Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe

Overview

General Information

Sample URL:https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
Analysis ID:1420288
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Modifies the windows firewall
Uses netsh to modify the Windows network and firewall settings
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses Microsoft's Enhanced Cryptographic Provider
Uses taskkill to terminate processes
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 5428 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • wget.exe (PID: 3704 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
  • SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe (PID: 2800 cmdline: "C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" MD5: E1C148070E7E9856B50B4AB3AA6C096B)
    • taskkill.exe (PID: 4480 cmdline: taskkill /im SRTMiniServer.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 1908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6888 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\SRTMiniServer\post_install.cmd"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • netsh.exe (PID: 1720 cmdline: netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" enable=yes profile=public,private MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
    • SRTMiniServer.exe (PID: 792 cmdline: "C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" MD5: D7C8D83952710C569E3671A42CF71773)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1596, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" > cmdline.out 2>&1, ProcessId: 5428, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D011030 ?fromStdString@QString@@SA?AV1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?fromStdString@QString@@SA?AV1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?toULongLong@QString@@QEBA_KPEA_NH@Z,??0QByteArray@@QEAA@AEBV0@@Z,?fromUtf8@QString@@SA?AV1@PEBDH@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ,?hash@QCryptographicHash@@SA?AVQByteArray@@AEBV2@W4Algorithm@1@@Z,?toHex@QByteArray@@QEBA?AV1@XZ,??0QString@@QEAA@AEBVQByteArray@@@Z,??1QByteArray@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??8@YA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,15_2_00007FF60D011030
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D046870 ??0QByteArray@@QEAA@XZ,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,??0QSettings@@QEAA@AEBVQString@@W4Format@0@PEAVQObject@@@Z,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,??0QVariant@@QEAA@XZ,?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z,?toString@QVariant@@QEBA?AVQString@@XZ,??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,??1QVariant@@QEAA@XZ,??1QString@@QEAA@XZ,?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ,?hash@QCryptographicHash@@SA?AVQByteArray@@AEBV2@W4Algorithm@1@@Z,??1QByteArray@@QEAA@XZ,?toHex@QByteArray@@QEBA?AV1@XZ,??4QString@@QEAAAEAV0@AEBVQByteArray@@@Z,??1QByteArray@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@AEBVQString@@@Z,??1QDebug@@QEAA@XZ,??0QByteArray@@QEAA@AEBV0@@Z,??1QByteArray@@QEAA@XZ,??1QSettings@@UEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,15_2_00007FF60D046870
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66AF770 ??0QUrl@@QEAA@AEBV0@@Z,??0QString@@QEAA@XZ,?setPassword@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z,??1QString@@QEAA@XZ,??0QString@@QEAA@XZ,?setFragment@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z,??1QString@@QEAA@XZ,??0QCryptographicHash@@QEAA@W4Algorithm@0@@Z,?toEncoded@QUrl@@QEBA?AVQByteArray@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z,?addData@QCryptographicHash@@QEAAXAEBVQByteArray@@@Z,??1QByteArray@@QEAA@XZ,?result@QCryptographicHash@@QEBA?AVQByteArray@@XZ,?constData@QString@@QEBAPEBVQChar@@XZ,?number@QByteArray@@SA?AV1@_JH@Z,?left@QByteArray@@QEBA?AV1@H@Z,??1QByteArray@@QEAA@XZ,??1QByteArray@@QEAA@XZ,?size@QString@@QEBAHXZ,?at@QByteArray@@QEBADH@Z,?size@QString@@QEBAHXZ,?constData@QString@@QEBAPEBVQChar@@XZ,?constData@QString@@QEBAPEBVQChar@@XZ,?number@QString@@SA?AV1@IH@Z,?size@QString@@QEBAHXZ,??0QString@@QEAA@HW4Initialization@Qt@@@Z,?constData@QString@@QEBAPEBVQChar@@XZ,?size@QString@@QEBAHXZ,?constData@QString@@QEBAPEBVQChar@@XZ,memcpy,??0QChar@@QEAA@UQLatin1Char@@@Z,?appendLatin1To@QAbstractConcatenable@@KAXPEBDHPEAVQChar@@@Z,?appendLatin1To@QAbstractConcatenable@@KAXPEBDHPEAVQChar@@@Z,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??1QCryptographicHash@@QEAA@XZ,??1QUrl@@QEAA@XZ,15_2_00007FFDF66AF770
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_0d159b48-0
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.1d\libcrypto-1_1-x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.00000000029CF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SRTMiniServer.exe, 0000000F.00000002.3099127380.00007FFE120C5000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: msvcrt.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2089562175.0000000002705000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Age does not matchThe module age and .pdb age do not match. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbghelp.pdb8 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\Objects\MPlatform\x64\ReleasePX\MLProxy.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbSS source: SRTMiniServer.exe, 0000000F.00000002.3098379559.00007FFE0CFD9000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.SRT.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\DEV\GA_SRTMINISERVER\build-sdiout\release\SDIOutAddon.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavcodec\avcodec-58.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2039719264.0000000002D8D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2102576289.0000000002701000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3099769472.00007FFE1A455000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\DEV\build-confaddon\release\Conference.pdbPP) source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2i-x64\out32dll\ssleay32.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2093942975.0000000002701000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3098539160.00007FFE0E161000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavformat\avformat-58.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2069234131.0000000002A09000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.GPU.x64.pdb? source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp120.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2085733686.000000000270E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_43.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2104648764.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Z:\Development\winsparkle\x64\Release\WinSparkle.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\DEV\GA_SRTMINISERVER\build-sdiout\release\SDIOutAddon.pdb99) source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdbGCTL source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2101285682.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavutil\avutil-56.pdbl source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2072268697.000000000281B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavfilter\avfilter-7.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2062619979.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr120.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2088538506.00000000050FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\DEV\build-confaddon\release\Conference.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.1d\libssl-1_1-x64.pdb?? source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2084811984.0000000002772000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_43.pdbH source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2104648764.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Signature does not matchThe module signature does not match with .pdb signature source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2101285682.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbF source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbghelp.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Developer\Desktop\rtp\bin\x64\CrashRpt1403.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1966774367.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3099567751.00007FFE1323A000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: msvcp140.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2087340958.00000000050FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: zzz_AsmCodeRange_*FrameData.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb!! source: SRTMiniServer.exe, 0000000F.00000002.3099127380.00007FFE120C5000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: SRTMiniServer.exe, 0000000F.00000002.3097531375.00007FFDFF173000.00000002.00000001.01000000.0000002A.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Sql.pdb11 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *.pdb source: SRTMiniServer.exe, 0000000F.00000002.3086834020.00000246CEBF4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.Core.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: yC:\DEV\GA_SRTMINISERVER\build-srtminiserver\bin\SRTMiniServer.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Developer\Desktop\rtp\bin\x64\CrashRpt1403.pdb$$ source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1966774367.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3099567751.00007FFE1323A000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavdevice\avdevice-58.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2053590759.000000000278F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Code\TriCaster\NDI 4\Bin64\Release\Processing.NDI.Lib.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2004179942.000000000270C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.1d\libssl-1_1-x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2084811984.0000000002772000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SRTMiniServer.exe, 0000000F.00000002.3098936268.00007FFE11EA4000.00000002.00000001.01000000.00000029.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb++ source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3098539160.00007FFE0E161000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.FFM.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2083486089.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.000000000294E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.amd64.pdbGCTL source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2087340958.00000000050FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502OpenSSL 1.1.1d 10 Sep 2019built on: Wed Sep 11 13:24:44 2019 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.000000000294E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Sql.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbCC source: SRTMiniServer.exe, 0000000F.00000002.3097531375.00007FFDFF173000.00000002.00000001.01000000.0000002A.sdmp
Source: Binary string: C:\DEV\GA_SRTMINISERVER\build-srtminiserver\bin\SRTMiniServer.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Drive not readyThis error indicates a .pdb file related failure. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-3.1.2-temp_64\libcrypto-3-x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2083486089.0000000002C25000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.SRT.x64.pdb] source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\Objects\MPlatform\x64\ReleasePX\MServer.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Unable to locate the .pdb file in this location source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libswresample\swresample-3.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2095719882.0000000002789000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3088799008.00007FFDF6652000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libswscale\swscale-5.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2099488639.0000000002815000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The module signature does not match with .pdb signature. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdb.dbg source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavutil\avutil-56.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2072268697.000000000281B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Device.AJA.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: or you do not have access permission to the .pdb location. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502OpenSSL 3.1.2 1 Aug 20233.1.2built on: Wed Aug 2 14:43:24 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lockcrypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8crypto\getenv.ccompiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: crypto\init.cOPENSSL_init_cryptoOPENSSL_atexitcrypto\initthread.ccrypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdupcrypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sepcrypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_paramossl_param_build_set_bn_padcrypto\param_build_set.ccopy_integercrypto\params.cunsigned_from_signedgeneral_get_intgeneral_set_intgeneral_get_uintgeneral_set_uintOSSL_PARAM_get_int32OSSL_PARAM_set_int32OSSL_PARA
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.GPU.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002702000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3090610938.00007FFDF774D000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\Users\Developer\Desktop\rtp\bin\x64\CrashSender1403.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002703000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SRTMiniServer.exe, 0000000F.00000002.3098379559.00007FFE0CFD9000.00000002.00000001.01000000.00000026.sdmp
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFCCE40 srt_getsockstate,srt_recv,_Mtx_lock,_Mtx_unlock,_Mtx_unlock,srt_getsockstate,srt_getlasterror_str,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,_Mtx_lock,_Mtx_unlock,??1QString@@QEAA@XZ,?_Throw_C_error@std@@YAXH@Z,?_Throw_C_error@std@@YAXH@Z,srt_getsockstate,srt_recv,_Mtx_lock,_Mtx_unlock,_Mtx_unlock,srt_getsockstate,srt_getlasterror_str,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@AEBVQString@@@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,_Mtx_lock,_Mtx_unlock,??1QString@@QEAA@XZ,?_Throw_C_error@std@@YAXH@Z,?_Throw_C_error@std@@YAXH@Z,15_2_00007FF60CFCCE40
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: http://bugreports.qt.io/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bugreports.qt.io/_q_receiveReplyMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogi
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002703000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/crashrpt/wiki/FAQ
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: http://core1.garaninapps.com/api/dns/reg2
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://core1.garaninapps.com/api/dns/reg2SHOW_DYNDNSERROR
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: http://core1.garaninapps.com/api/srtproxy/list
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.1837570647.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2069234131.000000000297F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dashif.org/guidelines/trickmode
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: http://downloads.garaninapps.com/srtminiserver_win.json
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://downloads.garaninapps.com/srtminiserver_win.jsonQMenuBar
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: http://garaninapps.com/rtmpminiserver/help/testndi
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://https://%02d:%02d:%02d%ws%02d.%d%02d:%02d:%02d%ws%02d%s..%s(%ws)F%05XGUID_NULLcbuffer
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: http://keys3.garaninapps.com
Source: SRTMiniServer.exe, 0000000F.00000002.3087743351.00000246CF05E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://keys3.garaninapps.com/134
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://keys3.garaninapps.comhttps://srtminiserver.com/trial-info/https://srtminiserver.com/store.htm
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2004179942.000000000270C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://new.tk/ndisdk_license/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000000.1859842351.0000000000409000.00000008.00000001.01000000.00000004.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000000.1859842351.0000000000409000.00000008.00000001.01000000.00000004.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.1837570647.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.1837570647.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2069234131.000000000297F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t2.symcb.com0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tl.symcb.com/tl.crl0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tl.symcb.com/tl.crt0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tl.symcd.com0&
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.000000000270C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://video1.sdpv=0video2.sdptxvideo3.sdp1video4.sdpVIDaudio1.sdp2audio2.sdpVIDaudio3.sdp/audio4.sd
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3089926205.00007FFDF715F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle#installerArguments
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle#minimumSystemVersion
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle#os
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle#releaseNotesLink
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle#releaseNotesLinktitledescriptionlinkhttp://www.a
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle#shortVersionString
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle#version
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3089926205.00007FFDF715F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.color.org)
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gimp.org/xmp/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.medialooks.com/extend_trialopenhttp://www.medialooks.com/cancel_trial_pDevChild
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2093942975.0000000002701000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org/V
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phreedom.org/md5)
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phreedom.org/md5)08:27
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.smpte-ra.org/schemas/434/2006/groups/S377M/2004
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.smpte-ra.org/schemas/434/2006/groups/S380M/2004
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.smpte-ra.org/schemas/434/2006/multiplex/S377M/2004
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.smpte-ra.org/schemas/434/2006/properties/S335M
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.smpte-ra.org/schemas/434/2006/types/S377M/2004
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002703000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://api.garaninapps.com/api/srt/get_number
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.garaninapps.com/api/srt/get_numberapplication/x-www-form-urlencodedLinkGenerator/URLLink
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2100683220.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/chart/interactive/docs/reference#events
Source: wget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
Source: wget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeCP
Source: wget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeOCESSORZP
Source: wget.exe, 00000002.00000002.1837268025.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeVP
Source: wget.exe, 00000002.00000002.1837268025.0000000000B75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeYP
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://garaninapps.com/sdioutaddon
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://garaninapps.com/sdioutaddonPlease
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0D
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/custom_proxy_server.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/dynamic_dns.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/help/dynamic_dns.htmlselectedProxyServerautoconnect_proxytab_indexSTART_LI
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/internet_connection_setup.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/larix_broadcaster_setup.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/help/larix_broadcaster_setup.htmlSyncBroadcaster
Source: SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/proxy_addon.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/settings_window.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/stream_to_studio.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/help/stream_to_studio.htmlLarixBroadcaster
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/syncbroadcaster_setup.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/help/syncbroadcaster_setup.htmlRemoteExperthttps://srtminiserver.com/remot
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/help/tv_guest.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/help/tv_guest.htmlStream
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/helpStart1onStartTriggered()2clicked():PREVIEWPreview1onPreviewTriggered()
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/remote_expert.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeString found in binary or memory: https://srtminiserver.com/remoteslides/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, SRTMiniServer.exe, 0000000F.00000002.3086551070.00000246CEAF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/store.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, SRTMiniServer.exe, 0000000F.00000002.3087743351.00000246CF05E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/trial-info/
Source: SRTMiniServer.exe, 0000000F.00000002.3086551070.00000246CEAF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://srtminiserver.com/trial-info/an
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2072268697.000000000281B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://streams.videolan.org/upload/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2100683220.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://svg-path-visualizer.netlify.app/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://winsparkle.org).
Source: wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.1837570647.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2100683220.000000000270B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/charts/loader.js
Source: SRTMiniServer.exeString found in binary or memory: https://www.medialooks.com)
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.medialooks.com)B
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.medialooks.com)D
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.medialooks.com/contacts/label_namecategory_namepurchase_msgcancelG
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2083486089.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2084811984.0000000002772000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/H
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/faq.html
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.thawte.com/cps0/
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.thawte.com/repository0W
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFE311015_2_00007FF60CFE3110
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D03A58015_2_00007FF60D03A580
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D00411015_2_00007FF60D004110
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFC1A4015_2_00007FF60CFC1A40
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02EE4015_2_00007FF60D02EE40
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D016E6015_2_00007FF60D016E60
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFD8EC015_2_00007FF60CFD8EC0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D070D4815_2_00007FF60D070D48
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFD0DD015_2_00007FF60CFD0DD0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFE0DD015_2_00007FF60CFE0DD0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFFEE2015_2_00007FF60CFFEE20
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFF6F8015_2_00007FF60CFF6F80
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFF8FB015_2_00007FF60CFF8FB0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D056FD015_2_00007FF60D056FD0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFCEFF015_2_00007FF60CFCEFF0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFE900015_2_00007FF60CFE9000
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02701015_2_00007FF60D027010
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFFAA6015_2_00007FF60CFFAA60
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D070AC815_2_00007FF60D070AC8
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFF2B0015_2_00007FF60CFF2B00
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01CB0015_2_00007FF60D01CB00
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFCE94015_2_00007FF60CFCE940
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D0109A015_2_00007FF60D0109A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFC8C9015_2_00007FF60CFC8C90
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFD8CA015_2_00007FF60CFD8CA0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D012CA015_2_00007FF60D012CA0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D034CD015_2_00007FF60D034CD0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFD6D0015_2_00007FF60CFD6D00
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D074D3015_2_00007FF60D074D30
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFD4B9015_2_00007FF60CFD4B90
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D024BA015_2_00007FF60D024BA0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFF4C0015_2_00007FF60CFF4C00
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFC6C1015_2_00007FF60CFC6C10
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D000C2015_2_00007FF60D000C20
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D07068615_2_00007FF60D070686
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D05E6B015_2_00007FF60D05E6B0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D0346E015_2_00007FF60D0346E0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D00871015_2_00007FF60D008710
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D03C5E015_2_00007FF60D03C5E0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFCA63015_2_00007FF60CFCA630
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D00285015_2_00007FF60D002850
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D00E86015_2_00007FF60D00E860
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02C77015_2_00007FF60D02C770
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02A7B015_2_00007FF60D02A7B0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01E7B015_2_00007FF60D01E7B0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFCC80015_2_00007FF60CFCC800
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFD82C015_2_00007FF60CFD82C0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D0022D015_2_00007FF60D0022D0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFFA33015_2_00007FF60CFFA330
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D0121A015_2_00007FF60D0121A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D0221A015_2_00007FF60D0221A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFE01D015_2_00007FF60CFE01D0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFC623015_2_00007FF60CFC6230
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D00A22015_2_00007FF60D00A220
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01822015_2_00007FF60D018220
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02047015_2_00007FF60D020470
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D07047015_2_00007FF60D070470
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D06A46015_2_00007FF60D06A460
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01A4B015_2_00007FF60D01A4B0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D06852015_2_00007FF60D068520
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D00C35015_2_00007FF60D00C350
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFFE36015_2_00007FF60CFFE360
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01E3F015_2_00007FF60D01E3F0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02C41015_2_00007FF60D02C410
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01FE5015_2_00007FF60D01FE50
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFFDE6015_2_00007FF60CFFDE60
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D009EB015_2_00007FF60D009EB0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D015EC015_2_00007FF60D015EC0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D00DD7015_2_00007FF60D00DD70
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02BD9015_2_00007FF60D02BD90
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D05FE2015_2_00007FF60D05FE20
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D0000A015_2_00007FF60D0000A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFC210015_2_00007FF60CFC2100
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01412015_2_00007FF60D014120
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFCFF6015_2_00007FF60CFCFF60
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D01BFB015_2_00007FF60D01BFB0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D5D5A015_2_00007FFDF5D5D5A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D834A015_2_00007FFDF5D834A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D7B83015_2_00007FFDF5D7B830
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D7980015_2_00007FFDF5D79800
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D5580015_2_00007FFDF5D55800
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D6F7F015_2_00007FFDF5D6F7F0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D577C015_2_00007FFDF5D577C0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D5D75015_2_00007FFDF5D5D750
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D8B6E015_2_00007FFDF5D8B6E0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D5D68015_2_00007FFDF5D5D680
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D9721015_2_00007FFDF5D97210
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D751D015_2_00007FFDF5D751D0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D7719015_2_00007FFDF5D77190
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D910C015_2_00007FFDF5D910C0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D7B0B015_2_00007FFDF5D7B0B0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D6709015_2_00007FFDF5D67090
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D6D40015_2_00007FFDF5D6D400
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D533C015_2_00007FFDF5D533C0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D6934015_2_00007FFDF5D69340
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D7932015_2_00007FFDF5D79320
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D8D2E015_2_00007FFDF5D8D2E0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D8DE1015_2_00007FFDF5D8DE10
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D79DE015_2_00007FFDF5D79DE0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF5D6DD3015_2_00007FFDF5D6DD30
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF629178015_2_00007FFDF6291780
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62D34F015_2_00007FFDF62D34F0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62A1C3015_2_00007FFDF62A1C30
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62A587015_2_00007FFDF62A5870
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62967E015_2_00007FFDF62967E0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF629648015_2_00007FFDF6296480
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62A42A015_2_00007FFDF62A42A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF630223015_2_00007FFDF6302230
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF629CDA015_2_00007FFDF629CDA0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62F6B0015_2_00007FFDF62F6B00
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF631D6A015_2_00007FFDF631D6A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62D56D015_2_00007FFDF62D56D0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF63036F015_2_00007FFDF63036F0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66EFE4015_2_00007FFDF66EFE40
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF67083E015_2_00007FFDF67083E0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66F00A015_2_00007FFDF66F00A0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66CD75015_2_00007FFDF66CD750
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66CD74515_2_00007FFDF66CD745
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66CD6F015_2_00007FFDF66CD6F0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66E57D015_2_00007FFDF66E57D0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66DB84015_2_00007FFDF66DB840
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF669782015_2_00007FFDF6697820
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66B981015_2_00007FFDF66B9810
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF671F7C015_2_00007FFDF671F7C0
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF66B349015_2_00007FFDF66B3490
Source: avutil-56.dll.5.drStatic PE information: Number of sections : 12 > 10
Source: swresample-3.dll0.5.drStatic PE information: Number of sections : 12 > 10
Source: avdevice-58.dll.5.drStatic PE information: Number of sections : 12 > 10
Source: avfilter-7.dll.5.drStatic PE information: Number of sections : 12 > 10
Source: avcodec-58.dll.5.drStatic PE information: Number of sections : 13 > 10
Source: avresample-4.dll.5.drStatic PE information: Number of sections : 12 > 10
Source: avformat-58.dll.5.drStatic PE information: Number of sections : 13 > 10
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avformat-58.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avcodec-58.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avfilter-7.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avutil-56.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: swscale-5.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: processing.ndi.lib.x64.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: srt.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: crashrpt1403.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5widgets.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5gui.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5sql.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5network.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5core.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avcodec-58.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avutil-56.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: secur32.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: swresample-3.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avutil-56.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: swscale-5.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: swresample-3.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: avutil-56.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: winmm.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dxva2.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: d3d9.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5gui.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5core.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5core.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5core.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: mpr.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: qt5svg.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeSection loaded: wintypes.dllJump to behavior
Source: avformat-58.dll.5.drStatic PE information: Section: .rodata ZLIB complexity 1.021484375
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002A61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: com.slnishinomiya.hyogo.jpkustanai.rucom.snpassenger-association.aerocom.sotsushima.nagasaki.jpcom.stuy.comx.seisa-geek.comcom.sv
Source: classification engineClassification label: mal48.evad.win@16/116@0/1
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60CFC1A40 memset,printf,??0QApplication@@QEAA@AEAHPEAPEADH@Z,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,?instance@QCoreApplication@@SAPEAV1@XZ,?setStyleSheet@QApplication@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,?number@QByteArray@@SA?AV1@HH@Z,?qputenv@@YA_NPEBDAEBVQByteArray@@@Z,??1QByteArray@@QEAA@XZ,CoCreateInstance,SysAllocString,SysFreeString,srand,rand,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@_N@Z,??1QDebug@@QEAA@XZ,av_log_set_level,?show@QWidget@@QEAAXXZ,?exec@QApplication@@SAHXZ,#9,??1QApplication@@UEAA@XZ,15_2_00007FF60CFC1A40
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServerJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\cmdline.outJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeMutant created: \Sessions\1\BaseNamedObjects\NewTek_AirPlay_UdpPingMutex
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_03
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeMutant created: \Sessions\1\BaseNamedObjects\NewTek_AirPlay_UdpSendMutex
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_03
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Users\user\AppData\Local\Temp\nsrF213.tmpJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;SRTMiniServer.exe&quot;)
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exeBinary or memory string: insert into process (line_num, width_frame, height_frame, input_fps, start_delay, crit_delay, decoder, decode_fps, audio_bufs, video_bufs, bitrate, auto_resets, total_pkt, loss_pkt, drops_pkt) values %1;
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS process ( id INTEGER PRIMARY KEY AUTOINCREMENT, cur_timestamp INTEGER DEFAULT(julianday(datetime('now','localtime'))), line_num INTEGER, width_frame INTEGER, height_frame INTEGER, input_fps INTEGER, start_delay INTEGER, crit_delay INTEGER, decoder bool, decode_fps INTEGER, audio_bufs INTEGER, video_bufs INTEGER, bitrate INTEGER, auto_resets INTEGER, total_pkt INTEGER, loss_pkt INTEGER, drops_pkt INTEGER );
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: select line_num, datetime(cur_timestamp) as timestamp, input_fps, decode_fps, audio_bufs, video_bufs, bitrate, auto_resets, total_pkt, loss_pkt, drops_pkt, width_frame, height_frame, start_delay, crit_delay, decoder from process WHERE timestamp >= datetime('now','-24 hour','localtime') order by line_num ASC, timestamp ASC;
Source: SRTMiniServer.exeString found in binary or memory: <!--StartFragment-->
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe"
Source: unknownProcess created: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe "C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe"
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /im SRTMiniServer.exe
Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\SRTMiniServer\post_install.cmd""
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" enable=yes profile=public,private
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe "C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" Jump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /im SRTMiniServer.exeJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\SRTMiniServer\post_install.cmd""Jump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe "C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" enable=yes profile=public,privateJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile written: C:\Program Files (x86)\SRTMiniServer\crashrpt_lang.iniJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeAutomated click: Next >
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeAutomated click: Next >
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeAutomated click: Install
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.1d\libcrypto-1_1-x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.00000000029CF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SRTMiniServer.exe, 0000000F.00000002.3099127380.00007FFE120C5000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: msvcrt.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2089562175.0000000002705000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Age does not matchThe module age and .pdb age do not match. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbghelp.pdb8 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\Objects\MPlatform\x64\ReleasePX\MLProxy.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbSS source: SRTMiniServer.exe, 0000000F.00000002.3098379559.00007FFE0CFD9000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.SRT.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\DEV\GA_SRTMINISERVER\build-sdiout\release\SDIOutAddon.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavcodec\avcodec-58.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2039719264.0000000002D8D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2102576289.0000000002701000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3099769472.00007FFE1A455000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\DEV\build-confaddon\release\Conference.pdbPP) source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\OpenSSL\Temp\openssl-1.0.2i-x64\out32dll\ssleay32.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2093942975.0000000002701000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3098539160.00007FFE0E161000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavformat\avformat-58.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2069234131.0000000002A09000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.GPU.x64.pdb? source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp120.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2085733686.000000000270E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_43.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2104648764.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Z:\Development\winsparkle\x64\Release\WinSparkle.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\DEV\GA_SRTMINISERVER\build-sdiout\release\SDIOutAddon.pdb99) source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdbGCTL source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2101285682.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavutil\avutil-56.pdbl source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2072268697.000000000281B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavfilter\avfilter-7.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2062619979.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr120.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2088538506.00000000050FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\DEV\build-confaddon\release\Conference.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.1d\libssl-1_1-x64.pdb?? source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2084811984.0000000002772000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_43.pdbH source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2104648764.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Signature does not matchThe module signature does not match with .pdb signature source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2101285682.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbF source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbghelp.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Developer\Desktop\rtp\bin\x64\CrashRpt1403.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1966774367.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3099567751.00007FFE1323A000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: msvcp140.amd64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2087340958.00000000050FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: zzz_AsmCodeRange_*FrameData.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb!! source: SRTMiniServer.exe, 0000000F.00000002.3099127380.00007FFE120C5000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: SRTMiniServer.exe, 0000000F.00000002.3097531375.00007FFDFF173000.00000002.00000001.01000000.0000002A.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Sql.pdb11 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *.pdb source: SRTMiniServer.exe, 0000000F.00000002.3086834020.00000246CEBF4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.Core.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: yC:\DEV\GA_SRTMINISERVER\build-srtminiserver\bin\SRTMiniServer.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Developer\Desktop\rtp\bin\x64\CrashRpt1403.pdb$$ source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1966774367.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3099567751.00007FFE1323A000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavdevice\avdevice-58.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2053590759.000000000278F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Code\TriCaster\NDI 4\Bin64\Release\Processing.NDI.Lib.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2004179942.000000000270C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.1.1d\libssl-1_1-x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2084811984.0000000002772000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SRTMiniServer.exe, 0000000F.00000002.3098936268.00007FFE11EA4000.00000002.00000001.01000000.00000029.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb++ source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3098539160.00007FFE0E161000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.FFM.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2083486089.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502 source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.000000000294E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.amd64.pdbGCTL source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2087340958.00000000050FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502OpenSSL 1.1.1d 10 Sep 2019built on: Wed Sep 11 13:24:44 2019 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.000000000294E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Sql.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbCC source: SRTMiniServer.exe, 0000000F.00000002.3097531375.00007FFDFF173000.00000002.00000001.01000000.0000002A.sdmp
Source: Binary string: C:\DEV\GA_SRTMINISERVER\build-srtminiserver\bin\SRTMiniServer.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Drive not readyThis error indicates a .pdb file related failure. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-3.1.2-temp_64\libcrypto-3-x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2083486089.0000000002C25000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.SRT.x64.pdb] source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\Objects\MPlatform\x64\ReleasePX\MServer.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Unable to locate the .pdb file in this location source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libswresample\swresample-3.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2095719882.0000000002789000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3088799008.00007FFDF6652000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libswscale\swscale-5.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2099488639.0000000002815000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The module signature does not match with .pdb signature. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdb.dbg source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\FFMPEG_ORIG\libavutil\avutil-56.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2072268697.000000000281B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Device.AJA.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: or you do not have access permission to the .pdb location. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2076756563.0000000002702000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502OpenSSL 3.1.2 1 Aug 20233.1.2built on: Wed Aug 2 14:43:24 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lockcrypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8crypto\getenv.ccompiler: cl /Z7 /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D_USING_V110_SDK71_ -D_WINSOCK_DEPRECATED_NO_WARNINGS -D_WIN32_WINNT=0x0502;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: crypto\init.cOPENSSL_init_cryptoOPENSSL_atexitcrypto\initthread.ccrypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdupcrypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sepcrypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_paramossl_param_build_set_bn_padcrypto\param_build_set.ccopy_integercrypto\params.cunsigned_from_signedgeneral_get_intgeneral_set_intgeneral_get_uintgeneral_set_uintOSSL_PARAM_get_int32OSSL_PARAM_set_int32OSSL_PARA
Source: Binary string: E:\Work\cvsroot\MPlatform\trunk\MFormats\MFormats\x64\ReleasePX\Medialooks.Codecs.GPU.x64.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002702000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3090610938.00007FFDF774D000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\Users\Developer\Desktop\rtp\bin\x64\CrashSender1403.pdb source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002703000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SRTMiniServer.exe, 0000000F.00000002.3098379559.00007FFE0CFD9000.00000002.00000001.01000000.00000026.sdmp
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62D56D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,DefWindowProcW,RegisterClassW,CreateWindowExW,GetDC,ChoosePixelFormat,SetPixelFormat,GetProcAddress,??0QByteArray@@QEAA@PEBDH@Z,?indexOf@QByteArray@@QEBAHDH@Z,?indexOf@QByteArray@@QEBAHDH@Z,?mid@QByteArray@@QEBA?AV1@HH@Z,?toInt@QByteArray@@QEBAHPEA_NH@Z,??1QByteArray@@QEAA@XZ,?mid@QByteArray@@QEBA?AV1@HH@Z,?toInt@QByteArray@@QEBAHPEA_NH@Z,??1QByteArray@@QEAA@XZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,??1QByteArray@@QEAA@XZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,ReleaseDC,DestroyWindow,GetModuleHandleW,UnregisterClassW,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,15_2_00007FFDF62D56D0
Source: Qt5Core.dll.5.drStatic PE information: real checksum: 0x5ee5c3 should be: 0x5e576d
Source: WinSparkle.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x1ce621
Source: avdevice-58.dll0.5.drStatic PE information: real checksum: 0x0 should be: 0xc8541
Source: avfilter.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x50ec18
Source: swresample.dll.5.drStatic PE information: real checksum: 0x0 should be: 0xab5e2
Source: avfilter-7.dll0.5.drStatic PE information: real checksum: 0x0 should be: 0x50ec18
Source: avformat.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x37f3fa
Source: nsDialogs.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x10157
Source: avutil-56.dll0.5.drStatic PE information: real checksum: 0x0 should be: 0x17df01
Source: srt.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x26dee1
Source: avdevice.dll.5.drStatic PE information: real checksum: 0x0 should be: 0xc8541
Source: swresample-3.dll.5.drStatic PE information: real checksum: 0x0 should be: 0xab5e2
Source: CrashRpt1403.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x2514e
Source: System.dll.5.drStatic PE information: real checksum: 0x0 should be: 0xd8f8
Source: StartMenu.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x9ebb
Source: swscale.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x143af0
Source: avutil.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x17df01
Source: libcrypto-3-x64.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x5d2e33
Source: swscale-5.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x143af0
Source: libssl-1_1-x64.dll.5.drStatic PE information: real checksum: 0x0 should be: 0xaf896
Source: libcrypto-1_1-x64.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x33e8ec
Source: avformat-58.dll0.5.drStatic PE information: real checksum: 0x0 should be: 0x37f3fa
Source: Processing.NDI.Lib.x64.dll.5.drStatic PE information: section name: _RDATA
Source: avcodec-58.dll.5.drStatic PE information: section name: .rodata
Source: avcodec-58.dll.5.drStatic PE information: section name: .xdata
Source: qgenericbearer.dll.5.drStatic PE information: section name: .qtmetad
Source: qsvgicon.dll.5.drStatic PE information: section name: .qtmetad
Source: qgif.dll.5.drStatic PE information: section name: .qtmetad
Source: qicns.dll.5.drStatic PE information: section name: .qtmetad
Source: qico.dll.5.drStatic PE information: section name: .qtmetad
Source: qjpeg.dll.5.drStatic PE information: section name: .qtmetad
Source: avdevice-58.dll.5.drStatic PE information: section name: .xdata
Source: qsvg.dll.5.drStatic PE information: section name: .qtmetad
Source: avfilter-7.dll.5.drStatic PE information: section name: .xdata
Source: qtga.dll.5.drStatic PE information: section name: .qtmetad
Source: avformat-58.dll.5.drStatic PE information: section name: .rodata
Source: avformat-58.dll.5.drStatic PE information: section name: .xdata
Source: qtiff.dll.5.drStatic PE information: section name: .qtmetad
Source: avresample-4.dll.5.drStatic PE information: section name: .xdata
Source: avutil-56.dll.5.drStatic PE information: section name: .xdata
Source: ipp90legacy.dll.5.drStatic PE information: section name: IPPCODE
Source: ipp90legacy.dll.5.drStatic PE information: section name: IPPDATA
Source: libmfxsw64.dll.5.drStatic PE information: section name: IPPCODE
Source: libmfxsw64.dll.5.drStatic PE information: section name: IPPDATA
Source: qwbmp.dll.5.drStatic PE information: section name: .qtmetad
Source: qwebp.dll.5.drStatic PE information: section name: .qtmetad
Source: qwebp.dll.5.drStatic PE information: section name: _RDATA
Source: qwindows.dll.5.drStatic PE information: section name: .qtmetad
Source: qsqlite.dll.5.drStatic PE information: section name: .qtmetad
Source: avcodec-58.dll0.5.drStatic PE information: section name: _RDATA
Source: avcodec-58.dll0.5.drStatic PE information: section name: .00cfg
Source: avcodec.dll.5.drStatic PE information: section name: _RDATA
Source: avcodec.dll.5.drStatic PE information: section name: .00cfg
Source: avdevice-58.dll0.5.drStatic PE information: section name: .00cfg
Source: avdevice.dll.5.drStatic PE information: section name: .00cfg
Source: avfilter-7.dll0.5.drStatic PE information: section name: _RDATA
Source: avfilter-7.dll0.5.drStatic PE information: section name: .00cfg
Source: avfilter.dll.5.drStatic PE information: section name: _RDATA
Source: avfilter.dll.5.drStatic PE information: section name: .00cfg
Source: avformat-58.dll0.5.drStatic PE information: section name: .00cfg
Source: avformat.dll.5.drStatic PE information: section name: .00cfg
Source: avutil-56.dll0.5.drStatic PE information: section name: _RDATA
Source: avutil-56.dll0.5.drStatic PE information: section name: .00cfg
Source: avutil.dll.5.drStatic PE information: section name: _RDATA
Source: avutil.dll.5.drStatic PE information: section name: .00cfg
Source: libcrypto-1_1-x64.dll.5.drStatic PE information: section name: .00cfg
Source: libcrypto-3-x64.dll.5.drStatic PE information: section name: .00cfg
Source: libssl-1_1-x64.dll.5.drStatic PE information: section name: .00cfg
Source: msvcp140.dll.5.drStatic PE information: section name: .didat
Source: swresample-3.dll.5.drStatic PE information: section name: .00cfg
Source: swresample.dll.5.drStatic PE information: section name: .00cfg
Source: swscale-5.dll.5.drStatic PE information: section name: _RDATA
Source: swscale-5.dll.5.drStatic PE information: section name: .00cfg
Source: swscale.dll.5.drStatic PE information: section name: _RDATA
Source: swscale.dll.5.drStatic PE information: section name: .00cfg
Source: MLProxy.dll.5.drStatic PE information: section name: .orpc
Source: MLProxy.dll.5.drStatic PE information: section name: _RDATA
Source: MServer.exe.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Codecs.Core.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Codecs.Core.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Codecs.Core.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Codecs.FFM.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Codecs.FFM.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Codecs.FFM.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Codecs.GPU.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Codecs.GPU.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Codecs.SRT.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Codecs.SRT.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Codecs.SRT.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Device.AJA.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Device.AJA.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Device.AJA.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Device.BMD.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Device.BMD.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Device.BMD.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Device.DS.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Device.DS.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Device.DS.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Device.NDI.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Device.NDI.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Device.NDI.x64.dll.5.drStatic PE information: section name: _RDATA
Source: Medialooks.Device.SCR.x64.dll.5.drStatic PE information: section name: IPPCODE
Source: Medialooks.Device.SCR.x64.dll.5.drStatic PE information: section name: IPPDATA
Source: Medialooks.Device.SCR.x64.dll.5.drStatic PE information: section name: _RDATA
Source: swresample-3.dll0.5.drStatic PE information: section name: .xdata
Source: srt.dll.5.drStatic PE information: section name: .text entropy: 6.839813709825436
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Qt5Sql.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Qt5Core.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avcodec-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\avdevice-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\bearer\qgenericbearer.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\avresample-4.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qtiff.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Qt5Widgets.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Conference.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avformat.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.SRT.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avutil-56.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Runtime.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qico.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\SDIOutAddon.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Qt5Gui.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\MServer.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.NDI.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qwebp.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.BMD.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\CrashRpt1403.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\sqldrivers\qsqlite.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\msvcp140.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\iconengines\qsvgicon.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qwbmp.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\swscale-5.dllJump to dropped file
Source: C:\Windows\SysWOW64\wget.exeFile created: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qtga.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.Core.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avfilter.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.FFM.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Processing.NDI.Lib.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avdevice.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.DS.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\avformat-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\preview.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\msvcp120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\MLProxy.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qgif.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\libcrypto-1_1-x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\D3DCompiler_43.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Processing.NDI.Lib.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\ssleay32.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\avfilter-7.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\msvcrt.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\vcruntime140.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\StartMenu.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\msvcr120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\msvcp120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\CrashSender1403.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avcodec.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avfilter-7.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\swscale-5.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.SCR.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\swscale.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\msvcr120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\msvcrt.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\dbghelp.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\avcodec-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\libcrypto-3-x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\swresample-3.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Qt5Network.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\ipp90legacy.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.GPU.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avutil.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\swresample-3.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\libmfxsw64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\srt.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qicns.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\Qt5Svg.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qsvg.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFormats.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Plugin.Delay.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avformat-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\libssl-1_1-x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\glew32.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\vcruntime140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\platforms\qwindows.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFReader.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\imageformats\qjpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\WinSparkle.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.AJA.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\avutil-56.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\avdevice-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFWriter.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Program Files (x86)\SRTMiniServer\swresample.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SRTMiniServerJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SRTMiniServer\SRTMiniServer.lnkJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SRTMiniServer\Uninstall.lnkJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\avdevice-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\bearer\qgenericbearer.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\avresample-4.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qtiff.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\Conference.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\avformat.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.SRT.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Runtime.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qico.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\SDIOutAddon.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\MServer.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.NDI.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.BMD.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qwebp.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\sqldrivers\qsqlite.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\iconengines\qsvgicon.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qwbmp.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qtga.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.Core.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\avfilter.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.FFM.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\avdevice.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.DS.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\preview.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\msvcp120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\MLProxy.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\D3DCompiler_43.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qgif.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\libcrypto-1_1-x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\ssleay32.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\msvcr120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\StartMenu.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\msvcp120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\CrashSender1403.exeJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\avcodec.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.SCR.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\swscale.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\msvcr120.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\libcrypto-3-x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\ipp90legacy.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.GPU.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\avutil.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\libmfxsw64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qicns.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qsvg.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFormats.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Plugin.Delay.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\libssl-1_1-x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\glew32.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\platforms\qwindows.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFReader.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\WinSparkle.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\imageformats\qjpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.AJA.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFWriter.x64.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\avdevice-58.dllJump to dropped file
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeDropped PE file which has not been started: C:\Program Files (x86)\SRTMiniServer\swresample.dllJump to dropped file
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeAPI coverage: 9.1 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF629E400 GetKeyboardLayoutList followed by cmp: cmp eax, 31h and CTI: je 00007FFDF629E65Ch15_2_00007FFDF629E400
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile Volume queried: C:\Program Files (x86) FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile Volume queried: C:\Program Files (x86) FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: wget.exe, 00000002.00000002.1837350149.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3083716781.00000246C81CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
Source: SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2039719264.0000000002A8E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62D56D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,DefWindowProcW,RegisterClassW,CreateWindowExW,GetDC,ChoosePixelFormat,SetPixelFormat,GetProcAddress,??0QByteArray@@QEAA@PEBDH@Z,?indexOf@QByteArray@@QEBAHDH@Z,?indexOf@QByteArray@@QEBAHDH@Z,?mid@QByteArray@@QEBA?AV1@HH@Z,?toInt@QByteArray@@QEBAHPEA_NH@Z,??1QByteArray@@QEAA@XZ,?mid@QByteArray@@QEBA?AV1@HH@Z,?toInt@QByteArray@@QEBAHPEA_NH@Z,??1QByteArray@@QEAA@XZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,??1QByteArray@@QEAA@XZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,ReleaseDC,DestroyWindow,GetModuleHandleW,UnregisterClassW,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBAXPEBDZZ,15_2_00007FFDF62D56D0
Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D076860 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,15_2_00007FF60D076860
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\SRTMiniServer\post_install.cmd""Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" enable=yes profile=public,privateJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /im SRTMiniServer.exeJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://downloadsnew.garaninapps.com/srtminiserver_2.4.3_2024-02-26_install.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://downloadsnew.garaninapps.com/srtminiserver_2.4.3_2024-02-26_install.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://downloadsnew.garaninapps.com/srtminiserver_2.4.3_2024-02-26_install.exe" Jump to behavior
Source: C:\Windows\SysWOW64\wget.exeQueries volume information: C:\Users\user\Desktop\download VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\platforms\qwindows.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\styles\qwindowsvistastyle.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\WEB VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\WEB VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\iconengines\qsvgicon.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qgif.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qicns.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qico.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qjpeg.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qsvg.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qtga.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qtiff.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qwbmp.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\imageformats\qwebp.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Program Files (x86)\SRTMiniServer\bearer\qgenericbearer.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Modifies the windows firewall
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" enable=yes profile=public,private
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" enable=yes profile=public,private
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D016E60 ??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,WSAStartup,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,socket,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,inet_addr,bind,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,inet_addr,htons,15_2_00007FF60D016E60
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FF60D02C770 ?setTerminationEnabled@QThread@@KAX_N@Z,srt_create_socket,htons,inet_pton,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,srt_getlasterror_str,__acrt_iob_func,fprintf,srt_setsockopt,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,srt_getlasterror_str,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ,?data@QByteArray@@QEAAPEADXZ,srt_setsockopt,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,srt_getlasterror_str,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??1QByteArray@@QEAA@XZ,srt_listen_callback,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,srt_getlasterror_str,__acrt_iob_func,fprintf,srt_listen,srt_getlasterror_str,__acrt_iob_func,fprintf,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,srt_setsockopt,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,?shared_null@QListData@@2UData@1@B,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,srt_accept,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,srt_getpeername,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,??0QString@@QEAA@$$QEAV0@@Z,??1QString@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@AEBVQString@@@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,?parent@QObject@@QEBAPEAV1@XZ,srt_getsockflag,?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@AEBVQString@@@Z,??6QDebug@@QEAAAEAV0@H@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@H@Z,??1QDebug@@QEAA@XZ,?fromAscii_he15_2_00007FF60D02C770
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF62E1200 ??1QString@@QEAA@XZ,AddClipboardFormatListener,?qErrnoWarning@@YAXPEBDZZ,SetClipboardViewer,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBX@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@_N@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBX@Z,??1QDebug@@QEAA@XZ,15_2_00007FFDF62E1200
Source: C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exeCode function: 15_2_00007FFDF6721710 htons,htonl,??1QString@@QEAA@XZ,htons,setsockopt,bind,WSAGetLastError,htons,htonl,bind,WSAGetLastError,15_2_00007FFDF6721710

