arcadia.exePE analysis report - Nothing conclusive

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

36.3sto launch

2telemetry events

1observed

63agent notes

Nothing conclusive

16/100

19 points short of the suspicious line at 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+16

Static analysis

2 high-risk capability(ies): sandbox evasion, self-modification to evade signatures
Weak exploit-mitigation posture (no ASLR/DEP/CFG) and unsigned

Model reading

Measured CLEAN16 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score

Dynamic ran no points

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution134s

Guest hardware2 vCPU4095 MB RAM

Detection signatures

3 detected · 1 withheld as common

Severity	Detection	Evidence	Layer
MED	Anti-analysis strings present MITRE T1497	string vbox matched string	static
MED	Surveillance/keylogging strings MITRE T1056	string getdc matched string	static
MED	Weak exploit mitigations and unsigned MITRE T1027	mitigation posture: weak signature unsigned	static

Withheld: 1 rule fired and was not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Reads its own startup info (parent/desktop check) fires on 36% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	none established at runtime
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)	none observed
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Anti-analysis / evasion checks	not measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Instrument coverage

0 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	not measured	Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
API call sequence	not measured	Not measured. No anti-analysis hook armed on this run, so this sequence carries interpreter spawns only and an empty one does not mean the sample called no APIs.
Explicit module loads	not measured	Not measured. No in-process monitor reported in on this run, so no module load could be recorded and an empty list does not mean the sample loaded nothing.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Qt(4.X)

Not packed Unsigned

LibraryQt(4.X)

Identity

File

typeexecutable

size3.1 MB

file arch32-bit (x86)

subsystemGUI

entropy6.117

date2010-03-30 12:48:32 UTC

Antivirus engine

no signature matched signature set 28161 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature set	Value
Set version	28161
Signatures in the set	3,642,894
Set published	22 Oct 2026 06:24 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

4.0 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 4.0 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural feature	What it means	Pushes	Weight
parser warning: Suspicious flags set for section...	Header defect reported by the parse: Suspicious flags set for section... (0)	towards benign	-1.0730
import directory size	Size of the import table	towards benign	-0.7475
image flag dll	Image flag: a library rather than a program	towards malicious	+0.6676
imported function count	Number of functions imported from other libraries (584)	towards benign	-0.5299
resource directory size	Size of the resource table (0)	towards malicious	+0.5147
feature column 2478	When a timestamp authority countersigned the signature	towards malicious	+0.3866
optional.subsystem	Subsystem the program runs under (console, windowed or driver) (2)	towards malicious	+0.3736
image flag relocs_stripped	Image flag: relocations stripped	towards malicious	+0.3319

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing

Not packed

This file's code is readable on disk - nothing is compressed or encrypted around it.

0/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed

No packer indicator fired: the entry point, the section layout and the entropy all read as an ordinary build.

Family configuration search

Incomplete

1 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available	69
Returned a result	1
Failed to decode	1

Secrets & malicious strings

2 flagged strings

Flagged string categories

anti-analysis / evasion med 1 hit

Indicator	Found in	Evidence from the sample
vbox	import table	QtGui4.dll!_ZN11QVBoxLayoutC1Ev

keylogging / surveillance med 1 hit

Indicator	Found in	Evidence from the sample
getdc	import table	QtGui4.dll!_ZNK7QWidget5getDCEv

Capabilities

1 behaviour bucket

Severity	Capability	MITRE	APIs
med	Evasion / stalling Sleeps, times, or otherwise stalls analysis	T1497.003	sleep

Security mitigations

weak posture

OFF ASLR (DynamicBase)

OFF High-entropy ASLR (64-bit)

OFF DEP / NX (NxCompat)

OFF Control Flow Guard

? SafeSEH

? Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Atypical for a benign modern build - common in packed/repacked malware.

Sections

5 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.textEP Executable code	0x1000	2.8 MB	2.8 MB	EXECUTEREAD	5.9852
.data Initialised data	0x2db000	3.5 KB	3.3 KB	READWRITE	3.6238
.rdata Read-only data	0x2dc000	197.0 KB	197.0 KB	READ	5.3585
.bss Uninitialised data	0x30e000	0.0 B	28.4 KB	READWRITE	0.0
.idata Import table	0x316000	29.0 KB	28.7 KB	READWRITE	5.7255

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

590 funcs / 11 DLLs

▸KERNEL32.dll21 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
AddAtomA	0x00316a84	-	-
CreateSemaphoreA	0x00316a88	-	-
ExitProcess	0x00316a8c	-	-
FindAtomA	0x00316a90	-	-
GetAtomNameA	0x00316a94	-	-
GetCommandLineA	0x00316a98	-	-
GetCommandLineW	0x00316a9c	-	-
GetLastError	0x00316aa0	-	-
GetModuleHandleA	0x00316aa4	-	-
GetStartupInfoA	0x00316aa8	-	-
InterlockedDecrement	0x00316aac	-	-
InterlockedIncrement	0x00316ab0	-	-
ReleaseSemaphore	0x00316ab4	-	-
SetLastError	0x00316ab8	-	-
SetUnhandledExceptionFilter	0x00316abc	-	-
Sleep	0x00316ac0	-	-
TlsAlloc	0x00316ac4	-	-
TlsFree	0x00316ac8	-	-
TlsGetValue	0x00316acc	-	-
TlsSetValue	0x00316ad0	-	-
WaitForSingleObject	0x00316ad4	-	-

▸mingwm10.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__mingwthr_key_dtor	0x00316ae0	-	-

▸msvcrt.dll6 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_fdopen	0x00316aec	-	-
_finite	0x00316af0	-	-
_read	0x00316af4	-	-
_stat	0x00316af8	-	-
_strdup	0x00316afc	-	-
_write	0x00316b00	-	-

▸msvcrt.dll75 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__getmainargs	0x00316b0c	-	-
__mb_cur_max	0x00316b10	-	-
__p__environ	0x00316b14	-	-
__p__fmode	0x00316b18	-	-
__set_app_type	0x00316b1c	-	-
_assert	0x00316b20	-	-
_cexit	0x00316b24	-	-
_ctype	0x00316b28	-	-
_errno	0x00316b2c	-	-
_filelengthi64	0x00316b30	-	-
_fstati64	0x00316b34	-	-
_iob	0x00316b38	-	-
_isctype	0x00316b3c	-	-
_lseeki64	0x00316b40	-	-
_onexit	0x00316b44	-	-
_pctype	0x00316b48	-	-
_setmode	0x00316b4c	-	-
_strnicmp	0x00316b50	-	-
_vsnprintf	0x00316b54	-	-
abort	0x00316b58	-	-
acos	0x00316b5c	-	-
atan	0x00316b60	-	-
atan2	0x00316b64	-	-
atexit	0x00316b68	-	-
atoi	0x00316b6c	-	-
calloc	0x00316b70	-	-
ceil	0x00316b74	-	-
clock	0x00316b78	-	-
cos	0x00316b7c	-	-
exit	0x00316b80	-	-
fclose	0x00316b84	-	-
fflush	0x00316b88	-	-
fgetpos	0x00316b8c	-	-
floor	0x00316b90	-	-
fmod	0x00316b94	-	-
fopen	0x00316b98	-	-
fprintf	0x00316b9c	-	-
fread	0x00316ba0	-	-
free	0x00316ba4	-	-
fsetpos	0x00316ba8	-	-
fwrite	0x00316bac	-	-
getc	0x00316bb0	-	-
localeconv	0x00316bb4	-	-
localtime	0x00316bb8	-	-
log10	0x00316bbc	-	-
malloc	0x00316bc0	-	-
memchr	0x00316bc4	-	-
memcpy	0x00316bc8	-	-
memmove	0x00316bcc	-	-
memset	0x00316bd0	-	-
pow	0x00316bd4	-	-
printf	0x00316bd8	-	-
putc	0x00316bdc	-	-
qsort	0x00316be0	-	-
realloc	0x00316be4	-	-
setlocale	0x00316be8	-	-
setvbuf	0x00316bec	-	-
signal	0x00316bf0	-	-
sin	0x00316bf4	-	-
sprintf	0x00316bf8	-	-
sqrt	0x00316bfc	-	-
strcmp	0x00316c00	-	-
strcoll	0x00316c04	-	-
strcpy	0x00316c08	-	-
strftime	0x00316c0c	-	-
strlen	0x00316c10	-	-
strncat	0x00316c14	-	-
strncmp	0x00316c18	-	-
strncpy	0x00316c1c	-	-
strtod	0x00316c20	-	-
strtol	0x00316c24	-	-
strxfrm	0x00316c28	-	-
time	0x00316c2c	-	-
tolower	0x00316c30	-	-
ungetc	0x00316c34	-	-

