprotectData
        libcrypto-1_1-x64.dllEVP_CIPHER_CTX_free, EVP_CIPHER_CTX_new, EVP_DecryptUpdate, EVP_DecryptInit_ex, EVP_aes_256_gcm
        Qt6WebEngineWidgets.dll?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z, ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z, ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z, ??1QWebEngineView@@UEAA@XZ
        Qt6Widgets.dll?paintEvent@QMenu@@MEAAXPEAVQPaintEvent@@@Z, ?hideEvent@QMenu@@MEAAXPEAVQHideEvent@@@Z, ?leaveEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?enterEvent@QMenu@@MEAAXPEAVQEnterEvent@@@Z, ?wheelEvent@QMenu@@MEAAXPEAVQWheelEvent@@@Z, ?mouseMoveEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mousePressEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?mouseReleaseEvent@QMenu@@MEAAXPEAVQMouseEvent@@@Z, ?keyPressEvent@QMenu@@MEAAXPEAVQKeyEvent@@@Z, ?changeEvent@QMenu@@MEAAXPEAVQEvent@@@Z, ?sizeHint@QMenu@@UEBA?AVQSize@@XZ, ?qt_metacall@QMenu@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QMenu@@UEAAPEAXPEBD@Z, ?metaObject@QMenu@@UEBAPEBUQMetaObject@@XZ, ?inputMethodQuery@QWidget@@UEBA?AVQVariant@@W4InputMethodQuery@Qt@@@Z, ?inputMethodEvent@QWidget@@MEAAXPEAVQInputMethodEvent@@@Z, ?sharedPainter@QWidget@@MEBAPEAVQPainter@@XZ, ?redirected@QWidget@@MEBAPEAVQPaintDevice@@PEAVQPoint@@@Z, ?initPainter@QWidget@@MEBAXPEAVQPainter@@@Z, ?metric@QWidget@@MEBAHW4PaintDeviceMetric@QPaintDevice@@@Z, ?nativeEvent@QWidget@@MEAA_NAEBVQByteArray@@PEAXPEA_J@Z, ?showEvent@QWidget@@MEAAXPEAVQShowEvent@@@Z, ?dropEvent@QWidget@@MEAAXPEAVQDropEvent@@@Z, ?dragLeaveEvent@QWidget@@MEAAXPEAVQDragLeaveEvent@@@Z, ?dragMoveEvent@QWidget@@MEAAXPEAVQDragMoveEvent@@@Z, ?dragEnterEvent@QWidget@@MEAAXPEAVQDragEnterEvent@@@Z, ?tabletEvent@QWidget@@MEAAXPEAVQTabletEvent@@@Z, ?actionEvent@QMenu@@MEAAXPEAVQActionEvent@@@Z, ?closeEvent@QWidget@@MEAAXPEAVQCloseEvent@@@Z, ?resizeEvent@QWidget@@MEAAXPEAVQResizeEvent@@@Z, ?moveEvent@QWidget@@MEAAXPEAVQMoveEvent@@@Z, ?focusOutEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?focusInEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z, ?keyReleaseEvent@QWidget@@MEAAXPEAVQKeyEvent@@@Z, ?mouseDoubleClickEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z, ?paintEngine@QWidget@@UEBAPEAVQPaintEngine@@XZ, ?event@QMenu@@MEAA_NPEAVQEvent@@@Z, ?hasHeightForWidth@QWidget@@UEBA_NXZ, ?heightForWidth@QWidget@@UEBAHH@Z, ?minimumSizeHint@QWidget@@UEBA?AVQSize@@XZ, ?setVisible@QWidget@@UEAAX_N@Z, ?devType@QWidget@@UEBAHXZ, ?setVisible@QSystemTrayIcon@@QEAAX_N@Z, ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z, ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z, ??1QSystemTrayIcon@@UEAA@XZ, ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z, ??1QMenu@@UEAA@XZ, ??0QMenu@@QEAA@PEAVQWidget@@@Z, ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z, ?resize@QWidget@@QEAAXHH@Z, ?hide@QWidget@@QEAAXXZ, ?show@QWidget@@QEAAXXZ, ?exec@QApplication@@SAHXZ, ??1QApplication@@UEAA@XZ, ??0QApplication@@QEAA@AEAHPEAPEADH@Z, ?contextMenuEvent@QWidget@@MEAAXPEAVQContextMenuEvent@@@Z, ?focusNextPrevChild@QMenu@@MEAA_N_N@Z, ?initStyleOption@QMenu@@MEBAXPEAVQStyleOptionMenuItem@@PEBVQAction@@@Z, ?timerEvent@QMenu@@MEAAXPEAVQTimerEvent@@@Z
        Qt6WebEngineCore.dll?qt_metacast@QWebEnginePage@@UEAAPEAXPEBD@Z, ?qt_metacall@QWebEnginePage@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?createWindow@QWebEnginePage@@MEAAPEAV1@W4WebWindowType@1@@Z, ?acceptNavigationRequest@QWebEnginePage@@MEAA_NAEBVQUrl@@W4NavigationType@1@_N@Z, ?javaScriptConsoleMessage@QWebEnginePage@@MEAAXW4JavaScriptConsoleMessageLevel@1@AEBVQString@@H1@Z, ?javaScriptPrompt@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@1PEAV3@@Z, ?javaScriptConfirm@QWebEnginePage@@MEAA_NAEBVQUrl@@AEBVQString@@@Z, ?javaScriptAlert@QWebEnginePage@@MEAAXAEBVQUrl@@AEBVQString@@@Z, ?chooseFiles@QWebEnginePage@@MEAA?AV?$QList@VQString@@@@W4FileSelectionMode@1@AEBV2@1@Z, ?staticMetaObject@QWebEnginePage@@2UQMetaObject@@B, ?event@QWebEnginePage@@UEAA_NPEAVQEvent@@@Z, ?triggerAction@QWebEnginePage@@UEAAXW4WebAction@1@_N@Z, ?featurePermissionRequested@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@@Z, ?setFeaturePermission@QWebEnginePage@@QEAAXAEBVQUrl@@W4Feature@1@W4PermissionPolicy@1@@Z, ??1QWebEnginePage@@UEAA@XZ, ??0QWebEnginePage@@QEAA@PEAVQObject@@@Z
        Qt6Gui.dll?triggered@QAction@@QEAAX_N@Z, ??1QIcon@@QEAA@XZ, ??0QIcon@@QEAA@AEBVQString@@@Z, ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z, ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z, ?staticMetaObject@QAction@@2UQMetaObject@@B
        Qt6Sql.dll?removeDatabase@QSqlDatabase@@SAXAEBVQString@@@Z, ?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z, ?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ, ?open@QSqlDatabase@@QEAA_NXZ, ??1QSqlDatabase@@QEAA@XZ, ?text@QSqlError@@QEBA?AVQString@@XZ, ??1QSqlError@@QEAA@XZ, ??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z, ??1QSqlQuery@@QEAA@XZ, ?value@QSqlQuery@@QEBA?AVQVariant@@H@Z, ?next@QSqlQuery@@QEAA_NXZ, ?exec@QSqlQuery@@QEAA_NXZ, ?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z, ?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z
        Qt6Network.dll?get@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@@Z, ?localHostName@QHostInfo@@SA?AVQString@@XZ, ?setBoundary@QHttpMultiPart@@QEAAXAEBVQByteArray@@@Z, ?setContentType@QHttpMultiPart@@QEAAXW4ContentType@1@@Z, ?append@QHttpMultiPart@@QEAAXAEBVQHttpPart@@@Z, ??1QHttpMultiPart@@UEAA@XZ, ??0QHttpMultiPart@@QEAA@W4ContentType@0@PEAVQObject@@@Z, ?setBodyDevice@QHttpPart@@QEAAXPEAVQIODevice@@@Z, ?post@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@PEAVQHttpMultiPart@@@Z, ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z, ??1QHttpPart@@QEAA@XZ, ??0QHttpPart@@QEAA@XZ, ?setRawHeader@QNetworkRequest@@QEAAXAEBVQByteArray@@0@Z, ?setUrl@QNetworkRequest@@QEAAXAEBVQUrl@@@Z, ??1QNetworkAccessManager@@UEAA@XZ, ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z, ??1QNetworkRequest@@QEAA@XZ, ??0QNetworkRequest@@QEAA@XZ, ?error@QNetworkReply@@QEBA?AW4NetworkError@1@XZ, ?finished@QNetworkReply@@QEAAXXZ, ?metaObject@QHttpMultiPart@@UEBAPEBUQMetaObject@@XZ, ?qt_metacast@QHttpMultiPart@@UEAAPEAXPEBD@Z, ?qt_metacall@QHttpMultiPart@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?staticMetaObject@QNetworkReply@@2UQMetaObject@@B, ?setBody@QHttpPart@@QEAAXAEBVQByteArray@@@Z