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Registry Run Keys / Startup Folder		11
Process Injection		2
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote Services11
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts12
Command and Scripting Interpreter		1
DLL Side-Loading		1
Registry Run Keys / Startup Folder		21
Disable or Modify Tools		LSASS Memory3
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Native API		Logon Script (Windows)1
DLL Side-Loading		11
Process Injection		Security Account Manager24
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
Software Packing		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1420288 URL: https://downloadsnew.garani... Startdate: 04/04/2024 Architecture: WINDOWS Score: 48 6 SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe 2 157 2->6         started        9 cmd.exe 2 2->9         started        file3 32 C:\Program Files (x86)\...\SRTMiniServer.exe, PE32+ 6->32 dropped 34 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 6->34 dropped 36 C:\Users\user\AppData\Local\...\System.dll, PE32 6->36 dropped 38 86 other files (none is malicious) 6->38 dropped 12 cmd.exe 1 6->12         started        14 taskkill.exe 1 6->14         started        16 SRTMiniServer.exe 17 6->16         started        42 Uses netsh to modify the Windows network and firewall settings 9->42 44 Modifies the windows firewall 9->44 18 wget.exe 2 9->18         started        22 conhost.exe 9->22         started        signatures4 process5 dnsIp6 24 netsh.exe 2 12->24         started        26 conhost.exe 12->26         started        28 conhost.exe 14->28         started        40 209.50.49.25 UPCLOUDUSAUS United States 18->40 30 SRTMiniServer_2.4....4-02-26_INSTALL.exe, PE32 18->30 dropped file7 process8

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe0%Avira URL Cloudsafe

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\SRTMiniServer\Conference.exe0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\CrashRpt1403.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\CrashSender1403.exe0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\D3DCompiler_43.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\MLProxy.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\MServer.exe0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.Core.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.FFM.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.GPU.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.SRT.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.AJA.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.BMD.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.DS.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.NDI.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.SCR.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFReader.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFWriter.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFormats.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Plugin.Delay.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Runtime.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\Processing.NDI.Lib.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\avcodec-58.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\avdevice-58.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\avfilter-7.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\avformat-58.dll2%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\avresample-4.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\avutil-56.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\d3dcompiler_47.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\glew32.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\ipp90legacy.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\libmfxsw64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\msvcp120.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\msvcr120.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\msvcrt.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\swresample-3.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\DLLs\swscale-5.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\Processing.NDI.Lib.x64.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\Qt5Core.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\Qt5Gui.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\Qt5Network.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\Qt5Sql.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\Qt5Svg.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\Qt5Widgets.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\SDIOutAddon.exe0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\WinSparkle.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avcodec-58.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avcodec.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avdevice-58.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avdevice.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avfilter-7.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avfilter.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avformat-58.dll2%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avformat.dll2%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avutil-56.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\avutil.dll0%ReversingLabs
C:\Program Files (x86)\SRTMiniServer\bearer\qgenericbearer.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://www.medialooks.com)D0%Avira URL Cloudsafe
http://ocsp.sectigo.com00%URL Reputationsafe
https://sectigo.com/CPS0D0%URL Reputationsafe
http://ns.useplus.org/ldf/xmp/1.0/0%URL Reputationsafe
https://sectigo.com/CPS00%URL Reputationsafe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/0%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t0%URL Reputationsafe
https://www.medialooks.com)0%Avira URL Cloudsafe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#0%URL Reputationsafe
http://dashif.org/guidelines/trickmode0%URL Reputationsafe
http://downloads.garaninapps.com/srtminiserver_win.jsonQMenuBar0%Avira URL Cloudsafe
https://www.medialooks.com)B0%Avira URL Cloudsafe
https://winsparkle.org).0%Avira URL Cloudsafe
http://www.andymatuschak.org/xml-namespaces/sparkle#shortVersionString0%Avira URL Cloudsafe
http://garaninapps.com/rtmpminiserver/help/testndi0%Avira URL Cloudsafe
http://core1.garaninapps.com/api/dns/reg2SHOW_DYNDNSERROR0%Avira URL Cloudsafe
http://www.andymatuschak.org/xml-namespaces/sparkle#releaseNotesLink0%Avira URL Cloudsafe
http://www.phreedom.org/md5)08:270%Avira URL Cloudsafe
http://video1.sdpv=0video2.sdptxvideo3.sdp1video4.sdpVIDaudio1.sdp2audio2.sdpVIDaudio3.sdp/audio4.sd0%Avira URL Cloudsafe
https://srtminiserver.com/help/stream_to_studio.html0%Avira URL Cloudsafe
http://www.andymatuschak.org/xml-namespaces/sparkle#os0%Avira URL Cloudsafe
http://www.andymatuschak.org/xml-namespaces/sparkle#installerArguments0%Avira URL Cloudsafe
https://srtminiserver.com/remoteslides/0%Avira URL Cloudsafe
http://core1.garaninapps.com/api/srtproxy/list0%Avira URL Cloudsafe
https://srtminiserver.com/help/larix_broadcaster_setup.html0%Avira URL Cloudsafe
https://srtminiserver.com/help/tv_guest.htmlStream0%Avira URL Cloudsafe
https://srtminiserver.com/trial-info/an0%Avira URL Cloudsafe
https://api.garaninapps.com/api/srt/get_numberapplication/x-www-form-urlencodedLinkGenerator/URLLink0%Avira URL Cloudsafe
https://srtminiserver.com/store.html0%Avira URL Cloudsafe
http://core1.garaninapps.com/api/dns/reg20%Avira URL Cloudsafe
http://www.smpte-ra.org/schemas/434/2006/multiplex/S377M/20040%Avira URL Cloudsafe
https://srtminiserver.com/trial-info/0%Avira URL Cloudsafe
http://www.smpte-ra.org/schemas/434/2006/properties/S335M0%Avira URL Cloudsafe
https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeCP0%Avira URL Cloudsafe
http://new.tk/ndisdk_license/0%Avira URL Cloudsafe
https://srtminiserver.com/help/syncbroadcaster_setup.html0%Avira URL Cloudsafe
https://svg-path-visualizer.netlify.app/0%Avira URL Cloudsafe
https://srtminiserver.com/help/larix_broadcaster_setup.htmlSyncBroadcaster0%Avira URL Cloudsafe
https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeOCESSORZP0%Avira URL Cloudsafe
https://garaninapps.com/sdioutaddonPlease0%Avira URL Cloudsafe
http://www.andymatuschak.org/xml-namespaces/sparkle#version0%Avira URL Cloudsafe
https://api.garaninapps.com/api/srt/get_number0%Avira URL Cloudsafe
https://srtminiserver.com/help/stream_to_studio.htmlLarixBroadcaster0%Avira URL Cloudsafe
http://www.phreedom.org/md5)0%Avira URL Cloudsafe
https://srtminiserver.com/help/proxy_addon.html0%Avira URL Cloudsafe
https://srtminiserver.com/help/custom_proxy_server.html0%Avira URL Cloudsafe
https://srtminiserver.com/help/settings_window.html0%Avira URL Cloudsafe
http://downloads.garaninapps.com/srtminiserver_win.json0%Avira URL Cloudsafe
https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeYP0%Avira URL Cloudsafe
http://www.smpte-ra.org/schemas/434/2006/groups/S380M/20040%Avira URL Cloudsafe
http://www.color.org)0%Avira URL Cloudsafe
http://www.smpte-ra.org/schemas/434/2006/types/S377M/20040%Avira URL Cloudsafe
http://keys3.garaninapps.comhttps://srtminiserver.com/trial-info/https://srtminiserver.com/store.htm0%Avira URL Cloudsafe
https://srtminiserver.com/helpStart1onStartTriggered()2clicked():PREVIEWPreview1onPreviewTriggered()0%Avira URL Cloudsafe
http://keys3.garaninapps.com/1340%Avira URL Cloudsafe
https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeVP0%Avira URL Cloudsafe
http://www.andymatuschak.org/xml-namespaces/sparkle#releaseNotesLinktitledescriptionlinkhttp://www.a0%Avira URL Cloudsafe
https://garaninapps.com/sdioutaddon0%Avira URL Cloudsafe
http://keys3.garaninapps.com0%Avira URL Cloudsafe
http://www.smpte-ra.org/schemas/434/2006/groups/S377M/20040%Avira URL Cloudsafe
https://srtminiserver.com/help/tv_guest.html0%Avira URL Cloudsafe
https://srtminiserver.com/help0%Avira URL Cloudsafe
https://srtminiserver.com/help/dynamic_dns.htmlselectedProxyServerautoconnect_proxytab_indexSTART_LI0%Avira URL Cloudsafe
http://https://%02d:%02d:%02d%ws%02d.%d%02d:%02d:%02d%ws%02d%s..%s(%ws)F%05XGUID_NULLcbuffer0%Avira URL Cloudsafe
https://srtminiserver.com/help/internet_connection_setup.html0%Avira URL Cloudsafe
http://www.andymatuschak.org/xml-namespaces/sparkle#minimumSystemVersion0%Avira URL Cloudsafe
https://srtminiserver.com/help/dynamic_dns.html0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.medialooks.com)DSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
low
http://downloads.garaninapps.com/srtminiserver_win.jsonQMenuBarSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.medialooks.com)SRTMiniServer.exefalse
  • Avira URL Cloud: safe
low
http://core1.garaninapps.com/api/dns/reg2SHOW_DYNDNSERRORSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.medialooks.com/extend_trialopenhttp://www.medialooks.com/cancel_trial_pDevChildSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    http://www.phreedom.org/md5)08:27SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://www.medialooks.com)BSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		low
    http://garaninapps.com/rtmpminiserver/help/testndiSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
    • Avira URL Cloud: safe
    		unknown
    http://ocsp.sectigo.com0wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.andymatuschak.org/xml-namespaces/sparkle#shortVersionStringSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.andymatuschak.org/xml-namespaces/sparkle#releaseNotesLinkSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.openssl.org/VSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2093942975.0000000002701000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://winsparkle.org).SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		low
      http://www.gimp.org/xmp/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        http://video1.sdpv=0video2.sdptxvideo3.sdp1video4.sdpVIDaudio1.sdp2audio2.sdpVIDaudio3.sdp/audio4.sdSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.000000000270C000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		low
        https://srtminiserver.com/help/stream_to_studio.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
        • Avira URL Cloud: safe
        		unknown
        http://www.andymatuschak.org/xml-namespaces/sparkle#osSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://www.andymatuschak.org/xml-namespaces/sparkle#installerArgumentsSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://code.google.com/p/crashrpt/wiki/FAQSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002703000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://core1.garaninapps.com/api/srtproxy/listSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
          • Avira URL Cloud: safe
          		unknown
          http://bugreports.qt.io/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
            		high
            https://srtminiserver.com/remoteslides/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
            • Avira URL Cloud: safe
            		unknown
            https://srtminiserver.com/trial-info/anSRTMiniServer.exe, 0000000F.00000002.3086551070.00000246CEAF0000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://srtminiserver.com/help/larix_broadcaster_setup.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
            • Avira URL Cloud: safe
            		unknown
            https://srtminiserver.com/help/tv_guest.htmlStreamSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://api.garaninapps.com/api/srt/get_numberapplication/x-www-form-urlencodedLinkGenerator/URLLinkSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://srtminiserver.com/store.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, SRTMiniServer.exe, 0000000F.00000002.3086551070.00000246CEAF0000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://crl.thawte.com/ThawteTimestampingCA.crl0SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://streams.videolan.org/upload/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2072268697.000000000281B000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://core1.garaninapps.com/api/dns/reg2SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                • Avira URL Cloud: safe
                		unknown
                http://www.smpte-ra.org/schemas/434/2006/multiplex/S377M/2004SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://srtminiserver.com/trial-info/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, SRTMiniServer.exe, 0000000F.00000002.3087743351.00000246CF05E000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://sectigo.com/CPS0DSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeCPwget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.smpte-ra.org/schemas/434/2006/properties/S335MSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://new.tk/ndisdk_license/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2004179942.000000000270C000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://srtminiserver.com/help/syncbroadcaster_setup.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                • Avira URL Cloud: safe
                		unknown
                https://srtminiserver.com/help/larix_broadcaster_setup.htmlSyncBroadcasterSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://svg-path-visualizer.netlify.app/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2100683220.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeOCESSORZPwget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://garaninapps.com/sdioutaddonPleaseSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.andymatuschak.org/xml-namespaces/sparkle#versionSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://api.garaninapps.com/api/srt/get_numberSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                • Avira URL Cloud: safe
                		unknown
                https://srtminiserver.com/help/stream_to_studio.htmlLarixBroadcasterSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://developers.google.com/chart/interactive/docs/reference#eventsSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2100683220.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://www.phreedom.org/md5)SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://srtminiserver.com/help/proxy_addon.htmlSRTMiniServer.exefalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://srtminiserver.com/help/custom_proxy_server.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ns.useplus.org/ldf/xmp/1.0/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://sectigo.com/CPS0wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://srtminiserver.com/help/settings_window.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.openssl.org/docs/faq.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://www.aiim.org/pdfa/ns/id/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3089926205.00007FFDF715F000.00000002.00000001.01000000.00000014.sdmpfalse
                      		high
                      http://iptc.org/std/Iptc4xmpExt/2008-02-29/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://ocsp.thawte.com0SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://downloads.garaninapps.com/srtminiserver_win.jsonSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeYPwget.exe, 00000002.00000002.1837268025.0000000000B75000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.smpte-ra.org/schemas/434/2006/types/S377M/2004SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsdSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2069234131.000000000297F000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://www.smpte-ra.org/schemas/434/2006/groups/S380M/2004SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exewget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://nsis.sf.net/NSIS_ErrorErrorSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000000.1859842351.0000000000409000.00000008.00000001.01000000.00000004.sdmpfalse
                            		high
                            https://srtminiserver.com/helpStart1onStartTriggered()2clicked():PREVIEWPreview1onPreviewTriggered()SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.color.org)SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exe, 0000000F.00000002.3089926205.00007FFDF715F000.00000002.00000001.01000000.00000014.sdmpfalse
                            • Avira URL Cloud: safe
                            		low
                            http://keys3.garaninapps.comhttps://srtminiserver.com/trial-info/https://srtminiserver.com/store.htmSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0twget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://keys3.garaninapps.com/134SRTMiniServer.exe, 0000000F.00000002.3087743351.00000246CF05E000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exeVPwget.exe, 00000002.00000002.1837268025.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.1837268025.0000000000B70000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://bugreports.qt.io/_q_receiveReplyMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogiSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://www.andymatuschak.org/xml-namespaces/sparkle#releaseNotesLinktitledescriptionlinkhttp://www.aSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://nsis.sf.net/NSIS_ErrorSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000000.1859842351.0000000000409000.00000008.00000001.01000000.00000004.sdmpfalse
                                		high
                                https://www.thawte.com/cps0/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://keys3.garaninapps.comSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://www.medialooks.com/contacts/label_namecategory_namepurchase_msgcancelGSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#wget.exe, 00000002.00000003.1812369594.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1812369594.0000000002BA6000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2133607089.0000000002A90000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2090431197.0000000002708000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002811000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2125942295.000000000270E000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2024132479.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1965575570.000000000270A000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2106395467.000000000270B000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2111448679.0000000002707000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2105630700.0000000002709000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://garaninapps.com/sdioutaddonSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://www.thawte.com/repository0WSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2010370107.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2023152263.0000000002BF8000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2014895414.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2018647689.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2016813506.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2017647324.000000000270A000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://srtminiserver.com/help/tv_guest.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://www.openssl.org/HSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2079638186.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2083486089.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2084811984.0000000002772000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://dashif.org/guidelines/trickmodeSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2069234131.000000000297F000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.smpte-ra.org/schemas/434/2006/groups/S377M/2004SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2120328314.000000000270D000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://srtminiserver.com/helpSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.winimage.com/zLibDllSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.1971396155.0000000002703000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://srtminiserver.com/help/dynamic_dns.htmlselectedProxyServerautoconnect_proxytab_indexSTART_LISRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://https://%02d:%02d:%02d%ws%02d.%d%02d:%02d:%02d%ws%02d%s..%s(%ws)F%05XGUID_NULLcbufferSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2122731031.0000000002700000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          http://www.andymatuschak.org/xml-namespaces/sparkle#minimumSystemVersionSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2029047588.000000000270B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://srtminiserver.com/help/internet_connection_setup.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://srtminiserver.com/help/dynamic_dns.htmlSRTMiniServer_2.4.3_2024-02-26_INSTALL.exe, 00000005.00000003.2026527391.0000000002704000.00000004.00000020.00020000.00000000.sdmp, SRTMiniServer.exefalse
                                          • Avira URL Cloud: safe
                                          		unknown