▸libgraph-4.dll6 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
agclose	0x00316c40	-	-
agedge	0x00316c44	-	-
agnode	0x00316c48	-	-
agopen	0x00316c4c	-	-
agsafeset	0x00316c50	-	-
agwrite	0x00316c54	-	-

▸libgvc-4.dll4 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
gvContext	0x00316c60	-	-
gvFreeContext	0x00316c64	-	-
gvFreeLayout	0x00316c68	-	-
gvLayout	0x00316c6c	-	-

▸libxml2-2.dll8 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
xmlCreatePushParserCtxt	0x00316c78	-	-
xmlCtxtResetPush	0x00316c7c	-	-
xmlFreeParserCtxt	0x00316c80	-	-
xmlGetLastError	0x00316c84	-	-
xmlGetPredefinedEntity	0x00316c88	-	-
xmlParseChunk	0x00316c8c	-	-
xmlSAX2GetColumnNumber	0x00316c90	-	-
xmlSAX2GetLineNumber	0x00316c94	-	-

▸QtCore4.dll49 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_Z5qFreePv	0x00316ca0	-	-
_Z7qMallocj	0x00316ca4	-	-
_Z7qMemSetPvij	0x00316ca8	-	-
_Z8qReallocPvj	0x00316cac	-	-
_Z8qWinMainP11HINSTANCE__S0_PciRiR7QVectorIS1_E	0x00316cb0	-	-
_ZN10QByteArray11shared_nullE	0x00316cb4	-	-
_ZN10QByteArray7reallocEi	0x00316cb8	-	-
_ZN10QByteArrayaSEPKc	0x00316cbc	-	-
_ZN10QByteArrayaSERKS_	0x00316cc0	-	-
_ZN11QMetaObject8activateEP7QObjectPKS_iPPv	0x00316cc4	-	-
_ZN11QVectorData6mallocEiiiPS_	0x00316cc8	-	-
_ZN16QCoreApplication13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE	0x00316ccc	-	-
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE	0x00316cd0	-	-
_ZN5QFile5closeEv	0x00316cd4	-	-
_ZN5QFileC1ERK7QString	0x00316cd8	-	-
_ZN5QFileD1Ev	0x00316cdc	-	-
_ZN7QObject10childEventEP11QChildEvent	0x00316ce0	-	-
_ZN7QObject10timerEventEP11QTimerEvent	0x00316ce4	-	-
_ZN7QObject11customEventEP6QEvent	0x00316ce8	-	-
_ZN7QObject11eventFilterEPS_P6QEvent	0x00316cec	-	-
_ZN7QObject13connectNotifyEPKc	0x00316cf0	-	-
_ZN7QObject16disconnectNotifyEPKc	0x00316cf4	-	-
_ZN7QObject16staticMetaObjectE	0x00316cf8	-	-
_ZN7QObject5eventEP6QEvent	0x00316cfc	-	-
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE	0x00316d00	-	-
_ZN7QString11shared_nullE	0x00316d04	-	-
_ZN7QString16codecForCStringsE	0x00316d08	-	-
_ZN7QString16fromAscii_helperEPKci	0x00316d0c	-	-
_ZN7QString4freeEPNS_4DataE	0x00316d10	-	-
_ZN7QString9fromAsciiEPKci	0x00316d14	-	-
_ZN7QString9fromUtf16EPKti	0x00316d18	-	-
_ZN7QThread11qt_metacallEN11QMetaObject4CallEiPPv	0x00316d1c	-	-
_ZN7QThread11qt_metacastEPKc	0x00316d20	-	-
_ZN7QThread5startENS_8PriorityE	0x00316d24	-	-
_ZN7QThreadC2EP7QObject	0x00316d28	-	-
_ZN7QThreadD2Ev	0x00316d2c	-	-
_ZN8QSysInfo14windowsVersionEv	0x00316d30	-	-
_ZN8QVariantC1ERK7QString	0x00316d34	-	-
_ZN8QVariantD1Ev	0x00316d38	-	-
_ZN9QListData11shared_nullE	0x00316d3c	-	-
_ZN9QListData6appendEv	0x00316d40	-	-
_ZN9QListData7detach2Ev	0x00316d44	-	-
_ZNK11QMetaObject2trEPKcS1_	0x00316d48	-	-
_ZNK7QString11toLocal8BitEv	0x00316d4c	-	-
_ZNK7QString7toAsciiEv	0x00316d50	-	-
_ZNK7QStringeqERK13QLatin1String	0x00316d54	-	-
_ZNK7QStringeqERKS_	0x00316d58	-	-
_ZNK7QThread10metaObjectEv	0x00316d5c	-	-
_ZNK7QThread9isRunningEv	0x00316d60	-	-