        Qt6Core.dll??6@YA?AVQDebug@@V0@AEBVQUrl@@@Z, ??5@YAAEAVQDataStream@@AEAV0@AEAVQUrl@@@Z, ??6@YAAEAVQDataStream@@AEAV0@AEBVQUrl@@@Z, ??8QUrl@@QEBA_NAEBV0@@Z, ??MQUrl@@QEBA_NAEBV0@@Z, ??0QUrl@@QEAA@$$QEAV0@@Z, ??0QUrl@@QEAA@AEBV0@@Z, ??0QUrl@@QEAA@XZ, ?qt_metacall@QThread@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QThread@@UEAAPEAXPEBD@Z, ?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ, ??0QMetaType@@QEAA@XZ, ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX@Z, ?staticMetaObject@QThread@@2UQMetaObject@@B, ?qResourceFeatureZlib@@YAEXZ, ?qUnregisterResourceData@@YA_NHPEBE00@Z, ?qRegisterResourceData@@YA_NHPEBE00@Z, ?id@QMetaType@@QEBAHH@Z, ?registerNormalizedTypedef@QMetaType@@SAXAEBVQByteArray@@V1@@Z, ??6QDataStream@@QEAAAEAV0@H@Z, ??5QDataStream@@QEAAAEAV0@AEAH@Z, ?append@QByteArray@@QEAAAEAV1@PEBD@Z, ?reserve@QByteArray@@QEAAX_J@Z, ?className@QMetaObject@@QEBAPEBDXZ, ?event@QObject@@UEAA_NPEAVQEvent@@@Z, ?setPermissions@QFile@@UEAA_NV?$QFlags@W4Permission@QFileDevice@@@@@Z, ?permissions@QFile@@UEBA?AV?$QFlags@W4Permission@QFileDevice@@@@XZ, ?resize@QFile@@UEAA_N_J@Z, ?size@QFile@@UEBA_JXZ, ?fileName@QFile@@UEBA?AVQString@@XZ, ?qt_metacall@QFile@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QFile@@UEAAPEAXPEBD@Z, ?metaObject@QFile@@UEBAPEBUQMetaObject@@XZ, ?readLineData@QFileDevice@@MEAA_JPEAD_J@Z, ?writeData@QFileDevice@@MEAA_JPEBD_J@Z, ?readData@QFileDevice@@MEAA_JPEAD_J@Z, ?atEnd@QFileDevice@@UEBA_NXZ, ?seek@QFileDevice@@UEAA_N_J@Z, ?pos@QFileDevice@@UEBA_JXZ, ?isSequential@QFileDevice@@UEBA_NXZ, ?skipData@QIODevice@@MEAA_J_J@Z, ?readLineData@QIODevice@@MEAA_JPEAD_J@Z, ?waitForBytesWritten@QIODevice@@UEAA_NH@Z, ?waitForReadyRead@QIODevice@@UEAA_NH@Z, ?canReadLine@QIODevice@@UEBA_NXZ, ?bytesToWrite@QIODevice@@UEBA_JXZ, ?bytesAvailable@QIODevice@@UEBA_JXZ, ?reset@QIODevice@@UEAA_NXZ, ?atEnd@QIODevice@@UEBA_NXZ, ?seek@QIODevice@@UEAA_N_J@Z, ?size@QIODevice@@UEBA_JXZ, ?pos@QIODevice@@UEBA_JXZ, ?setupChildProcess@QProcess@@EEAA?AUUse_setChildProcessModifier_Instead@1@XZ, ?writeData@QProcess@@MEAA_JPEBD_J@Z, ?readData@QProcess@@MEAA_JPEAD_J@Z, ?close@QProcess@@UEAAXXZ, ?isSequential@QProcess@@UEBA_NXZ, ?bytesToWrite@QProcess@@UEBA_JXZ, ?waitForBytesWritten@QProcess@@UEAA_NH@Z, ?waitForReadyRead@QProcess@@UEAA_NH@Z, ?open@QProcess@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?qt_metacall@QProcess@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z, ?qt_metacast@QProcess@@UEAAPEAXPEBD@Z, ?metaObject@QProcess@@UEBAPEBUQMetaObject@@XZ, ??AQJsonDocument@@QEBA?BVQJsonValue@@AEBVQString@@@Z, ?fromJson@QJsonDocument@@SA?AV1@AEBVQByteArray@@PEAUQJsonParseError@@@Z, ??4QJsonDocument@@QEAAAEAV0@$$QEAV0@@Z, ??1QJsonDocument@@QEAA@XZ, ??0QJsonDocument@@QEAA@XZ, ??0QJsonParseError@@QEAA@XZ, ??AQJsonValue@@QEBA?BV0@AEBVQString@@@Z, ?toVariant@QJsonValue@@QEBA?AVQVariant@@XZ, ??1QJsonValue@@QEAA@XZ, ?sleep@QThread@@SAXK@Z, ?currentType@QOperatingSystemVersion@@SA?AW4OSType@1@XZ, ?waitForFinished@QProcess@@QEAA_NH@Z, ?start@QProcess@@QEAAXAEBVQString@@AEBV?$QList@VQString@@@@V?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ??1QProcess@@UEAA@XZ, ??0QProcess@@QEAA@PEAVQObject@@@Z, ?homePath@QDir@@SA?AVQString@@XZ, ?exists@QDir@@QEBA_NXZ, ?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z, ?setNameFilters@QDir@@QEAAXAEBV?$QList@VQString@@@@@Z, ??1QDir@@QEAA@XZ, ??0QDir@@QEAA@AEBVQString@@@Z, ?fileName@QFileInfo@@QEBA?AVQString@@XZ, ?filePath@QFileInfo@@QEBA?AVQString@@XZ, ??1QFileInfo@@QEAA@XZ, ??0QFileInfo@@QEAA@AEBV0@@Z, ?currentMSecsSinceEpoch@QDateTime@@SA_JXZ, ?toString@QVariant@@QEBA?AVQString@@XZ, ?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ, ??0QVariant@@QEAA@PEBD@Z, ??0QVariant@@QEAA@AEBVQString@@@Z, ??1QVariant@@QEAA@XZ, ?qt_QMetaEnum_debugOperator@@YA?AVQDebug@@AEAV1@_JPEBUQMetaObject@@PEBD@Z, ??6QDebug@@QEAAAEAV0@AEBVQByteArray@@@Z, ??6QDebug@@QEAAAEAV0@PEBD@Z, ??1QDebug@@QEAA@XZ, ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z, ?copy@QFile@@SA_NAEBVQString@@0@Z, ?remove@QFile@@SA_NAEBVQString@@@Z, ?exists@QFile@@QEBA_NXZ, ??1QFile@@UEAA@XZ, ??0QFile@@QEAA@AEBVQString@@@Z, ?close@QFileDevice@@UEAAXXZ, ?write@QIODevice@@QEAA_JAEBVQByteArray@@@Z, ?allocate@QArrayData@@SAPEAXPEAPEAU1@_J11W4AllocationOption@1@@Z, ??0QString@@QEAA@AEBV0@@Z, ??1QString@@QEAA@XZ, ??0QString@@QEAA@PEBD@Z, ??1Connection@QMetaObject@@QEAA@XZ, ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z, ?exit@QCoreApplication@@SAXH@Z, ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z, ??1QUrl@@QEAA@XZ, ??0QThread@@QEAA@PEAVQObject@@@Z, ??1QThread@@UEAA@XZ, ?start@QThread@@QEAAXW4Priority@1@@Z, ?event@QThread@@UEAA_NPEAVQEvent@@@Z, ?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z, ?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z, ?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z, ?customEvent@QObject@@MEAAXPEAVQEvent@@@Z, ?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z, ?qBadAlloc@@YAXXZ, ??0QMessageLogger@@QEAA@PEBDH0@Z, ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ, ??0QChar@@QEAA@_S@Z, ??0QChar@@QEAA@D@Z, ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z, ?castHelper@QByteArrayView@@CAPEBDPEBD@Z, ?size@QByteArrayView@@QEBA_JXZ, ?data@QByteArrayView@@QEBAPEBDXZ, ??0QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@PEBD_J@Z, ??0QByteArray@@QEAA@AEBV0@@Z, ??1QByteArray@@QEAA@XZ, ??0QByteArray@@QEAA@$$QEAV0@@Z, ??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z, ?data@QByteArray@@QEAAPEADXZ, ?data@QByteArray@@QEBAPEBDXZ, ?left@QByteArray@@QEHAA?AV1@_J@Z, ?right@QByteArray@@QEGBA?AV1@_J@Z, ?append@QByteArray@@QEAAAEAV1@AEBV1@@Z, ??YQByteArray@@QEAAAEAV0@PEBD@Z, ?setNum@QByteArray@@QEAAAEAV1@_KH@Z, ?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z, ?fromBase64@QByteArray@@SA?AV1@AEBV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z, ?size@QByteArray@@QEBA_JXZ, ?length@QByteArray@@QEBA_JXZ, ?isNull@QByteArray@@QEBA_NXZ, ??0QString@@QEAA@$$QEAV0@@Z, ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z, ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z, ?indexOf@QString@@QEBA_JAEBV1@_JW4CaseSensitivity@Qt@@@Z, ?append@QString@@QEAAAEAV1@VQChar@@@Z, ?append@QString@@QEAAAEAV1@AEBV1@@Z, ?append@QString@@QEAAAEAV1@V?$QBasicUtf8StringView@$0A@@@@Z, ?split@QString@@QEBA?AV?$QList@VQString@@@@AEBV1@V?$QFlags@W4SplitBehaviorFlags@Qt@@@@W4CaseSensitivity@Qt@@@Z, ?toUtf8@QString@@QEHAA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEGBA?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ, ?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z, ?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z, ?toInt@QString@@QEBAHPEA_NH@Z, ??YQString@@QEAAAEAV0@PEBD@Z, ??8QString@@QEBA_NPEBD@Z, ?QStringList_join@QtPrivate@@YA?AVQString@@PEBV?$QList@VQString@@@@PEBVQChar@@_J@Z, ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ
        KERNEL32.dllWideCharToMultiByte, LocalFree, GetCommandLineW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleW, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext
        VCRUNTIME140_1.dll__CxxFrameHandler4
        VCRUNTIME140.dll_CxxThrowException, memcpy, memcmp, memmove, __std_terminate, memset, __current_exception, __current_exception_context, __C_specific_handler, __std_exception_copy, __std_exception_destroy
        api-ms-win-crt-heap-l1-1-0.dll_set_new_mode, free, _callnewh, malloc
        api-ms-win-crt-runtime-l1-1-0.dll_register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _initialize_onexit_table, _get_narrow_winmain_command_line, _initterm, _initterm_e, exit, _exit, _initialize_narrow_environment, _c_exit, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, __p___argc, terminate, __p___argv
        api-ms-win-crt-math-l1-1-0.dll__setusermatherr
        api-ms-win-crt-stdio-l1-1-0.dll_set_fmode, __p__commode
        api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
        SHELL32.dllCommandLineToArgvW

        Possible Origin

        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States

        Network Behavior

        ⊘No network behavior found

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:12:18:00
        Start date:10/10/2024
        Path:C:\Users\user\Desktop\LlDmBISVy0.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\LlDmBISVy0.exe"
        Imagebase:0x7ff755c20000
        File size:233'984 bytes
        MD5 hash:B9693B6541A22D01B100B867375279E6
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Disassembly

        Reset < >

          Non-executed Functions

          Function 00007FF755C233B0 Relevance: 333.7, APIs: 172, Strings: 18, Instructions: 1152windowmemoryCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$V0@@$Char@@Char@@@$A@$$$?arg@Byte$Dir@@$?append@$Array$FileFlags@List@View@@$V1@@$?file?size@Array@@Info@@Path@String@@@$Debug@@$?data@?entryDir@@@@Dir@@@@@Filter@Flag@InfoInfo@@@@Sort$?cast?homeCaseHelper@Logger@@MessageName@Qt@@@Sensitivity@$?allocate@?debug@?exists@?index?remove?remove@?set?split@A@@@@AllocationArray@@@BasicBehaviorData@@Database@Database@@File@@Filters@Int@NameNull@Option@1@@Qt@@@@SplitStringString@@@@String@@@@@U1@_Utf8V1@_View@$0freememcmp
          • String ID: %1_%2$%1_%2_%3$%1_%2_%3_%4$%1_%2_%3_%4_%5$*.ldb$*.log$/Library/Keychains/login.keychain-db$/Local Extension Settings/$/Local State$/Login Data$/pwd$Default$Profile $key$logkc_db$lst$pld$pwd
          • API String ID: 2470095737-179149765
          • Opcode ID: aea8ccbf7ba59413deba93f46afa3e58f18f166ef1ff1b7f30a749a50e3ed78f
          • Instruction ID: fe982a2a1c560ac7b73d8f09ed01b5ee9eed188e424c341622300ce15c5d2c00
          • Opcode Fuzzy Hash: aea8ccbf7ba59413deba93f46afa3e58f18f166ef1ff1b7f30a749a50e3ed78f
          • Instruction Fuzzy Hash: CDC283B7A14A4396EB10EF64E8946ADB320FB85F4CF845031DA8E47A68DF3DE548C750
          Function 00007FF755C24690 Relevance: 261.7, APIs: 138, Strings: 11, Instructions: 925windowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$Debug@@$Logger@@Message$Database@@Error@@$?debug@Query@@$?home?last?text@A@$$Dir@@Error@Path@String@@0@String@@@V0@@$?add?copy@?exec@?open@?prepare@?setArray@@ByteDatabaseDatabase@Database@@@File@@Name@
          • String ID: %s.$/Login Data$/pwd$@$Error occurred opening the database.$Error occurred querying.$QSQLITE$origin_url: $password: $select username_value, password_value, origin_url from logins order by date_created$username:
          • API String ID: 3116649450-68594496
          • Opcode ID: 6b1e289d4f64c9bac0af0c3a1d367a43dcf9370a173cc262626135be55bc3327
          • Instruction ID: f003d114523aee9c4abffd87a4da9715839c9d810d24a4372aef779735fbd118
          • Opcode Fuzzy Hash: 6b1e289d4f64c9bac0af0c3a1d367a43dcf9370a173cc262626135be55bc3327
          • Instruction Fuzzy Hash: 0292A4B7A18A4796EB00EF24D8542A9B321FB85F9DFC81131DA8E476A4DF3DE548C350
          Function 00007FF755C22B20 Relevance: 150.9, APIs: 77, Strings: 9, Instructions: 363networktimeCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: Http$Byte$Part@@$Array@@$?setVariant@@$Header@Headers@KnownNetworkRequest@@String@@Variant@@@$Multi$?append@$Array@@@$Body@Part@@@$ContentV0@@$HostString@@@V1@@$?arg@?current?localA@$$Bit@BodyBoundary@Char@@Char@@@DateDevice@Device@@@Epoch@File@@Info@@Local8Name@Num@Object@@@SecsSinceTime@@Type@Type@0@Type@1@@Utf8@V1@_malloc
          • String ID: ---------------------------99614912995$Call_$application/json$application/octet-stream$form-data; name="hid";$form-data; name="multi_file"; filename="%1"$form-data; name="type";$form-data; name="uts";${"options":{"filename":"
          • API String ID: 1558666637-725218759
          • Opcode ID: 3c7026c36c3053d4909fdb4034197684b9948dd718b8320bca8d5832f924591e
          • Instruction ID: f295267a6b1b69e54b97e9929628b7ca11106815fac3ecddc951f8a63f5ac82a
          • Opcode Fuzzy Hash: 3c7026c36c3053d4909fdb4034197684b9948dd718b8320bca8d5832f924591e
          • Instruction Fuzzy Hash: 35F12EBAB04A47AAEB04EF60E8541A9B331FB85F4DBC45031DA8E576A8DF3DD509C350
          Function 00007FF755C25570 Relevance: 135.5, APIs: 72, Strings: 5, Instructions: 785windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$?homeDir@@Path@Process@@memmove$Base@@@@@ByteDebug@@DeviceDevice@@File@@Flag@Flags@ModeOpen$?start@Array@@List@Logger@@MessageNetworkObject@@@String@@@@free$?close@?debug@?error@?open@?read?wait?write@All@Array@@@Error@1@FileFinished@Reply@@String@@@
          • String ID: --directory$-xf$/.pyp/python.exe$Download Python Success!$tar
          • API String ID: 1279688832-946420070
          • Opcode ID: 246b9298f9b310866e0d81a54239c765b70d6202b7d59b284447d9d5d9031e2d
          • Instruction ID: 63599b53218a52f0c2c31f06e8588499422cdbb92db45002340dff1b542d8822
          • Opcode Fuzzy Hash: 246b9298f9b310866e0d81a54239c765b70d6202b7d59b284447d9d5d9031e2d
          • Instruction Fuzzy Hash: 9062A1B7B18A4782EE10EB14D4445A9A361FB84F9CFC85132EA8E4B7A4DF3EE545C710
          Function 00007FF755C269F0 Relevance: 119.9, APIs: 56, Strings: 12, Instructions: 881COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove$?currentOperatingSystemType@Type@1@Version@@free