                                          World Map of Contacted IPs

                                          • No. of IPs < 25%
                                          • 25% < No. of IPs < 50%
                                          • 50% < No. of IPs < 75%
                                          • 75% < No. of IPs

                                          Public IPs

                                          IPDomainCountryFlagASNASN NameMalicious
                                          209.50.49.25
                                          		unknownUnited States
                                          		25697UPCLOUDUSAUSfalse

                                          General Information

                                          Joe Sandbox version:40.0.0 Tourmaline
                                          Analysis ID:1420288
                                          Start date and time:2024-04-04 17:25:03 +02:00
                                          Joe Sandbox product:CloudBasic
                                          Overall analysis duration:0h 10m 20s
                                          Hypervisor based Inspection enabled:false
                                          Report type:full
                                          Cookbook file name:urldownload.jbs
                                          Sample URL:https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                          Number of analysed new started processes analysed:18
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • HCA enabled
                                          • EGA enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Analysis stop reason:Timeout
                                          Detection:MAL
                                          Classification:mal48.evad.win@16/116@0/1
                                          EGA Information:
                                          • Successful, ratio: 100%
                                          HCA Information:Failed

                                          Warnings

                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                          • Not all processes where analyzed, report is missing behavior information
                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                          • Skipping network analysis since amount of network traffic is too extensive
                                          • VT rate limit hit for: https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe

                                          Simulations

                                          Behavior and APIs

                                          TimeTypeDescription
                                          17:27:14API Interceptor6x Sleep call for process: SRTMiniServer.exe modified

                                          Joe Sandbox View / Context

                                          IPs

                                          ⊘No context

                                          Domains

                                          ⊘No context

                                          ASNs

                                          ⊘No context

                                          JA3 Fingerprints

                                          ⊘No context

                                          Dropped Files

                                          ⊘No context

                                          Created / dropped Files

                                          C:\Program Files (x86)\SRTMiniServer\Conference.exe

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):290432
                                          Entropy (8bit):6.67247427858707
                                          Encrypted:false
                                          SSDEEP:6144:y7+a9NFU8wuNC43sIajsKd6EYsF8ylLRJq8dXpREDzLX6bJVedq0BzEvA5GwjuzG:da9NK2bajsKd6EYsF8ylLRJq8dXpRou6
                                          MD5:821F1AA194A78D454B3B6221F9C1F9D3
                                          SHA1:50D08CE417E58DD80BD553B6A12491FACE8B63FE
                                          SHA-256:9C5FFF537463564AA27B1E24020B63B13B4A4196B08ADC2E7D905BC428D37D5C
                                          SHA-512:E0FF4342E23804879A138EF185469DFBE48E1AD7DC3A67FAC7500CBEF2C2F14307211DA46693B64FF05C686A4697F720E295BBB596298913545A682AD4445198
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.................w......w......w......w......i......i....................`.........c..........8......8......Rich............PE..d...!{)c.........."......X..........<E.........@.............................p.......*....`.................................................`v...............P..$....F...(...`...... #..T....................$..(....#...............p..@............................text....V.......X.................. ..`.rdata..B....p.......\..............@..@.data........0......................@....pdata..$....P.......(..............@..@.reloc.......`.......8..............@..B........................................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Conference.exe.manifest

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):30761
                                          Entropy (8bit):5.519495101310609
                                          Encrypted:false
                                          SSDEEP:384:OXgPzDHtlM8M2/MD3yXfTBEt87etgXaW8ssvE1cGB0kPE1jyydPTYH0cSaSuiHNC:ZtMr6yb/6pM1jyyxYJSuitC
                                          MD5:C4150E31D589604C6ABD0F1359637007
                                          SHA1:182380BA6AFD2D39FE4504BE4A1F7834820FD06B
                                          SHA-256:EC985BF8231448EB9272112BC25929A1C4A0E1041D6B6C200732F5F20E246FC5
                                          SHA-512:164C7A5BA53BB01DD2C8209D372C34B5A853B72E5D5B8952F3825EB4C8C3F24F0D16849C4DEDA81851846AEF35C9ECE3E4947F55AA1FCAA1ED1BD580C9AB254A
                                          Malicious:false
                                          Reputation:low
                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">.. <file name="DLLs\Medialooks.Codecs.Core.x64.dll">.. <comClass clsid="{96EB1C14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitter Class" threadingModel="free"/>.. <comClass clsid="{96EB1C64-4CC0-4830-9CC3-F064196B2626}" description="MFDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1C74-4CC0-4830-9CC3-F064196B2626}" description="MFMuxer Class" threadingModel="free"/>.. <comClass clsid="{96EB1C94-4CC0-4830-9CC3-F064196B2626}" description="MFEncoder Class" threadingModel="free"/>.. </file>.. <file name="DLLs\Medialooks.Codecs.FFM.x64.dll">.. <comClass clsid="{9285699B-E779-4B2E-92CA-26DDEE01AA2A}" description="MFCaptionsDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1F14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitterFFM Class" threadin

                                          C:\Program Files (x86)\SRTMiniServer\CrashRpt1403.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):138240
                                          Entropy (8bit):5.615855915083794
                                          Encrypted:false
                                          SSDEEP:3072:3SBBmBH2vHO7GNtUdUOiNvTrr4lK1MaPaX:CBBmwPNolK1t
                                          MD5:E7F78CA310050942951A226F558D9B8C
                                          SHA1:728867AF983911B2A7864F3AC6B8BA325DC82AF3
                                          SHA-256:2DEBEF10B5FC4AD348136132672A7C4AA27BACF57B662B0C6B390FD20758714A
                                          SHA-512:F57542ADD262DBB6A654DD7C14C9EE1D59562D50AEF87362F57D06F38A61F54703B748581BB4A52ACA00C096E8C003A611B955FD2D4B6AC16C8CD2A922474A49
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................R............................................C..................>.......V............Rich............PE..d....}.a.........." ................p........................................`............`.........................................`...t.......|....@...........#...........P..x.......T...........................p...8...............0............................text............................... ..`.rdata...W.......X..................@..@.data...p...........................@....pdata...#.......$..................@..@.rsrc........@......................@..@.reloc..x....P......................@..B................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\CrashRpt1403.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):6034
                                          Entropy (8bit):4.896233453488442
                                          Encrypted:false
                                          SSDEEP:96:GFoabriAa5w0FNl3LKLXLKjLKQXVwfI0dXL:go+iAdWkUVL0dXL
                                          MD5:1418EC77BED9C051146DCAA8049EE149
                                          SHA1:4C5D1C22E65E09FBBBCBECB4FAFFEE9393AB16DC
                                          SHA-256:C5B1AEAFE74073B4283AF663EC1B06DFB57FD07CBC28D36FBC5392BD825308DD
                                          SHA-512:19475CFA37A956C4CC79A4DB50CD031C5182E8401CF986A53E31B0CE49002E22452DD476F2A96C0954A710C239C5C3B82B82A88AABD53ABAC475BE0012012730
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ -1 0 1090 `....-...\...........N...N...f...f...................................:...:..........................................."..."...........~...~...d...d...........D...D...........0...0........__IMPORT_DESCRIPTOR_CrashRpt1403.__NULL_IMPORT_DESCRIPTOR..CrashRpt1403_NULL_THUNK_DATA.__imp_crInstallW.crInstallW.__imp_crInstallA.crInstallA.__imp_crUninstall.crUninstall.__imp_crInstallToCurrentThread2.crInstallToCurrentThread2.__imp_crUninstallFromCurrentThread.crUninstallFromCurrentThread.__imp_crAddFile2W.crAddFile2W.__imp_crAddFile2A.crAddFile2A.__imp_crAddScreenshot.crAddScreenshot.__imp_crAddPropertyW.crAddPropertyW.__imp_crAddPropertyA.crAddPropertyA.__imp_crGenerateErrorReport.crGenerateErrorReport.__imp_crExceptionFilter.crExceptionFilter.__imp_crEmulateCrash.crEmulateCrash.__imp_crGetLastErrorMsgW.crGetLastErrorMsgW.__imp_crGetLastErrorMsgA.crGetLastErrorMsgA.__imp_crAddRegKeyW.crAddRegKeyW.__imp_crAddRegKeyA.crAddRegKeyA.__

                                          C:\Program Files (x86)\SRTMiniServer\CrashSender1403.exe

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1128576
                                          Entropy (8bit):6.467454234098882
                                          Encrypted:false
                                          SSDEEP:24576:nvaVYZzumcdTPfE/sfejV9A/g4n/9f4IjT9Y0UF:nvaSPcdTP8/sfK9Gg0/9f42Tg
                                          MD5:2A7E1CE296153DEF6C9559F38E002C6C
                                          SHA1:DD0B50770594217DFF3B25219C34135A022C576E
                                          SHA-256:3DA0CE43355E4599B6FD8D755BF5658267FBB1E36B60AD8C3D67C6EBF37E7443
                                          SHA-512:919D070DCC835B988E7C2984DC094268676C18F4DF3C75D84C6A63E8751C9F9FCC7FAE821294FBA7BB50B19DB4A7FFE30C53E51A333687C3D0D8641267914F87
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Feo_Feo_Feo_O.._Peo_ .._Geo_..k^Leo_..l^Beo_..n^@eo_..j^beo_R.k^Geo_R.n^Yeo_Fen_.do_..g^&eo_..j^Reo_..._Geo_Fe._Geo_..m^Geo_RichFeo_................PE..d....%.a.........."......\..........H..........@.............................@.......|....`.....................................................X.......0....0..tm.......(...0......`...T...............................8............p..0............................text...@[.......\.................. ..`.rdata.......p.......`..............@..@.data...(...........................@....pdata..tm...0...n..................@..@.rsrc...0............x..............@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\D3DCompiler_43.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):2526056
                                          Entropy (8bit):6.326395907728081
                                          Encrypted:false
                                          SSDEEP:49152:zf59zPxKcvHzDB6t3+C0/aJfyLg7Ie4Xy+5j4m2CTB:M2642o7lftd
                                          MD5:ADA0C39D4EACDC81FD84163A95D62079
                                          SHA1:207321F1B449985B2D06ED50B989FA6259E4EB8E
                                          SHA-256:44C3A7E330B54A35A9EFA015831392593AA02E7DA1460BE429D17C3644850E8A
                                          SHA-512:1AFC63DB5D2030B76ABC19094FC9FEF28CC6250BD265294647E65DB81F13749C867722924460F7A6021C739F4057F95501F0322CDEC28A2101BF94164557A1A5
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L..^L..^L..^..X^N..^..m^]..^L..^..^..Z^K..^..l^w..^..]^M..^..i^>..^kz.^M..^..\^M..^..[^M..^RichL..^........................PE..d......K.........." ......$.........\.#.......................................&.......&...@...........................................%.......$.P.....&.......%......t&.h.....&..0...................................................................................text.....$.......$................. ..`.data...X.....%..V....$.............@....pdata........%......T%.............@..@.rsrc.........&......(&.............@..@.reloc..0G....&..H...,&.............@..B........................................................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\MLProxy.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):546136
                                          Entropy (8bit):6.422852728483225
                                          Encrypted:false
                                          SSDEEP:6144:OPrw4l4zkHK5NnXD9lJ/dhm2JBnDvkjk0x5orErO5DUVlV6A8fLXeZN:9Lh5NnXD9lJ/dhm2JBnDFIrEqMHiZN
                                          MD5:AB8359DED125108AE09DACE8BF9C7DF8
                                          SHA1:3E730FB798F3224308CBDA122B41E3A09AE9ADDA
                                          SHA-256:40901BC4F2C07B18C4BDF5B308A4845A1C4D7B1FC65FEB796BF4EA08A8DBD4DB
                                          SHA-512:29F2D54B54B1F28545EBAA95144A6583EA6A75231FAE95BD88067CCE1B0C76D5E94C67EADBD581B9AE93F0FF8AF54FFFC9F04BF50C85409121DB0DBAF9EBCAFA
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........d.r.7.r.7.r.7...6.r.7...6.r.7...6gr.7...6.r.7...6.r.7..;7.r.7...6.r.7..?7.r.7../7.r.7.r.7~r.77..6.r.77..6.r.77..6.r.77.C7.r.7.r+7.r.77..6.r.7Rich.r.7................PE..d...Z.Mb.........." .........N.......$....................................................`......................................... ...............p..h.......DU...2..X#......@...8,..T............................,..8...............(............................text...\........................... ..`.orpc............................... ..`.rdata.............................@..@.data....1..........................@....pdata..DU.......V..................@..@_RDATA.......`......................@..@.rsrc...h....p......................@..@.reloc..@............&..............@..B........................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\MServer.exe

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):227672
                                          Entropy (8bit):6.049473469907997
                                          Encrypted:false
                                          SSDEEP:3072:FY12aXKCdRRguv1tRgde74B6LPBx6UpvOppenimUeTNppja72P:oRKK9dtR7VLOojUUNppfP
                                          MD5:D49B210D8D11C47B85D2C5A15172B1C4
                                          SHA1:9999AAE98AD5E41B20456CB9AD8CAE8948E1CB1E
                                          SHA-256:845803E40C06A9B147D7D148B255DB8FAF04BFD4456F11B1D266D03A9801FB23
                                          SHA-512:7A856D3F382EF5000EF209DBE18370A4B9B4BC44628220DB64D0DB573869997ABA931776F3EBB10226E146E2E39C75FEFF8B9FD076C0DBE26269D65E0E1333AF
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................$......................6.....&.......)...y......y.J....."....y......Rich............PE..d...b.Mb.........."............................@....................................S.....`.................................................(c..x.......X............V..X#..........pC..p....................E..(....C..8............................................text.............................. ..`.rdata..............................@..@.data........p.......^..............@....pdata...............j..............@..@_RDATA..............................@..@.rsrc...X...........................@..@.reloc...............N..............@..B................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\MServer.exe.manifest

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):30610
                                          Entropy (8bit):5.5077760140436824
                                          Encrypted:false
                                          SSDEEP:384:OyZ8MvOkHZeUXbcZud1jyyAYH0cSaSuiHN5w:fuMGgZeUrCw1jyyAYJSuitC
                                          MD5:E0BD3550BF8DD8001CD490FE7123339B
                                          SHA1:4693963B3F438164185DCE33640DA6F1BA6A426E
                                          SHA-256:56FAD2263B546D0334A9B40AF81CD715815A6D34752E2542B982A1CC6B855BCC
                                          SHA-512:B4758ADF25CF12368228CC2DFE0133772A6D32766D352C2196C999E0A645035746220A82BC641585B5DDBD3AB998F2A5AA1545E1FA7EEC6DA1D331A8B38C5AF1
                                          Malicious:false
                                          Reputation:low
                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">.. <file name="Medialooks.Codecs.Core.x64.dll">.. <comClass clsid="{96EB1C14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitter Class" threadingModel="free"/>.. <comClass clsid="{96EB1C64-4CC0-4830-9CC3-F064196B2626}" description="MFDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1C74-4CC0-4830-9CC3-F064196B2626}" description="MFMuxer Class" threadingModel="free"/>.. <comClass clsid="{96EB1C94-4CC0-4830-9CC3-F064196B2626}" description="MFEncoder Class" threadingModel="free"/>.. </file>.. <file name="Medialooks.Codecs.FFM.x64.dll">.. <comClass clsid="{9285699B-E779-4B2E-92CA-26DDEE01AA2A}" description="MFCaptionsDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1F14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitterFFM Class" threadingModel="fr

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.Core.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):7054192
                                          Entropy (8bit):6.631499214368884
                                          Encrypted:false
                                          SSDEEP:49152:RkEJXQYYu1PfIUQeOU82StGhN9fn87/0/uh8VxoeYKSmrKE6b6yFYoYUvqCmi9QK:fIUQyEIv4O6zQaYFvVZVdlu073DHU
                                          MD5:7438DE4D788419B876E91FA782E9F011
                                          SHA1:D257E5E3D6621AB8AA62F9200169C58BB7229056
                                          SHA-256:C30470526FC0F4962A7946B4600414C2A9E617780CEF51E6DBCDE8E1437757BA
                                          SHA-512:0EC04757820EDF96923B134AA18297784EFBEA866BA9FA35B68D7DB85AA1C95D5F6BEDEC6DB236ED955ADC6F61203590783A78D88084DDF8D5ED231AF529E4C7
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$...........S..S..S..G.._..G..]..G.......Z.Q..?..\..?..Z..Z.A.R..S......?.....?..|..Z.E.V..Z.U.@..S........W.....R....9.R..S.Q.R.....R..RichS..........PE..d...'.Mb.........." .....rY.........$5T.......................................k.....K.k...`...........................................b.......b......@f.x~....c.......k.p#....k.X...`&`.T....................(`.(....&`.8.............Y..............................text...4.V.......V................. ..`IPPCODE.......V.......V............. ..`.rdata...|....Y..~...vY.............@..@.data...$o....c..V....b.............@....pdata........c......Jc.............@..@IPPDATA......`e.......e.............@..._RDATA.......0f.......e.............@..@.rsrc...x~...@f.......e.............@..@.reloc..X.....k......bk.............@..B........................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.FFM.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):14270320
                                          Entropy (8bit):6.726898743089476
                                          Encrypted:false
                                          SSDEEP:98304:v2W2+MACgshC5nIfugOQ77zuAdjU6loYcVigmXrXf9a/Xt:CoshC5/gOQ77zxdXtNrXla/Xt
                                          MD5:A1C12542A82E786C0F5DD20A845DAA2B
                                          SHA1:085BAD716F98FBA1B199935215B361846FE8459F
                                          SHA-256:43744509C9AD421F2ABF4B06AAA0F0CDDD926024FE2454F0641C5595A52C2351
                                          SHA-512:E9B330D7D0B2A4D53D731983AF1E211EE4710F9C9FE6E17826F622C451D8185337C586C44AF52B26F5468EC6012AF662E47FE2E01B34F997AE9CA67C0C2E3E86
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........T..:L.:L.:L..>M.:L..9M.:L..?Mo.:L...L.:L..>M..:L..9M.:L..;M.:L.:L..:L.~.L..:L..?M..:L..L.:L..L.:L.;L.:L..9M.:L..?M.:L..:M.:L...L.:L..L.:L..8M.:LRich.:L........PE..d...0.Mb.........." ..........-..............................................@......p.....`....................................................T.......................p#.......J......T.......................(.......8............ ...............................text...D[.......\.................. ..`IPPCODE.-....p.......`.............. ..`.rdata....'.. ....'.................@..@.data...L...........................@....pdata...............J..............@..@IPPDATA.p........ ..................@..._RDATA...............>..............@..@.rsrc................@..............@..@.reloc...J.......L...P..............@..B................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.GPU.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):2504048
                                          Entropy (8bit):6.224157622012352
                                          Encrypted:false
                                          SSDEEP:49152:AYMqm/fKAv/opjam9wATSR+z2WZ6GLXMSlx:4jv9R+Xz
                                          MD5:8C457D8534E66C6A6492BAB7683C16AC
                                          SHA1:6C6E908CFD9735708B730BB93B3861D3935DD00E
                                          SHA-256:280DA97D4FD1C090C84C2F8128E949E430BCB9AA33A6CD0B505D3511C594B061
                                          SHA-512:6CF4732593DFA6F385E790E3C1A94734DB46177CA3A80C6EA013F1CD10680A1D086884956C76FBE3696F0D5D7613F95F8725C6914A92F9A103122F82DB0AF047
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........e`....F...F...F.o.G...F.o.G...F.o.GO..F.l.G...F/V.F...F.o.G...F...F...F...F...F.k.F...F.p.G...F.p.G...F.p.G...F.|.F...F.|.F...F...F...F+p.G...F+p.G...F+p.G...F+p.F...F...F...F+p.G...FRich...F........PE..d...+.Mb.........." ................t.........................................&......<&...`.........................................0.".......".@....P%. .....#.......&.p#...`&.t#...! .T....................# .(...0" .8............0..0............................text...(........................... ..`IPPCODE.]........ .................. ..`.rdata.......0......................@..@.data...L.....#..`....".............@....pdata........#......@#.............@..@_RDATA.......@%.......$.............@..@.rsrc... ....P%.......$.............@..@.reloc..t#...`&..$....%.............@..B........................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Codecs.SRT.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):4066160
                                          Entropy (8bit):6.3926179861702614
                                          Encrypted:false
                                          SSDEEP:49152:yo6Ba4A9YMjxSKJTiXH8AugQcLxS944LRodKFvYKpt9FqysYv7QYs1qPninWeL1s:qomtxdood3K9j+giHs
                                          MD5:E6522B81A70691930BDD03AB212EB8A2
                                          SHA1:1CA614DC47843A9A2B21DB6CBCA38A7788F2AEF1
                                          SHA-256:0FD015ED4BEDCDABC42A0EBA70E586731C645803D1657D6FAD763A6C91DFAAC9
                                          SHA-512:999CC03B3ACA911919D93DF9A3F8C51016B3689BCD082527A8403AB0E59C3ECC1B9E8D3BF4691FA79EFAD2CD3AB5BC59A9DCFEDA7363A889A7B3531B0916DCE8
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......9%..}Dd.}Dd.}Dd.i/`.iDd.i/g.pDd.i/a..Dd..0l.HDd..%`..Ed..-`.vDd..-a.nDd.}Dd.kDd.'...eDd..0`.rDd..0g.wDd..0a.+Dd.t<.xDd.t<..hDd.}De.gEd..0g.|Dd..0a.uDd..0d.|Dd..0..|Dd.}D.|Dd..0f.|Dd.Rich}Dd.........................PE..d...(.Mb.........." .....>+.........xz........................................>......f>...`.........................................`&9.....$D9.......>.H`....:.L.....=.p#...p>. f...Y4.T....................[4.(....Y4.8............`+. ............................text...|.*.......*................. ..`IPPCODE.-.....*.......*............. ..`.rdata.......`+......B+.............@..@.data...Ps...p9......D9.............@....pdata..L.....:......8:.............@..@IPPDATA.......=.......=.............@..._RDATA........=.......=.............@..@.rsrc...H`....>..b....=.............@..@.reloc.. f...p>..h....=.............@..B................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.AJA.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):13284208
                                          Entropy (8bit):6.727606571603292
                                          Encrypted:false
                                          SSDEEP:98304:s2t33uN95/mY9ObFT1OQVuivpKWSxUUdnHVqcoMdQzhK77Idg/HU9:HEZEl1OQVuGpCaUGzw77Idgvm
                                          MD5:600646B41E513458C0527A63A8320EBF
                                          SHA1:FD1585DE29C5E8AB94772DCD7BDC4465A48F122E
                                          SHA-256:13B05B872058A7C23DE1A9665644068B2C779CB72E5069C5B609960FFB9BDA1C
                                          SHA-512:DBC3BF3BA48D339C04AA0E8F586341645B69594283E6E4FD7CA6E35D90F541D325A58723F2C63F8EE9E505F896B54A77CBEFE2193CA424C1674FE7949E864DCB
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........<...].X.].X.].X.6.Y.].X.6.Y"].X.2CX.].X.).Y.].X.).Y.].X4.uX.].Xp/.Y.].XL4.Y.].X..sX.].X.].X*Q.X.).Y.].X.6.Y.].X.6.Y.].X.].X.\.X?).Y.].X?).Y.].X?).Y.].X?)AX.].X.])X.].X?).Y.].XRich.].X........................PE..d....Mb.........." ..........9......Vz.............................................j(....`.........................................@....... ...........<....p...k......p#.......g..|[..T....................]..(....[..8............................................text............................... ..`IPPCODE.=........................... ..`.rdata...[0......\0.................@..@.data....*...@......................@....pdata...k...p...l..................@..@IPPDATA.@...........................@..._RDATA..............................@..@.rsrc...<...........................@..@.reloc...g.......h...(..............@..B........................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.BMD.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):21487984
                                          Entropy (8bit):6.725517729659603
                                          Encrypted:false
                                          SSDEEP:196608:JfVIUQwVLazu8NV3UuQ4DTaMytyUH9dK6WjOQ+S7MimIf7OjBn:fIUQw2V3x6MmIjM
                                          MD5:759B27BD8A63ADF60555B46DC9B0519F
                                          SHA1:28E87196352D27E6F15578E7D164FBCAB785A61B
                                          SHA-256:34B8C8875171B815FBB59D13A5C29496674850BBFAD79654296D7866D428AE1C
                                          SHA-512:0995BF5931ACF055517B0354E18D93F87F094CED587B7613494B507F0D5E740C5908891E8B3F771C0837FC9D71DCB7A4E17678ACE5BE3CA5CFBC50FD03F21000
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......n..u*..&*..&*..&>.'$..&>.' ..&>.'...&F.'%..&F.'#..&^.'(..&*..&...&pa~&...&F.'...&#.0&/..&#. &9..&*..&...&..'+..&..',..&..'+..&..L&+..&*.$&+..&..'+..&Rich*..&................PE..d....Mb.........." .....*....3.....d........................................@H......~H...`.........................................P.B.......B.......G.X....`C.."....G.p#....G..E....:.T.....................:.(.....:.8............P...............................text...l'.......(.................. ..`IPPCODE."....@.......,.............. ..`.rdata...d...P...f..................@..@.data.........B.......B.............@....pdata..."...`C..$....C.............@..@IPPDATA.p(....G..*...:G.............@..._RDATA........G......dG.............@..@.rsrc...X.....G......fG.............@..@.reloc...E....G..F...xG.............@..B................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.DS.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):22927728
                                          Entropy (8bit):6.683714700524515
                                          Encrypted:false
                                          SSDEEP:196608:IfgIUQW0ZLS6VtuUDfsZDyayUHqo/HEFNOQT5xcXInBk:HIUQHV+HrYnB
                                          MD5:2E4C105A2473B4CA80762498FB041B74
                                          SHA1:CA290D97C1BA12733B741A96F6866ABAAE87C651
                                          SHA-256:3303AB55745473F143FE1675DB32EA65707D671AB3D8F880E1D83D89BB20E686
                                          SHA-512:9ABFC78BE4254D81C70AC7A417F2B0EDDD7608C3D300FD283D6B7E8891FB7102C9261416D4346E57636919B8AB430927E91E7052DB61624D1FAD6AFC4BAB6324
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......ON.../../../..D../..D../..D../..WY../..}M../.g[../.g[../..D../.Q......./..4.g[.:/..WR../..WB../../../..[../..[../..[../..[.../../F../..[../.Rich./.........................PE..d....Mb.........." ......#...9.....\C.......................................0^......^...`.........................................0VW......VW.......].X....pX.T.....].p#....]..]....N.T.....................N.(...`.N.8............ $..............................text............................... ..`IPPCODE............................. ..`.rdata...P3.. $..R3...#.............@..@.data...$.....W......PW.............@....pdata..T....pX.......X.............@..@IPPDATA.0)...p]..*....].............@..._RDATA........]......>].............@..@.rsrc...X.....]......@].............@..@.reloc...]....]..^...X].............@..B........................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.NDI.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):9675632
                                          Entropy (8bit):6.705660584110193
                                          Encrypted:false
                                          SSDEEP:98304:dCYiQvgZdOnOjkOQVs/Y+28zP9sTIK3XUAR0:oVLvkOQVsA+dP9ssK3XUAR0
                                          MD5:0EE566DE084986A188C1C0849B720195
                                          SHA1:63165BE7B637AD6B43FF03EFEAB85DF850F48E1F
                                          SHA-256:A66DA973F9DE3953CEF4EDF525B342D3B91582600700B84E356ED0BF0834F7BE
                                          SHA-512:B0573314205DCC163CB5CC2B91ECCA3F8418EC74C3529887B1C22B8AD7BB4CF433CEDFEAAC3440EE720803F0A066F66A2BF4C1C48D5F6394DEE616BFF2C64175
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......[d...............n.......n.......n......sq......sq.......q......E.7.............sq../....}y......}i..............q.......q.......q.......q........m......q......Rich....................PE..d....Mb.........." .....<j..@).....,.X............................................2....`.........................................p?......<@..........h........z......p#.......6..P...T.......................(.......8............`j..............................text... (Z......*Z................. ..`IPPCODE.}....@Z.......Z............. ..`.rdata....&..`j...&..@j.............@..@.data...tu...`...`...<..............@....pdata...z.......|..................@..@IPPDATA.@....`......................@..._RDATA...............4..............@..@.rsrc...h............6..............@..@.reloc...6.......8...H..............@..B................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Device.SCR.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):14327664
                                          Entropy (8bit):6.681344736513694
                                          Encrypted:false
                                          SSDEEP:98304:0IUQJpxIAlD4dAK09V//yVpblWsfTkm4D/7kOQSgX/CWqBwSK5V:0IUQJbIQVI7k9PkOQSwqWAK3
                                          MD5:B43CFC6D323FF34BE2BA692D5037C076
                                          SHA1:96AF5A2448DD024E29911BD6F9371C5A81E8869E
                                          SHA-256:25FC2C8D9BA7EE70F11D07D73DE416E90619235E5B4DE70FBDB634AB5FC22CD3
                                          SHA-512:D80FEF1B4383934950B3083D12096D9262BB5BDB30E7B4B054FFD99D9F16BCB7AA252C2EF0B3DACECB4BB063560F8521FBF91FFD1B25EAA73E8611E754D21C52
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......I.s4...g...g...g...f...g...f...g...f...ga..f...ga..f...g..g...gW|.g%..g...g...g.F.g...ga..f8..g.F.g...g.F.g...g.F.g...g...g...g...f...g...f...g...f...g...f...g...g...g...g...g...f...gRich...g................PE..d....Mb.........." .........z'.....`%...............................................l....`.................................................|...@.......T............|..p#......\3.. U..T....................W..(....U..8............ ...............................text...~F.......H.................. ..`IPPCODE.}....`.......L.............. ..`.rdata....!.. ....!.................@..@.data....x... ...`..................@....pdata...............\..............@..@IPPDATA..............B..............@..._RDATA...............`..............@..@.rsrc...T............b..............@..@.reloc..\3.......4...H..............@..B........................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFReader.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):28375912
                                          Entropy (8bit):6.072634678034487
                                          Encrypted:false
                                          SSDEEP:196608:LIUNQyyfCHVjdiDT7rKOQLUC3UkeePbbbrcB+VfGzeI:LIUNQ6VjsDT7+eu++s6I
                                          MD5:DCBC88D64D18E42B10449D898F3E0BC4
                                          SHA1:D41FA542A2FB9D409F8A4FFBAD43DE860921C0FF
                                          SHA-256:51FD4E220748805D31124C14DA7D5DAB430C66033268CD61A58BEC595FA8B25D
                                          SHA-512:FFE3B508D4A22F24A9E0C124054983BA4F794B175C04C8909475D38AC3C4C0B2AD3B28C2C557B66FCBFBAFA8FC8181B24F9504099089C259E411898ED18DD2CD
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.......&PX.b16.b16.b16.vZ2.}16.vZ5.{16.vZ3.16..Y3.h16.c..`16.@Q7.j16..P2.?16.kI..c16.b16.|&6.8....06..^..k16..E3.116..E2.p16..E5.n16.kI..g16.kI...16.b17..06.E5.c16.E2.}16.E3.o16.E6.c16.E..c16.b1..c16.E4.c16.Richb16.........................PE..d...>.Mb.........." ......f...J.....T....................................................`..................................................y..........<......|......h#...`...l...`..8.......................(... a..8............`...............................text...G.K.......K................. ..`IPPCODE.......K.......K............. ..`.rdata....8..0f...8...f.............@..@.data........ ......................@....pdata...h......j..................@..@.idata...\...`...^...z..............@..@.tls...............................@....00cfg..Q.........................@..@IPPDATA...........................@..._RDATA..