▸QtGui4.dll398 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_ZN10QBoxLayout10addStretchEi	0x00316d6c	-	-
_ZN10QBoxLayout9addLayoutEP7QLayouti	0x00316d70	-	-
_ZN10QBoxLayout9addWidgetEP7QWidgeti6QFlagsIN2Qt13AlignmentFlagEE	0x00316d74	-	-
_ZN10QTabWidget10paintEventEP11QPaintEvent	0x00316d78	-	-
_ZN10QTabWidget10tabRemovedEi	0x00316d7c	-	-
_ZN10QTabWidget11changeEventEP6QEvent	0x00316d80	-	-
_ZN10QTabWidget11qt_metacallEN11QMetaObject4CallEiPPv	0x00316d84	-	-
_ZN10QTabWidget11qt_metacastEPKc	0x00316d88	-	-
_ZN10QTabWidget11resizeEventEP12QResizeEvent	0x00316d8c	-	-
_ZN10QTabWidget11tabInsertedEi	0x00316d90	-	-
_ZN10QTabWidget12setElideModeEN2Qt13TextElideModeE	0x00316d94	-	-
_ZN10QTabWidget13keyPressEventEP9QKeyEvent	0x00316d98	-	-
_ZN10QTabWidget15setCurrentIndexEi	0x00316d9c	-	-
_ZN10QTabWidget15setTabsClosableEb	0x00316da0	-	-
_ZN10QTabWidget20setUsesScrollButtonsEb	0x00316da4	-	-
_ZN10QTabWidget5clearEv	0x00316da8	-	-
_ZN10QTabWidget5eventEP6QEvent	0x00316dac	-	-
_ZN10QTabWidget6addTabEP7QWidgetRK7QString	0x00316db0	-	-
_ZN10QTabWidget9removeTabEi	0x00316db4	-	-
_ZN10QTabWidget9showEventEP10QShowEvent	0x00316db8	-	-
_ZN10QTabWidgetC1EP7QWidget	0x00316dbc	-	-
_ZN10QTabWidgetC2EP7QWidget	0x00316dc0	-	-
_ZN10QTabWidgetD2Ev	0x00316dc4	-	-
_ZN11QDockWidget11setFeaturesE6QFlagsINS_17DockWidgetFeatureEE	0x00316dc8	-	-
_ZN11QDockWidget15setAllowedAreasE6QFlagsIN2Qt14DockWidgetAreaEE	0x00316dcc	-	-
_ZN11QDockWidget9setWidgetEP7QWidget	0x00316dd0	-	-
_ZN11QDockWidgetC1ERK7QStringP7QWidget6QFlagsIN2Qt10WindowTypeEE	0x00316dd4	-	-
_ZN11QFileDialog15getOpenFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE	0x00316dd8	-	-
_ZN11QFileDialog15getSaveFileNameEP7QWidgetRK7QStringS4_S4_PS2_6QFlagsINS_6OptionEE	0x00316ddc	-	-
_ZN11QHBoxLayoutC1Ev	0x00316de0	-	-
_ZN11QHeaderView10setMovableEb	0x00316de4	-	-
_ZN11QHeaderView13setResizeModeENS_10ResizeModeE	0x00316de8	-	-
_ZN11QHeaderView21setStretchLastSectionEb	0x00316dec	-	-
_ZN11QHeaderView26setCascadingSectionResizesEb	0x00316df0	-	-
_ZN11QMainWindow10addToolBarEN2Qt11ToolBarAreaEP8QToolBar	0x00316df4	-	-
_ZN11QMainWindow10addToolBarERK7QString	0x00316df8	-	-
_ZN11QMainWindow11qt_metacallEN11QMetaObject4CallEiPPv	0x00316dfc	-	-
_ZN11QMainWindow11qt_metacastEPKc	0x00316e00	-	-
_ZN11QMainWindow13addDockWidgetEN2Qt14DockWidgetAreaEP11QDockWidget	0x00316e04	-	-
_ZN11QMainWindow15createPopupMenuEv	0x00316e08	-	-
_ZN11QMainWindow16contextMenuEventEP17QContextMenuEvent	0x00316e0c	-	-
_ZN11QMainWindow16setCentralWidgetEP7QWidget	0x00316e10	-	-
_ZN11QMainWindow16staticMetaObjectE	0x00316e14	-	-
_ZN11QMainWindow5eventEP6QEvent	0x00316e18	-	-
_ZN11QMainWindow9setCornerEN2Qt6CornerENS0_14DockWidgetAreaE	0x00316e1c	-	-
_ZN11QMainWindowC2EP7QWidget6QFlagsIN2Qt10WindowTypeEE	0x00316e20	-	-
_ZN11QMainWindowD2Ev	0x00316e24	-	-
_ZN11QMessageBox14setWindowTitleERK7QString	0x00316e28	-	-
_ZN11QMessageBox16setDefaultButtonENS_14StandardButtonE	0x00316e2c	-	-
_ZN11QMessageBox18setInformativeTextERK7QString	0x00316e30	-	-
_ZN11QMessageBox18setStandardButtonsE6QFlagsINS_14StandardButtonEE	0x00316e34	-	-
_ZN11QMessageBox7setTextERK7QString	0x00316e38	-	-
_ZN11QMessageBox8criticalEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_	0x00316e3c	-	-
_ZN11QMessageBoxC1EP7QWidget	0x00316e40	-	-
_ZN11QMessageBoxD1Ev	0x00316e44	-	-
_ZN11QTreeWidget12scrollToItemEPK15QTreeWidgetItemN17QAbstractItemView10ScrollHintE	0x00316e48	-	-
_ZN11QTreeWidget13setItemHiddenEPK15QTreeWidgetItemb	0x00316e4c	-	-
_ZN11QTreeWidget14setColumnCountEi	0x00316e50	-	-
_ZN11QTreeWidget15setHeaderLabelsERK11QStringList	0x00316e54	-	-
_ZN11QTreeWidget15setItemSelectedEPK15QTreeWidgetItemb	0x00316e58	-	-
_ZN11QTreeWidget17setSortingEnabledEb	0x00316e5c	-	-
_ZN11QTreeWidget5clearEv	0x00316e60	-	-
_ZN11QTreeWidgetC1EP7QWidget	0x00316e64	-	-
_ZN11QVBoxLayoutC1Ev	0x00316e68	-	-
_ZN12QApplication4execEv	0x00316e6c	-	-
_ZN12QApplicationC1ERiPPci	0x00316e70	-	-
_ZN12QApplicationD1Ev	0x00316e74	-	-
_ZN12QKeySequenceC1ERK7QString	0x00316e78	-	-
_ZN12QKeySequenceD1Ev	0x00316e7c	-	-
_ZN12QPainterPath10addEllipseERK6QRectF	0x00316e80	-	-
_ZN12QPainterPath11setFillRuleEN2Qt8FillRuleE	0x00316e84	-	-
_ZN12QPainterPath12addRoundRectERK6QRectFii	0x00316e88	-	-
_ZN12QPainterPath6lineToERK7QPointF	0x00316e8c	-	-
_ZN12QPainterPath6moveToERK7QPointF	0x00316e90	-	-
_ZN12QPainterPath7addPathERKS_	0x00316e94	-	-
_ZN12QPainterPath7addRectERK6QRectF	0x00316e98	-	-
_ZN12QPainterPathC1ERKS_	0x00316e9c	-	-
_ZN12QPainterPathC1Ev	0x00316ea0	-	-
_ZN12QPainterPathD1Ev	0x00316ea4	-	-
_ZN12QPainterPathaSERKS_	0x00316ea8	-	-
_ZN12QTableWidget11setRowCountEi	0x00316eac	-	-
_ZN12QTableWidget14setColumnCountEi	0x00316eb0	-	-
_ZN12QTableWidget17setSortingEnabledEb	0x00316eb4	-	-
_ZN12QTableWidget25setHorizontalHeaderLabelsERK11QStringList	0x00316eb8	-	-
_ZN12QTableWidget7setItemEiiP16QTableWidgetItem	0x00316ebc	-	-
_ZN12QTableWidgetC1EP7QWidget	0x00316ec0	-	-
_ZN13QFontMetricsFC1ERK5QFont	0x00316ec4	-	-
_ZN13QFontMetricsFD1Ev	0x00316ec8	-	-
_ZN13QGraphicsItem10itemChangeENS_18GraphicsItemChangeERK8QVariant	0x00316ecc	-	-
_ZN13QGraphicsItem10sceneEventEP6QEvent	0x00316ed0	-	-
_ZN13QGraphicsItem10wheelEventEP24QGraphicsSceneWheelEvent	0x00316ed4	-	-
_ZN13QGraphicsItem11setSelectedEb	0x00316ed8	-	-
_ZN13QGraphicsItem12focusInEventEP11QFocusEvent	0x00316edc	-	-
_ZN13QGraphicsItem12setExtensionENS_9ExtensionERK8QVariant	0x00316ee0	-	-
_ZN13QGraphicsItem13dragMoveEventEP27QGraphicsSceneDragDropEvent	0x00316ee4	-	-
_ZN13QGraphicsItem13focusOutEventEP11QFocusEvent	0x00316ee8	-	-
_ZN13QGraphicsItem13keyPressEventEP9QKeyEvent	0x00316eec	-	-
_ZN13QGraphicsItem14dragEnterEventEP27QGraphicsSceneDragDropEvent	0x00316ef0	-	-
_ZN13QGraphicsItem14dragLeaveEventEP27QGraphicsSceneDragDropEvent	0x00316ef4	-	-
_ZN13QGraphicsItem14hoverMoveEventEP24QGraphicsSceneHoverEvent	0x00316ef8	-	-
_ZN13QGraphicsItem14mouseMoveEventEP24QGraphicsSceneMouseEvent	0x00316efc	-	-
_ZN13QGraphicsItem15hoverEnterEventEP24QGraphicsSceneHoverEvent	0x00316f00	-	-
_ZN13QGraphicsItem15hoverLeaveEventEP24QGraphicsSceneHoverEvent	0x00316f04	-	-
_ZN13QGraphicsItem15keyReleaseEventEP9QKeyEvent	0x00316f08	-	-
_ZN13QGraphicsItem15mousePressEventEP24QGraphicsSceneMouseEvent	0x00316f0c	-	-
_ZN13QGraphicsItem16contextMenuEventEP30QGraphicsSceneContextMenuEvent	0x00316f10	-	-
_ZN13QGraphicsItem16inputMethodEventEP17QInputMethodEvent	0x00316f14	-	-
_ZN13QGraphicsItem16sceneEventFilterEPS_P6QEvent	0x00316f18	-	-
_ZN13QGraphicsItem17mouseReleaseEventEP24QGraphicsSceneMouseEvent	0x00316f1c	-	-
_ZN13QGraphicsItem21mouseDoubleClickEventEP24QGraphicsSceneMouseEvent	0x00316f20	-	-
_ZN13QGraphicsItem6setPosERK7QPointF	0x00316f24	-	-
_ZN13QGraphicsItem6updateERK6QRectF	0x00316f28	-	-
_ZN13QGraphicsItem7advanceEi	0x00316f2c	-	-
_ZN13QGraphicsItem8setFlagsE6QFlagsINS_16GraphicsItemFlagEE	0x00316f30	-	-
_ZN13QGraphicsItem9dropEventEP27QGraphicsSceneDragDropEvent	0x00316f34	-	-
_ZN13QGraphicsItem9setZValueEd	0x00316f38	-	-
_ZN13QGraphicsItemC2EPS_P14QGraphicsScene	0x00316f3c	-	-
_ZN13QGraphicsItemD2Ev	0x00316f40	-	-
_ZN13QGraphicsView10paintEventEP11QPaintEvent	0x00316f44	-	-
_ZN13QGraphicsView10wheelEventEP11QWheelEvent	0x00316f48	-	-
_ZN13QGraphicsView11qt_metacallEN11QMetaObject4CallEiPPv	0x00316f4c	-	-
_ZN13QGraphicsView11qt_metacastEPKc	0x00316f50	-	-
_ZN13QGraphicsView11resizeEventEP12QResizeEvent	0x00316f54	-	-
_ZN13QGraphicsView11setDragModeENS_8DragModeE	0x00316f58	-	-
_ZN13QGraphicsView12focusInEventEP11QFocusEvent	0x00316f5c	-	-