          • String ID: /.config/BraveSoftware/Brave-Browser$/.config/google-chrome$/.config/opera$/AppData/Local/BraveSoftware/Brave-Browser/User Data$/AppData/Local/Google/Chrome/User Data$/AppData/Roaming/Opera Software/Opera Stable$/Library/Application Support/BraveSoftware/Brave-Browser$/Library/Application Support/Google/Chrome$/Library/Application Support/com.operasoftware.opera$/Users$/home$C:\Users
          • API String ID: 283656904-339602194
          • Opcode ID: f1c4c6a375f70ff9108a1aa7a2b22820d4c6d222c986d2292962c70737e4cc34
          • Instruction ID: 2e718323882cec6468157262bc934ea03243c44b3c2b4a93f2441d9e0411eb81
          • Opcode Fuzzy Hash: f1c4c6a375f70ff9108a1aa7a2b22820d4c6d222c986d2292962c70737e4cc34
          • Instruction Fuzzy Hash: 5E829EB7F08A5786EF10EB65D4846FC6360EB44B8CBC84132DA4E57694DF3AE949C360
          Function 00007FF755C225C0 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 337windownetworkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$ByteDebug@@Device@@File@@$?homeArray@@Base@@@@@DeviceDir@@Flag@Flags@Logger@@MessageModeNetworkOpenPath@Process@@memmove$?close@?debug@?error@?open@?read?start@?write@All@Array@@@Error@1@FileList@Object@@@Reply@@String@@@String@@@@free
          • String ID: Download Client Success!$python
          • API String ID: 3419874151-3759921097
          • Opcode ID: b3b77bb5caebf7836780c2305add4cc2e1e480cfc593f136445eca4aebb2a0c0
          • Instruction ID: 9caa3841860d9c36479028de466bafd7f244d0f319a466bde4dc92e907145c55
          • Opcode Fuzzy Hash: b3b77bb5caebf7836780c2305add4cc2e1e480cfc593f136445eca4aebb2a0c0
          • Instruction Fuzzy Hash: 07E17DB7B08A4796EB10EFA5D8441AC6360EB45F9CBC84132DA4E577A8DF39E509C350
          Function 00007FF755C295A8 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
          • String ID:
          • API String ID: 313767242-0
          • Opcode ID: 3ace01a729f4377ccab7c2d2335b0107ba2e04b9437e380d5e12aa11a53a7592
          • Instruction ID: d62f25b378b21c9d47e548a5ec6239d3bd4bda35323308202abf4454ba7dae09
          • Opcode Fuzzy Hash: 3ace01a729f4377ccab7c2d2335b0107ba2e04b9437e380d5e12aa11a53a7592
          • Instruction Fuzzy Hash: D73135B7618B8286E7609F60E4407EDB364FB84B4CF88403ADA8D47794EF39D548C724
          Function 00007FF755C297F8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
          • String ID:
          • API String ID: 2933794660-0
          • Opcode ID: eb4612fc2041f40caedf73507f6f7be42af04d574852d212b71b0888e0cf46bc
          • Instruction ID: 0be969ee2cc76cc32dbd0204a7604613302410bd480f6a8946344332baa8a158
          • Opcode Fuzzy Hash: eb4612fc2041f40caedf73507f6f7be42af04d574852d212b71b0888e0cf46bc
          • Instruction Fuzzy Hash: 8C114CB6B14B068AEB009B60E8442B873B4FB58B5CF880E31DA6D467A4DF78D1A48350
          Function 00007FF755C2978C Relevance: .0, Instructions: 2COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: bb0a68e27f6fc000d11db93a2eaca196b853b787c8f44582de108ecaecbe28cd
          • Instruction ID: c8066ea2789888c406b73097f847f2110823346920588c6c8f5c5ca0f7a5d404
          • Opcode Fuzzy Hash: bb0a68e27f6fc000d11db93a2eaca196b853b787c8f44582de108ecaecbe28cd
          • Instruction Fuzzy Hash: FFA001AA91890BD0EA05AB01A850920A230EB60B08BC84131C09D85060AE2EA540C221
          Function 00007FF755C21610 Relevance: 107.0, APIs: 55, Strings: 6, Instructions: 298windownetworkthreadCOMMON
          Download Yara Rule
          APIs
          • ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF755C21646
          • ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF755C2164F
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21661
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF755C21674
          • ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF755C2167E
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF755C2168C
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C21698
            • Part of subcall function 00007FF755C21040: ??0QThread@@QEAA@PEAVQObject@@@Z.QT6CORE ref: 00007FF755C21074
            • Part of subcall function 00007FF755C21040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF755C2108B
            • Part of subcall function 00007FF755C21040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF755C21098
            • Part of subcall function 00007FF755C21040: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF755C210A5
            • Part of subcall function 00007FF755C21040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF755C210B0
            • Part of subcall function 00007FF755C21040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF755C210BB
            • Part of subcall function 00007FF755C21040: ??0QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF755C210C6
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C210D8
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21141
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21154
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21167
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C2117D
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21193
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C211A9
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C211BF
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C211D5
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C211EB
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21201
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21217
            • Part of subcall function 00007FF755C21040: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C2122D
          • ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF755C216B1
            • Part of subcall function 00007FF755C28964: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF755C216DD), ref: 00007FF755C2897E
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF755C21739
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF755C21744
          • ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF755C21750
            • Part of subcall function 00007FF755C28964: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF755C28994
            • Part of subcall function 00007FF755C27D50: ??0QWebEnginePage@@QEAA@PEAVQObject@@@Z.QT6WEBENGINECORE(?,?,?,?,?,?,?,?,?,?,?,00007FF755C21772), ref: 00007FF755C27D62
            • Part of subcall function 00007FF755C27D50: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF755C27DFF