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFWriter.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):35211624
                                          Entropy (8bit):6.134930863063333
                                          Encrypted:false
                                          SSDEEP:196608:QfkIUNQA0KF8dDVTuM6Op7pySyjHVLq+A2tWdOQRf6W0POg9vMCImCv0E8+Id3:/IUNQ3VL+A2t/Og9vBIl0E8+Id3
                                          MD5:C4D65D7061DFA8CDAC34AB900579572E
                                          SHA1:29E0164BD585926E8D3661305EF3AF0C1EE60229
                                          SHA-256:C790EA3F292BA45EAE3A2984A4EEA0277489EC0ECCB76843F4B2538CCABEE150
                                          SHA-512:62799EBC88C6FD61FF6862D264F027FD24856A74DDBBC5472F612936E3F1C82F88670F0815508D1761AED5864119132F2AB7DF8B7563EDB77FDBA68DADA7EAB8
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......R..a.w.2.w.2.w.2...3.w.2...3.w.2...3.w.2z..3.w.2z..3.w.2z..3.w.2.%P2.w.2b..3.w.2..K2.w.2.w.2Ck.2L..2.v.2z..3+w.2..O2.w.2.._2.w.2.w.2Tv.2...3.w.2...3.w.2...3.w.2..32.w.2.w[2.w.2...3.w.2Rich.w.2........................PE..d...:.Mb.........." .........lU.....7.....................................................`.....................................................|........k.......h...&..h#.......O...<..8................... ...(....<..8............................................text....&.......(.................. ..`IPPCODE.*....@...................... ..`.rdata....@.......@.................@..@.data...............................@....pdata..4............v..............@..@.idata..tG.......H..................@..@IPPDATA.N....0......................@....tls.........P......................@....00cfg..Q....`......................@..@_RDATA.."....p..................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.MFormats.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):28575080
                                          Entropy (8bit):6.75056444650105
                                          Encrypted:false
                                          SSDEEP:196608:lf+IUNQeO4fya6VCu5EVpmZyoynHgF5/p1bADOQA3U+c4GU6BksjoObk1On:0IUNQhVlp1brR6Bp7bXn
                                          MD5:D89A992C64B621E87193E8199867FDE9
                                          SHA1:3FBA3BD4D53B62BDA1866ED6439638BC68187B71
                                          SHA-256:08643AA1AE5BDA73404B35297D38C8DF59C1A2FD183EED4F7BAC773A9A73F2D2
                                          SHA-512:B983985AA63BBDF8FFA75F7AB8006A0EF55AAF291289166603E0744DD4A6E961D71702AE45A72259DFA4E7BCE85EDB5EF67571673341E99A596177757A1AB71A
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......t..#0.zp0.zp0.zp$.~q'.zp$.yq%.zp$..q..zp..p2.zpD.{q2.zp9..p1.zp0.zp..zpj$.p..zp\..qc.zp\.~q?.zp\.yq:.zp9..p1.zp9..p5.zp9..p/.zp0.{pd.zp.yq1.zp.~q5.zp..q2.zp.zq1.zp.p1.zp0..p1.zp.xq1.zpRich0.zp................PE..d.....Mb.........." ......l...G.......I......................................`.......g....`..........................................%......L&..h........D.....|......h#......hU......T.......................(.....8.............l.(............................text...h.T.......T................. ..`IPPCODE.......U.......T............. ..`.rdata..&l7...l..n7...l.............@..@.data...l....P...^...2..............@....pdata..|..........................@..@IPPDATA.@............Z..............@..._RDATA...............D..............@..@.rsrc....D.......F...F..............@..@.reloc..hU.......V..................@..B................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Plugin.Delay.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):15432048
                                          Entropy (8bit):6.749915850631642
                                          Encrypted:false
                                          SSDEEP:98304:PIUQfoRCdtD+BJTb0uVcN3I/b1e6aKq1EbK9h9AOQx+c6PRb4iIXmak0neBC/+:PIUQfsCDuVjK1E8AOQx+zRzG7n0CG
                                          MD5:F214BFC4DE3F35F13900A248517AC584
                                          SHA1:EBDE7A67009F093C7FCD194B1AD6385F9E5D000D
                                          SHA-256:0422246DBF527304D40CA3B20ED122675D881C2CEE7B61EE813456344B670D41
                                          SHA-512:021C8487DF254524EB67D6A3DDED61E2D2CE4D541E0979BB3BE1846DF1B0D0CC8A89EA3860BBB1A2D68F38D253D0140DEC71CD1BEDCACBCB85091C8C65D11CA6
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.........%..K...K...K..uO...K..uH...K..uN...K..jO...K..jH...K.AL...K..f...K..uJ...K...K...K......K..jN...K.EjO...K..f...K..f...K...J...K.EjH...K.EjN...K.EjK...K.Ej....K......K.EjI...K.Rich..K.........PE..d...r.Mb.........." .....v....-.....x>....................................................`.................................................t...........p............V..p#.......:......T.......................(...`...8............................................text.............................. ..`IPPCODE.B......................... ..`.rdata....$.......$..z..............@..@.data.......0......................@....pdata........... ..................@..@IPPDATA.............................@..._RDATA..............................@..@.rsrc...p...........................@..@.reloc...:.......<..................@..B................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Medialooks.Runtime.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):30561640
                                          Entropy (8bit):6.71405420781881
                                          Encrypted:false
                                          SSDEEP:196608:XfT7IUNQZJW3uQFuLCf5whVHjyHyRHC+o7dCZCMZLOQ/HWp3FqcakboRJQ0bdZQ:PIUNQXVHi7dCZmQkbo3QSZQ
                                          MD5:886991B060F4DA2E289283B70ECE9FD5
                                          SHA1:F620B75F454D6E3AFC12138C7777C9A76372E3F9
                                          SHA-256:F0C381E32022C697FEC7D4C1CAE704FD3B5A190AB80BB1F948B48A9125839F5D
                                          SHA-512:E57C9CCC65667D66DC4989E710B958B5D356C9699B552D6F321826F992A2382301FEACA4BF13617F2EE94D2BFADEC16AFAAD9A8B91A455EFEAEE48D2A7FF34E2
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........|^...0...0...0..v4...0..v3...0..v5.i.0..}1...0.d|4...0..v1...0..e....0..O....0...0.;.0.....f.0..r...0..i5...0..i4...0..i3...0..e....0..e....0...1...0..i3...0..i4...0..i5...0..i0...0..i...0.......0..i2...0.Rich..0.................PE..d...@.Mb.........." ........`N......N^...................................................`...........................................................$W...........2..h#..........H_..T....................a..(...._..8............................................text....-l.......l................. ..`.orpc...{....@l......2l............. ..`IPPCODE......Pl......6l............. ..`.rdata....<.......<................@..@.data...............................@....pdata..............................@..@IPPDATA.@............T..............@..._RDATA...............>..............@..@.rsrc...$W.......X...@..............@..@.reloc..........

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\Processing.NDI.Lib.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):28050872
                                          Entropy (8bit):6.571132491531632
                                          Encrypted:false
                                          SSDEEP:196608:VV05Jd1XXjdhbHBayM5xXjdhbHBayBRMFOEQ1PviHdeLuDWfY45W:sXjzbhK5xXjzbhvU
                                          MD5:E918518C7AA284CE72081B91D3D28EAD
                                          SHA1:0CA1A634C28BF8A76D3043468B4A6755BC0CBD87
                                          SHA-256:3C79A9D6445CA1C4E78CD85F9852433967DD4A50C0CBEDC9D61E9C4B7707D8F7
                                          SHA-512:80C76F4467E59719C4615F84E64B0C4C4EE10F928F88EA817E0E888AFA0C0E37B38CC95ED131815684F011ED5F68B91A7CCEB11D9557A9A4455B47B6B530DE9B
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........7.`.d.`.d.`.d...e.`.d...eU`.d...e.`.d...e.`.d...e.`.d...e.`.d...d.`.d.`.d.`.d:..e.`.d:..e.`.d...e.`.d...e.`.d.`.d.a.d:..e.`.d:..e.`.d:.,d.`.d.`Dd.`.d:..e.`.dRich.`.d........................PE..d...-..`.........." ...............................................................c....`.........................................@Y.......j..@....P..........`.......!...`...=...4..T....................6..(...05..8...........................................text...8......................... ..`.rdata............................@..@.data................r..............@....pdata..`...........................@..@_RDATA.......@......................@..@.rsrc........P......................@..@.reloc...=...`...>..................@..B........................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\avcodec-58.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):37810176
                                          Entropy (8bit):6.624908444345091
                                          Encrypted:false
                                          SSDEEP:393216:+8UUW+2sQTvMuyihJfeM5EZCSGgu28FJvVd:+T0QAuTh9TpSMVd
                                          MD5:8C7B2589A7950471627D305FBF6BB904
                                          SHA1:0A4C06288569D67C24D0A4F6C7E78B18821345F7
                                          SHA-256:C37C22EDF6B052AF2DF4C3FDDCC1711CEA5B1B1AF169BAA0F68F8002B10981AE
                                          SHA-512:C37AF05180B505E603D784418538DBAE956DA1139DB8FC5EC98BC519AF20AA276C97329F481AB3CC2B74365D632C3F40483592911ED58903BFF84AC2C5CFAB83
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$.`....@..z..P.........................................U.......@...`... .......................................S.r.....S..E...PT.......3.4............`T..^............................/.(.....................S.`............................text...x^.......`..................`.``.data........p.......d..............@.`..rdata...ng......pg.................@..@.rodata.P....p3......b3.............@.`@.pdata..4.....3......v3.............@.0@.xdata..L....`8......B8.............@.0@.bss....py...@?.......................p..edata..r.....S.. ..."?.............@.0@.idata...E....S..F...B?.............@.0..CRT....`....0T.......?.............@.@..tls.........@T.......?.............@.@..rsrc........PT.......?.............@.0..reloc...^...`T..`....?.............@.0B........................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\avdevice-58.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):1563136
                                          Entropy (8bit):6.546764304100476
                                          Encrypted:false
                                          SSDEEP:24576:XCW8kwUfdaXuEvHKq3a4lD97C+hpGE0ZG7LSRzXUUX5D7W1dZ0TZcIIIIIIR0zif:X/EUfdaDDK4Dt0ZG7LyvaiziTFprzKUL
                                          MD5:6C1BA27832508DECBCE2385EB61F21B9
                                          SHA1:60239C027E7D90FB82726ACADACF83F4FE0855AC
                                          SHA-256:6438F3745BD21391F449C4963B061D7670E1652CD3ADBE5CDFB03E9CC77F3AD9
                                          SHA-512:FD4B8D4C70105C60D9E81DC5B33EFBFBCB8806EFD4A731F37FAC14275BA48B8F5B91713BC3371870FB9AFB44DD1D81207059F7AE3EF5CA4C88CBFA3B9B46F021
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$.........4..P...............................................)F....`... .................................................hF...`.......P..............p..L...............................(...................,................................text...............................`.P`.data....S.......T..................@.`..rdata.......`.......@..............@.`@.pdata......P.......,..............@.0@.xdata.............................@.0@.bss.....3............................`..edata...............n..............@.0@.idata..hF.......H...r..............@.0..CRT....X....@......................@.@..tls.........P......................@.@..rsrc........`......................@.0..reloc..L....p......................@.0B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\avfilter-7.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):26075136
                                          Entropy (8bit):7.117761838151895
                                          Encrypted:false
                                          SSDEEP:393216:5jYnrgj087j3ZgmbbnyZTeAnIlLyZGP2TTgLf3cWeqeo8XpKw7F:5nImFDuT6Ly7Ts0WeDoqX
                                          MD5:F5695C8285347E896CCAC36BFD66793B
                                          SHA1:EE4221654AA916D85E5FDCFF39CC579E90BDD50C
                                          SHA-256:D5E38888A926612F8B823CCC37487F857E25F3277AE0C0CA139808A2C00358D6
                                          SHA-512:ED7D7E6298AC5EE7EBC24A930D5DDADFBFA6E2DBD083ABF118F7CB8E86B448E8E04366068C5BD3DB109240E4A6739F9FD8E48A7AC59A400C44198928F0CB6893
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$..g.....p..P...............................................].....`... ..................................................L..............|o.............................................(.................... ...............................text...h.g.......g.................`.P`.data...@.....g.......g.............@.`..rdata..@.....h.......h.............@.p@.pdata..|o.......p.................@.0@.xdata... ...`..."...@..............@.0@.bss....Po............................`..edata...............b..............@.0@.idata...L.......N...l..............@.0..CRT....`....`......................@.@..tls.........p......................@.@..rsrc...............................@.0..reloc.............................@.0B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\avformat-58.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):9625600
                                          Entropy (8bit):6.536815715028949
                                          Encrypted:false
                                          SSDEEP:98304:0oHCcTDFLkQ/zwJwguGruUWEOvQl+lf1thHajw2fBAUZLe0HZvdM:vkQq8UnO/fzh6jw2fVy0jM
                                          MD5:BAB673125DE323560526C0629AF9D3CA
                                          SHA1:046343408B463229CC2931A17AC1E46F887F4613
                                          SHA-256:03C663611FE009B2548A520B112C0F649EF59BE45DC704CE214BDDEEB0C02A76
                                          SHA-512:F02BE3E394E30ACFD9641174EF040485FF579219CF383F547B3340D59C85FC0BB5ADB4F2DACDE68564BF94DC948DD129BE43D973EA518BAA5258B7449CD83A53
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 2%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$..b........P........................................@............`... ........................................t.......a...........P..................8............................r..(....................................................text.....b.......b.................`.p`.data.........b.......b.............@.`..rodata.......d.......d.............@.0..rdata...F&...e..H&...d.............@.p@.pdata.......P.......&..............@.0@.xdata..<....0......................@.@@.bss..................................`..edata..t..........................@.0@.idata...a......b.................@.0..CRT....`....`.......0..............@.@..tls.........p.......2..............@.@..rsrc................4..............@.0..reloc..8............8..............@.0B........................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\avresample-4.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):162304
                                          Entropy (8bit):6.367140899669312
                                          Encrypted:false
                                          SSDEEP:3072:LWWdFs9tEh4Simwx8KEtXL5ZHM/yfXmU3f8zNlj+aC:RW8XxUzN7
                                          MD5:2DA4C98F205A9D30B14DA6F26A9662D3
                                          SHA1:C9DA0A1CE301C2426C35B82FD4CA059B3B3AFA29
                                          SHA-256:4D34663DF09787C88C195CE4B4B88D18F5B0343613A0371ACAEFF45485D2FB45
                                          SHA-512:E1D49213BB5BE2053C39773FB9A7FF2B608BC3A901D7D34E070B782C6B3E64CEB7A243D0D07ADCAE23FC9A468FF15D1A328590B4C22DDBAFE4FA360F373B20CC
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$.....v......P...............................................>.....`... ..............................................................p...............................................S..(.......................0............................text...............................`.P`.data........ ......................@.P..rdata..08...0...:..................@.`@.pdata.......p.......F..............@.0@.xdata..|............R..............@.0@.bss.... .............................`..edata...............^..............@.0@.idata...............b..............@.0..CRT....X............n..............@.@..tls.................p..............@.@..rsrc................r..............@.0..reloc...............v..............@.0B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\avutil-56.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):865792
                                          Entropy (8bit):6.437206029161204
                                          Encrypted:false
                                          SSDEEP:12288:5cv//cogmgsffFK5nlGnErj05Nb0aBtjOIi6SJQdVR6CCjOioYv:Xhns3fnbjrSKUCoBv
                                          MD5:D5F809ADAC5DA54AC1DD741923AF061E
                                          SHA1:194C826C945C43DA7E1DE5133D2A02FE1773D97F
                                          SHA-256:1CA7C910A85E7B7876021AF5D4BDBB664A23AE2526531AACC26A8588C2592741
                                          SHA-512:419C4AB61B55E696A5CA4091FC768459B215C9091DFD44DC1FF0D255259818F75755BED27C0A6C8B7C2A7241B2015499DC242D4815F4CB52D45CE3843CAE425E
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$.....2.... .P.....................................................`... .......................................-..?...0..D....p.......@..\L..............................................(....................6..P............................text...............................`.P`.data...............................@.`..rdata..P.... ......................@.`@.pdata..\L...@...N... ..............@.0@.xdata...S.......T...n..............@.0@.bss...... ...........................`..edata...?....-..@..................@.0@.idata..D....0......................@.0..CRT....`....P....... ..............@.@..tls.........`......."..............@.@..rsrc........p.......$..............@.0..reloc...............(..............@.0B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\d3dcompiler_47.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):4173928
                                          Entropy (8bit):6.329085982329133
                                          Encrypted:false
                                          SSDEEP:49152:VBfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyu:BeZevVKACOvWYQk
                                          MD5:699ECC49CA12082DDBDA30669690EE35
                                          SHA1:8B3C633AEA3C4FCB2F2277B4C1F81B85E4219A96
                                          SHA-256:0BEA1620DD82F5E6BE1650FBE84CE819BA9F32F4148308CF1E68C4D825D74937
                                          SHA-512:DC18ADBB494771437BE9E1BC53E2AF3D34B74E36142D20ACEBE47B305373F9B5D9BA876E278FDC6D7A6E0DDD310C8A09A72AD399D3BFD4157DD85317E24F72F9
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..(.a.{.a.{.a.{..m{5a.{..l{.a.{.m{.a.{.o{.a.{.a.{.a.{.i{.a.{.l{.a.{.h{.a.{.q{.a.{.k{.a.{.n{.a.{Rich.a.{........................PE..d......R.........." ......;.........`.8......................................@@......^@...`...........................................;.u...P.>.d.....?.@.....=......t?.h<... ?..{..................................@a................>.P............................text.....;.......;................. ..`.data...h.....;.......;.............@....pdata........=......n<.............@..@.idata..@.....>......B>.............@..@.rsrc...@.....?......\>.............@..@.reloc....... ?......b>.............@..B........................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\glew32.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):364032
                                          Entropy (8bit):6.221132321562538
                                          Encrypted:false
                                          SSDEEP:6144:7JNyWTWo1aETChCPR/KFOnAElG76SW0A1di/qt8oRFGNGHLcZ7jQlfaOjIdl56C:1N/S0aZCZRnr64nLCqIdl
                                          MD5:6FCB382735D0DBD68D14F818BF839430
                                          SHA1:F70250C3645F0812A78AD559628BCCEC3BBFB097
                                          SHA-256:E80DC7EBE2AA9D7CEC9466328F63AEF530CC754F1C9DFC714261C69F4228EA65
                                          SHA-512:872E64A8318882F5E244D0FE49EA10DB6238EE9B7FA13B8F5FED4849BF64A412C86633004926CDEF38B9C46E54470C99BB0D5B5EF3A6CA9318B2AAA7F36BFAB6
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.......u....7..u....:..u...u...u.......u....2..u....3..u....4..u..Rich.u..........PE..d....=.Q.........." .....8...R.................b.............................0......E.....@.........................................0...........<........$................... ..`....................................................P...............................text...Z7.......8.................. ..`.rdata.......P.......<..............@..@.data...@k...`.......@..............@....pdata...............P..............@..@.rsrc....$.......$...d..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\ipp90legacy.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):21117952
                                          Entropy (8bit):6.630752349249341
                                          Encrypted:false
                                          SSDEEP:196608:hXcHynhiM9wgnC5uiKemfFikTKjLm4U9QMD:3fF3jq
                                          MD5:A83498A86D4FA96B63C9E2D7A8444875
                                          SHA1:7DF8468EEAC792E8C0BA841CF20EA3FFD7814C87
                                          SHA-256:283A1A059DB03CC56A9E19487E413F860562479C7CED59C4F1C7BF444F368C0D
                                          SHA-512:656F8372A05F32358FC18A1C25E84DC846FF8062E5065BB8230F36105A27B93F8C4FFB5DB7126A4536172E5DB980DC4F4E67BB29826DC278D2F98F3166702D57
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................................................7..F...................M.......Rich..........................PE..d...#A._.........." ......)..........t........................................B...........`...........................................9.\P...h9.(....@B......P;..............PB.dI....1.p.............................1...............)..............................text....".......$.................. ..`IPPCODE.}.)..@....)..(.............. ..`.rdata........).......).............@..@.data.........9......T9.............@....pdata.......P;.......;.............@..@IPPDATA......@@.......?.............@....rsrc........@B.......A.............@..@.reloc..dI...PB..J....A.............@..B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\libmfxsw64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):8195456
                                          Entropy (8bit):6.521072467591149
                                          Encrypted:false
                                          SSDEEP:49152:NhNf2ZY9P/GMZ0PlhnblEiGm5dUNP+aLsdZ+wn3jrQnz8PK4yVkFmOvMXbHPpQK5:Eu0Pl/5inst/Qph8HDUTRKPs
                                          MD5:BB358DE48A8F678628E708DCAF5900AF
                                          SHA1:A9560D22F4BDB488B98792280C07291AA657AA99
                                          SHA-256:D7F3CCBACBF9978A7A07BEBDD8B332B1D952753217761250337648BAB533461F
                                          SHA-512:D60D099575FA8AF6FE10BAEC56A3C6D9D62820E225DBE57DA880B3D77E0CB2789056599809D57BEC9BFFE3D6566A861E0D06EEE72616CFC94B805667E267359B
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~...:}..:}..:}..U...-}..U...)}..U....}..h...3}..h...O}..h....}..U...1}..:}...}..:}...}..`.|..}..V...*|..V...;}..V.N.;}..V...;}..Rich:}..........................PE..d...Z..\.........." ......j...........U.......................................}.......}...`A.........................................ex. ....nx.P.....}.......z......|.......}..B..`.q.p....................q.(....q...............j. ............................text.....[.......[................. ..`IPPCODE..N....[..P....[............. ..`.rdata........j.......j.............@..@.data...4,....x..X...rx.............@....pdata.......z.......y.............@..@IPPDATA..N...@}..P...V|.............@....rsrc.........}.......|.............@..@.reloc...B....}..D....|.............@..B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\msvcp120.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):660128
                                          Entropy (8bit):6.339798513733826
                                          Encrypted:false
                                          SSDEEP:12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
                                          MD5:46060C35F697281BC5E7337AEE3722B1
                                          SHA1:D0164C041707F297A73ABB9EA854111953E99CF1
                                          SHA-256:2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
                                          SHA-512:2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\msvcr120.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):963232
                                          Entropy (8bit):6.634408584960502
                                          Encrypted:false
                                          SSDEEP:24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
                                          MD5:9C861C079DD81762B6C54E37597B7712
                                          SHA1:62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
                                          SHA-256:AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
                                          SHA-512:3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\msvcrt.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):634880
                                          Entropy (8bit):6.529698884144268
                                          Encrypted:false
                                          SSDEEP:12288:QpC1XhsbQfIiZ3f5Lzf1wUEyUQAmVyK6EOaA0OONRQ:QpCZhsboIiZ3x/dcQAmVyK3OaA0O+Q
                                          MD5:C391FC68282A000CDF953F8B6B55D2EF
                                          SHA1:964EE2D28DC71210982F72E567DF89F9F527B67B
                                          SHA-256:1CB0DAB84545D9FDEA5A7865A1E7132CEAC91DECF8B100285B63098D7B09E584
                                          SHA-512:E324197FF69C92307F86A21B2DDAAE5F9AC699F3B234C09FA4DAFEE3757B0C716577DB1D62CA23180DC34D7899686D32C52C072A0D01B29DD91DD01744506CD2
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.H..............b.5.............d.......r......c.......u.......e.......`.....Rich....................PE..d...?..N.........." .........,...... .........ju.....................................p....@.............................................j..D................p..d\......................8............................................................................text............................... ..`.rdata..Lj.......l..................@..@.data....V.......N..................@....pdata..d\...p...^...H..............@..@.rsrc...............................@..@.reloc..............................@..B...N.......N.......N.......N.......N@......Na......N.......N.......N.......N.......N.......N.......N6......N_......N.......N.......N.......N.......N.......N.......N.......NA......Nc......N.......N.......N.......N............KERNELBASE.dll.ntdll.dll.API-MS-Win-Core