_ZN13QGraphicsView12setCacheModeE6QFlagsINS_13CacheModeFlagEE	0x00316f60	-	-
_ZN13QGraphicsView13dragMoveEventEP14QDragMoveEvent	0x00316f64	-	-
_ZN13QGraphicsView13ensureVisibleERK6QRectFii	0x00316f68	-	-
_ZN13QGraphicsView13focusOutEventEP11QFocusEvent	0x00316f6c	-	-
_ZN13QGraphicsView13keyPressEventEP9QKeyEvent	0x00316f70	-	-
_ZN13QGraphicsView13setRenderHintEN8QPainter10RenderHintEb	0x00316f74	-	-
_ZN13QGraphicsView13viewportEventEP6QEvent	0x00316f78	-	-
_ZN13QGraphicsView14dragEnterEventEP15QDragEnterEvent	0x00316f7c	-	-
_ZN13QGraphicsView14dragLeaveEventEP15QDragLeaveEvent	0x00316f80	-	-
_ZN13QGraphicsView14drawBackgroundEP8QPainterRK6QRectF	0x00316f84	-	-
_ZN13QGraphicsView14drawForegroundEP8QPainterRK6QRectF	0x00316f88	-	-
_ZN13QGraphicsView14mouseMoveEventEP11QMouseEvent	0x00316f8c	-	-
_ZN13QGraphicsView14setInteractiveEb	0x00316f90	-	-
_ZN13QGraphicsView15keyReleaseEventEP9QKeyEvent	0x00316f94	-	-
_ZN13QGraphicsView15mousePressEventEP11QMouseEvent	0x00316f98	-	-
_ZN13QGraphicsView15setResizeAnchorENS_14ViewportAnchorE	0x00316f9c	-	-
_ZN13QGraphicsView16contextMenuEventEP17QContextMenuEvent	0x00316fa0	-	-
_ZN13QGraphicsView16inputMethodEventEP17QInputMethodEvent	0x00316fa4	-	-
_ZN13QGraphicsView16scrollContentsByEii	0x00316fa8	-	-
_ZN13QGraphicsView17mouseReleaseEventEP11QMouseEvent	0x00316fac	-	-
_ZN13QGraphicsView18focusNextPrevChildEb	0x00316fb0	-	-
_ZN13QGraphicsView21mouseDoubleClickEventEP11QMouseEvent	0x00316fb4	-	-
_ZN13QGraphicsView21setViewportUpdateModeENS_18ViewportUpdateModeE	0x00316fb8	-	-
_ZN13QGraphicsView5eventEP6QEvent	0x00316fbc	-	-
_ZN13QGraphicsView8setSceneEP14QGraphicsScene	0x00316fc0	-	-
_ZN13QGraphicsView9drawItemsEP8QPainteriPP13QGraphicsItemPK24QStyleOptionGraphicsItem	0x00316fc4	-	-
_ZN13QGraphicsView9dropEventEP10QDropEvent	0x00316fc8	-	-
_ZN13QGraphicsView9setMatrixERK7QMatrixb	0x00316fcc	-	-
_ZN13QGraphicsView9showEventEP10QShowEvent	0x00316fd0	-	-
_ZN13QGraphicsViewC2EP7QWidget	0x00316fd4	-	-
_ZN13QGraphicsViewD2Ev	0x00316fd8	-	-
_ZN14QGraphicsScene10removeItemEP13QGraphicsItem	0x00316fdc	-	-
_ZN14QGraphicsScene10wheelEventEP24QGraphicsSceneWheelEvent	0x00316fe0	-	-
_ZN14QGraphicsScene11eventFilterEP7QObjectP6QEvent	0x00316fe4	-	-
_ZN14QGraphicsScene11qt_metacallEN11QMetaObject4CallEiPPv	0x00316fe8	-	-
_ZN14QGraphicsScene11qt_metacastEPKc	0x00316fec	-	-
_ZN14QGraphicsScene12focusInEventEP11QFocusEvent	0x00316ff0	-	-
_ZN14QGraphicsScene12setSceneRectERK6QRectF	0x00316ff4	-	-
_ZN14QGraphicsScene13dragMoveEventEP27QGraphicsSceneDragDropEvent	0x00316ff8	-	-
_ZN14QGraphicsScene13focusOutEventEP11QFocusEvent	0x00316ffc	-	-
_ZN14QGraphicsScene13keyPressEventEP9QKeyEvent	0x00317000	-	-
_ZN14QGraphicsScene14clearSelectionEv	0x00317004	-	-
_ZN14QGraphicsScene14dragEnterEventEP27QGraphicsSceneDragDropEvent	0x00317008	-	-
_ZN14QGraphicsScene14dragLeaveEventEP27QGraphicsSceneDragDropEvent	0x0031700c	-	-
_ZN14QGraphicsScene14drawBackgroundEP8QPainterRK6QRectF	0x00317010	-	-
_ZN14QGraphicsScene14drawForegroundEP8QPainterRK6QRectF	0x00317014	-	-
_ZN14QGraphicsScene14mouseMoveEventEP24QGraphicsSceneMouseEvent	0x00317018	-	-
_ZN14QGraphicsScene15keyReleaseEventEP9QKeyEvent	0x0031701c	-	-
_ZN14QGraphicsScene15mousePressEventEP24QGraphicsSceneMouseEvent	0x00317020	-	-
_ZN14QGraphicsScene16contextMenuEventEP30QGraphicsSceneContextMenuEvent	0x00317024	-	-
_ZN14QGraphicsScene16inputMethodEventEP17QInputMethodEvent	0x00317028	-	-
_ZN14QGraphicsScene16staticMetaObjectE	0x0031702c	-	-
_ZN14QGraphicsScene17mouseReleaseEventEP24QGraphicsSceneMouseEvent	0x00317030	-	-
_ZN14QGraphicsScene18setBackgroundBrushERK6QBrush	0x00317034	-	-
_ZN14QGraphicsScene21mouseDoubleClickEventEP24QGraphicsSceneMouseEvent	0x00317038	-	-
_ZN14QGraphicsScene5eventEP6QEvent	0x0031703c	-	-
_ZN14QGraphicsScene6renderEP8QPainterRK6QRectFS4_N2Qt15AspectRatioModeE	0x00317040	-	-
_ZN14QGraphicsScene6updateERK6QRectF	0x00317044	-	-
_ZN14QGraphicsScene7addItemEP13QGraphicsItem	0x00317048	-	-
_ZN14QGraphicsScene9drawItemsEP8QPainteriPP13QGraphicsItemPK24QStyleOptionGraphicsItemP7QWidget	0x0031704c	-	-
_ZN14QGraphicsScene9dropEventEP27QGraphicsSceneDragDropEvent	0x00317050	-	-
_ZN14QGraphicsScene9helpEventEP23QGraphicsSceneHelpEvent	0x00317054	-	-
_ZN14QGraphicsSceneC2EP7QObject	0x00317058	-	-
_ZN14QGraphicsSceneD2Ev	0x0031705c	-	-
_ZN15QAbstractButton7setTextERK7QString	0x00317060	-	-
_ZN15QAbstractSlider10setMaximumEi	0x00317064	-	-
_ZN15QAbstractSlider10setMinimumEi	0x00317068	-	-
_ZN15QAbstractSlider8setValueEi	0x0031706c	-	-
_ZN15QProgressDialog12setLabelTextERK7QString	0x00317070	-	-
_ZN15QProgressDialog8setValueEi	0x00317074	-	-
_ZN15QProgressDialogC1ERK7QStringS2_iiP7QWidget6QFlagsIN2Qt10WindowTypeEE	0x00317078	-	-
_ZN15QTreeWidgetItemC1EP11QTreeWidgeti	0x0031707c	-	-
_ZN15QTreeWidgetItemC1EPS_i	0x00317080	-	-
_ZN16QTableWidgetItemC1ERK7QStringi	0x00317084	-	-
_ZN17QAbstractItemView14clearSelectionEv	0x00317088	-	-
_ZN17QAbstractItemView16setSelectionModeENS_13SelectionModeE	0x0031708c	-	-
_ZN17QAbstractItemView16setTextElideModeEN2Qt13TextElideModeE	0x00317090	-	-
_ZN17QAbstractItemView21setVerticalScrollModeENS_10ScrollModeE	0x00317094	-	-
_ZN17QAbstractItemView23setAlternatingRowColorsEb	0x00317098	-	-
_ZN17QAbstractItemView23setHorizontalScrollModeENS_10ScrollModeE	0x0031709c	-	-
_ZN4QPen8setColorERK6QColor	0x003170a0	-	-
_ZN4QPen8setStyleEN2Qt8PenStyleE	0x003170a4	-	-
_ZN4QPen8setWidthEi	0x003170a8	-	-
_ZN4QPenC1ERKS_	0x003170ac	-	-
_ZN4QPenC1Ev	0x003170b0	-	-
_ZN4QPenD1Ev	0x003170b4	-	-
_ZN5QFontC1Ev	0x003170b8	-	-
_ZN5QFontD1Ev	0x003170bc	-	-
_ZN5QIcon7addFileERK7QStringRK5QSizeNS_4ModeENS_5StateE	0x003170c0	-	-
_ZN5QIconC1Ev	0x003170c4	-	-
_ZN5QIconD1Ev	0x003170c8	-	-
_ZN5QMenuC1EP7QWidget	0x003170cc	-	-
_ZN6QBrushC1EN2Qt11GlobalColorENS0_10BrushStyleE	0x003170d0	-	-
_ZN6QBrushC1ERK6QColorN2Qt10BrushStyleE	0x003170d4	-	-
_ZN6QBrushC1ERK7QPixmap	0x003170d8	-	-
_ZN6QBrushD1Ev	0x003170dc	-	-
_ZN6QColor6setHsvEiiii	0x003170e0	-	-
_ZN6QColor6setRgbEiiii	0x003170e4	-	-
_ZN6QColorC1EN2Qt11GlobalColorE	0x003170e8	-	-
_ZN6QColoraSERKS_	0x003170ec	-	-
_ZN6QFrame10paintEventEP11QPaintEvent	0x003170f0	-	-
_ZN6QFrame11changeEventEP6QEvent	0x003170f4	-	-
_ZN6QFrame11qt_metacallEN11QMetaObject4CallEiPPv	0x003170f8	-	-
_ZN6QFrame11qt_metacastEPKc	0x003170fc	-	-
_ZN6QFrame16staticMetaObjectE	0x00317100	-	-
_ZN6QFrame5eventEP6QEvent	0x00317104	-	-
_ZN6QFrameC2EP7QWidget6QFlagsIN2Qt10WindowTypeEE	0x00317108	-	-
_ZN6QFrameD2Ev	0x0031710c	-	-
_ZN6QLabel7setTextERK7QString	0x00317110	-	-
_ZN6QLabelC1EP7QWidget6QFlagsIN2Qt10WindowTypeEE	0x00317114	-	-
_ZN6QLabelC1ERK7QStringP7QWidget6QFlagsIN2Qt10WindowTypeEE	0x00317118	-	-
_ZN7QAction10setCheckedEb	0x0031711c	-	-
_ZN7QAction10setEnabledEb	0x00317120	-	-
_ZN7QAction11setShortcutERK12QKeySequence	0x00317124	-	-
_ZN7QAction12setCheckableEb	0x00317128	-	-
_ZN7QAction12setStatusTipERK7QString	0x0031712c	-	-
_ZN7QAction7setIconERK5QIcon	0x00317130	-	-
_ZN7QActionC1ERK7QStringP7QObject	0x00317134	-	-
_ZN7QDialog4execEv	0x00317138	-	-
_ZN7QLayout18setContentsMarginsEiiii	0x0031713c	-	-
_ZN7QMatrix5scaleEdd	0x00317140	-	-
_ZN7QMatrix6rotateEd	0x00317144	-	-
_ZN7QMatrix9translateEdd	0x00317148	-	-
_ZN7QMatrixC1Ev	0x0031714c	-	-
_ZN7QPixmapC1ERK5QSize	0x00317150	-	-
_ZN7QPixmapC1ERK7QStringPKc6QFlagsIN2Qt19ImageConversionFlagEE	0x00317154	-	-
_ZN7QPixmapD1Ev	0x00317158	-	-
_ZN7QRegionC1Ev	0x0031715c	-	-
_ZN7QRegionD1Ev	0x00317160	-	-
_ZN7QSlider15setTickIntervalEi	0x00317164	-	-