            • Part of subcall function 00007FF755C27D50: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF755C27E0A
          • ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF755C2177A
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C2178C
          • ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF755C217A2
          • ?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF755C217B0
          • ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF755C217BE
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C217CA
          • ?resize@QWidget@@QEAAXHH@Z.QT6WIDGETS ref: 00007FF755C217DF
          • ?show@QWidget@@QEAAXXZ.QT6WIDGETS ref: 00007FF755C217E9
          • ??0QMenu@@QEAA@PEAVQWidget@@@Z.QT6WIDGETS ref: 00007FF755C21808
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C2182E
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF755C2183C
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C21849
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF755C218DC
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF755C218E9
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C218FA
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF755C21908
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C21915
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF755C219A1
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF755C219AE
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C219BF
          • ?addAction@QWidget@@QEAAPEAVQAction@@AEBVQString@@@Z.QT6WIDGETS ref: 00007FF755C219CD
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C219DA
          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF755C21A4E
          • ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF755C21A5B
          • ??0QSystemTrayIcon@@QEAA@PEAVQObject@@@Z.QT6WIDGETS ref: 00007FF755C21A67
          • ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21A79
          • ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF755C21A8B
          • ?setIcon@QSystemTrayIcon@@QEAAXAEBVQIcon@@@Z.QT6WIDGETS ref: 00007FF755C21A99
          • ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF755C21AA7
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C21AB2
          • ?setContextMenu@QSystemTrayIcon@@QEAAXPEAVQMenu@@@Z.QT6WIDGETS ref: 00007FF755C21ABF
          • ?setVisible@QSystemTrayIcon@@QEAAX_N@Z.QT6WIDGETS ref: 00007FF755C21ACB
          • ?exec@QApplication@@SAHXZ.QT6WIDGETS ref: 00007FF755C21AD1
          • ??1QSystemTrayIcon@@UEAA@XZ.QT6WIDGETS ref: 00007FF755C21ADD
          • ??1QWebEngineView@@UEAA@XZ.QT6WEBENGINEWIDGETS ref: 00007FF755C21AE8
            • Part of subcall function 00007FF755C21370: ??1QString@@QEAA@XZ.QT6CORE(?,?,?,00007FF755C21348), ref: 00007FF755C213B3
            • Part of subcall function 00007FF755C21370: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF755C21348), ref: 00007FF755C213C5
            • Part of subcall function 00007FF755C21300: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF755C21354
          • ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C21B2C
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF755C21B36
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF755C21B40
          • ??1QNetworkRequest@@QEAA@XZ.QT6NETWORK ref: 00007FF755C21B4A
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF755C21B54
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF755C21B5E
          • ??1QNetworkAccessManager@@UEAA@XZ.QT6NETWORK ref: 00007FF755C21B68
          • ??1QThread@@UEAA@XZ.QT6CORE ref: 00007FF755C21B72
          • ??1QApplication@@UEAA@XZ.QT6WIDGETS ref: 00007FF755C21B7D
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$Object@@$Network$Connection@Meta$Icon@@$?setAccessEngineManager@@Object@@@Request@@$?connectApplication@@Base@ConnectionImpl@ObjectPrivate@@Qt@@SlotString@@@SystemTrayType@U3@@Widget@@$View@@$?addAction@Action@@Thread@@$Icon@Icon@@@Url@@Widget@@@Windowfree$?exec@?load@?resize@?show@?start@Closed@Concurrency::cancel_current_taskContextLastMenu@Menu@@Menu@@@Mode@0@@Page@Page@@Page@@@ParsingPriority@1@@QuitUrl@@@Visible@malloc
          • String ID: &Close$&Hide$:/logo.ico$:/logo.png$Sho&w$https://hello.freeconference.com/login/access-code
          • API String ID: 90596291-1651899464
          • Opcode ID: aa0c0ef5abe39f4393a5f1dfc9897acf0d44706815d6acdb93c9f448ba4dec86
          • Instruction ID: de571d6cc306fbfa3d6071613e9f2f6ef2840c60b831278e6f9e8e47ff3d33ab
          • Opcode Fuzzy Hash: aa0c0ef5abe39f4393a5f1dfc9897acf0d44706815d6acdb93c9f448ba4dec86
          • Instruction Fuzzy Hash: A9F10EB6A18A8796EB10EF60E8941EDB370FB84B4DF844135D68E43A68DF3DE549C350
          Function 00007FF755C27980 Relevance: 77.2, APIs: 39, Strings: 5, Instructions: 225networkwindowCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$Network$Debug@@$Object@@$Meta$Connection@Logger@@MessageReply@@Url@@$ByteV0@@$?append@?connect?debug@?error@?get@?setA@@@@AccessArray@@Base@BasicConnectionError@1@Impl@Manager@@Mode@0@@ObjectParsingPrivate@@Qt@@Request@@Request@@@SlotStringType@U3@@Url@Url@@@Utf8View@$0$?home?qt_?read?remove@A@$$All@Array@@@Device@@Dir@@Enum_debugFile@@Operator@@Path@String@@@V1@_malloc
          • String ID: /client/8$/pdown$/pwd$Error: $NetworkError
          • API String ID: 1525978948-1230961729
          • Opcode ID: 40e635a350328c2aa23660a40eb30deef58b7b66c00e73d05fb3e31aaf70d731
          • Instruction ID: 4f62e6c72c8c06edb5430fcfd4c78eed4c4949c0dca326a1b4d4faa3b7f9c572
          • Opcode Fuzzy Hash: 40e635a350328c2aa23660a40eb30deef58b7b66c00e73d05fb3e31aaf70d731
          • Instruction Fuzzy Hash: A1B13FB7A04B469AE700EF64E8901EDB3B4FB44B4DF845435DA8E53A28EF39E548C350
          Function 00007FF755C230F0 Relevance: 73.7, APIs: 40, Strings: 2, Instructions: 163COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: Byte$Array@@$Json$Document@@String@@Value@@$File@@$String@@@V0@$$V0@@Variant@@$?fromFlags@Parse$?data@?exists@?length@?open@?read?right@?size@All@Array@Array@@@@@Base64Base64@Base@@@@@DeviceDevice@@Error@@Error@@@Flag@Json@ModeOpenOption@V1@_Variant@
          • String ID: encrypted_key$os_crypt
          • API String ID: 2100764627-2981665407
          • Opcode ID: 6066b3e00c832f703dc3d66c5aa392ed1db1e9c9ade01990ab384814a58fdad6
          • Instruction ID: 784f3a8b9117b6b1508da0ae92a39ae237e462c401fcd17ac91984e02a164a66