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\swresample-3.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):431616
                                          Entropy (8bit):6.532333052001319
                                          Encrypted:false
                                          SSDEEP:6144:+Q+zlpjRhJHZwGlUQ7BTTiT2HkPvdpDkaQFqAImlGMNYt:foldVUQ1TBqoFg
                                          MD5:69F145A1E74C423CBAED69F56500281A
                                          SHA1:CD53DE3A15395E313E422315A42C625637DAE7AB
                                          SHA-256:3B1A2D3D1945CA2F7E38A438A1BFE53331F16CEB69C47E6D25CCA3E0B829B684
                                          SHA-512:83F7E076D78862185BA8406ADA746134E8DD6661FCE8837C2E42193FCE8115934EE1D30EB8C08305BA90A128B31016BECEB07C53D8D6137EBF074B7155685EE3
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$.........R..P.....................................................`... ...................................... .......0.......`.......p..L............p..@............................P..(...................@2...............................text...............................`.P`.data...............................@.`..rdata..p...........................@.`@.pdata..L....p.......@..............@.0@.xdata... ......."...V..............@.0@.bss.....Q............................`..edata....... .......x..............@.0@.idata.......0.......|..............@.0..CRT....X....@......................@.@..tls.........P......................@.@..rsrc........`......................@.0..reloc..@....p......................@.0B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\DLLs\swscale-5.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                          Category:dropped
                                          Size (bytes):567808
                                          Entropy (8bit):6.545705144095029
                                          Encrypted:false
                                          SSDEEP:12288:QowUUPw+aMa9iuSqQ6ZmWkFOyJEMbYTB7c26/5pmpAvKF66vFtvjRp:QowUUPwPCpaMbYTi/5pmpAvKF66vFtvn
                                          MD5:EE25EBBCEC188C364199EA904A2D8F9E
                                          SHA1:30DDAAD06D7BC4FE8DE7C979EE02EF2E861FC538
                                          SHA-256:6C6BBA47053EF51A3F0098E1EA68AABCCED9D273EB01237C422ED33DB94F94ED
                                          SHA-512:CBDC3FCBE9B255BB1E8390B59B0FEC7F8DC8D850C4C03A6418FA26B2D5C4A62CBB413981BC28F7E68D23AEA1EF505086D315A0CB086C69F074257523D8B6B827
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...$............P...............................................\h....`... ......................................P.......`..0............P..<'..........................................@4..(....................a...............................text...............................`.P`.data...............................@.P..rdata...].......^..................@.`@.pdata..<'...P...(...4..............@.0@.xdata..H5.......6...\..............@.0@.bss....`.............................`..edata.......P......................@.0@.idata..0....`......................@.0..CRT....X....p......................@.@..tls................................@.@..rsrc...............................@.0..reloc..............................@.0B................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Processing.NDI.Lib.x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):25331200
                                          Entropy (8bit):6.522878448729758
                                          Encrypted:false
                                          SSDEEP:196608:QbpEEXjdhbHBaypHXjdhbHBayBrXWfYZMf+WUplr7:QbpTXjzbhfHXjzbho+WUplr7
                                          MD5:E2C114FBBCED08E750D3FE37AB774DBB
                                          SHA1:63A637AFEC9CAD6F0A05C87F543FC5EDAF49CA00
                                          SHA-256:98EA2F732794FDA246580414CA728CE5CA76B415B7496E67A78E6DCC6764A517
                                          SHA-512:B356A7B881B70E679518550D7077D0A8353A539EEDB56BE7FE6ECBE2E382E85F16F920B4D95CA51744B840C07FAB75B86D0D9165E0E08E5D063078B04864D0B1
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nc_.*.1.*.1.*.1.Od2.;.1.Od4...1.....).1.xj2.#.1.xj4.R.1.xj5...1..k2.".1.Od5.6.1.Od0.1.1.*.0.>.1..k8...1..k1.+.1..k.+.1.*...+.1..k3.+.1.Rich*.1.........PE..d.....9^.........." ......z..R.......1....................................................`.............................................p...@........ .......`..............0...b...x|.p....................y|.(....x|.............. z..............................text.....z.......z................. ..`.rdata....... z.......z.............@..@.data....M.......z..................@....pdata......`.......h..............@..@.rsrc........ ......................@..@.reloc...b...0...d..."..............@..B........................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Qt5Core.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):6164600
                                          Entropy (8bit):6.646037490349141
                                          Encrypted:false
                                          SSDEEP:98304:zP/qGJuO1Ty/aNaJsv6tWKFdu9C5Fs74/Eorqf2X:zHqGIOBy/7Jsv6tWKFdu9C5O7orqf2X
                                          MD5:5FDF9EDCEDC637C005EFACC076F552BB
                                          SHA1:B92B5BACA9B82CF79087E07821D35410CE3F4E2C
                                          SHA-256:47888A0EF6EEFFDE2DB72E02B44F8BAF053B54F81271559ACF167E291CF7272F
                                          SHA-512:8012E42A4D4FE8022B67EE0F64FD66C00CEF771AFF6E18BEA962420B8E6A85E23132715E783A0F08C1C087EDEBCEEEFFA1BBE6B3AB8EC0F7DDFE4F23B832C7B5
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............[...[...[..}[...[...Z...[8A)[...[...Z...[...Z...[...Z...[..Z...[..Z...[...[...[m..Z...[m..ZV..[m..Z...[m..[...[..y[...[m..Z...[Rich...[........PE..d......].........." .....r..../......j,.......................................^.......^...`...........................................R.....lkY.......^......0\.TC....].x.....^.."....K.T.....................K.(.....K..............................................text....p.......r.................. ..`.rdata..v.+.......+..v..............@..@.data.........Y......xY.............@....pdata..TC...0\..D....[.............@..@.rsrc.........^.......].............@..@.reloc..."....^..$....].............@..B........................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Qt5Gui.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):6509176
                                          Entropy (8bit):6.671682523497419
                                          Encrypted:false
                                          SSDEEP:49152:Mfav657bvN//cUWquB+ZiX+Ye+/Cp/Xai0VuWgxlS2bsBjopO+VB0GdXrAsxmLui:MCv69vs0hWgxs9f+aOuoX9s
                                          MD5:C35A8347CFFB2EE11FFD23644CBA4EAD
                                          SHA1:E66101A22731DDBBD76371617A0211AAE265AE6F
                                          SHA-256:9F9E22D4F731439FBF710CE34BA0607FB9E60AE0E5E78D50B3547D1F55F08C5C
                                          SHA-512:A6493896B31F40E29F626EADC3B698CCCFDF50F4E217CD73694A862576DB54C9A7A8727EB26E094ED76FE7FA358BF25D51C99253B7060425B52109C05523A208
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......T*.d.K.7.K.7.K.7.3n7.K.7..:7.K.7.).6.K.7.).6.K.7.).6.K.7.).6.K.7c).6.K.7.(.6.K.7.K.7.N.7.(.6.K.7.(.6HJ.7.(.6.K.7.(.7.K.7.Kj7.K.7.(.6.K.7Rich.K.7................PE..d...3..].........." ......9...).....|.9.......................................d.......c...`..........................................'C.<....!\.@.....c......0`......<c.x.....c.,-....>.T.....................>.(.....>...............9../...........................text.....9.......9................. ..`.rdata..fN#...9..P#...9.............@..@.data........@]..X....].............@....pdata.......0`......._.............@..@.rsrc.........c.......c.............@..@.reloc..,-....c.......c.............@..B................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Qt5Network.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1327224
                                          Entropy (8bit):6.389267625029064
                                          Encrypted:false
                                          SSDEEP:24576:RYQzjq3sIk5E5Q0K6DK+PHO9bfwYUYDE1rFd4v+wI2uoni+ro:fssxMQR45Pu9zwYUYDE1W+8uoDo
                                          MD5:1226D7DE44ECA9BB9509F0B478E99206
                                          SHA1:AA93D8C440D28A574E53FCFB2A353B0E403AFA70
                                          SHA-256:CFF0443C5E6D46417D567CF2C9950D4CFF333956E8662C05A9C0A1068CEFE88E
                                          SHA-512:48FFCA0F9BC67E05E61330E981D0CDD4A8A0B1986B8496DA5620A0916AB5EC462B29824142809805F51D1D21D73294F6B0E6DC28D9364CBEB1204F6AA8D59FF9
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..[i...i...i...`...c......m......c......m......q......e......j...i...............h.....x.h...i...h......h...Richi...........................PE..d......].........." ................................................................%<....`..........................................}..._......,....`.......p.......*..x....p.......@..T...................8B..(...@A..................(............................text...c........................... ..`.rdata..L...........................@..@.data...............................@....pdata.......p.......&..............@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Qt5Sql.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):211064
                                          Entropy (8bit):6.360045719512351
                                          Encrypted:false
                                          SSDEEP:3072:BsxtiiIDQwyVuHQ667btzp1i+k9h2w6rV27TNfk9g5NX6:WxJIDQfVuHQ6yH1p2nNc9x
                                          MD5:D990FBE61CFEBE5C59F84036F2701A16
                                          SHA1:39089FB83A9B11254BF773D59169FC955D5ED69A
                                          SHA-256:D8F36E59A9844BB1433C2F2698B3C36D779D8303A5EEC6B8C60E03270B970A30
                                          SHA-512:7B96A001A00F15FD86116A8839A085412689E845B6E2B64CD11CFDDDBD69DB638808C81EFD4FBBBDF25FCA508D9DADA19ADECCDA5976982339984F9013367FDB
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........vH..%H..%H..%A.~%L..%...$J..%;..$J..%...$K..%...$[..%...$B..%...$K..%H..%d..%...$\..%...$I..%...%I..%H.z%I..%...$I..%RichH..%................PE..d......].........." .........L......0........................................p.......v....`..........................................L..Xm......x....P....... ..D(..."..x....`..$.......T...................X...(...`...................h............................text............................... ..`.rdata..x...........................@..@.data...(...........................@....pdata..D(... ...*..................@..@.rsrc........P......................@..@.reloc..$....`......................@..B................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Qt5Svg.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):338552
                                          Entropy (8bit):6.36144564466742
                                          Encrypted:false
                                          SSDEEP:6144:FWlnA5MUaGL6ZiziIzE4x8IrVJQ6+SMGou5BjvnMCH4i9iR/+O:FYA5UGYi/SJ
                                          MD5:C2296A44D727D11373A5C5CE28F40242
                                          SHA1:921859E2DD844EBA8E0E5997DF49C88F2CF5F656
                                          SHA-256:B7A538BE653930C8621606DF322F631DFF5B03EDD4BD86BC482626798F841368
                                          SHA-512:B1BD19296B33555716F1AC201343C3CB58743677083796E4E5E556DD9273394DFDC9D1F0082699CCBC4594C9235BAB887915D61BFF11312FEEC417B7C71CFCBE
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............yf..yf..yf......yf...g..yf...g..yf...e..yf...c..yf...b..yf...g..yf..yg..zf...c..yf...f..yf......yf..y..yf...d..yf.Rich.yf.................PE..d......].........." .........,...............................................`......W4....`.........................................`...P....;.......@..........$3......x....P..H...p^..T...................._..(....^..................h............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..$3.......4..................@..@.rsrc........@......................@..@.reloc..H....P......................@..B................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\Qt5Widgets.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):5592184
                                          Entropy (8bit):6.599431210109492
                                          Encrypted:false
                                          SSDEEP:49152:70o5dKNqZ/8KIsJWxK8uHVS8slg1yK0AJGyYBoMhhboPorQKIM+xA6a0ARvYnBH9:9KNqZ9skdELUjY5CzxA6a0ARvYXeAus
                                          MD5:B74BCF525BE24543C0837A1F0E217296
                                          SHA1:EE4DD0463A37ADBDAEFF576C1FE973BA3701238F
                                          SHA-256:6FCC127954B95BB5D3B62E1A88094C3C4395E1585874025521CC7C4B05AABD7D
                                          SHA-512:2E6831709405190C7D499CDE925B2D0F0053CD05C48651BE785BC94F08A24FA4BE05250C30FB25421F6A5BDD8F7D65255024ECCC16699590183194218958B215
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Fd..'.}.'.}.'.}._.}.'.}:E.|.'.}:E.|.'.}:E.|.'.}:E.|.'.}.E.|.'.}(D.|.'.}.'.}.*.}(D.|Z'.}(D.|.'.}(D.}.'.}.'.}.'.}(D.|.'.}Rich.'.}................PE..d.....].........." ......4... .....|.4.......................................U......KV...`...........................................C.TQ....L.......U.......Q.(G...>U.x.....U.....`.?.T.....................?.(.....?...............4.Hh...........................text.....4.......4................. ..`.rdata........4.......4.............@..@.data...8.....N.......N.............@....pdata..(G....Q..H...bQ.............@..@.rsrc.........U.......T.............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\SDIOutAddon.exe

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):238720
                                          Entropy (8bit):6.238682968518126
                                          Encrypted:false
                                          SSDEEP:6144:Ugoh+RnXEvtvUjJGUlxUpkESUzMTDatFc/fG/eTqj7MEA+6NCUvMFM6oycr5Ti:UJwRnXEVvUj1BPi
                                          MD5:344A5D90E9535EEF8E66D7E40FD948A4
                                          SHA1:AD430E95962C30B91A315D0F0089F0EC9BA2630F
                                          SHA-256:918CB3F5586DC5CBF871ADE33581F8DE389339AE0BDC119539595426260CE3A9
                                          SHA-512:074E50B9364569A41E87C79C1A31D03ECEE4905BC2AD2B8D15624B7808D51A110D8781A24BD8C390179279B09D1F3270F76CEBC226585A045D312B65255C96E4
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.............x.............................................6.......6...............................4.......4.......Rich............PE..d....K.e..........".................4..........@....................................e.....`................................................. ...|....................|...(......\...Xq..T....................s..(....q..8............................................text............................... ..`.rdata...w.......x..................@..@.data...H....p.......R..............@....pdata...............`..............@..@.reloc..\............r..............@..B................................................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\SDIOutAddon.exe.manifest

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):30761
                                          Entropy (8bit):5.519495101310609
                                          Encrypted:false
                                          SSDEEP:384:OXgPzDHtlM8M2/MD3yXfTBEt87etgXaW8ssvE1cGB0kPE1jyydPTYH0cSaSuiHNC:ZtMr6yb/6pM1jyyxYJSuitC
                                          MD5:C4150E31D589604C6ABD0F1359637007
                                          SHA1:182380BA6AFD2D39FE4504BE4A1F7834820FD06B
                                          SHA-256:EC985BF8231448EB9272112BC25929A1C4A0E1041D6B6C200732F5F20E246FC5
                                          SHA-512:164C7A5BA53BB01DD2C8209D372C34B5A853B72E5D5B8952F3825EB4C8C3F24F0D16849C4DEDA81851846AEF35C9ECE3E4947F55AA1FCAA1ED1BD580C9AB254A
                                          Malicious:false
                                          Reputation:low
                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">.. <file name="DLLs\Medialooks.Codecs.Core.x64.dll">.. <comClass clsid="{96EB1C14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitter Class" threadingModel="free"/>.. <comClass clsid="{96EB1C64-4CC0-4830-9CC3-F064196B2626}" description="MFDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1C74-4CC0-4830-9CC3-F064196B2626}" description="MFMuxer Class" threadingModel="free"/>.. <comClass clsid="{96EB1C94-4CC0-4830-9CC3-F064196B2626}" description="MFEncoder Class" threadingModel="free"/>.. </file>.. <file name="DLLs\Medialooks.Codecs.FFM.x64.dll">.. <comClass clsid="{9285699B-E779-4B2E-92CA-26DDEE01AA2A}" description="MFCaptionsDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1F14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitterFFM Class" threadin

                                          C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1563264
                                          Entropy (8bit):6.63807388426676
                                          Encrypted:false
                                          SSDEEP:24576:wwWw5lSr8uDq3f5jiARRJuRAi8KDpEGUB1W3DQYISEaWOdWMQpfrk:q8Cq3Bi4ut+GGAQYISEaW/lpfQ
                                          MD5:D7C8D83952710C569E3671A42CF71773
                                          SHA1:877DAD6E03490D476B434F50C83FD2E88093CEA1
                                          SHA-256:5088E61172C185368EA2B62476968E82B37DA1C433DD899D66102C1EB0119BEC
                                          SHA-512:D564944B634B42ACB6386000888C63400EB2F088019D1F6B4EAC55619DCDC6AE07A65C35A4A74BF5C797AF1D384766FB65A5098415B0EEF4EE388936532C1965
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......XE...$...$...$...\U..$..NQ...$..NQ...$..NQ..=$..NQ...$...G...$...G...$..JQ...$..NL...$..z..=$..z...$..J...$...Q...$...[...$..z...$..GL...$...$..."...Q...$...Q..|$...Q9..$...Q...$..Rich.$..........PE..d....L.e.........."......L..........,q.........@....................................K.....`.........................................................@..X|..............(......d,...V..T....................X..(....V..8............`...5...........................text...3K.......L.................. ..`.rdata......`.......P..............@..@.data...p...........................@....pdata..............x..............@..@.rsrc...X|...@...~..................@..@.reloc..d,..........................@..B........................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe.manifest

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):30761
                                          Entropy (8bit):5.519495101310609
                                          Encrypted:false
                                          SSDEEP:384:OXgPzDHtlM8M2/MD3yXfTBEt87etgXaW8ssvE1cGB0kPE1jyydPTYH0cSaSuiHNC:ZtMr6yb/6pM1jyyxYJSuitC
                                          MD5:C4150E31D589604C6ABD0F1359637007
                                          SHA1:182380BA6AFD2D39FE4504BE4A1F7834820FD06B
                                          SHA-256:EC985BF8231448EB9272112BC25929A1C4A0E1041D6B6C200732F5F20E246FC5
                                          SHA-512:164C7A5BA53BB01DD2C8209D372C34B5A853B72E5D5B8952F3825EB4C8C3F24F0D16849C4DEDA81851846AEF35C9ECE3E4947F55AA1FCAA1ED1BD580C9AB254A
                                          Malicious:false
                                          Reputation:low
                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">.. <file name="DLLs\Medialooks.Codecs.Core.x64.dll">.. <comClass clsid="{96EB1C14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitter Class" threadingModel="free"/>.. <comClass clsid="{96EB1C64-4CC0-4830-9CC3-F064196B2626}" description="MFDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1C74-4CC0-4830-9CC3-F064196B2626}" description="MFMuxer Class" threadingModel="free"/>.. <comClass clsid="{96EB1C94-4CC0-4830-9CC3-F064196B2626}" description="MFEncoder Class" threadingModel="free"/>.. </file>.. <file name="DLLs\Medialooks.Codecs.FFM.x64.dll">.. <comClass clsid="{9285699B-E779-4B2E-92CA-26DDEE01AA2A}" description="MFCaptionsDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1F14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitterFFM Class" threadin

                                          C:\Program Files (x86)\SRTMiniServer\START_NO_NDI.bat

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):24
                                          Entropy (8bit):3.6887218755408675
                                          Encrypted:false
                                          SSDEEP:3:kt3Z4A5Mn:YZ4uM
                                          MD5:A3EDDECE90C2CE1B8EAA969AEF405BB5
                                          SHA1:EB49A72231CE9A2FB54048D55CF8A0301936D133
                                          SHA-256:390A92CB8B5F9A9CCC718AAA9547A065167442CA0624A6348A24E8618586E194
                                          SHA-512:40DC8359A4C6EBF31876D46B1138C94AD6BE4281F52CC6D83FA50D2E66F238E599BCC744A94A9E0CF57FC933D990D49B3F57D02D559D5CC3D80CCED22BC6BF1C
                                          Malicious:false
                                          Reputation:low
                                          Preview:SRTMiniServer.exe no_ndi

                                          C:\Program Files (x86)\SRTMiniServer\WEB\bootstrap.min.css

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:ASCII text, with very long lines (65319), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):155764
                                          Entropy (8bit):5.066642470765085
                                          Encrypted:false
                                          SSDEEP:1536:M/xImT+IcCQYYDnDEBi83NcuSEk/ekX/uKiq3SYiLENM6HN264:M/Riz7G3q3SYiLENM6HN264
                                          MD5:8FE70898895271DDC62823321011273A
                                          SHA1:60F0159744E3B554A45DA027F9E7FAA992AED71A
                                          SHA-256:AE576713BC196098F7438DEDE6FF1F835A23291C32B745AD7E6FB6DB809A719B
                                          SHA-512:A37D9F7728554BB6C241D68303E0F09BD427F061A681CF61BDDDF1DDA40A0C77C10E3E0BF8E58F1D31C1AF14DF7E5941C26EE53B065E35454EA8CDFFB47392EE
                                          Malicious:false
                                          Reputation:low
                                          Preview:/*!.. * Bootstrap v4.3.1 (https://getbootstrap.com/).. * Copyright 2011-2019 The Bootstrap Authors.. * Copyright 2011-2019 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. */:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace}*,::after,::before{box-si

                                          C:\Program Files (x86)\SRTMiniServer\WEB\bootstrap.min.js

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:ASCII text, with very long lines (57791), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):58078
                                          Entropy (8bit):5.248934854412323
                                          Encrypted:false
                                          SSDEEP:768:BwYyDyKAmHVaS3m3Dqp0NwCkXDtdFDLmTV+miDNJcJiQMRqyPiYtB6UvcCg8YGxV:BwTKktDLmTF8yJL45XtHjoGL
                                          MD5:0A958254DB529F99F475080FE2A6DCDB
                                          SHA1:EEBC17246F2BEDA813DD3372593CC54A152F9CB4
                                          SHA-256:3BCD802E9F77849E7C1E93C87279FBBB04D45949D2BE79B03566CEACDE29B158
                                          SHA-512:327BF409CDD167171A300EF7F95FAC5CBC802320B2872EA845EC434FF7987A21CB0F0346A8EB3CB891447B98E2E622C3D721BC295BF4F26E763659DBB8A09940
                                          Malicious:false
                                          Reputation:low
                                          Preview:/*!.. * Bootstrap v4.3.1 (https://getbootstrap.com/).. * Copyright 2011-2019 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors).. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. */..!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e((t=t||self).bootstrap={},t.jQuery,t.Popper)}(this,function(t,g,u){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(o){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{},e=Object.keys(r);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(r).filter(function(t){return Object.getOwnPropertyDescr

                                          C:\Program Files (x86)\SRTMiniServer\WEB\code.js

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):3275
                                          Entropy (8bit):5.282483775398536
                                          Encrypted:false
                                          SSDEEP:96:zSAnFMbVRitnciiIncQsg6skA3iVxBsXeGP4n+iKsDsC:zS+t0BtKIuAX
                                          MD5:548ED5E4985F579C56161224EF394CCB
                                          SHA1:76A9D74C1268EDBDE9F66A6232BE4612A5EF40D9
                                          SHA-256:DFCAEFD1E4D6D27B3D85322691C65BD20ECC2C3A508BFC768F4CC12E84FF26A8
                                          SHA-512:E552A16924C90063E3D66598F64EB4F9C359FF69B89F73030458DD547398B7A81DC60782DE76D47BF7A88C170C423F41E039F62E04EDE5559DEA59AC3BF9B79C
                                          Malicious:false
                                          Reputation:low
                                          Preview:var g_timer = undefined;....var g_client = new Vue({.. el: '#mainApp',.. data:{...secret_key: '',...items: [],...error: '',...last_line_modal_open: -1.. },.... methods:{...start: function(){... this.loadInfo();...},.....signURL: function(path){....... // for unsecure-way... if(!this.secret_key)....return path;..... // for true way... var ts = new Date().getTime(); ... var s = ts + ":" + this.secret_key;... var sign = md5(s);... // console.log(sign);... ... res = path + "?tick="+ ts + "&sign=" + sign;... // console.log(res);... return res;...},......loadInfo:function(){... this.error = '';... $.getJSON(this.signURL('/api/v1/read'), function(data){....this.items = data;....g_timer = setTimeout(this.loadInfo, 4000);... }.bind(this)).fail(....function(r){.... this.error = r.responseText||'unknown error';}.bind(this));...},.....disconnect: function(linenum){... if(!confirm('Are you sure?'))....return;... ... var url = '/ap

                                          C:\Program Files (x86)\SRTMiniServer\WEB\index.html

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:HTML document, Unicode text, UTF-8 text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):7156
                                          Entropy (8bit):5.14160857108203
                                          Encrypted:false
                                          SSDEEP:96:iBSPVPrgRfdfI+qyF15HesPNXwiEkTqBjJoW1DbkD1RjwKjH:gS9kpBb+HdAA9TQTT7
                                          MD5:135E5A1A4BFFBB887B33133E9287ED4B
                                          SHA1:E680A28E2C13892C3E7ED999668EEE641E295CB5
                                          SHA-256:F8E7BFFF55E3F716AE1D97D3D0EF5947C1B3BD7FB9227AA2C5C7C74049210EFE
                                          SHA-512:C6ADEA491B3406AB659B0E442DB9C38712904CAB1D1814D42A3A685013FF5B83221F723D8C9AC199B69F316544E5F80B12CF22E9D6DB8C79D3CC3808E029CA8F
                                          Malicious:false
                                          Reputation:low
                                          Preview:<!DOCTYPE html>..<html lang="en">....<head>.. <meta charset="utf-8">.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1">.... <title>SRTMiniServer Remote Control</title>.. <script src="/jquery-3.4.1.min.js"></script>.. <script src="/bootstrap.min.js"></script>.... <link rel="stylesheet" href="/bootstrap.min.css">.... <script src="/md5.min.js"></script>...... <script src="/vue.min.js"></script>.. <style>.. div.state {.. width: 25px;.. height: 25px;.. float: right;.. }.... div.clsDISABLE {.. background: lightgray;.. }.... div.clsNOTACTIVE {.. background: lightgray;.. }.... div.clsWAIT {.. background: yellow;.. }.... div.clsCONNECTED {.. background: green;.. }.... #previewImg {.. display: none;.. width: 100%;.. height: 100%;.. margin: 20px;.. overflow: hidden;.. }.. </style>....</head>....<body>.. <div class="

                                          C:\Program Files (x86)\SRTMiniServer\WEB\jquery-3.4.1.min.js

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:ASCII text, with very long lines (65450), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):88147
                                          Entropy (8bit):5.291368969514295
                                          Encrypted:false
                                          SSDEEP:1536:jTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPmt:jgZm0H5HO5+gCKWZyPmHQ47GKR
                                          MD5:A6B6350EE94A3EA74595C065CBF58AF0
                                          SHA1:B15F7CFA79519756DFF1AD22553FD0ED09024343
                                          SHA-256:412B8FF9C5AB32B9019FCD84BCD4A54C0E265A14528474F4EE45B27A20ABEAEB
                                          SHA-512:F5A9C6AEE347C155E4DD796C51716B7447BC22AE44741FCEB6BCFEE02F955AD4063D38613F241108A3E1F3E1F540FCAED8D9848B9A0FB823C00955CF9A19EFAD
                                          Malicious:false
                                          Reputation:low
                                          Preview:/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}va

                                          C:\Program Files (x86)\SRTMiniServer\WEB\md5.min.js

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:ASCII text, with very long lines (3730), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):3767
                                          Entropy (8bit):5.162847936696883
                                          Encrypted:false
                                          SSDEEP:96:zUTvi9tF3qfkOs+NQ/1Cqg41qNtP+qrmi3:o+9H31Os+NQ/sqgPjP7rmi3
                                          MD5:D42FF83C2D527CDAB773855CFE523561
                                          SHA1:C27927A82941BA972C140ABF26AD82E04C32D86A
                                          SHA-256:9265EA6EE06A36211EF80E33821B309020E5C40C972CF70A07F10577C0CCE549
                                          SHA-512:FA6AE19064268F7E3ADF24578142739E80BF09A2B23F039B1A3E9FA8AFF19D055AD2E3DB5C0758075C4B96D38337DE33E9A5CCD9D04DB3EFBF0CC6C9EEDA14C2
                                          Malicious:false
                                          Reputation:low
                                          Preview:!function(n){"use strict";function t(n,t){var r=(65535&n)+(65535&t);return(n>>16)+(t>>16)+(r>>16)<<16|65535&r}function r(n,t){return n<<t|n>>>32-t}function e(n,e,o,u,c,f){return t(r(t(t(e,n),t(u,f)),c),o)}function o(n,t,r,o,u,c,f){return e(t&r|~t&o,n,t,u,c,f)}function u(n,t,r,o,u,c,f){return e(t&o|r&~o,n,t,u,c,f)}function c(n,t,r,o,u,c,f){return e(t^r^o,n,t,u,c,f)}function f(n,t,r,o,u,c,f){return e(r^(t|~o),n,t,u,c,f)}function i(n,r){n[r>>5]|=128<<r%32,n[14+(r+64>>>9<<4)]=r;var e,i,a,d,h,l=1732584193,g=-271733879,v=-1732584194,m=271733878;for(e=0;e<n.length;e+=16)i=l,a=g,d=v,h=m,g=f(g=f(g=f(g=f(g=c(g=c(g=c(g=c(g=u(g=u(g=u(g=u(g=o(g=o(g=o(g=o(g,v=o(v,m=o(m,l=o(l,g,v,m,n[e],7,-680876936),g,v,n[e+1],12,-389564586),l,g,n[e+2],17,606105819),m,l,n[e+3],22,-1044525330),v=o(v,m=o(m,l=o(l,g,v,m,n[e+4],7,-176418897),g,v,n[e+5],12,1200080426),l,g,n[e+6],17,-1473231341),m,l,n[e+7],22,-45705983),v=o(v,m=o(m,l=o(l,g,v,m,n[e+8],7,1770035416),g,v,n[e+9],12,-1958414417),l,g,n[e+10],17,-42063),m,l,n[e+1

                                          C:\Program Files (x86)\SRTMiniServer\WEB\vue.min.js

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:ASCII text, with very long lines (65445), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):86405
                                          Entropy (8bit):5.2345246771384755
                                          Encrypted:false
                                          SSDEEP:1536:YLZlSVs7FGil28bu82QAqKcxqUrY5yVqhAsryo:glMu2WpnKcxhYEVKAsWo
                                          MD5:3F96EEF2EA71F95E3EF47502FBACA5FF
                                          SHA1:7595DF905B7B1F59C0575EF9E622F8074F4F3960
                                          SHA-256:08598E8F5553EDCE0A9E698B040AECC4D22D9D824EF88458A01A11BDF92C7DAE
                                          SHA-512:9537CE90F01E4B1B2BE6CD33B77CAE86CBF5CC5173E9503406A1FBC5FC101BA8216CF03B91662DE77088722137582B6468089A5243EF07C3096E10555AAE7905
                                          Malicious:false
                                          Reputation:low
                                          Preview:/*!.. * Vue.js v2.5.8.. * (c) 2014-2017 Evan You.. * Released under the MIT License... */..!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):e.Vue=t()}(this,function(){"use strict";function e(e){return void 0===e||null===e}function t(e){return void 0!==e&&null!==e}function n(e){return!0===e}function r(e){return!1===e}function i(e){return"string"==typeof e||"number"==typeof e||"boolean"==typeof e}function o(e){return null!==e&&"object"==typeof e}function a(e){return"[object Object]"===Si.call(e)}function s(e){return"[object RegExp]"===Si.call(e)}function c(e){var t=parseFloat(String(e));return t>=0&&Math.floor(t)===t&&isFinite(e)}function u(e){return null==e?"":"object"==typeof e?JSON.stringify(e,null,2):String(e)}function l(e){var t=parseFloat(e);return isNaN(t)?e:t}function f(e,t){for(var n=Object.create(null),r=e.split(","),i=0;i<r.length;i++)n[r[i]]=!0;return t?function(e){return n[e.toLowerCase()]}