_ZN7QSlider15setTickPositionENS_12TickPositionE	0x00317168	-	-
_ZN7QSliderC1EN2Qt11OrientationEP7QWidget	0x0031716c	-	-
_ZN7QWidget10closeEventEP11QCloseEvent	0x00317170	-	-
_ZN7QWidget10enterEventEP6QEvent	0x00317174	-	-
_ZN7QWidget10fontChangeERK5QFont	0x00317178	-	-
_ZN7QWidget10leaveEventEP6QEvent	0x0031717c	-	-
_ZN7QWidget10paintEventEP11QPaintEvent	0x00317180	-	-
_ZN7QWidget10setVisibleEb	0x00317184	-	-
_ZN7QWidget10wheelEventEP11QWheelEvent	0x00317188	-	-
_ZN7QWidget11actionEventEP12QActionEvent	0x0031718c	-	-
_ZN7QWidget11changeEventEP6QEvent	0x00317190	-	-
_ZN7QWidget11qt_metacallEN11QMetaObject4CallEiPPv	0x00317194	-	-
_ZN7QWidget11qt_metacastEPKc	0x00317198	-	-
_ZN7QWidget11resizeEventEP12QResizeEvent	0x0031719c	-	-
_ZN7QWidget11styleChangeER6QStyle	0x003171a0	-	-
_ZN7QWidget11tabletEventEP12QTabletEvent	0x003171a4	-	-
_ZN7QWidget12focusInEventEP11QFocusEvent	0x003171a8	-	-
_ZN7QWidget13dragMoveEventEP14QDragMoveEvent	0x003171ac	-	-
_ZN7QWidget13enabledChangeEb	0x003171b0	-	-
_ZN7QWidget13focusOutEventEP11QFocusEvent	0x003171b4	-	-
_ZN7QWidget13keyPressEventEP9QKeyEvent	0x003171b8	-	-
_ZN7QWidget13paletteChangeERK8QPalette	0x003171bc	-	-
_ZN7QWidget13setSizePolicyE11QSizePolicy	0x003171c0	-	-
_ZN7QWidget14dragEnterEventEP15QDragEnterEvent	0x003171c4	-	-
_ZN7QWidget14dragLeaveEventEP15QDragLeaveEvent	0x003171c8	-	-
_ZN7QWidget14languageChangeEv	0x003171cc	-	-
_ZN7QWidget14mouseMoveEventEP11QMouseEvent	0x003171d0	-	-
_ZN7QWidget14setWindowTitleERK7QString	0x003171d4	-	-
_ZN7QWidget14updateGeometryEv	0x003171d8	-	-
_ZN7QWidget15keyReleaseEventEP9QKeyEvent	0x003171dc	-	-
_ZN7QWidget15mousePressEventEP11QMouseEvent	0x003171e0	-	-
_ZN7QWidget15setMinimumWidthEi	0x003171e4	-	-
_ZN7QWidget16contextMenuEventEP17QContextMenuEvent	0x003171e8	-	-
_ZN7QWidget16inputMethodEventEP17QInputMethodEvent	0x003171ec	-	-
_ZN7QWidget16staticMetaObjectE	0x003171f0	-	-
_ZN7QWidget17mouseReleaseEventEP11QMouseEvent	0x003171f4	-	-
_ZN7QWidget17setWindowModalityEN2Qt14WindowModalityE	0x003171f8	-	-
_ZN7QWidget18focusNextPrevChildEb	0x003171fc	-	-
_ZN7QWidget21mouseDoubleClickEventEP11QMouseEvent	0x00317200	-	-
_ZN7QWidget22windowActivationChangeEb	0x00317204	-	-
_ZN7QWidget5eventEP6QEvent	0x00317208	-	-
_ZN7QWidget6renderEP12QPaintDeviceRK6QPointRK7QRegion6QFlagsINS_10RenderFlagEE	0x0031720c	-	-
_ZN7QWidget8winEventEP6tagMSGPl	0x00317210	-	-
_ZN7QWidget9addActionEP7QAction	0x00317214	-	-
_ZN7QWidget9dropEventEP10QDropEvent	0x00317218	-	-
_ZN7QWidget9hideEventEP10QHideEvent	0x0031721c	-	-
_ZN7QWidget9moveEventEP10QMoveEvent	0x00317220	-	-
_ZN7QWidget9setLayoutEP7QLayout	0x00317224	-	-
_ZN7QWidget9showEventEP10QShowEvent	0x00317228	-	-
_ZN7QWidgetC2EPS_6QFlagsIN2Qt10WindowTypeEE	0x0031722c	-	-
_ZN7QWidgetD2Ev	0x00317230	-	-
_ZN8QMenuBar7addMenuERK7QString	0x00317234	-	-
_ZN8QPainter13setRenderHintENS_10RenderHintEb	0x00317238	-	-
_ZN8QPainter3endEv	0x0031723c	-	-
_ZN8QPainter6setPenERK4QPen	0x00317240	-	-
_ZN8QPainter7setFontERK5QFont	0x00317244	-	-
_ZN8QPainter8drawPathERK12QPainterPath	0x00317248	-	-
_ZN8QPainter8drawTextERK6QRectFiRK7QStringPS0_	0x0031724c	-	-
_ZN8QPainter8fillPathERK12QPainterPathRK6QBrush	0x00317250	-	-
_ZN8QPainter8setBrushERK6QBrush	0x00317254	-	-
_ZN8QPainterC1EP12QPaintDevice	0x00317258	-	-
_ZN8QPrinter15setOutputFormatENS_12OutputFormatE	0x0031725c	-	-
_ZN8QPrinter17setOutputFileNameERK7QString	0x00317260	-	-
_ZN8QPrinterC1ENS_11PrinterModeE	0x00317264	-	-
_ZN8QToolBar12addSeparatorEv	0x00317268	-	-
_ZN8QToolBar15setAllowedAreasE6QFlagsIN2Qt11ToolBarAreaEE	0x0031726c	-	-
_ZN8QToolBarC1EP7QWidget	0x00317270	-	-
_ZN9QCheckBox13setCheckStateEN2Qt10CheckStateE	0x00317274	-	-
_ZN9QCheckBoxC1ERK7QStringP7QWidget	0x00317278	-	-
_ZNK10QTabWidget10metaObjectEv	0x0031727c	-	-
_ZNK10QTabWidget12currentIndexEv	0x00317280	-	-
_ZNK10QTabWidget15minimumSizeHintEv	0x00317284	-	-
_ZNK10QTabWidget5countEv	0x00317288	-	-
_ZNK10QTabWidget6widgetEi	0x0031728c	-	-
_ZNK10QTabWidget8sizeHintEv	0x00317290	-	-
_ZNK10QTableView14verticalHeaderEv	0x00317294	-	-
_ZNK10QTableView16horizontalHeaderEv	0x00317298	-	-
_ZNK11QDockWidget16toggleViewActionEv	0x0031729c	-	-
_ZNK11QMainWindow7menuBarEv	0x003172a0	-	-
_ZNK11QTreeWidget13selectedItemsEv	0x003172a4	-	-
_ZNK11QTreeWidget9findItemsERK7QString6QFlagsIN2Qt9MatchFlagEEi	0x003172a8	-	-
_ZNK12QPainterPath10intersectsERKS_	0x003172ac	-	-
_ZNK12QPainterPath10subtractedERKS_	0x003172b0	-	-
_ZNK12QPainterPath12boundingRectEv	0x003172b4	-	-
_ZNK12QPainterPath8containsERK7QPointF	0x003172b8	-	-
_ZNK12QPainterPath8containsERKS_	0x003172bc	-	-
_ZNK13QFontMetricsF12boundingRectERK7QString	0x003172c0	-	-
_ZNK13QGraphicsItem10isSelectedEv	0x003172c4	-	-
_ZNK13QGraphicsItem10opaqueAreaEv	0x003172c8	-	-
_ZNK13QGraphicsItem12isObscuredByEPKS_	0x003172cc	-	-
_ZNK13QGraphicsItem16collidesWithItemEPKS_N2Qt17ItemSelectionModeE	0x003172d0	-	-
_ZNK13QGraphicsItem16collidesWithPathERK12QPainterPathN2Qt17ItemSelectionModeE	0x003172d4	-	-
_ZNK13QGraphicsItem16inputMethodQueryEN2Qt16InputMethodQueryE	0x003172d8	-	-
_ZNK13QGraphicsItem17supportsExtensionENS_9ExtensionE	0x003172dc	-	-
_ZNK13QGraphicsItem3posEv	0x003172e0	-	-
_ZNK13QGraphicsItem4typeEv	0x003172e4	-	-
_ZNK13QGraphicsItem5shapeEv	0x003172e8	-	-
_ZNK13QGraphicsItem8containsERK7QPointF	0x003172ec	-	-
_ZNK13QGraphicsItem8scenePosEv	0x003172f0	-	-
_ZNK13QGraphicsItem9extensionERK8QVariant	0x003172f4	-	-
_ZNK13QGraphicsView10metaObjectEv	0x003172f8	-	-
_ZNK13QGraphicsView16inputMethodQueryEN2Qt16InputMethodQueryE	0x003172fc	-	-
_ZNK13QGraphicsView8sizeHintEv	0x00317300	-	-
_ZNK14QGraphicsScene13selectedItemsEv	0x00317304	-	-
_ZNK14QGraphicsScene16inputMethodQueryEN2Qt16InputMethodQueryE	0x00317308	-	-
_ZNK14QGraphicsScene17itemsBoundingRectEv	0x0031730c	-	-
_ZNK14QGraphicsScene5itemsEv	0x00317310	-	-
_ZNK14QGraphicsScene6itemAtERK7QPointF	0x00317314	-	-
_ZNK14QGraphicsScene9sceneRectEv	0x00317318	-	-
_ZNK15QAbstractSlider5valueEv	0x0031731c	-	-
_ZNK15QAbstractSlider7maximumEv	0x00317320	-	-
_ZNK15QProgressDialog11wasCanceledEv	0x00317324	-	-
_ZNK15QProgressDialog5valueEv	0x00317328	-	-
_ZNK19QAbstractScrollArea15minimumSizeHintEv	0x0031732c	-	-
_ZNK24QGraphicsSceneMouseEvent8scenePosEv	0x00317330	-	-
_ZNK30QGraphicsSceneContextMenuEvent8scenePosEv	0x00317334	-	-
_ZNK4QPen5widthEv	0x00317338	-	-
_ZNK6QColor10saturationEv	0x0031733c	-	-
_ZNK6QColor3hueEv	0x00317340	-	-
_ZNK6QColor4darkEi	0x00317344	-	-
_ZNK6QColor5lightEi	0x00317348	-	-
_ZNK6QColor5valueEv	0x0031734c	-	-
_ZNK6QFrame8sizeHintEv	0x00317350	-	-
_ZNK7QAction4textEv	0x00317354	-	-
_ZNK7QMatrix3mapERK7QPointF	0x00317358	-	-
_ZNK7QPixmap4saveERK7QStringPKci	0x0031735c	-	-
_ZNK7QWidget11paintEngineEv	0x00317360	-	-
_ZNK7QWidget14heightForWidthEi	0x00317364	-	-
_ZNK7QWidget15minimumSizeHintEv	0x00317368	-	-
_ZNK7QWidget16inputMethodQueryEN2Qt16InputMethodQueryE	0x0031736c	-	-
_ZNK7QWidget5getDCEv	0x00317370	-	-
_ZNK7QWidget6metricEN12QPaintDevice17PaintDeviceMetricE	0x00317374	-	-
_ZNK7QWidget7devTypeEv	0x00317378	-	-
_ZNK7QWidget8sizeHintEv	0x0031737c	-	-
_ZNK7QWidget9releaseDCEP5HDC__	0x00317380	-	-
_ZNK8QPainter3penEv	0x00317384	-	-
_ZNK9QCheckBox10checkStateEv	0x00317388	-	-
_ZNK9QTreeView6headerEv	0x0031738c	-	-
_ZThn8_NK7QWidget11paintEngineEv	0x00317390	-	-
_ZThn8_NK7QWidget5getDCEv	0x00317394	-	-
_ZThn8_NK7QWidget6metricEN12QPaintDevice17PaintDeviceMetricE	0x00317398	-	-
_ZThn8_NK7QWidget7devTypeEv	0x0031739c	-	-
_ZThn8_NK7QWidget9releaseDCEP5HDC__	0x003173a0	-	-