          • Opcode Fuzzy Hash: 6066b3e00c832f703dc3d66c5aa392ed1db1e9c9ade01990ab384814a58fdad6
          • Instruction Fuzzy Hash: 16812EB6A14A4796EB00AF60E8541ADB330FF95F5DF841032D68E46678EF3DE549C710
          Function 00007FF755C21040 Relevance: 61.4, APIs: 22, Strings: 13, Instructions: 141networkmemorythreadCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$Network$Object@@@$AccessManager@@Request@@$?allocate@AllocationArrayData@@Option@1@@Thread@@U1@_V0@@
          • String ID: acmacodkjbdgmoleebolmdjonilkdbch$aeachknmefphepccionboohckonoeemg$aholpfdialjgjfhomihkjbmgjidlcdno$bfnaelmomeimhlpmgjnjophhpkkoljpa$dlcobpjiigpikoobohmabehhmhfoodbb$ejbalbakoplchlghecdalmeeeajnimhm$fhbohimaelbohpjbbldcngcnapndodjp$hifafgmccdpekplomjjkcfgodnhcellj$hnfanknocfeofbddgcijnmhnfnkdnaad$http://95.164.17.24:1224$ibnejdfjmmkpcnlpebklmnkoeoihofec$jblndlipeogpafnldhgmapagcccfchpi$nkbihfbeogaeaoehlefnkodbefgpgknn
          • API String ID: 2244258320-3047107916
          • Opcode ID: 932dfe42cf342746e1af437bbed1f91df498ad079b3e3429e264e5c04b58f586
          • Instruction ID: 40bd98e87c5e745f685bb9d17b445d8b8dd29b00d2bb1649c07cf77302daaae7
          • Opcode Fuzzy Hash: 932dfe42cf342746e1af437bbed1f91df498ad079b3e3429e264e5c04b58f586
          • Instruction Fuzzy Hash: FF71217A618F47A2E714EB20E8842A9B364FB89B4DF845031D6CE83664DF3DE56DC710
          Function 00007FF755C27D40 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 111COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: Byte$Array@@$ArrayView@@$?size@$?append@?data@Meta$?castHelper@Type@@$?class?id@?register?reserve@Name@NormalizedNull@Object@@Typedef@V1@@memcmp
          • String ID: Feature
          • API String ID: 2588427355-3496627450
          • Opcode ID: f320afb7356ec3442d198143a1dab4e1b4413ce96fa99bd39083d2740c7197bc
          • Instruction ID: 280d88af7b4eb91fd24219b1051aaa5a0ed033750a7ecc1dec9be0fff8e887e2
          • Opcode Fuzzy Hash: f320afb7356ec3442d198143a1dab4e1b4413ce96fa99bd39083d2740c7197bc
          • Instruction Fuzzy Hash: 0A5132BBA09A8782EA10EB11E844179F360FF94F9DF884135D9CE43664EF6DE545C710
          Function 00007FF755C27650 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 98networkCOMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: ByteNetwork$Array@@String@@$Object@@Request@@$?setConnection@MetaUrl@@$?append@?connect?post@A@@@@AccessArray@@0@Base@BasicConnectionHeader@HttpImpl@Manager@@Mode@0@@MultiObjectParsingPart@@@Private@@Qt@@Reply@@SlotStringType@U3@@Url@Url@@@Utf8V0@@View@$0malloc
          • String ID: /uploads$Content-Type$multipart/form-data; boundary=---------------------------99614912995
          • API String ID: 1290966195-1692235574
          • Opcode ID: fc487b596d2f6f09dc1442a1b1ad643b27ec4972e4011b308b33d104d083d600
          • Instruction ID: 8fc7f3dffefec840ad7b4c996fff6ba1768efdc57a73a09bf85c89e85521a610
          • Opcode Fuzzy Hash: fc487b596d2f6f09dc1442a1b1ad643b27ec4972e4011b308b33d104d083d600
          • Instruction Fuzzy Hash: 77414477604B46AAE700EF64E8402ECB370FB45B5CF844235DA9D63AA4EF39E559C350
          Function 00007FF755C26680 Relevance: 10.7, APIs: 7, Instructions: 182memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE ref: 00007FF755C26740
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF755C26750
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF755C26786
          • ??0QString@@QEAA@$$QEAV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF755C21FFB), ref: 00007FF755C26816
          • ??0QString@@QEAA@AEBV0@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF755C21FFB), ref: 00007FF755C26886
          • ??1QString@@QEAA@XZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF755C21FFB), ref: 00007FF755C26913
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF755C21FFB), ref: 00007FF755C26927
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$Alloc@@ArrayData@@V0@@$?reallocateA@$$AllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 2195022652-0
          • Opcode ID: 623aac26004f9cdcdafa123b244ec9be1fe2ed087e30baad01fb8f2984a41aa2
          • Instruction ID: a0b55869fb401d44288b66d3d22f4e8b60b4d5c550d98fe0804888a532854520
          • Opcode Fuzzy Hash: 623aac26004f9cdcdafa123b244ec9be1fe2ed087e30baad01fb8f2984a41aa2
          • Instruction Fuzzy Hash: D17169BAB19B4682DE44DF09E444268B3A0FB44F88F984136DB8D57B94DF3DE0A4C720
          Function 00007FF755C26430 Relevance: 10.7, APIs: 7, Instructions: 160memoryCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: FileInfo@@$Alloc@@ArrayData@@V0@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 1506373291-0
          • Opcode ID: da378fd962e3991fcc159a29152eeec093f69e04807ab8106bd8beb602226e39
          • Instruction ID: b7773d19cd1344d67e947b3fdbcd7c3043712436016ce9a8008e093895641e98
          • Opcode Fuzzy Hash: da378fd962e3991fcc159a29152eeec093f69e04807ab8106bd8beb602226e39
          • Instruction Fuzzy Hash: CC619BBBB19B8682DA10DF05E044529B3A4FB44F98F9D8135DE9E43798DF39E491C720
          Function 00007FF755C21E40 Relevance: 10.7, APIs: 7, Instructions: 160COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$A@$$V0@@$memmove
          • String ID:
          • API String ID: 349968220-0
          • Opcode ID: afe3feaf2e18a29c801bb765b753f56bbed760d60457107e94b7fdbcee993adf
          • Instruction ID: 88fcd3042f01137bd7d1a30782969c6d3f48da6f059479710e9cd1621d12511f
          • Opcode Fuzzy Hash: afe3feaf2e18a29c801bb765b753f56bbed760d60457107e94b7fdbcee993adf
          • Instruction Fuzzy Hash: 955180BBB1864692EE149B1AD54427CA360FB44FA8B984732DABD073D0DF3EE555C310
          Function 00007FF755C29A60 Relevance: 10.6, APIs: 7, Instructions: 117COMMON
          Download Yara Rule
          APIs
          • __p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF755C29A67
          • __p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF755C29A76
          • GetCommandLineW.KERNEL32 ref: 00007FF755C29AA2
          • CommandLineToArgvW.SHELL32 ref: 00007FF755C29AB3
            • Part of subcall function 00007FF755C21610: ??0QApplication@@QEAA@AEAHPEAPEADH@Z.QT6WIDGETS ref: 00007FF755C21646
            • Part of subcall function 00007FF755C21610: ?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z.QT6GUI ref: 00007FF755C2164F
            • Part of subcall function 00007FF755C21610: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C21661
            • Part of subcall function 00007FF755C21610: ??0QIcon@@QEAA@AEBVQString@@@Z.QT6GUI ref: 00007FF755C21674