                                          C:\Program Files (x86)\SRTMiniServer\WinSparkle.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1854976
                                          Entropy (8bit):6.293225162957466
                                          Encrypted:false
                                          SSDEEP:49152:hkrhiW6awi1fLs8mNSB8m7MLVjTUhBFJi35ky:bWY6vx7BJi35k
                                          MD5:203518EF7EF3379BA08FA64484EBF8BE
                                          SHA1:4C145C2253759C0EC00EC988D44E742A052D4071
                                          SHA-256:62A8198984DFECB5E561931B19D4C9079CB9A042CD63D54E8930C2EA7ACE52EE
                                          SHA-512:D80F7DB9D395A13DE9C26BC40637E2022F874F7EE3C91229D84756D53007C358248C730A70E3410E48595B27F7F23C796D065E2F5184283BA3F958D62944F85C
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......b.\W&.2.&.2.&.2.....4.2.......2.....:.2...1...2...7...2...6...2./.....2./...'.2./...1.2.&.3..2...;...2...2.'.2.....'.2.&...$.2...0.'.2.Rich&.2.........................PE..d......Y.........." .........H...............................................@............`......................................... .......$........0.. ....@..X...............<t......T...........................@................................................text... ........................... ..`.rdata...D.......F..................@..@.data....(..........................@....pdata..X....@.......v..............@..@.gfids..<.... .......L..............@..@.rsrc... ....0.......P..............@..@.reloc..<t.......v..................@..B................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avcodec-58.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):16499712
                                          Entropy (8bit):6.094485096442523
                                          Encrypted:false
                                          SSDEEP:98304:oh9ScxYmjRIuSh7Hw88kgYAZ0QnLvYCP8lwuL21LP/xBC/b+yZ0pJM2fgyWQ3:oh9SjmdYh74hRvalwR//C/JkM2flWQ
                                          MD5:C51E95E9BBDBF9CA4DA138284C27D4D3
                                          SHA1:53C24A7B4FC43DE83FF6FC85012DF19D3C703C80
                                          SHA-256:1A554DC0931D17848E4AD520DD82DA4DC6B8F65E7A1F1C2F3ADEF6311AAF0F32
                                          SHA-512:F5A737B9C66681A6173FC987D74AA99812533F2E1A0D5C986D6E3D9DB26BDE99E7CD60A7570A3A8E379C30E6C0DCCEFFBCFC23552BC16D1E94FBF935F608A2C7
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........r|..r|..r|......r|...y..r|.>...r|..,...r|..,y..r|..,x..r|...x..r|...}..r|..,}..r|..r}..s|..r|..r|..,x.8q|..,|..r|..,~..r|.Rich.r|.........................PE..d...m..a.........." .....(..........-B....................................... l...........`.........................................Pa...%...}i.x.............d..M............j.....ps..8............................s...............pi..............................text....'.......(.................. ..`.rdata...F<..@...H<..,..............@..@.data.....s..........t..............@....pdata.......d......z..............@..@.idata..`9...pi..:...8..............@..@.gfids........i......r..............@..@_RDATA..i.....i......v..............@..@.00cfg........j......B..............@..@.reloc...~....j......D..............@..B........................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avcodec.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):16499712
                                          Entropy (8bit):6.094485096442523
                                          Encrypted:false
                                          SSDEEP:98304:oh9ScxYmjRIuSh7Hw88kgYAZ0QnLvYCP8lwuL21LP/xBC/b+yZ0pJM2fgyWQ3:oh9SjmdYh74hRvalwR//C/JkM2flWQ
                                          MD5:C51E95E9BBDBF9CA4DA138284C27D4D3
                                          SHA1:53C24A7B4FC43DE83FF6FC85012DF19D3C703C80
                                          SHA-256:1A554DC0931D17848E4AD520DD82DA4DC6B8F65E7A1F1C2F3ADEF6311AAF0F32
                                          SHA-512:F5A737B9C66681A6173FC987D74AA99812533F2E1A0D5C986D6E3D9DB26BDE99E7CD60A7570A3A8E379C30E6C0DCCEFFBCFC23552BC16D1E94FBF935F608A2C7
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........r|..r|..r|......r|...y..r|.>...r|..,...r|..,y..r|..,x..r|...x..r|...}..r|..,}..r|..r}..s|..r|..r|..,x.8q|..,|..r|..,~..r|.Rich.r|.........................PE..d...m..a.........." .....(..........-B....................................... l...........`.........................................Pa...%...}i.x.............d..M............j.....ps..8............................s...............pi..............................text....'.......(.................. ..`.rdata...F<..@...H<..,..............@..@.data.....s..........t..............@....pdata.......d......z..............@..@.idata..`9...pi..:...8..............@..@.gfids........i......r..............@..@_RDATA..i.....i......v..............@..@.00cfg........j......B..............@..@.reloc...~....j......D..............@..B........................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avcodec.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):58100
                                          Entropy (8bit):5.008297750858528
                                          Encrypted:false
                                          SSDEEP:768:LdQerEFYpgBTWMhzrQgBfSdDw7zzpQrFpBNIKBzfNwjdeEYgDDnSvDG7V/S1KEWq:LMRQgBfSQEI6zfWnSfQle88D
                                          MD5:E46E362EFCCA763C15252C2509364ED0
                                          SHA1:A0826A17B1EC9F663A4200AF02D2FD308DD0D131
                                          SHA-256:95E4CEC9D247BAEEFBF7C095627680D671837F31611F09352D8360FD211C245F
                                          SHA-512:9C15AACD2B8C8B4AE8D8E77D4DEF31A36208D7732A63BB2FB305FE2B0C2FDAFA8884F35D785DC03B50D60FE24F4DD8EAC5327E9C8C0E5DC66EE192B1356487B7
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ 1627653229 0 14180 `.......oR..q...r...t"..t"..t...t...u...u...u...u...u...u...vv..vv..v...v...wZ..wZ..w...w...x2..x2..x...x...y...y...y...y...y...y...zd..zd..z...z...{H..{H..{...{...|0..|0..|...|...}...}...}...}...}...}...~j..~j..~...~....\...\...........X...X...........D...D...........8...8........... ... ...................~...~...........p...p...........d...d...........J...J...........:...:...................|...|...........h...h...........P...P...........:...:...................................`...`...........<...<...........4...4..........."..."...................................`...`...........<...<...................................n...n...........F...F...........<...<...........2...2...........$...$...................|...|...........^...^...........J...J...........<...<...................................................t...t...........f...f...........\...\...........<...<...................................j...j...........J...J....

                                          C:\Program Files (x86)\SRTMiniServer\avdevice-58.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):766464
                                          Entropy (8bit):5.86155240126907
                                          Encrypted:false
                                          SSDEEP:6144:IVXvwliMJxngToONU3B9FcY0QpdHKnrDueT0fzh71FP/TCWCONzHOv8r4dgkEbw0:FiMJ9iU3BDrkneV3nFHOv8rKgkE8bh
                                          MD5:64B92D4AD54400169C266EAB0BB76E83
                                          SHA1:B42C63DBD817FAA437E735A94A3EC038378CFBA5
                                          SHA-256:BC3AEE9BC7EB1DA65F30E53E20CE912C9680E70D526B8318AD8ABD0BF4B97419
                                          SHA-512:8B1F22DBF4189DA73047225A8D83857681313C3C1755088223B665D997E3D9A9EAD3AE531AE741C1B109520FD2E56BC55DA509516B6435DAAAEB8EFD9949FA9D
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... C.N..N..N...M..N...K.D.N.r:...N...M..N...K...N...J...N...J...N...O..N.F.O..N..O.3.N.F.J..N.F.N..N.F.L..N.Rich.N.........................PE..d......a.........." .................D.......................................0............`.............................................d....................P..D[..................0\..8...........................p\...............................................text.............................. ..`.rdata..t2.......4..................@..@.data....4..........................@....pdata...e...P...f..................@..@.idata..A-...........l..............@..@.gfids..............................@..@.00cfg..............................@..@.reloc..............................@..B........................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avdevice.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):766464
                                          Entropy (8bit):5.86155240126907
                                          Encrypted:false
                                          SSDEEP:6144:IVXvwliMJxngToONU3B9FcY0QpdHKnrDueT0fzh71FP/TCWCONzHOv8r4dgkEbw0:FiMJ9iU3BDrkneV3nFHOv8rKgkE8bh
                                          MD5:64B92D4AD54400169C266EAB0BB76E83
                                          SHA1:B42C63DBD817FAA437E735A94A3EC038378CFBA5
                                          SHA-256:BC3AEE9BC7EB1DA65F30E53E20CE912C9680E70D526B8318AD8ABD0BF4B97419
                                          SHA-512:8B1F22DBF4189DA73047225A8D83857681313C3C1755088223B665D997E3D9A9EAD3AE531AE741C1B109520FD2E56BC55DA509516B6435DAAAEB8EFD9949FA9D
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... C.N..N..N...M..N...K.D.N.r:...N...M..N...K...N...J...N...J...N...O..N.F.O..N..O.3.N.F.J..N.F.N..N.F.L..N.Rich.N.........................PE..d......a.........." .................D.......................................0............`.............................................d....................P..D[..................0\..8...........................p\...............................................text.............................. ..`.rdata..t2.......4..................@..@.data....4..........................@....pdata...e...P...f..................@..@.idata..A-...........l..............@..@.gfids..............................@..@.00cfg..............................@..@.reloc..............................@..B........................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avdevice.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):6336
                                          Entropy (8bit):4.97017567162833
                                          Encrypted:false
                                          SSDEEP:48:nbCUApZJXqiH4/dVk6s+bsHg/PeKKoyAOu2eeKxD3YFeKbx/7/AP56JkYZUFIacl:nbCUA1qbdVkqI5KcKxDvKb5zQMJbZCx6
                                          MD5:17C2C64C919188122ECD625E960E392D
                                          SHA1:7665D09B4FD4E998F8FE64E2BE540F4A7227AFC6
                                          SHA-256:A17E6E146C0D312E58350683A6274ED120F51D0C910C8C3F8E365E95104CE833
                                          SHA-512:259A6EDE6F7437A77B03BE760DFC5B81782F7D9E50E34359B88AFBB5F920EC3594E695048ACA3D51ED723ADCF5AE2382948E576F322169581005D142EBE2A934
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ 1627653301 0 1324 `....)...........V...........0...0...................................................................................|...|...........j...j...........\...\...........N...N__IMPORT_DESCRIPTOR_avdevice-58.__NULL_IMPORT_DESCRIPTOR..avdevice-58_NULL_THUNK_DATA.__imp_av_device_capabilities.av_device_capabilities.__imp_av_device_ffversion.av_device_ffversion.__imp_av_fopen_utf8.av_fopen_utf8.__imp_av_input_audio_device_next.av_input_audio_device_next.__imp_av_input_video_device_next.av_input_video_device_next.__imp_av_output_audio_device_next.av_output_audio_device_next.__imp_av_output_video_device_next.av_output_video_device_next.__imp_avdevice_app_to_dev_control_message.avdevice_app_to_dev_control_message.__imp_avdevice_capabilities_create.avdevice_capabilities_create.__imp_avdevice_capabilities_free.avdevice_capabilities_free.__imp_avdevice_configuration.avdevice_configuration.__imp_avdevice_dev_to_app_control_message.avdevi

                                          C:\Program Files (x86)\SRTMiniServer\avfilter-7.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):5238784
                                          Entropy (8bit):5.797359864609232
                                          Encrypted:false
                                          SSDEEP:49152:wPWV80ghqa3gC24Y2IAHk/c8hvlBgMtDNeav4NBNjh4jsjFmnWD7gIhaSu6aAP/S:wmRrP2gZDze3BTnI
                                          MD5:16349AD59F50BD87D680EC80B2F9A62D
                                          SHA1:C143C1F639A5F760020C910C8ECDC8F6792B387C
                                          SHA-256:4CC7D312149EE591FD2FA0A5B2BB6C6D9009BF96B26E4FDEB8BFB5719DC35DDF
                                          SHA-512:B75483218817D57C6DCC567B5A77AF9723DC53B5AF8011DBDEAC58A15A720D98917EFDA5BAD52BECCB7693621A6B619C6E5223C2F9C75B0CECD0D1A34C12AF6D
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h~.h~.h~...z..h~...}.h~...{..h~.....h~.6}.h~.6{.h~.6z.h~.'6..h~.h...i~.h~.h~.'6z..i~.'6~.h~.'6|.h~.Rich.h~.................PE..d......a.........." ......9..<......aJ........................................P...........`.........................................0.K.......N...............L...............O.....p;G.8............................;G...............N..............................text.....9.......9................. ..`.rdata..7....09...... 9.............@..@.data....s...0K.......K.............@....pdata........L.......L.............@..@.idata...<....N..>..."N.............@..@.gfids........O......`N.............@..@_RDATA........O......dN.............@..@.00cfg........O.......O.............@..@.reloc........O...... O.............@..B........................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avfilter.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):5238784
                                          Entropy (8bit):5.797359864609232
                                          Encrypted:false
                                          SSDEEP:49152:wPWV80ghqa3gC24Y2IAHk/c8hvlBgMtDNeav4NBNjh4jsjFmnWD7gIhaSu6aAP/S:wmRrP2gZDze3BTnI
                                          MD5:16349AD59F50BD87D680EC80B2F9A62D
                                          SHA1:C143C1F639A5F760020C910C8ECDC8F6792B387C
                                          SHA-256:4CC7D312149EE591FD2FA0A5B2BB6C6D9009BF96B26E4FDEB8BFB5719DC35DDF
                                          SHA-512:B75483218817D57C6DCC567B5A77AF9723DC53B5AF8011DBDEAC58A15A720D98917EFDA5BAD52BECCB7693621A6B619C6E5223C2F9C75B0CECD0D1A34C12AF6D
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h~.h~.h~...z..h~...}.h~...{..h~.....h~.6}.h~.6{.h~.6z.h~.'6..h~.h...i~.h~.h~.'6z..i~.'6~.h~.'6|.h~.Rich.h~.................PE..d......a.........." ......9..<......aJ........................................P...........`.........................................0.K.......N...............L...............O.....p;G.8............................;G...............N..............................text.....9.......9................. ..`.rdata..7....09...... 9.............@..@.data....s...0K.......K.............@....pdata........L.......L.............@..@.idata...<....N..>..."N.............@..@.gfids........O......`N.............@..@_RDATA........O......dN.............@..@.00cfg........O.......O.............@..@.reloc........O...... O.............@..B........................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avfilter.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):18062
                                          Entropy (8bit):4.9900150569814095
                                          Encrypted:false
                                          SSDEEP:192:ac0oTFT5V1nNRS2qTSJLoPn+G75uyXT1k+GUJhqpWKpP2KgO+Px+49:ac0oTF/RSf+Zya+ZePzUJD
                                          MD5:0BE24344F0B26B2D6E4993233ACD47BD
                                          SHA1:80BE3AC2AD082527BDA94DCD6F176259B50E20BC
                                          SHA-256:704081D214C16B0F3FD402C5A236B92E47CCFCE482C24351E1A5A5626B66326A
                                          SHA-512:8A17290FB019BB920D69584D49D44098EC77B45E81D08D77959CD9A036A11052315FF2A00D560C08E521C0C84AAC4B51D6E03CD85EAC956F4784D8B37AC6BE84
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ 1627653292 0 4288 `......."...$@..%z..&...&...'V..'V..'...'...(P..(P..(...(...)@..)@..)...)...*:..*:..*...*...+...+...+...+...,2..,2..,...,...-(..-(..-...-.................../.../.../~../~../.../...0l..0l..0...0...1n..1n..1...1...2b..2b..2...2...3H..3H..3...3...42..42..4...4...5...5...5...5...5...5...6p..6p..6...6...7b..7b..7...7...8R..8R..8...8...9@..9@..:*..:*..9...9...:...:...;...;...;...;...<...<...<...<...=...=...=|..=|..=...=...>d..>d..>...>...?J..?J..?...?...@*..@*..@...@...A...A...A...A...B...B...Bz..Bz..B...B...Cb..Cb..C...C...DP..DP..D...D...E8..E8..E...E...F...F.__IMPORT_DESCRIPTOR_avfilter-7.__NULL_IMPORT_DESCRIPTOR..avfilter-7_NULL_THUNK_DATA.__imp_av_abuffersink_params_alloc.av_abuffersink_params_alloc.__imp_av_buffersink_get_channel_layout.av_buffersink_get_channel_layout.__imp_av_buffersink_get_channels.av_buffersink_get_channels.__imp_av_buffersink_get_format.av_buffersink_get_format.__imp_av_buffersink_get_frame.av_buffe

                                          C:\Program Files (x86)\SRTMiniServer\avformat-58.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):3654144
                                          Entropy (8bit):5.812478515063854
                                          Encrypted:false
                                          SSDEEP:49152:JOitYRE+tgqVVdoi7KG/sM9GTjoFC6rkQZBoy2mIYcj13IZS7an0swH+:+E+tgqVUi7KG/sQGn6J2mHf
                                          MD5:FD344F58FABDB9F27DB2FD817CEB27A5
                                          SHA1:46C44FC2AB224795A16FC9A597A8542D226AEACB
                                          SHA-256:2D7EC29897CC15680C99FDDFA5EAA4818D88076B8C19ABE7427D55DFC3FD8EA5
                                          SHA-512:69F80B5E355F7223D43BB25A50627B9FD2FDAA4DC7BB6EB257F7383203BBE0F22E0A738F13771ABE8549CF0D1900F32E2AEDF935F99A683A94D7C8C6A37D641A
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 2%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................FAU........................r.........?...r...?...r......r......Rich...................PE..d......a.........." .....`'.........}L.......................................08...........`.........................................pE3. ....C7.x............P5.X.............7..K..../.8...........................P./..............07..............................text....^'......`'................. ..`.rdata.......p'......d'.............@..@.data...Q....`3......T3.............@....pdata.......P5.......5.............@..@.idata...S...07..T....6.............@..@.gfids........7......F7.............@..@.00cfg........7......J7.............@..@.reloc...t....7..v...L7.............@..B................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avformat.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):3654144
                                          Entropy (8bit):5.812478515063854
                                          Encrypted:false
                                          SSDEEP:49152:JOitYRE+tgqVVdoi7KG/sM9GTjoFC6rkQZBoy2mIYcj13IZS7an0swH+:+E+tgqVUi7KG/sQGn6J2mHf
                                          MD5:FD344F58FABDB9F27DB2FD817CEB27A5
                                          SHA1:46C44FC2AB224795A16FC9A597A8542D226AEACB
                                          SHA-256:2D7EC29897CC15680C99FDDFA5EAA4818D88076B8C19ABE7427D55DFC3FD8EA5
                                          SHA-512:69F80B5E355F7223D43BB25A50627B9FD2FDAA4DC7BB6EB257F7383203BBE0F22E0A738F13771ABE8549CF0D1900F32E2AEDF935F99A683A94D7C8C6A37D641A
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 2%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................FAU........................r.........?...r...?...r......r......Rich...................PE..d......a.........." .....`'.........}L.......................................08...........`.........................................pE3. ....C7.x............P5.X.............7..K..../.8...........................P./..............07..............................text....^'......`'................. ..`.rdata.......p'......d'.............@..@.data...Q....`3......T3.............@....pdata.......P5.......5.............@..@.idata...S...07..T....6.............@..@.gfids........7......F7.............@..@.00cfg........7......J7.............@..@.reloc...t....7..v...L7.............@..B................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avformat.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):41278
                                          Entropy (8bit):5.006751445989004
                                          Encrypted:false
                                          SSDEEP:768:0YK+VYrqBkf5uBIaYqkSPW8VrBlGMASKOsE8xYNrY7jt9:0YKhuBI+PWkuy8x/9
                                          MD5:2F99AEEC722798D348FC5FE33A902A8C
                                          SHA1:B11DB6D65C4AE194F634C9CB0C04913E75E0DF2C
                                          SHA-256:5AEF734CCDD507DDBE4A0B9A0C0F8E25EFFE2062BE14CF9679080B4433820010
                                          SHA-512:D116478619E91DB09B71C66DC44C9A3BA87C2437BB7B75772A33EBAD1C8D30B2EC1BA3A033457C20C17CC8D1C54FFF790BD1FD07A7A7F15D6654D1F4993907E7
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ 1627653258 0 9648 `....e..K...N$..O^..P...P...Q4..Q4..Q...Q...R"..R"..R...R...S...S...Sv..Sv..S...S...TZ..TZ..T...T...UB..UB..U...U...V4..V4..V...V...W&..W&..W...W...X...X...X...X...Y...Y...Y...Y...Z...Z...Z...Z...[...[...[z..[z..[...[...\r..\r..\...\...]n..]n..]...]...^j..^j..^...^..._j.._j.._..._...`V..`V..`...`...aN..aN..a...a...b<..b<..b...b...c"..c"..c...c...d...d...dv..dv..d...d...e`..e`..e...e...f@..f@..f...f...g6..g6..g...g...h(..h(..h...h...i...i...i...i...iz..iz..jZ..jZ..j...j...kH..kH..k...k...l6..l6..l...l...m*..m*..m...m...n...n...nt..nt..n...n...o^..o^..o...o...pF..pF..p...p...q,..q,..q...q...r ..r ..r...r...s...s...s...s...t...t...t...t...u...u...u...u...v...v...v|..v|..v...v...wf..wf..w...w...x\..x\..x...x...yR..yR..y...y...zD..zD..z...z...{*..{*..{...{...|...|...|...|...}...}...}...}...~...~...~z..~z..~...~....r...r...........\...\...........F...F...........<...<...........<...<...................................j...j....

                                          C:\Program Files (x86)\SRTMiniServer\avutil-56.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1519104
                                          Entropy (8bit):5.915092115142045
                                          Encrypted:false
                                          SSDEEP:24576:lBZ6ZbAN9x7HblmLHEVgK8GeYmPBSGePW:lzqbA9x770LkWK8GoPBSG
                                          MD5:74F6769953D29A4E27CB20F56D138794
                                          SHA1:7C5C3E5A8BE913B9A6B31674FDDFBDFBE40A7F6D
                                          SHA-256:3A57E12FF2B3F2EC80EDD55BB356AB86221DEEEA7902DE892C329FAB789BD041
                                          SHA-512:329C1AFFB7228B534DDAC2DE97FBABCE8DBA9AF140397D6B9B0C2522787B68A664CA983EA0E8EF2ADD26695FD619268402F3B71200B4FE9DABA99652648720DC
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Va..7.A.7.A.7.A.S.@.7.A.S.@.7.A.S.@.7.A;..A.7.A.i.@.7.A.i.@.7.A.i.@.7.A.S.@.7.A.7.A.7.A.7.A.7.A.i.@.7.A.i.@.7.A.i.@.7.ARich.7.A........................PE..d...^..a.........." .....~...R-......R....................................... ?...........`.........................................p...$M....>.P.............=...............>..... ...8...........................`.................>..............................text...M|.......~.................. ..`.rdata...r.......t..................@..@.data...Y.'.........................@....pdata.......=.....................@..@.idata........>.....................@..@.gfids........>.....................@..@_RDATA........>.....................@..@.00cfg........>.....................@..@.reloc...<....>..>..................@..B................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avutil.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1519104
                                          Entropy (8bit):5.915092115142045
                                          Encrypted:false
                                          SSDEEP:24576:lBZ6ZbAN9x7HblmLHEVgK8GeYmPBSGePW:lzqbA9x770LkWK8GoPBSG
                                          MD5:74F6769953D29A4E27CB20F56D138794
                                          SHA1:7C5C3E5A8BE913B9A6B31674FDDFBDFBE40A7F6D
                                          SHA-256:3A57E12FF2B3F2EC80EDD55BB356AB86221DEEEA7902DE892C329FAB789BD041
                                          SHA-512:329C1AFFB7228B534DDAC2DE97FBABCE8DBA9AF140397D6B9B0C2522787B68A664CA983EA0E8EF2ADD26695FD619268402F3B71200B4FE9DABA99652648720DC
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Va..7.A.7.A.7.A.S.@.7.A.S.@.7.A.S.@.7.A;..A.7.A.i.@.7.A.i.@.7.A.i.@.7.A.S.@.7.A.7.A.7.A.7.A.7.A.i.@.7.A.i.@.7.A.i.@.7.ARich.7.A........................PE..d...^..a.........." .....~...R-......R....................................... ?...........`.........................................p...$M....>.P.............=...............>..... ...8...........................`.................>..............................text...M|.......~.................. ..`.rdata...r.......t..................@..@.data...Y.'.........................@....pdata.......=.....................@..@.idata........>.....................@..@.gfids........>.....................@..@_RDATA........>.....................@..@.00cfg........>.....................@..@.reloc...<....>..>..................@..B................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\avutil.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):122452
                                          Entropy (8bit):5.075210096218731
                                          Encrypted:false
                                          SSDEEP:3072:g4AgI+cRGmPzD7440fmSxPWajioXbTjr653Z:g4AvGmPzD74hmSx3jioX653Z
                                          MD5:A5BA76A581C351E3060E8412D27A0644
                                          SHA1:41629B3572F3D1D844E55A3E45B36EE6CBAD8A00
                                          SHA-256:114547F0052CDAC2D443EF83D1B6FBFD894057F525C1B515BCACF9332DEBB1FA
                                          SHA-512:5A292319683C472A91074B8F3D43CB3D2A59D9F56B7CB23D7B7A4498995131E15A9F5182D849D62B8D8EF82761D450A266004606E9725DAC770A9C556341540B
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ 1627653214 0 29172 `....Q...r..........:...:.................v...v...........R...R...............................|...|...........`...`...........F...F.........(...(.................t...t...........T...T...........8...8.................................v...v...........Z...Z...........<...<...................................j...j...........D...D...........0...0...................|...|...........b...b...........H...H...........$...$...................r...r...........\...\...........F...F...........<...<........... ... ...................x...x...........T...T...........*...*...................z...z...........X...X...........4...4...................................~...~...........b...b...........P...P...........:...:...........&...&...................v...v...........~...~...........Z...Z...........0...0...................h...h...........R...R...........*...*...................j...j...........B...B...................................j

                                          C:\Program Files (x86)\SRTMiniServer\bearer\qgenericbearer.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):53368
                                          Entropy (8bit):5.970742008855059
                                          Encrypted:false
                                          SSDEEP:768:aYmAvGHIfpfsBYgfFOINotxX8hNKdxdpgqycW/Ru5wyB1m0Tx9fygp69XbVmzR:kHCUNOqoghNKdx/gqycW/EBd96gGXbQ1
                                          MD5:CC919B21CE13287DD11AFFFF24F6DB6D
                                          SHA1:D41F80E2C56A357EE8742C8FBDFD290407130E7E
                                          SHA-256:023B1A28897817FE9AECA65882997D3F72337BE6FBE3FD1FF4FBF264AE4C5F98
                                          SHA-512:C250A3296D4B742A8392D75430090D3ACA882561040A3BF67BD390F4D2C3CB2417E45A8B0BDBA13F7349A2F098DAD30AB53FF11DD34F4E4A6DE3D13A893DE4F6
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..?}..l}..l}..lt..ly..l..m...l..m~..l..ml..l..mw..l..my..l..mx..l}..l..l..m{..l..m|..l..{l|..l..m|..lRich}..l........................PE..d...9..].........." .....T...h......0X..............................................n.....`.............................................|...............P.......P.......x.......p.......T.......................(... ................p...............................text....R.......T.................. ..`.rdata...F...p...H...X..............@..@.data...............................@....pdata..P...........................@..@.qtmetadj...........................@..P.rsrc...P...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\crashrpt_lang.ini

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):8214
                                          Entropy (8bit):3.46410018464503
                                          Encrypted:false
                                          SSDEEP:96:rsw6o2KPZEOTWSucfgjfJpkiZJpkiVxoVrOSBngI3NnS0FivuiLugXeTmZ4dIc8k:wlo2K/uKFVVgOgncoW
                                          MD5:771DA39B527E886A247A0C0A33FFB715
                                          SHA1:CB762ABE50294A08A7823C246E02CD9347555B49
                                          SHA-256:763F0FE5AF80055827FB2563AF696BD1452C39BE080720AB483D0CE6AC36EE92
                                          SHA-512:628382CF8A6035275B48D6FF3CF0DC17C2B61F65E4EF0F138990A09FD0CF09A4F821E2CB5780A3FDDB49A01E3F6AF1F379ED44BEF290D39B0D04D5E110B7D9A5
                                          Malicious:false
                                          Reputation:low
                                          Preview:..[.S.e.t.t.i.n.g.s.].....A.u.t.h.o.r.N.a.m.e.=.....A.u.t.h.o.r.E.m.a.i.l.=.....L.a.n.g.u.a.g.e.=.E.n.g.l.i.s.h.....R.T.L.R.e.a.d.i.n.g.=.0.....C.r.a.s.h.R.p.t.V.e.r.s.i.o.n.=.1.4.0.3.........[.M.a.i.n.D.l.g.].....D.l.g.C.a.p.t.i.o.n.=.E.r.r.o.r. .R.e.p.o.r.t.....H.e.a.d.e.r.T.e.x.t.=.%.s. .h.a.s. .s.t.o.p.p.e.d. .w.o.r.k.i.n.g.....S.u.b.H.e.a.d.e.r.T.e.x.t.=.P.l.e.a.s.e. .s.e.n.d. .u.s. .t.h.i.s. .e.r.r.o.r. .r.e.p.o.r.t. .(.%.s.). .t.o. .h.e.l.p. .f.i.x. .t.h.e. .p.r.o.b.l.e.m. .a.n.d. .i.m.p.r.o.v.e. .t.h.i.s. .s.o.f.t.w.a.r.e.......W.h.a.t.D.o.e.s.R.e.p.o.r.t.C.o.n.t.a.i.n.=.W.h.a.t. .d.o.e.s. .t.h.i.s. .r.e.p.o.r.t. .c.o.n.t.a.i.n.?.....P.r.o.v.i.d.e.A.d.d.i.t.i.o.n.a.l.I.n.f.o.=.P.r.o.v.i.d.e. .a.d.d.i.t.i.o.n.a.l. .i.n.f.o. .a.b.o.u.t. .t.h.e. .p.r.o.b.l.e.m. .(.r.e.c.o.m.m.e.n.d.e.d.).......Y.o.u.r.E.m.a.i.l.=.Y.o.u.r. .E.-.m.a.i.l.:.....D.e.s.c.r.i.b.e.P.r.o.b.l.e.m.=.D.e.s.c.r.i.b.e. .i.n. .a. .f.e.w. .w.o.r.d.s. .w.h.a.t. .y.o.u. .w.e.r.e. .d.o.i.n.g. .w.h.e.n. .t.h.e. .e.r.