▸QtSvg4.dll5 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_ZN13QSvgGenerator11setFileNameERK7QString	0x003173ac	-	-
_ZN13QSvgGenerator14setDescriptionERK7QString	0x003173b0	-	-
_ZN13QSvgGenerator7setSizeERK5QSize	0x003173b4	-	-
_ZN13QSvgGenerator8setTitleERK7QString	0x003173b8	-	-
_ZN13QSvgGeneratorC1Ev	0x003173bc	-	-

▸QtXml4.dll17 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_ZN12QDomDocument10setContentEP9QIODeviceP7QStringPiS4_	0x003173c8	-	-
_ZN12QDomDocumentC1ERK7QString	0x003173cc	-	-
_ZN12QDomDocumentD1Ev	0x003173d0	-	-
_ZN12QDomNodeListD1Ev	0x003173d4	-	-
_ZN8QDomNodeD1Ev	0x003173d8	-	-
_ZN8QDomNodeD2Ev	0x003173dc	-	-
_ZN8QDomNodeaSERKS_	0x003173e0	-	-
_ZNK11QDomElement17elementsByTagNameERK7QString	0x003173e4	-	-
_ZNK11QDomElement4textEv	0x003173e8	-	-
_ZNK11QDomElement7tagNameEv	0x003173ec	-	-
_ZNK12QDomDocument15documentElementEv	0x003173f0	-	-
_ZNK12QDomNodeList4itemEi	0x003173f4	-	-
_ZNK12QDomNodeList6lengthEv	0x003173f8	-	-
_ZNK8QDomNode10firstChildEv	0x003173fc	-	-
_ZNK8QDomNode11nextSiblingEv	0x00317400	-	-
_ZNK8QDomNode6isNullEv	0x00317404	-	-
_ZNK8QDomNode9toElementEv	0x00317408	-	-