            • Part of subcall function 00007FF755C21610: ?setWindowIcon@QGuiApplication@@SAXAEBVQIcon@@@Z.QT6GUI ref: 00007FF755C2167E
            • Part of subcall function 00007FF755C21610: ??1QIcon@@QEAA@XZ.QT6GUI ref: 00007FF755C2168C
            • Part of subcall function 00007FF755C21610: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C21698
            • Part of subcall function 00007FF755C21610: ?start@QThread@@QEAAXW4Priority@1@@Z.QT6CORE ref: 00007FF755C216B1
            • Part of subcall function 00007FF755C21610: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT6CORE ref: 00007FF755C21739
            • Part of subcall function 00007FF755C21610: ??1Connection@QMetaObject@@QEAA@XZ.QT6CORE ref: 00007FF755C21744
            • Part of subcall function 00007FF755C21610: ??0QWebEngineView@@QEAA@PEAVQWidget@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF755C21750
            • Part of subcall function 00007FF755C21610: ?setPage@QWebEngineView@@QEAAXPEAVQWebEnginePage@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF755C2177A
            • Part of subcall function 00007FF755C21610: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C2178C
            • Part of subcall function 00007FF755C21610: ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z.QT6CORE ref: 00007FF755C217A2
            • Part of subcall function 00007FF755C21610: ?load@QWebEngineView@@QEAAXAEBVQUrl@@@Z.QT6WEBENGINEWIDGETS ref: 00007FF755C217B0
            • Part of subcall function 00007FF755C21610: ??1QUrl@@QEAA@XZ.QT6CORE ref: 00007FF755C217BE
            • Part of subcall function 00007FF755C21610: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C217CA
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$Engine$?setApplication@@Object@@View@@$CommandConnection@Icon@@LineMetaUrl@@Window$?connect?load@?start@ArgvBase@Closed@ConnectionIcon@Icon@@@Impl@LastMode@0@@ObjectPage@Page@@@ParsingPriority@1@@Private@@Qt@@QuitSlotString@@@Thread@@Type@U3@@Url@@@Widget@@@__p___argc__p___argv
          • String ID:
          • API String ID: 1766454188-0
          • Opcode ID: 69e0cd6fd87c89ddf0229ad9c56da05064589dbb42f0c8aae167be428afe7b3f
          • Instruction ID: d74fc5b8a82566315a7ebe508df4f73fb9974e7cc9e6925c47697ef5bf32c02d
          • Opcode Fuzzy Hash: 69e0cd6fd87c89ddf0229ad9c56da05064589dbb42f0c8aae167be428afe7b3f
          • Instruction Fuzzy Hash: 5551407A608B8286D660EF15F84036AB7A5FB89BD8F884135DADD43B59CF3DD054CB10
          Function 00007FF755C28E18 Relevance: 10.6, APIs: 7, Instructions: 94COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
          • String ID:
          • API String ID: 3995423050-0
          • Opcode ID: 5cd613f77a582b439be90963d0218d0814c02d0455d6769eb06d34fe44e059d8
          • Instruction ID: 443b21e463008b3c5c02eb2925576cbc85b9656b2e0b0b3bd77a177a60b053e0
          • Opcode Fuzzy Hash: 5cd613f77a582b439be90963d0218d0814c02d0455d6769eb06d34fe44e059d8
          • Instruction Fuzzy Hash: 69314CAFE0C34781FA14FB2494513B992919F51F4CFCC4038E98E4B2D3DE2EA4458260
          Function 00007FF755C26950 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37windowthreadCOMMON
          Download Yara Rule
          APIs
            • Part of subcall function 00007FF755C269F0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C26A29
            • Part of subcall function 00007FF755C269F0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C26A6E
            • Part of subcall function 00007FF755C269F0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C26A7F
            • Part of subcall function 00007FF755C269F0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C26ABA
            • Part of subcall function 00007FF755C269F0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C26ACB
            • Part of subcall function 00007FF755C269F0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C26B06
            • Part of subcall function 00007FF755C269F0: ?currentType@QOperatingSystemVersion@@SA?AW4OSType@1@XZ.QT6CORE ref: 00007FF755C26B0C
            • Part of subcall function 00007FF755C269F0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C26B63
            • Part of subcall function 00007FF755C233B0: ??0QDir@@QEAA@AEBVQString@@@Z.QT6CORE ref: 00007FF755C233FB
            • Part of subcall function 00007FF755C233B0: ?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z.QT6CORE ref: 00007FF755C23413
            • Part of subcall function 00007FF755C233B0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C23468
            • Part of subcall function 00007FF755C233B0: ??0QChar@@QEAA@_S@Z.QT6CORE ref: 00007FF755C2347D
            • Part of subcall function 00007FF755C233B0: ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z.QT6CORE ref: 00007FF755C234A2
            • Part of subcall function 00007FF755C233B0: ??0QChar@@QEAA@_S@Z.QT6CORE ref: 00007FF755C234B7
            • Part of subcall function 00007FF755C233B0: ??0QString@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C234CC
            • Part of subcall function 00007FF755C233B0: ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z.QT6CORE ref: 00007FF755C234E8
            • Part of subcall function 00007FF755C233B0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C23528
            • Part of subcall function 00007FF755C233B0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C23534
            • Part of subcall function 00007FF755C233B0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C2353F
            • Part of subcall function 00007FF755C233B0: ??1QString@@QEAA@XZ.QT6CORE ref: 00007FF755C2354A
            • Part of subcall function 00007FF755C22B20: ??0QHttpMultiPart@@QEAA@W4ContentType@0@PEAVQObject@@@Z.QT6NETWORK ref: 00007FF755C22B79
            • Part of subcall function 00007FF755C22B20: ??0QHttpPart@@QEAA@XZ.QT6NETWORK ref: 00007FF755C22B8F
            • Part of subcall function 00007FF755C22B20: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C22BA1
            • Part of subcall function 00007FF755C22B20: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF755C22BB3
            • Part of subcall function 00007FF755C22B20: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF755C22BBE
            • Part of subcall function 00007FF755C22B20: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C22BCF
            • Part of subcall function 00007FF755C22B20: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF755C22BE4