                                          C:\Program Files (x86)\SRTMiniServer\dbghelp.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                          Category:dropped
                                          Size (bytes):1256080
                                          Entropy (8bit):6.309251228019489
                                          Encrypted:false
                                          SSDEEP:12288:6llxriy6xVDK69gTNYS0zmJGB6cHRecworIMHr5QpUPmhETVo2Qm9H3RgQHRhLrs:Ivi/DK69YNYSIWcHY9GZDJ3G6RhLzy3
                                          MD5:DEE832103585EE41BD7F1A905F0726F7
                                          SHA1:74D43E48CF87C48168A65159C308BB67CF691012
                                          SHA-256:3AB019BD41C6F30D4250F26B40E695021698D7909D538E2F9B8AEAB73BB7B8AA
                                          SHA-512:7F55444A953B95A179F0C80DDC102BF26ED2B1C60BF5BCE7BAFACAB20AB5DA3F0CE35B0AFB49888C12AFA89F9B14F469E9D23708DD96E1111BE654B6D967ECCB
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.e.1...1...1...............0.......=...1...........6.......".......p.......0.......e....#u.........0.......0...Rich1...................PE..L......S...........!......................................................................@.........................p...s......P........................<..........`............................... ...@.......................@....................text............................... ..`.data............H..................@....idata..b...........................@..@.rsrc................&..............@..@.reloc..............0..............@..B................................................................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\iconengines\qsvgicon.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):41080
                                          Entropy (8bit):6.096989444680318
                                          Encrypted:false
                                          SSDEEP:768:XyK9XT0p6fg+mtWEFGjLpsSul7z3Z4UamzAU:XjF0pUgFtWEMjLps1l7z3Z4GEU
                                          MD5:372721E063CCC13AC8A273556933AC94
                                          SHA1:4C0F3231CF684F6569D2701CBDD38196701AF728
                                          SHA-256:218ED2C3C6A251983CDBD3D333982BFC48E601C5F6E43717C6AA92EB37FC48B4
                                          SHA-512:BF45A9D64518767B00966429911DF076D922A8C8D79278ED9976221A054A37A157AA5ED76018F64004D7EF1992155F0E03E9A318B2172C64C2858B4B7052A45F
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l\...2...2...2..u....2..o3...2..o3...2..o1...2..o7...2..o6...2..n3...2...3.U.2..n7...2..n2...2..n...2..n0...2.Rich..2.........................PE..d...%..].........." .....B...F......LH....................................................`.........................................pw..x....w..........H.......4.......x...........`h..T....................i..(....h...............`...............................text...9A.......B.................. ..`.rdata...3...`...4...F..............@..@.data................z..............@....pdata..4............|..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qgif.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):37496
                                          Entropy (8bit):6.049886753919195
                                          Encrypted:false
                                          SSDEEP:384:3IqlSGr/3oMtlWYfyn4CL6VO41uv3JqlsRTVh9+pnHU+Z5Ol5fp/EhLKnfePPLTm:dfoM24E6J7suU+Lmf2h2mzXK
                                          MD5:F824AEB1027BD965ED3EF984BD4664FA
                                          SHA1:5B79D33F17365A97EFFA2647E8255097D1B353DD
                                          SHA-256:95D2C7EA857D9583E0E45EDE9C27EE2D8B2B9A8C7818A81BC5437AED3865AC73
                                          SHA-512:75C82151D2AC88A659BD9967DFD7898874D9325AA34D879C170A9FAEE3CA08AC9AB654903825B9FBC6B265C280EB11851781A034F542E99EAFFDF1D10514064B
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.l............................q...........................................m...................................Rich............PE..d......].........." .....>...B.......C....................................................`..........................................f..t....f..........@.......p....|..x...........0W..T....................X..(....W...............P...............................text....=.......>.................. ..`.rdata...(...P...*...B..............@..@.data...X............l..............@....pdata..p............n..............@..@.qtmetads............t..............@..P.rsrc...@............v..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qicns.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):46712
                                          Entropy (8bit):6.0948625087007775
                                          Encrypted:false
                                          SSDEEP:768:hZYxOAlvD6THTF7lcmSXtH40ZLRDETh/o6OKFrJeFum0mz7:zhAxuTHZBg40zETh/aKFrJeFumVP
                                          MD5:BF3D5494A1E9AAB786DDD4164B7688A5
                                          SHA1:240D293978D988B45B7D096D08937A27BC833754
                                          SHA-256:E9A2D8530BB3CB93AAE1DEC31D1CE5B4388698D338B2E6EFC78E5A22AA32F1BC
                                          SHA-512:8A0AE5BF5AF06C43BCD77E7D8652753D651BF372742B87D2BEF2799386FEA1AA573B9630F8BD0C1A9C677793DC7A77A807E4EC1A1295B6633FEDA7E68BDD33D8
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r=.Y.S.Y.S.Y.S.Pk.._.S..qR.[.S.*qR.[.S..qP.[.S..qV.K.S..qW.Q.S..pR.\.S.Y.R...S..pV.[.S..pS.X.S..p..X.S..pQ.X.S.RichY.S.........PE..d......].........." .....L...R.......R....................................................`.........................................@~..t....~..........@...............x............m..T...................Xn..(...`m...............`...............................text....K.......L.................. ..`.rdata..b7...`...8...P..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qico.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):38008
                                          Entropy (8bit):5.971768661665538
                                          Encrypted:false
                                          SSDEEP:384:DHzaGIzlL7z2xCCwEwi1qXutba0OcUdhr41M1K18nSqHwv4zPI4il9y+bsCnfePY:DTaBjWwyT8ZnSqQv+PI9y+bsCmzyn
                                          MD5:7B9897AD3B8FD4B0A30A63A5D9069133
                                          SHA1:18683135B910D29A70711E92EF95FE20D717DD19
                                          SHA-256:4CDB55A9B8EC00FB0EC01E4C11E7EDA9DCFCAF4CFCC491B4A902ACE09BEA8A9F
                                          SHA-512:0E0FDE18DE2E7688A6AC9DE99B31E044933E8D26968F678BBF2B8C18B81E3C4ACE8175476CFB7AB940FE05960E80916905AE036811C92768AA424F0EB64F5E24
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9".\}Cd.}Cd.}Cd.t;..yCd..!e..Cd..!e..Cd..!g.~Cd..!a.iCd..!`.wCd.. e.xCd.}Ce..Cd.. a.~Cd.. d.|Cd.. ..|Cd.. f.|Cd.Rich}Cd.................PE..d......].........." .....8...H.......<..............................................,.....`..........................................g..t....h..........@............~..x........... X..T...................xY..(....X...............P..H............................text....6.......8.................. ..`.rdata..P/...P...0...<..............@..@.data................l..............@....pdata...............p..............@..@.qtmetad.............v..............@..P.rsrc...@............x..............@..@.reloc...............|..............@..B................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qjpeg.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):403064
                                          Entropy (8bit):5.687936176386248
                                          Encrypted:false
                                          SSDEEP:6144:imsJ0PtIqeDh6jyQ4t2XieW2ZSCWbvzZXcTVbH5mJXPCV1je0TfZF:imt1fXj4lpCnDZF
                                          MD5:D7C537066C088459B29E1BD1BF4E9C89
                                          SHA1:5E6CC70FF1F8AC6245A96FB47B7F28EF12C956A2
                                          SHA-256:8C57EA7524A4788D5DEB5C3B9ECA9EB0E3DB0D7D3FA689A4A11ABF50271FA2CA
                                          SHA-512:26F72C81AEE129202991A96FDE4A57C09AC9E588A2E040E28DCBF3CD9821C948812800127BBE160952E55CA05A8FFC6D3BDF6DDA4F492708BCF98E764903695C
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......xU.<4..<4..<4..5L..64...V..>4..OV..>4..O.=4...V..?4...V..(4...V..64...W..94..<4..4...W...4...W..?4...W..=4...Ww.=4...W..=4..Rich<4..........................PE..d...Q..].........." .................%.......................................p.......N....`.........................................P...t............P..@.......T!......x....`.........T...................H...(...P................0...............................text...)........................... ..`.rdata.......0......."..............@..@.data...X...........................@....pdata..T!......."..................@..@.qtmetad.....@......................@..P.rsrc...@....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qsvg.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):31352
                                          Entropy (8bit):5.931721950860058
                                          Encrypted:false
                                          SSDEEP:384:SZw4dpXca9ilSrS9OmUj2NoLHP2JaXjCGI4bzFXgfrhuw72TN6nfePPLTTjczq:CRZO9N+QNsXjCIFwfcwKT0mz1
                                          MD5:3927023C462C2B7A0DEAE2795685FDCC
                                          SHA1:8138BF193CAF4D290DD49CC2D1A8A0B4ACCB4C1E
                                          SHA-256:D14841D9EC61F0D972A06EC5E71B80138205B2474AC03EC0918E15743454BF74
                                          SHA-512:64F281E5FAE5118655B4A3D0048EC2EEE15660A5BEBEABA38B7BA7865F17E566D013ECC5B39350906CB7803100345C249FA9FD0272C89FB4D3BE51C00F178817
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tu..0.i.0.i.0.i.9l..4.i..vh.2.i.Cvh.2.i..vj.3.i..vl.".i..vm.:.i..wh.7.i.0.h..i..wl.2.i..wi.1.i..w..1.i..wk.1.i.Rich0.i.........................PE..d...#..].........." .....&...B......@*...............................................;....`.........................................`T..t....T..........@............d..x............G..T....................I..(... H...............@.. ............................text....$.......&.................. ..`.rdata...*...@...,...*..............@..@.data...X....p.......V..............@....pdata...............X..............@..@.qtmetad.............\..............@..P.rsrc...@............^..............@..@.reloc...............b..............@..B........................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qtga.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):30840
                                          Entropy (8bit):5.823352142084011
                                          Encrypted:false
                                          SSDEEP:384:uZJkWvS28DC3K/SsvTlKFSJ87MEUwTilbFzxrP5nfePPLTTjqh:uoqMS4lPJAMEUwkF9rxmzOh
                                          MD5:7C3E347A3E8FC0B991B36A2B1CFBCF03
                                          SHA1:8F27CCE3FCC9F7E2D5BA4F36D6D164DCD954866E
                                          SHA-256:87279DC013BFACB085F311A1108E8A04B96B1E3D83D5C199098473453CE5273F
                                          SHA-512:4F3FA11221BFBA074A5230BFEBFA0C8189A2B337EE7162861DFD5C69AB18FC98962A321533EC5AD4C8B3302F18F18DD92F76CBE16C5C813B8F0E5DDFB972E113
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b................8............8......8......8......*............*......*......*......*......Rich...........................PE..d......].........." .....$...@......()...............................................#....`.........................................@W..t....W..........@............b..x............H..T...................(J..(...0I...............@..H............................text....#.......$.................. ..`.rdata..((...@...*...(..............@..@.data........p.......R..............@....pdata...............V..............@..@.qtmetadu............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qtiff.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):385656
                                          Entropy (8bit):5.705852521717556
                                          Encrypted:false
                                          SSDEEP:6144:LeWiCkxDp7EEEEEEIanPIHSo7rNQOpPjd3MiMOPwMtY:6Wi1x3nAyoldFY
                                          MD5:2B4A9C304167635107DB24BDA6824DFA
                                          SHA1:C80D6FCA943B42660AEEC41FCBBD4F6CDD877CD3
                                          SHA-256:4F116CD865107B0605A9BB8193E9A24B8B5EC00E76AE959FFCB1E91D490D911D
                                          SHA-512:DF2115C3E5591DA1E9297FB4051F73788124863C855192C809F33FCE3181802EB1793F25556CC529561B9219B8EAC251AF321446A2468D4108556C4FD7213B24
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0.0.ti^.ti^.ti^.}..di^..._.vi^..._.vi^...].pi^...[.`i^...Z.~i^..._.qi^.ti_..i^...[.vi^...Z.Wi^...^.ui^.....ui^...\.ui^.Richti^.........................PE..d......].........." ................@........................................ ............`.........................................`...t..............@.......x'......x.......$...@T..T....................U..(....T...............0...............................text............................... ..`.rdata...w...0...x..................@..@.data...X...........................@....pdata..x'.......(..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..$...........................@..B................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qwbmp.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):29304
                                          Entropy (8bit):5.963247593605271
                                          Encrypted:false
                                          SSDEEP:384:YNbvUPgr1FnxLMiECSFC8E2Dav9EuwO4/E9JHsnfePPLTTjZ:u1XMQoE2GvpwOAE9JMmzd
                                          MD5:432CAA14CE03C85F3E23CF4FD53A2221
                                          SHA1:9FCE139500EE4FAB629437E926639F7047A23098
                                          SHA-256:9C0BBEB17903374DC282FB65EB85EC42F522A7941E1B76BEACF7FB24F76F0718
                                          SHA-512:F860ADAEDB8704694BE05E38F3727888FB9C3F73F6DE8A05DF9F7D79891F48012783DC2A1F3C69F22167A048777C53ABA9BD438BACABAC6A26741C90D377A58C
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................i.....G...............G.......G.......G.......U...............U.......U.......U.......U.......Rich....................PE..d......].........." ....."...8.......)....................................................`..........................................T..t....T..........@............\..x............F..T...................(H..(...0G...............@..p............................text....!.......".................. ..`.rdata..R&...@...(...&..............@..@.data........p.......N..............@....pdata...............P..............@..@.qtmetad~............T..............@..P.rsrc...@............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\imageformats\qwebp.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):497784
                                          Entropy (8bit):6.63454110478341
                                          Encrypted:false
                                          SSDEEP:12288:e5BavMOQwH9T9NRibx3hXMSJi9EAM7VEGN:e54lQwHF97iASJmiVEGN
                                          MD5:CB1394843BC3E40980309DFE51E32699
                                          SHA1:E9B255A701B5A85C32530734743EE2109E986415
                                          SHA-256:9D6AAC5B1978CEC9F88C67CC1013DF28A614E2A7DD954E7C1B9E89E7DAF72EF5
                                          SHA-512:7F192BF436E5D5C5371D66B256EBC641ECBDFAE1802ABFF5AD8CEE45562EB1BABD00AA1F40CE85FC6ED5911CA4EA7260610E7FECAB69E108001B3908DEAFDF6B
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................../..."............"......"...."....0..............0......0....0......0.C.....0......Rich....................PE..d......].........." .....................................................................`..........................................-..t...D...........@........F......x...........p...T......................(......................0............................text............................... ..`.rdata..~s.......t..................@..@.data...X(...P.......,..............@....pdata...F.......H...0..............@..@.qtmetadv............x..............@..P_RDATA.. ............z..............@..@.rsrc...@............|..............@..@.reloc..............................@..B................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\libcrypto-1_1-x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):3386880
                                          Entropy (8bit):6.106149657127588
                                          Encrypted:false
                                          SSDEEP:49152:RVwASOOrIU6imtGtlqE2qROh5PETRKAv0LOB8p2AVU+DjM+SGDu23QvyPLtU8TsK:YE+hBc2AL3QvgtU8I1CPwDv3uFZj
                                          MD5:AD4B3F36B744D0A207AA7D085B43DC73
                                          SHA1:AB6AF88B8B05F3BB06DB37C30D6883C4BE6A6176
                                          SHA-256:F7A5F80B147505DB82C1334DC9C7ADF2C3D01871C8761EC194CE66058C394021
                                          SHA-512:706351749E2AFAC99B42C5254D23386D454FAC02D22AAAC14828509F2DED48CE966DBE19777F6572C87546205494E73E6AA4F5AEA4B065BA659356486566D7C7
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|.......................................................0.........9......9......9......9......Rich....................PE..d.....x].........." .....H$.........|p.......................................P4...........`.........................................0....f....3.,.....3.|.....1...............3..O...V,.8............................W,...............3..............................text....G$......H$................. ..`.rdata.......`$......L$.............@..@.data...!x...@1..*..."1.............@....pdata.......1......L1.............@..@.idata..t"....3..$....3.............@..@.00cfg........3......*3.............@..@.rsrc...|.....3......,3.............@..@.reloc..:x....3..z...43.............@..B........................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\libcrypto-3-x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):6082048
                                          Entropy (8bit):6.074931160218059
                                          Encrypted:false
                                          SSDEEP:98304:FS3+51x/3rGbVsk9NJUIyAaPGT1CPwDvt3uF+DCv:WaP/3rGbqk9NJNyAauT1CPwDvt3uF+DC
                                          MD5:186DE3986331CB46A04DBF1792DC0D56
                                          SHA1:9D3D140C0B135A55D55F508987D93EB3EEE877DB
                                          SHA-256:CF989E237037B224B7CCB74E1692AA09C5B14933D6E8EB2B83282E847FC0FE8B
                                          SHA-512:2827F3AF041EC06B2285DE4E73107FAADB365E044D4EB3EA367029A28BB99830721A55CB3023FD3DF3E0E95B88568D60137C0B7FC2CE9DDF4835B64D1817F05D
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............cD..cD..cD...D..cD..bE..cD..fE..cD..gE..cD..`E..cD..bE..cD..bD..cD..cD..cDe.gE.cDe.cE..cDe.D..cDe.aE..cDRich..cD................PE..d...yl.d.........." ......D..L......X........................................`]...........`...........................................U.....P;\.,....p\.s....PY...............\.....<.Q.8.............................Q.8............0\.P............................text.....D.......D................. ..`.rdata........D.......D.............@..@.data........X..V....X.............@....pdata..D....PY.......X.............@..@.idata...$...0\..&....[.............@..@.00cfg..Q....`\.......[.............@..@.rsrc...s....p\.......[.............@..@.reloc........\.......[.............@..B........................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\libssl-1_1-x64.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):679424
                                          Entropy (8bit):5.494341821507123
                                          Encrypted:false
                                          SSDEEP:12288:nLCEaLwMwJdNim7tMcDmyUsF7Drpxkn8h4OnzQ4dwhv9W0RCYAuU2lvz:Klbm7tMD0Ik4c+n0luU2lvz
                                          MD5:3BA81469C395C1646E5B0A0B2B8F8DFF
                                          SHA1:A9361C1C9E0D8442875A47A82E56F7C73E84F80A
                                          SHA-256:F50F7D8F2308EB8BE4B40126631E8724AECAD7540A968D8C6131BB32363A0A2F
                                          SHA-512:52578EE87C653DFD819020514BDA08CB45332C7B675100DDBAD4765FD5E02FA5F433757F931EB8D7A7FAA64F978B28919C379B2449DE9B7410FFE74FF76B0EEE
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8<..YRT.YRT.YRT.!.T.YRT.1SU.YRT.?SU.YRT.1WU.YRT.1VU.YRT.1QU.YRTf0SU.YRT.YST.XRTf0VU.YRTf0RU.YRTf0.T.YRTf0PU.YRTRich.YRT................PE..d.....x].........." ..... ...D.......$....................................................`.........................................P....N...%..........s........K..............D... ...8...........................`................................................text...7........ .................. ..`.rdata..^#...0...$...$..............@..@.data...1M...`...D...H..............@....pdata...S.......T..................@..@.idata..wV.......X..................@..@.00cfg.......p.......8..............@..@.rsrc...s............:..............@..@.reloc..!............B..............@..B........................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\msvcp120.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):660128
                                          Entropy (8bit):6.339798513733826
                                          Encrypted:false
                                          SSDEEP:12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
                                          MD5:46060C35F697281BC5E7337AEE3722B1
                                          SHA1:D0164C041707F297A73ABB9EA854111953E99CF1
                                          SHA-256:2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
                                          SHA-512:2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\msvcp140.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):641696
                                          Entropy (8bit):6.344280759303537
                                          Encrypted:false
                                          SSDEEP:12288:+/AqzeYd5jcj712LobwFYz0U3lVQEKZm+jWodEEVncj:8x4rYYzr3jQEKZm+jWodEEVu
                                          MD5:D396985225D85CAA7D743D67C7DA6316
                                          SHA1:915D5829ED02171684C2A9E8B3B57F7A35BC1E2C
                                          SHA-256:BE2EF4F6D540D0AC5FDDD556DCB6BFAF6CB6288679E4D64882D625FF35F173AA
                                          SHA-512:D7B0DF2865BF491C9CAF34CBABEFB7B7F04B35B85276A59FEF0499D02B09651D8F6D0DB9E87DF4A9A1417F07784A8E5625E9805BC434B87D64E442AB98E24075
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,<.h]..h]..h]....D.j]..a%8.p]...?..k]..h]...]...?..l]...?..c]...?..~]...?...]...?..i]...?T.i]...?..i]..Richh]..........PE..d....8'Y.........." ......................................................................`A.........................................;..h.......,............p..`B.......>..............8...........................P@............... .......7..@....................text............................... ..`.rdata....... ......................@..@.data...T9...0......................@....pdata..`B...p...D...6..............@..@.didat..h............z..............@....rsrc................|..............@..@.reloc..............................@..B................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\msvcr120.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):963232
                                          Entropy (8bit):6.634408584960502
                                          Encrypted:false
                                          SSDEEP:24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
                                          MD5:9C861C079DD81762B6C54E37597B7712
                                          SHA1:62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
                                          SHA-256:AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
                                          SHA-512:3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\msvcrt.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):634880
                                          Entropy (8bit):6.529698884144268
                                          Encrypted:false
                                          SSDEEP:12288:QpC1XhsbQfIiZ3f5Lzf1wUEyUQAmVyK6EOaA0OONRQ:QpCZhsboIiZ3x/dcQAmVyK3OaA0O+Q
                                          MD5:C391FC68282A000CDF953F8B6B55D2EF
                                          SHA1:964EE2D28DC71210982F72E567DF89F9F527B67B
                                          SHA-256:1CB0DAB84545D9FDEA5A7865A1E7132CEAC91DECF8B100285B63098D7B09E584
                                          SHA-512:E324197FF69C92307F86A21B2DDAAE5F9AC699F3B234C09FA4DAFEE3757B0C716577DB1D62CA23180DC34D7899686D32C52C072A0D01B29DD91DD01744506CD2
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.H..............b.5.............d.......r......c.......u.......e.......`.....Rich....................PE..d...?..N.........." .........,...... .........ju.....................................p....@.............................................j..D................p..d\......................8............................................................................text............................... ..`.rdata..Lj.......l..................@..@.data....V.......N..................@....pdata..d\...p...^...H..............@..@.rsrc...............................@..@.reloc..............................@..B...N.......N.......N.......N.......N@......Na......N.......N.......N.......N.......N.......N.......N6......N_......N.......N.......N.......N.......N.......N.......N.......NA......Nc......N.......N.......N.......N............KERNELBASE.dll.ntdll.dll.API-MS-Win-Core

                                          C:\Program Files (x86)\SRTMiniServer\platforms\qwindows.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1472632
                                          Entropy (8bit):6.5842021372576465
                                          Encrypted:false
                                          SSDEEP:24576:66YD7Po3twR8Git2eZalxSsF1fAPLuEZLBwZC:lYPPo3CRotmlxSsQPLutC
                                          MD5:3A34B0C4DD44D136ABB060349B13C7E2
                                          SHA1:E50F9B33FF3D53D2CECD973D578EAEB66AAD51C1
                                          SHA-256:2D30922B432D1678F3B9D9D0551DB09C72F572B113B3254D590745FCE4A33B81
                                          SHA-512:B4C9AE73194C2F8A1CC49DAB9CDEFB8D289D3A871333914EF4D8156FC08ADF6DFA02E12A191C8284A5517AA769D63D7D347C71AEC61B632C7EB0DC9FCEC18F4D
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v..s%..s%..s%...%..s%.F.%..s%D.p$..s%D.v$..s%D.w$..s%D.r$..s%V.r$..s%V.w$..s%.u$..s%.r$..s%..r%;.s%V.v$..s%V.s$..s%V..%..s%V.q$..s%Rich..s%........PE..d...w..].........." .................................................................z....`.............................................@...............H.......P....b..x...........0X..T....................Y..(....X...............0...4...........................text............................... ..`.rdata..F....0......."..............@..@.data....z...@...0...&..............@....pdata..P............V..............@..@.qtmetad.............@..............@..P.rsrc...H............B..............@..@.reloc...............F..............@..B................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\post_install.cmd

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):145
                                          Entropy (8bit):4.631720174113214
                                          Encrypted:false
                                          SSDEEP:3:6xQkcFAJxYA3X6XdFJLLJNYHAGBhoM7Z4AawuxAWFoDMOu7vn:6IsxYYX6NzLYHMmZ43LxAWFTOu7v
                                          MD5:E8294E3F4DE0A4CA79232E22F7AC19EF
                                          SHA1:5F10D1A2B92E1294D6108BBD702E105931E69553
                                          SHA-256:EA21F57E28ABBD9046A0EF5481ED077032695ECA7988D860A75A308EA1B39F34
                                          SHA-512:22107C2AF1D06C549D0AD2A50B612C1F86AAEF5AA8C33EEEACAD9FD0D8FEC74CE7FD15A46EC7E129A1698D13570B3A3B68D0872C9E63274AFDF32DA99CBB0494
                                          Malicious:false
                                          Reputation:low
                                          Preview:netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="%cd%\SRTMiniServer.exe" enable=yes profile=public,private....

                                          C:\Program Files (x86)\SRTMiniServer\preview.exe

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):77952
                                          Entropy (8bit):6.024118423938727
                                          Encrypted:false
                                          SSDEEP:1536:K1pprYlIrgQElEBkaTlHgIBdq1A63fQa67ukWdLnSbdR4iDGz:ODYl8gQQEBka9JBIh3fQa67ukWdLnCda
                                          MD5:52B9DA6126C1F2BACEF41F0DEBAFFF1F
                                          SHA1:C2A6C383B226F423D1E3A6FD8B151785F989CEB0
                                          SHA-256:9EF3047FD2C6D265796826BDC9F2F12634BB2FF771637DB9BA90B05AD39B5543
                                          SHA-512:746457CFA9538D5CEF368CB62D331150AFEFEAC47527AFBFB6E667C41A399678E0CA808A239348C986851B7FFB7F07AA5720615378A0428DF9B20E2A71E1001C
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Ou............lW....Ya.....Ya.....Ya....Ya....P|.....w......w.......Y..Y|......a......a....Rich...................PE..d.....|e.........."......R...........O.........@.............................P............`.................................................0...@............0...........(...@..@.......................................8............p...............................text...|P.......R.................. ..`.rdata.......p.......V..............@..@.data...p.... ......................@....pdata.......0......................@..@.reloc..@....@......................@..B................................................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\preview.exe.manifest

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):30761
                                          Entropy (8bit):5.519495101310609
                                          Encrypted:false
                                          SSDEEP:384:OXgPzDHtlM8M2/MD3yXfTBEt87etgXaW8ssvE1cGB0kPE1jyydPTYH0cSaSuiHNC:ZtMr6yb/6pM1jyyxYJSuitC
                                          MD5:C4150E31D589604C6ABD0F1359637007
                                          SHA1:182380BA6AFD2D39FE4504BE4A1F7834820FD06B
                                          SHA-256:EC985BF8231448EB9272112BC25929A1C4A0E1041D6B6C200732F5F20E246FC5
                                          SHA-512:164C7A5BA53BB01DD2C8209D372C34B5A853B72E5D5B8952F3825EB4C8C3F24F0D16849C4DEDA81851846AEF35C9ECE3E4947F55AA1FCAA1ED1BD580C9AB254A
                                          Malicious:false
                                          Reputation:low
                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">.. <file name="DLLs\Medialooks.Codecs.Core.x64.dll">.. <comClass clsid="{96EB1C14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitter Class" threadingModel="free"/>.. <comClass clsid="{96EB1C64-4CC0-4830-9CC3-F064196B2626}" description="MFDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1C74-4CC0-4830-9CC3-F064196B2626}" description="MFMuxer Class" threadingModel="free"/>.. <comClass clsid="{96EB1C94-4CC0-4830-9CC3-F064196B2626}" description="MFEncoder Class" threadingModel="free"/>.. </file>.. <file name="DLLs\Medialooks.Codecs.FFM.x64.dll">.. <comClass clsid="{9285699B-E779-4B2E-92CA-26DDEE01AA2A}" description="MFCaptionsDecoder Class" threadingModel="free"/>.. <comClass clsid="{96EB1F14-4CC0-4830-9CC3-F064196B2626}" description="MFSplitterFFM Class" threadin