Binary metadata

what the headers declare about this build

Resource langs	-
Debug info	no
TLS callbacks	no

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Capability detection

18 capabilities

Capability	Namespace
create or open file	-
contain obfuscated stackstrings	anti-analysis/obfuscation/string/stackstring
delay execution	-
contain loop	-
terminate process	host-interaction/process/terminate
accept command line arguments	host-interaction/cli
write file on Windows	host-interaction/file-system/write
parse PE header	load-code/pe
authenticate HMAC	data-manipulation/hmac
parse credit card information	collection/credit-card
enumerate PE sections	load-code/pe
resolve function by parsing PE exports	load-code/pe
read file on Windows	host-interaction/file-system/read
allocate thread local storage	host-interaction/thread/tls
get thread local storage value	host-interaction/process
set thread local storage value	host-interaction/thread/tls
reference analysis tools strings	anti-analysis
reference anti-VM strings targeting VirtualBox	anti-analysis/anti-vm/vm-detection

ATT&CK techniques

Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005]Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]

Malware Behavior Catalog

Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionAnti-Behavioral Analysis::Virtual Machine DetectionAnti-Static Analysis::Executable Code Obfuscation::Argument ObfuscationAnti-Static Analysis::Executable Code Obfuscation::Stack StringsCryptography::Hashed Message Authentication CodeData::Check StringDiscovery::Analysis Tool Discovery::Process detectionDiscovery::Code Discovery::Enumerate PE SectionsExecution::Command and Scripting InterpreterFile System::Create FileFile System::Read FileFile System::Writes FileProcess::Allocate Thread Local StorageProcess::Set Thread Local Storage ValueProcess::Terminate Process

Signature matches

0 findings · 4 file properties · 0 scored

File properties

IsPE32IsWindowsGUIMinGW_1QtFrameWork

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

No signature rule identified a threat in this file.

Extracted strings

showing 200 of 2806

!This program cannot be run in DOS mode.
.text
`.data
.rdata
@.bss
.idata
%dlq
%llq
%xlq
%lrq
%xnq
%xpq
%lpq
%lqq
%dpq
%dqq
%lmq
%xoq
%xqq
%doq
%loq
%dsq
%xsq
%dnq
%xrq
%lsq
%xmq
%drq
%lnq
CUNG
CUNG5
B4CUNG
%lkq
%dkq
%xkq
List of model elements
Properties of selected elements
Windows
Save Graph File
Errors were encountered while opening the file
Open Graph File
.png
no_name
16.png
24.png
&Open
Open an existing file
1openGraph()
2triggered()
Save an existing file
&Save
1saveGraph()
Export an existing file
Cancels last action
Undo
1undo()
Computes automatic layout
&Update Layout
1updateLayout()
Destroy layout
Destroy Layout
1destroyLayout()
Clone/unclone modifiers
Layout &Modifiers
1toggleModifiersCloning()
(un)clone or (un)branch selection
&Arrange Selection
1arrangeSelection()
Toggles container visibility
Show &Containers
1toggleContainerVisibility()
File
&File
&Action
No Document
tata
Text files (*.txt);;Graphviz files (*.dot);;PDF files (*.pdf);;PS files (*.ps);;SVG files (*.svg)
ArcadiaLastDocument.xml
Wrong number of visible layouts!:
rng.first != rng.second
c:/boost/boost_1_37_0/boost/graph/detail/adjacency_list.hpp
Problem, more than one visible layout!
Default Layout
Around
basic_string::_S_construct NULL not valid
Vertices:
Edges:
basic_string::substr
.dot
true
GenericContainer
Reactant
Product
Modifier
GraphLayout::addNeighbourFromEdge
Clone and edge mismatch
Reaction
That's awkward...
CloneContainer
Content
?CompContainer
BranchContainer
TriangleContainer
triangle removal
triangle addition
basic_string::_M_replace_aux
basic_string::at
No direction
Too many
security
width
height
CompContainer
Hah!!! Compartment has no core!
Cleaning up edge routing memory (can't be interrupted)
Edge routing in progress... Processing connectors
Edge routing in progress... Initializing shapes
Edge routing in progress... Initializing connectors
Edge routing in progress...
Cancel
Edge routing in progress... Cleaning up memory
Edge routing in progress... Initializing
Edge routing in progress... Processing
Edge
Edge Unknown
Vertex
Vertex Unknown
Label
Type
@Toggles automatic edge routing on the current view
&Route Edges
1toggleAvoidingEdges()
Toggles cloning on all modifiers on the current view
Layout Modifiers
1cloneModifiers()
Toggles cloning or branching on all selected species or reactions in the current view
Arrange Selection
Displays first view
1farLeft()
Displays previous view
1left()
Displays next view
1right()
Displays last view
1farRight()
Creates a local view of the current selection (or displays the already existing view)
Select layout
1newLayout()
Applies automatic layout rules to the current view
Update layout
Zoom
1setupMatrix()
2valueChanged(int)
1changeCenter(QPointF)
2newCenter(QPointF)
1sceneSwitched(int)
2currentChanged(int)
1layoutDestroyed()
2tabCloseRequested(int)
No Layout
Show only
&Local view
Switches to local view
1switchToLocalView()
1executeAction( QAction * )
2triggered ( QAction * )
%d
%d
%d
Type
Label
Neighbours
Show only current layout
1changeVertexSelection()
2itemSelectionChanged()
1doubleClickVertex(QTreeWidgetItem *, int)
2itemDoubleClicked(QTreeWidgetItem *, int)
1updateTree()
2stateChanged (int)
No selection
A_%d
spaghetti.jpg
2selectionChanged()
Cannot find SBO description file
SBO_XML.xml expected in
- manually download the file from
http://www.ebi.ac.uk/sbo/exports/Main/SBO_XML.xml
into
then [Retry]?
- [Open] an existing SBO description file from a different location on your machine?
- [Ignore] the problem and disable SBO support for this session?
XML Files (*.xml);;Any (*)
Open SBO File
SBML Files (*.sbml *.xml)
Species
empty set
Source
Sink
[NoName]
In PathwayGraphModel::findEdgeFromNeighbourRelationship