            • Part of subcall function 00007FF755C22B20: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF755C22BEF
            • Part of subcall function 00007FF755C22B20: ??0QByteArray@@QEAA@PEBD_J@Z.QT6CORE ref: 00007FF755C22C07
            • Part of subcall function 00007FF755C22B20: ?setBody@QHttpPart@@QEAAXAEBVQByteArray@@@Z.QT6NETWORK ref: 00007FF755C22C17
            • Part of subcall function 00007FF755C22B20: ??1QByteArray@@QEAA@XZ.QT6CORE ref: 00007FF755C22C22
            • Part of subcall function 00007FF755C22B20: ?append@QHttpMultiPart@@QEAAXAEBVQHttpPart@@@Z.QT6NETWORK ref: 00007FF755C22C30
            • Part of subcall function 00007FF755C22B20: ??0QHttpPart@@QEAA@XZ.QT6NETWORK ref: 00007FF755C22C3B
            • Part of subcall function 00007FF755C22B20: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C22C4D
            • Part of subcall function 00007FF755C22B20: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF755C22C5F
            • Part of subcall function 00007FF755C22B20: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF755C22C6A
            • Part of subcall function 00007FF755C22B20: ??0QVariant@@QEAA@PEBD@Z.QT6CORE ref: 00007FF755C22C7B
            • Part of subcall function 00007FF755C22B20: ?setHeader@QHttpPart@@QEAAXW4KnownHeaders@QNetworkRequest@@AEBVQVariant@@@Z.QT6NETWORK ref: 00007FF755C22C90
            • Part of subcall function 00007FF755C22B20: ??1QVariant@@QEAA@XZ.QT6CORE ref: 00007FF755C22C9B
            • Part of subcall function 00007FF755C22B20: ?localHostName@QHostInfo@@SA?AVQString@@XZ.QT6NETWORK ref: 00007FF755C22CA5
            • Part of subcall function 00007FF755C22B20: ?toUtf8@QString@@QEHAA?AVQByteArray@@XZ.QT6CORE ref: 00007FF755C22CB3
          • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT6CORE ref: 00007FF755C26994
          • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT6CORE ref: 00007FF755C269A2
          • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT6CORE ref: 00007FF755C269B3
          • ??1QDebug@@QEAA@XZ.QT6CORE ref: 00007FF755C269BF
          • ?sleep@QThread@@SAXK@Z.QT6CORE ref: 00007FF755C269CA
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: String@@$Http$Part@@$Variant@@$?set$ByteHeader@Headers@KnownNetworkRequest@@Variant@@@$Array@@Debug@@$?arg@Char@@Char@@@Dir@@Flags@HostList@Logger@@MessageMulti$?append@?current?debug@?entry?local?sleep@Array@@@Body@ContentDir@@@@Dir@@@@@FileFilter@Flag@InfoInfo@@Info@@@@Name@Object@@@OperatingPart@@@SortString@@@SystemThread@@Type@Type@0@Type@1@Utf8@Version@@
          • String ID: post again
          • API String ID: 2416970176-4274939911
          • Opcode ID: 43666c4a51a8fd044ff6e2580c831c2e41bdbceaa0718240cf980670ca1280f1
          • Instruction ID: 33a6a8b7a1b99418f6d74b3faf6b58cb3f89056da3256490a9da53456401e62f
          • Opcode Fuzzy Hash: 43666c4a51a8fd044ff6e2580c831c2e41bdbceaa0718240cf980670ca1280f1
          • Instruction Fuzzy Hash: 740144BBF0878352EA00BBA5F455179A361EF85F9CF886030DA8F06765DE7DE4488760
          Function 00007FF755C21400 Relevance: 10.5, APIs: 7, Instructions: 31networkCOMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: Network$AccessManager@@Request@@$String@@free
          • String ID:
          • API String ID: 2366384267-0
          • Opcode ID: a76caa7952f88549332c601348929612624342b2025b6820931a5379d1126955
          • Instruction ID: 1e8f6a62653e993e4b0b4c725e6678077cc89deb566c5364ecaa29f9abfb6215
          • Opcode Fuzzy Hash: a76caa7952f88549332c601348929612624342b2025b6820931a5379d1126955
          • Instruction Fuzzy Hash: 5C01976AA2590792EB44FF20D8552BC6325EF51F4DFC85031C98E460B59E29E58EC360
          Function 00007FF755C2A7FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: __current_exception__current_exception_contextterminate
          • String ID: csm
          • API String ID: 2542180945-1018135373
          • Opcode ID: 35399df40d6b3399d44909a634f2974c5ed6b350caa197db1af6e49fc2e85eba
          • Instruction ID: c9e8a896e0b269cda0afa4a398ed08f5f98503c2ad2d80915768db2858494c8d
          • Opcode Fuzzy Hash: 35399df40d6b3399d44909a634f2974c5ed6b350caa197db1af6e49fc2e85eba
          • Instruction Fuzzy Hash: CDF0E77B505B45CAC714BF21EC900AC7364F788B9CB8A5121FA8D4BB55CF39D891C350
          Function 00007FF755C27E80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: Debug@@$Meta$?qt_Enum_debugObject@@Operator@@V1@_
          • String ID: Feature
          • API String ID: 1967151937-3496627450
          • Opcode ID: 8bf7e3df14a88745a403558fb1104582218e606200afad8b23d712e84b38d9dd
          • Instruction ID: e23eb49c4520b01b1a530af20b850def75e7f2f6e08447679c416661cab130d6
          • Opcode Fuzzy Hash: 8bf7e3df14a88745a403558fb1104582218e606200afad8b23d712e84b38d9dd
          • Instruction Fuzzy Hash: CBF0D4BA509E87E5CA00AF84E8800A9B774FB85B59B941032E68D03734DF7DD199CB10
          Function 00007FF755C26140 Relevance: 6.2, APIs: 4, Instructions: 197memoryCOMMON
          Download Yara Rule
          APIs
          • ?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF755C21D98), ref: 00007FF755C261F6
          • ?qBadAlloc@@YAXXZ.QT6CORE(?,?,?,?,?,?,?,?,?,00007FF755C21D98), ref: 00007FF755C26206
          • ?qBadAlloc@@YAXXZ.QT6CORE ref: 00007FF755C26247
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF755C21D98), ref: 00007FF755C26416
          Memory Dump Source
          • Source File: 00000000.00000002.2937217758.00007FF755C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF755C20000, based on PE: true
          • Associated: 00000000.00000002.2937205447.00007FF755C20000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937230667.00007FF755C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937243505.00007FF755C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937259020.00007FF755C3D000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_7ff755c20000_LlDmBISVy0.jbxd
          Similarity
          • API ID: Alloc@@ArrayData@@$?reallocateAllocationOption@1@@U?$pair@Unaligned@X@std@@free
          • String ID:
          • API String ID: 915963882-0
          • Opcode ID: 14a9ab99b30a597e57efaf0e4a45f4a38b1f365866463e107ff07778c2b55e48
          • Instruction ID: f59508dd6abdbd285a68117534fcbfba21b697e45b93c508707ac47cd0720f74
          • Opcode Fuzzy Hash: 14a9ab99b30a597e57efaf0e4a45f4a38b1f365866463e107ff07778c2b55e48
          • Instruction Fuzzy Hash: 02818D77B15B4A82DE44DF0AE4805ACB3A0FB54F88B984132DB9E43764DF3AE1A1C710