Stack and decoded strings were not recovered: it did not finish within the time allowed. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)

AddressBytesMnemonicOperands

0x40124055pushebp

0x40124189e5movebp, esp

0x40124383ec08subesp, 8

0x401246c7042402000000movdword ptr [esp], 2

0x40124dff151c6b7100calldword ptr [0x716b1c]

0x401253e8a8feffffcall0x401100

0x40125890nop

0x4012598db42600000000leaesi, [esi]

0x40126055pushebp

0x4012618b0d686b7100movecx, dword ptr [0x716b68]

0x40126789e5movebp, esp

0x4012695dpopebp

0x40126affe1jmpecx

0x40126c8d742600leaesi, [esi]

0x40127055pushebp

0x4012718b0d446b7100movecx, dword ptr [0x716b44]

0x40127789e5movebp, esp

0x4012795dpopebp

0x40127affe1jmpecx

0x40127c90nop

0x40127d90nop

0x40127e90nop

0x40127f90nop

0x40128055pushebp

0x40128189e5movebp, esp

0x4012835dpopebp

0x401284e9276b2500jmp0x657db0

0x40128990nop

0x40128a90nop

0x40128b90nop

0x40128c90nop

0x40128d90nop

0x40128e90nop

0x40128f90nop

0x40129055pushebp

0x40129189e5movebp, esp

0x4012938b4508moveax, dword ptr [ebp + 8]

0x4012968b4018moveax, dword ptr [eax + 0x18]

0x40129985c0testeax, eax

0x40129b7503jne0x4012a0

0x40129d5dpopebp

0x40129ec3ret

0x40129f90nop

0x4012a0894508movdword ptr [ebp + 8], eax

0x4012a35dpopebp

0x4012a4e9575a0000jmp0x406d00

0x4012a990nop

0x4012aa8db600000000leaesi, [esi]

0x4012b055pushebp

0x4012b189e5movebp, esp

0x4012b383ec58subesp, 0x58

0x4012b68965e8movdword ptr [ebp - 0x18], esp

0x4012b98b4508moveax, dword ptr [ebp + 8]

0x4012bc895df4movdword ptr [ebp - 0xc], ebx

0x4012bf8975f8movdword ptr [ebp - 8], esi

0x4012c28945bcmovdword ptr [ebp - 0x44], eax

0x4012c58d45f4leaeax, [ebp - 0xc]

0x4012c88945e0movdword ptr [ebp - 0x20], eax

0x4012cb8d45c0leaeax, [ebp - 0x40]

0x4012ce890424movdword ptr [esp], eax

callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample

Fingerprint	192:w/KPCp7B2Q2Ii6LMv0XrrCcDKfBnKFOkeeyi2tAGJnId3OIEtYe5Zk4LtlZwnxFH:wSPCp7B2gZgvEDKAFeeyi2tA3xe5je1
Imports read	590 functions from 10 libraries (590 distinct)
Comparable	yes
Compared against	95 stored samples

Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

7 frames · screen recording · 134s

1 / 7

0:00 · 1/7

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 134s

1 process(es) observed

LaunchedC:\Users\user\Desktop\arcadia.exe

Privilegestandard

Telemetry sources: Kernel ETW (3 of 69 events) Process audit: 1

Evasion / anti-analysis checks

9 checks

MED

System Checks Capability analysis

MITRE T1497

MED

Reference analysis tools strings Capability rule

MITRE T1497 · Anti-analysis

MED

Reference anti-VM strings targeting VirtualBox Capability rule

MITRE T1497.001 · Virtual-machine detection

MED

Dynamic Analysis Evasion::Delayed Execution Capability taxonomy

MITRE T1497 · Anti-Behavioral Analysis

MED

Virtual Machine Detection Capability taxonomy

MITRE T1497 · Anti-Behavioral Analysis

MED

Anti-analysis strings (VM/debugger/tool names) strings

MITRE T1497 · vbox

LOW

Contain obfuscated stackstrings Capability rule

MITRE T1027 · Code or string obfuscation

LOW

Executable Code Obfuscation::Argument Obfuscation Capability taxonomy

MITRE T1497 · Anti-Static Analysis

LOW

Executable Code Obfuscation::Stack Strings Capability taxonomy

MITRE T1497 · Anti-Static Analysis

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 924 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

1 read

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

arcadia.exe

1 process

Attributed activity

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 0 registry · sample scope

Files (0) Registry (0)

Operation	Target	Process

No file or registry operations captured.

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Earlier analysis of these bytes

1 earlier run

Earlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.

Run	Analysed	Module	Verdict	Score
#2901	2026-10-22 17:35	File Analysis	Nothing conclusive16	16/100

17 answered no 1 could not answer 5 had nothing to check

0Sources with a hit

18Sources queriedof 23 available

470.6kFeed records

1Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	3,003 records 5 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 3 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,153 records 5 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,680 records 5 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer

Source	Checks	Result	Detail	Feed
URLhaus	IP / domain / URL	feed unavailable	26 observed indicators, none listed	no records ingested
blocklist.de	IP / domain / URL	clean	26 observed indicators, none listed	27.6k records 5 minutes ago
CINS Army	IP / domain / URL	clean	26 observed indicators, none listed	15k records 5 minutes ago
Emerging Threats	IP / domain / URL	clean	26 observed indicators, none listed	482 records 5 minutes ago
Feodo Tracker	IP / domain / URL	clean	26 observed indicators, none listed	5 records 5 minutes ago
IPsum	IP / domain / URL	clean	26 observed indicators, none listed	19.7k records 5 minutes ago
Phishing.Database	IP / domain / URL	clean	26 observed indicators, none listed	391.5k records 3 hours ago
ThreatFox	IP / domain / URL	clean	26 observed indicators, none listed	1,153 records 5 minutes ago

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 9 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

2 clear

Source	Checks	Result	Detail	Feed
Sigma rules	Behavior log	clean	-	2,275 records 5 hours ago
Signature rules	Sample content	clean	4 structural rules matched (file properties, not findings)	110 records 5 minutes ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	1 process image path, none masqueraded	245 records 5 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 4 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 5 minutes ago
LOLRMM	Names and domains	clean	2 name/domain indicators checked, no remote-management tooling	360 records 5 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 3 info

File indicators

Severity	Type	Indicator	Description
info	sample_sha256	54d323451c12bac68561e48634c14f326eadc68a4528c68e642a6a50c7bb8c84	Submitted sample (SHA256)
info	sample_md5	b1fbd1d9429016c2dc1b26ae63ecf68c	Submitted sample (MD5)
info	imphash	6948fc47aa8dc754708a21141a757bac	Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2902

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

2 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

Submitted	Environment	Verdict	Score
2026-10-22 17:21 Shown below	Windows 10 22H2	Nothing conclusive	16/100
2026-10-22 17:14	Windows 10 22H2	Nothing conclusive	16/100