                                          C:\Program Files (x86)\SRTMiniServer\sqldrivers\qsqlite.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1170552
                                          Entropy (8bit):6.5303767382369635
                                          Encrypted:false
                                          SSDEEP:24576:K9woPtryUrkN4MX2QG5Vlu2AaHraZOCU4TQJvVV71WERqlHD:K9lPVyUrk+bVl18UvVV7MHlHD
                                          MD5:D0601C559C2907E0F39E64FD7DA2B7D6
                                          SHA1:8355271577375E626C46352D7057383FF6319432
                                          SHA-256:6F3C1C04A184E4DCC11CA0F33D866DCF4DC7E1F841D9D70F7D0D71DDB5F8775F
                                          SHA-512:B712A1B107661C2F05B257DCB54CD18E3E10D0F342E21EEE07355336859C6C5350F237D959DE9660E9FFEED818EAF37E54400FC7C4710E478B77D330511E3DFC
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%e.S%e.S%e.Z].._%e..Gd.Q%e. Gd.Q%e..Gf.W%e..G`.A%e..Ga.Y%e..Fd.V%e.S%d.e$e..Fa.R%e..F`.P%e..Fe.R%e..F..R%e..Fg.R%e.RichS%e.........................PE..d...(..].........." .....r...\......\x....................................... ............`............................................t...D...........@....0..`.......x..............T...................H...(...P................................................text....p.......r.................. ..`.rdata...>.......@...v..............@..@.data....T.......J..................@....pdata..`....0......................@..@.qtmetadf...........................@..P.rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\srt.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):2505216
                                          Entropy (8bit):6.777833045665491
                                          Encrypted:false
                                          SSDEEP:49152:XGtlqwMVwASOYQIU6iOIbnYMDwHF7U3X/jtrTq1QLxNVKOh5Pnny884EdPuufe/A:4v+rdKCPoUufz
                                          MD5:8E00F3E787B9648DB916EE1822FAFA25
                                          SHA1:F7063E71FBA0B3CFE8A2D57788F067EDAEC594CD
                                          SHA-256:FC89A61CA82D40F1DE1C016BA3E2B1E7872D1C1030B08DF85A371E537035F620
                                          SHA-512:2DEF7EA1BECFBC67B15EAC6B1E37EE790647A56DC7F711E0988388181FCC649EEDAD32B67B12E95A7DE22D65F6AF887CCD8129B3C594D83C82C24315ADC39B8E
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........r+3..E`..E`..E`.k.`..E`.fDa..E`.f@a..E`.fAa..E`.fFa..E`.uCa..E`.uDa..E`..D`..E`..E`..E`1zAai.E`[fAa..E`[f@a..E`[fEa..E`[f.`..E`...`..E`[fGa..E`Rich..E`........PE..d...&..b.........." ................Tb........................................&...........`..........................................v$.X...H.$.|....`&......`%..............p&..N....".......................".(... .".8...............`............................text............................... ..`.rdata..............................@..@.data........$..H....$.............@....pdata.......`%.......$.............@..@.rsrc........`&.......%.............@..@.reloc...N...p&..P....%.............@..B................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\ssleay32.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):383488
                                          Entropy (8bit):6.067024105059228
                                          Encrypted:false
                                          SSDEEP:6144:7wpXWDYvMBucXhBOQuBWy3w/OFT+evUuPt3bEUibPL2KJlR0PM6IDiZVhr4LNCcF:7wUYvWucXhBOQuBWy3w/OFT+evUAt3bY
                                          MD5:930F15BA7DE47211E0DB9AC67BA9A891
                                          SHA1:25EA6471744B359AF6D7CCDEE0EB538D5D497F6B
                                          SHA-256:77C14F38D7F25040699225C7C3CFFEC989EFED3873AE19213AFAD66540598AA2
                                          SHA-512:CE4B802427AAA71A2B2807698CC77BFD0817337DA719A10193AD56A25545409DC1253FBE1C8191772CB67CC5EFDEE040F521647E546F5C999658D83B21E59546
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...DP..0...DP..5...2.......DP......DP..3...DP..3...DP..3...Rich2...................PE..d......W.........." ......................................................... ...........................................................)......P.......0........*...................................................................................................text...>........................... ..`.rdata..`...........................@..@.data...............................@....pdata...*.......,..................@..@.rsrc...0...........................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\swresample-3.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):678912
                                          Entropy (8bit):5.840415831050741
                                          Encrypted:false
                                          SSDEEP:6144:4YrgRBfMcUj9jPHEf9LxczmwXvbVMvCNUYDFnQKB4pVftuTk:4YcUhPkpx0XivCSYDFnbBTk
                                          MD5:4B00E085605BD8443729FD4FAD623263
                                          SHA1:2C58CD1C5C8E013EE24088A278E691B0019E2628
                                          SHA-256:783FDF348E2EDB2CB45B6AE2E1195A2194EFF8673B5B5A8733F7A5BC72D1D73A
                                          SHA-512:F8F7D31FAC9FC3C85EAB17696C2C8727ADE90D4D89867E35E0DD174FB61B1EABBB82539C1ACFD7A6165E588AC1B19EF9E9A17083B17A330A3EAF0FD4A54A0933
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X.:.9.i.9.i.9.i.].h.9.i.].h.9.i.].h#9.i.].h.9.i.g.h.9.i.g.h.9.i.g.h.9.i.g.h.9.i.9.i.9.i.9.i.9.i.g.h.9.i.g.h.9.i.g.h.9.iRich.9.i........................PE..d...c..a.........." .........p......%;....................................................`.........................................0........t..<...............@S...................>..8............................?...............p...............................text............................... ..`.rdata..H.... ......................@..@.data..../..........................@....pdata...\.......^..................@..@.idata..@....p.......0..............@..@.gfids...............D..............@..@.00cfg...............H..............@..@.reloc...............J..............@..B........................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\swresample.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):678912
                                          Entropy (8bit):5.840415831050741
                                          Encrypted:false
                                          SSDEEP:6144:4YrgRBfMcUj9jPHEf9LxczmwXvbVMvCNUYDFnQKB4pVftuTk:4YcUhPkpx0XivCSYDFnbBTk
                                          MD5:4B00E085605BD8443729FD4FAD623263
                                          SHA1:2C58CD1C5C8E013EE24088A278E691B0019E2628
                                          SHA-256:783FDF348E2EDB2CB45B6AE2E1195A2194EFF8673B5B5A8733F7A5BC72D1D73A
                                          SHA-512:F8F7D31FAC9FC3C85EAB17696C2C8727ADE90D4D89867E35E0DD174FB61B1EABBB82539C1ACFD7A6165E588AC1B19EF9E9A17083B17A330A3EAF0FD4A54A0933
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X.:.9.i.9.i.9.i.].h.9.i.].h.9.i.].h#9.i.].h.9.i.g.h.9.i.g.h.9.i.g.h.9.i.g.h.9.i.9.i.9.i.9.i.9.i.g.h.9.i.g.h.9.i.g.h.9.iRich.9.i........................PE..d...c..a.........." .........p......%;....................................................`.........................................0........t..<...............@S...................>..8............................?...............p...............................text............................... ..`.rdata..H.... ......................@..@.data..../..........................@....pdata...\.......^..................@..@.idata..@....p.......0..............@..@.gfids...............D..............@..@.00cfg...............H..............@..@.reloc...............J..............@..B........................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\swresample.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):6420
                                          Entropy (8bit):4.856719364831041
                                          Encrypted:false
                                          SSDEEP:48:sUfaZgrxDmKGtGrZZXC6xoPWv29KCAyAO3bo9KKj99KnKg7KW6H:s5gMRKs7P39KCk9Kk9KncWE
                                          MD5:38EC9F4CD9C139B248631CCE6BD129A5
                                          SHA1:DB855B072DCA8FD559C991856CD70E05C5D2F2D4
                                          SHA-256:E434FF6B2165C20E96AF9FF48C005A64A7876F0262E31922F00E90A47EF4C21C
                                          SHA-512:002EF644315DC2D3DD93A65181F55681F2C60359FBB3748366176020B9E93C98EC30397B3D10071429083AF343F5CAE6205A1C844A1B7D2AE6A752864F90488D
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ 1627653219 0 1172 `....1.......>...z...........J...J...........0...0...................|...|...........b...b...........<...<...................................p...p...........R...R...........B...B...........,...,........__IMPORT_DESCRIPTOR_swresample-3.__NULL_IMPORT_DESCRIPTOR..swresample-3_NULL_THUNK_DATA.__imp_swr_alloc.swr_alloc.__imp_swr_alloc_set_opts.swr_alloc_set_opts.__imp_swr_build_matrix.swr_build_matrix.__imp_swr_close.swr_close.__imp_swr_config_frame.swr_config_frame.__imp_swr_convert.swr_convert.__imp_swr_convert_frame.swr_convert_frame.__imp_swr_drop_output.swr_drop_output.__imp_swr_ffversion.swr_ffversion.__imp_swr_free.swr_free.__imp_swr_get_class.swr_get_class.__imp_swr_get_delay.swr_get_delay.__imp_swr_get_out_samples.swr_get_out_samples.__imp_swr_init.swr_init.__imp_swr_inject_silence.swr_inject_silence.__imp_swr_is_initialized.swr_is_initialized.__imp_swr_next_pts.swr_next_pts.__imp_swr_set_channel_mapping.swr_set_chan

                                          C:\Program Files (x86)\SRTMiniServer\swscale-5.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1322496
                                          Entropy (8bit):5.944151826657313
                                          Encrypted:false
                                          SSDEEP:24576:a1VTEJxcePMM0NelNZzllVx03lWQYx3Va79ieissiZ4jZOiJRE:anTEJxcePoNkZ03lWQYx3Va79tissiZr
                                          MD5:4F49E0A496E591094EC7E0C4743EAA04
                                          SHA1:5FC8E5518FED2B1BD6B076E4D64BE802A66B1F07
                                          SHA-256:D9370235447080D644F2555990B4DB7F827B2C188C3FAC1F087CD0766143864F
                                          SHA-512:06F2AE605119EA9B23EC631855133125B9A91679C2CC0E3907043546569A7241E9F3B7572E8F121937D72FE0FE337722BB4D8F99644A221E7B0FCCFB02706FF4
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........F.............................-..........................................................................Rich............................PE..d...e..a.........." ................=<.......................................@............`..........................................H......X...<............ ............... .......(..8............................(..................X............................text............................... ..`.rdata..g^.......`..................@..@.data........P.......8..............@....pdata..L.... .......H..............@..@.idata..............................@..@.gfids..............................@..@_RDATA..............................@..@.00cfg..............................@..@.reloc....... ......................@..B................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\swscale.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):1322496
                                          Entropy (8bit):5.944151826657313
                                          Encrypted:false
                                          SSDEEP:24576:a1VTEJxcePMM0NelNZzllVx03lWQYx3Va79ieissiZ4jZOiJRE:anTEJxcePoNkZ03lWQYx3Va79tissiZr
                                          MD5:4F49E0A496E591094EC7E0C4743EAA04
                                          SHA1:5FC8E5518FED2B1BD6B076E4D64BE802A66B1F07
                                          SHA-256:D9370235447080D644F2555990B4DB7F827B2C188C3FAC1F087CD0766143864F
                                          SHA-512:06F2AE605119EA9B23EC631855133125B9A91679C2CC0E3907043546569A7241E9F3B7572E8F121937D72FE0FE337722BB4D8F99644A221E7B0FCCFB02706FF4
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........F.............................-..........................................................................Rich............................PE..d...e..a.........." ................=<.......................................@............`..........................................H......X...<............ ............... .......(..8............................(..................X............................text............................... ..`.rdata..g^.......`..................@..@.data........P.......8..............@....pdata..L.... .......H..............@..@.idata..............................@..@.gfids..............................@..@_RDATA..............................@..@.00cfg..............................@..@.reloc....... ......................@..B................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\swscale.lib

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:current ar archive
                                          Category:dropped
                                          Size (bytes):8784
                                          Entropy (8bit):5.034000671077319
                                          Encrypted:false
                                          SSDEEP:96:GxpqQabZNAsI1bob1EYpfeqN5Eq6bMY9BmAqZbOZaK78K2KdP+A5jBJXV1bWgXkz:I7ajIRs1EaeAnuM4WFOXHNfJXVRWg9CB
                                          MD5:2F03A939A4D6785F074E4C10FC59FEA4
                                          SHA1:10BE021074AD2189510B65DF8918086E55A5FA44
                                          SHA-256:B9EB7B8A147684D407E3A164C049773C0FB553D69A87FFABFCCF79ABA0D71A50
                                          SHA-512:18F1B66DC69E1A6BBDB7E0F08D7490D4B1F5B8B209632461789A227AA90482E7F03ECD68DEDBCDCD34E9FB9203B3F4F72855BF461098BD2F7073C816B09BB0C2
                                          Malicious:false
                                          Reputation:low
                                          Preview:!<arch>./ 1627653221 0 1798 `....G...............^...^...4...4...................................h...h...................R...R...................*...*...................................d...d...........J...J...(...(...................................r...r...........F...F.......... *.. *.. ... ...!...!...!t..!t..!...!.__IMPORT_DESCRIPTOR_swscale-5.__NULL_IMPORT_DESCRIPTOR..swscale-5_NULL_THUNK_DATA.__imp_sws_addVec.sws_addVec.__imp_sws_alloc_context.sws_alloc_context.__imp_sws_alloc_set_opts.sws_alloc_set_opts.__imp_sws_allocVec.sws_allocVec.__imp_sws_cloneVec.sws_cloneVec.__imp_sws_convertPalette8ToPacked24.sws_convertPalette8ToPacked24.__imp_sws_convertPalette8ToPacked32.sws_convertPalette8ToPacked32.__imp_sws_convVec.sws_convVec.__imp_sws_freeContext.sws_freeContext.__imp_sws_freeFilter.sws_freeFilter.__imp_sws_freeVec.sws_freeVec.__imp_sws_get_class.sws_get_class.__imp_sws_getCachedContext.sws_getCachedContext.__imp_sws_getCoefficients.sws_getCoe

                                          C:\Program Files (x86)\SRTMiniServer\template.html

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (3399), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):30287
                                          Entropy (8bit):5.010977169462368
                                          Encrypted:false
                                          SSDEEP:384:QN6tCKCkrJNWpS1KH1uPCU5/JU24nojFJLx5jtb/J8VcgFlxm8ON/dqq+e:QN6d3WpScVuPCUvJLhKGgFlxm8ON/dN
                                          MD5:C3CAE12068E77B265B33EA411A8DF4E0
                                          SHA1:EBBD42B58817168BA2BD149B8997B28F8B9E2605
                                          SHA-256:C8F1D75F89EF370137319909A5BE317E23E174F2A8349196A77E8B964A4FB448
                                          SHA-512:35DE069A526B51B041AE003B37D663E1D2B69ECDFDB3D5CAE9C7F186CD4F5A02C0598AD3B296CFBFC42A046238E0943F1169C1F442A38C955A710BA95EBB3A0A
                                          Malicious:false
                                          Reputation:low
                                          Preview:<script type="text/javascript" src="https://www.gstatic.com/charts/loader.js"></script>....<script type="text/javascript">.. google.charts.load('current', {.. packages: ['corechart', 'line', 'annotationchart'].. });.... //...... ... .. ............ ...... ...... .... null.. function getRowDataOrNull(arr, index){.. let data = arr[index];.. if (data === undefined).. return null;.. return data;//dont use || bc then 0 same set null (dont view).. }.. .. /*function delAdditionalLinesFromLegend(elementId_chart, indexes_len){.. //console.log(document.querySelectorAll('#fps_chart svg')[0].querySelectorAll('g')[1].querySelectorAll('g'));//.. console.log('delAdditionalLinesFromLegend', indexes_len);.. let legend_option = document.querySelector(`#${elementId_chart} svg g:nth-child(4)`).. for (let i = 0; i < legend_option.length; i+=2){.. if (indexes_len-- > 0){/

                                          C:\Program Files (x86)\SRTMiniServer\vcruntime140.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):87728
                                          Entropy (8bit):6.525099099914053
                                          Encrypted:false
                                          SSDEEP:1536:RQXcZzgSnGJZkN3in6yF+i4p7m1rJOTnsupxiyKLV/QecbOqleHHz1v9b3nneA:RQsrSnb+p+OTsupxwV/QecbOqAHHZv9p
                                          MD5:9A53905892D9C9F3BF9D295C8B32E446
                                          SHA1:2C5C56FF86FB1E827B2E0D479C529BAEA13EB561
                                          SHA-256:D58E3FF10FD96A22A8E6D2FD76146A282CC45CCFAF2301257E76E7C2771CBD41
                                          SHA-512:2DDE975E15F95AA9310820CAE009F2B04E26B7BAFEBB42D5822E3917017E4A37E17B0A71825F8F79F075ABC1507D7D4D9202550FDD7A53AB54AC0FDE4349FE2F
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'m..c.hDc.hDc.hD..Da.hDjt.Dh.hDc.iDO.hD.nmE`.hD.nlEi.hD.nkEn.hD.n`E|.hD.nhEb.hD.n.Db.hD.njEb.hDRichc.hD........................PE..d....8'Y.........." .........T...............................................`............`A............................................4...4........@.......0..X........>...P..l.......8............................................................................text...D........................... ..`.rdata..H6.......8..................@..@.data...x.... ......................@....pdata..X....0......................@..@.rsrc........@......................@..@.reloc..l....P......................@..B................................................................................................................................................................................................................................................

                                          C:\Program Files (x86)\SRTMiniServer\vcruntime140_1.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):44312
                                          Entropy (8bit):6.623047237297825
                                          Encrypted:false
                                          SSDEEP:768:vG3xRsJTKdiibUoT2zvivbXXyJWqWZ8DZX:vG7DyM22DiJMCtX
                                          MD5:9040ED0FDF4CE7558CBFFB73D4C17761
                                          SHA1:669C8380959984CC62B05535C18836F815308362
                                          SHA-256:6CC4315DACEB0522816C60678344466CB452426267F70C7FAAE925361674E774
                                          SHA-512:303143006C781260540E9D0D3739ACC33F2D54F884358C7485599DD22B87CCE9B81F68D6AD80F0F5BB1798CE54A79677152C1D3600E443E192AECD442EA0A2E4
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j&=..Hn..Hn..Hn@..n..Hn!fIo..Hn.s.n..Hn..In..Hn!fKo..Hn!fLo..Hn!fMo..Hn!fHo..Hn!f.n..Hn!fJo..HnRich..Hn........PE..d....h.].........." .....:...4.......A..............................................?.....`A.........................................j......<k..x....................l...A......(....a..8...........................0b...............P..X............................text...t9.......:.................. ..`.rdata..P ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..(............j..............@..B................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\StartMenu.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                          Category:dropped
                                          Size (bytes):7680
                                          Entropy (8bit):4.619286357808789
                                          Encrypted:false
                                          SSDEEP:96:8giqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1ts3hhEl7y:8giqVPgK8K9eIdE9B/t0hg7
                                          MD5:E439EA88B4453578ADCFE9026CD287FD
                                          SHA1:414CE13B7D4F2B1C4D51A71A037EC2822FA63E61
                                          SHA-256:27FB85EEDE9B98F4FB6CD9BD22F1F268E13D3BB365A4BB8DA744090D032C76E4
                                          SHA-512:F8D1023EB3C665ECD10805BB95E1B29491B3653BD7178BDD39DAFFAF83564626E8679864056333EBFBF631F414195771DE7824E669A07BACB0A04EEE8D74B062
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(...(...(..<'...(.......(..8....(.......(..Rich.(..........................PE..L......]...........!........."............... ...............................p............@..........................$..e.... ..x....P..(....................`..t.................................................... ...............................text............................... ..`.rdata..U.... ......................@..@.data........0......................@....rsrc...(....P......................@..@.reloc..8....`......................@..B................................................................................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\System.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                          Category:dropped
                                          Size (bytes):11776
                                          Entropy (8bit):5.854901984552606
                                          Encrypted:false
                                          SSDEEP:192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
                                          MD5:0063D48AFE5A0CDC02833145667B6641
                                          SHA1:E7EB614805D183ECB1127C62DECB1A6BE1B4F7A8
                                          SHA-256:AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
                                          SHA-512:71CBBCAEB345E09306E368717EA0503FE8DF485BE2E95200FEBC61BCD8BA74FB4211CD263C232F148C0123F6C6F2E3FD4EA20BDECC4070F5208C35C6920240F0
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir*.-.D.-.D.-.D...J.*.D.-.E.>.D.....*.D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L......]...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..|....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\modern-wizard.bmp

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                          Category:dropped
                                          Size (bytes):26494
                                          Entropy (8bit):1.9568109962493656
                                          Encrypted:false
                                          SSDEEP:24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
                                          MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                          SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                          SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                          SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                          Malicious:false
                                          Reputation:low
                                          Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                                          C:\Users\user\AppData\Local\Temp\nsoF5ED.tmp\nsDialogs.dll

                                          Download File
                                          Process:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                          Category:dropped
                                          Size (bytes):9728
                                          Entropy (8bit):5.127431636878203
                                          Encrypted:false
                                          SSDEEP:96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
                                          MD5:6E64E5D5F9498058A300B26B8741D9D5
                                          SHA1:837CE28E5E02788DA63A7F1D8F20207D2B0BF523
                                          SHA-256:8D4B1C275FD1CD0782A265080B56D1AEC8D1C93EDCA5EF3B050D1D20D7B61F33
                                          SHA-512:F53514D36021D79F85DF2494D403F03589B3AD848889B9224F962CC932EF740F127131A914C7171AD8136CA1EF631285EA1C80576DB18CCF8EA56940EB00EA1E
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L......]...........!......... ......Y........0............................................@..........................6..k....0.......`.......................p.......................................................0...............................text............................... ..`.rdata..{....0......................@..@.data........@......................@....rsrc........`....... ..............@..@.reloc..t....p......."..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                          C:\Users\user\Desktop\cmdline.out

                                          Download File
                                          Process:C:\Windows\SysWOW64\cmd.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:modified
                                          Size (bytes):182267
                                          Entropy (8bit):2.1594895647294634
                                          Encrypted:false
                                          SSDEEP:768:0uH8M7Gq+J+Qza4SL6lelDQkhrv8lKUZ2zZYc9wjHRSyjGpvMNh/+eWfzwWcN4a:0q8M7GqvQaEOvtSjxapUzXWIj
                                          MD5:E400FA8F633DA2331E70B93F0D765770
                                          SHA1:0F88B375D0E525935ACAB4FB3FEBA6FDDD47C9E2
                                          SHA-256:C153914627FE60A04CE799A0B263E074D939FFDA39460D3C3F6A5B362FE43C14
                                          SHA-512:4697166E11966E27BB782F0D7A9C3142519A393C71DC08A2DED20E04428E6C6447B63DCB584BF6B14E4C8274DB87673D1F1A4D2C29C8A530F2A75BD272E50EB0
                                          Malicious:false
                                          Reputation:low
                                          Preview:--2024-04-04 17:25:50-- https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe..Resolving downloadsnew.garaninapps.com (downloadsnew.garaninapps.com)... 209.50.49.25..Connecting to downloadsnew.garaninapps.com (downloadsnew.garaninapps.com)|209.50.49.25|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 120048384 (114M) [application/octet-stream]..Saving to: 'C:/Users/user/Desktop/download/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe'.... 0K .......... .......... .......... .......... .......... 0% 320K 6m6s.. 50K .......... .......... .......... .......... .......... 0% 323K 6m4s.. 100K .......... .......... .......... .......... .......... 0% 2.81M 4m16s.. 150K .......... .......... .......... .......... .......... 0% 381K 4m29s.. 200K .......... .......... .......... .......... .......... 0% 4.33M 3m40s.. 250K .......... .......... .......... .......... .......... 0% 5.08M 3m7s.. 300K .......... .......... .

                                          C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe

                                          Download File
                                          Process:C:\Windows\SysWOW64\wget.exe
                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                          Category:dropped
                                          Size (bytes):120048384
                                          Entropy (8bit):7.999995895707177
                                          Encrypted:true
                                          SSDEEP:1572864:ZQ2Wgxg+Ra0EVkrVBv/LVXj9ff9tyfs4G3CWyc7vugmdaZCqN55NqVbPqr2/A8YN:ZQ2nFXP/t9f8Gya7vrJg6rNijACiXpq0
                                          MD5:E1C148070E7E9856B50B4AB3AA6C096B
                                          SHA1:A9A2EC7C975B572AC9CB80B000AE3907D643CDD5
                                          SHA-256:599398B4D8F16B49A177B4B033F247D0E498FC57D41AAA86D43D6CAD85E506FB
                                          SHA-512:635CFBCD17A5F1AD2B7BC4804910E8D3E2578CB058EABAD713B95B8A572952DBE2FF5345BF7E3AC7A7AA83F2A2529A717E6FD5A0259E1DABF15E8F1FA97805AB
                                          Malicious:false
                                          Reputation:low
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.*....F..G.w.F.*....F..v..F...@..F.Rich.F.........PE..L......].................`..........52.......p....@.................................^.'...@.................................0t..........0C............'..(...........................................................p...............................text...}_.......`.................. ..`.rdata..>....p.......d..............@..@.data................x..............@....ndata...P...@...........................rsrc...0C.......D...|..............@..@................................................................................................................................................................................................................................................................................................................................................................

                                          Static File Info

                                          ⊘No static file info

                                          Network Behavior

                                          ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                          Statistics

                                          CPU Usage

                                          Click to jump to process

                                          Memory Usage

                                          Click to jump to process

                                          High Level Behavior Distribution

                                          Click to dive into process behavior distribution

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          General

                                          Target ID:0
                                          Start time:17:25:50
                                          Start date:04/04/2024
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe" > cmdline.out 2>&1
                                          Imagebase:0x240000
                                          File size:236'544 bytes
                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:1
                                          Start time:17:25:50
                                          Start date:04/04/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:2
                                          Start time:17:25:50
                                          Start date:04/04/2024
                                          Path:C:\Windows\SysWOW64\wget.exe
                                          Wow64 process (32bit):true
                                          Commandline:wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://downloadsnew.garaninapps.com/SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe"
                                          Imagebase:0x400000
                                          File size:3'895'184 bytes
                                          MD5 hash:3DADB6E2ECE9C4B3E1E322E617658B60
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:5
                                          Start time:17:26:12
                                          Start date:04/04/2024
                                          Path:C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Users\user\Desktop\download\SRTMiniServer_2.4.3_2024-02-26_INSTALL.exe"
                                          Imagebase:0x400000
                                          File size:120'048'384 bytes
                                          MD5 hash:E1C148070E7E9856B50B4AB3AA6C096B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:6
                                          Start time:17:26:13
                                          Start date:04/04/2024
                                          Path:C:\Windows\SysWOW64\taskkill.exe
                                          Wow64 process (32bit):true
                                          Commandline:taskkill /im SRTMiniServer.exe
                                          Imagebase:0x760000
                                          File size:74'240 bytes
                                          MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:7
                                          Start time:17:26:13
                                          Start date:04/04/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:11
                                          Start time:17:27:04
                                          Start date:04/04/2024
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\SRTMiniServer\post_install.cmd""
                                          Imagebase:0x240000
                                          File size:236'544 bytes
                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:12
                                          Start time:17:27:04
                                          Start date:04/04/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:13
                                          Start time:17:27:04
                                          Start date:04/04/2024
                                          Path:C:\Windows\SysWOW64\netsh.exe
                                          Wow64 process (32bit):true
                                          Commandline:netsh advfirewall firewall add rule name=SRTMiniServer dir=in action=allow program="C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe" enable=yes profile=public,private
                                          Imagebase:0x1560000
                                          File size:82'432 bytes
                                          MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:15
                                          Start time:17:27:11
                                          Start date:04/04/2024
                                          Path:C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Program Files (x86)\SRTMiniServer\SRTMiniServer.exe"
                                          Imagebase:0x7ff60cfc0000
                                          File size:1'563'264 bytes
                                          MD5 hash:D7C8D83952710C569E3671A42CF71773
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Antivirus matches:
                                          • Detection: 0%, ReversingLabs
                                          Reputation:low
                                          Has exited:false

                                          Disassembly

                                          Reset < >

                                            Execution Graph

                                            Execution Coverage:5.4%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:43.7%
                                            Total number of Nodes:1734
                                            Total number of Limit Nodes:139
                                            execution_graph 34494 7ffdf629d8db ?requested@QPlatformInputContextFactory@@SA?AVQString@ ?isNull@QString@ 34495 7ffdf629d92e ?create@QPlatformInputContextFactory@@SAPEAVQPlatformInputContext@@AEBVQString@@ 34494->34495 34496 7ffdf629d903 34494->34496 34497 7ffdf629d915 34495->34497 34498 7ffdf629d960 ??1QString@@QEAA 34495->34498 34500 7ffdf62bc120 7 API calls 34496->34500 34497->34498 34501 7ffdf6380e9c 34500->34501 34502 7ffdf62bc1de ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34501->34502 34502->34497 34503 7ffdf629c090 34504 7ffdf629c0a9 34503->34504 34505 7ffdf629c0e3 GetWindowLongPtrW 34503->34505 34506 7ffdf629c128 ?windowEvent@QPlatformWindow@@UEAA_NPEAVQEvent@@ 34504->34506 34510 7ffdf629c0ba GetWindowLongPtrW 34504->34510 34508 7ffdf629c107 34505->34508 34509 7ffdf629c10f GetCapture 34505->34509 34516 7ffdf6299d70 34508->34516 34509->34506 34512 7ffdf629c122 ReleaseCapture 34509->34512 34513 7ffdf629c0da 34510->34513 34514 7ffdf629c0d2 34510->34514 34512->34506 34513->34506 34515 7ffdf6299d70 27 API calls 34514->34515 34515->34513 34541 7ffdf62a1690 34516->34541 34518 7ffdf6299d81 ?isDebugEnabled@QLoggingCategory@ 34519 7ffdf6299f90 SetWindowLongPtrW 34518->34519 34520 7ffdf6299d92 ??0QByteArray@@QEAA@PEBDH ?number@QByteArray@@SA?AV1@_KH ?append@QByteArray@@QEAAAEAV1@AEBV1@ ??1QByteArray@@QEAA 34518->34520 34519->34509 34521 7ffdf6299de9 ?append@QByteArray@@QEAAAEAV1@PEBD 34520->34521 34522 7ffdf6299dfe 34520->34522 34521->34522 34523 7ffdf6299e19 34522->34523 34524 7ffdf6299e04 ?append@QByteArray@@QEAAAEAV1@PEBD 34522->34524 34525 7ffdf6299e1f ?append@QByteArray@@QEAAAEAV1@PEBD 34523->34525 34526 7ffdf6299e34 34523->34526 34524->34523 34525->34526 34527 7ffdf6299e3a ?append@QByteArray@@QEAAAEAV1@PEBD 34526->34527 34528 7ffdf6299e4f 34526->34528 34527->34528 34529 7ffdf6299e55 ?append@QByteArray@@QEAAAEAV1@PEBD 34528->34529 34530 7ffdf6299e6a 34528->34530 34529->34530 34531 7ffdf6299e85 34530->34531 34532 7ffdf6299e70 ?append@QByteArray@@QEAAAEAV1@PEBD 34530->34532 34533 7ffdf6299e8b ?append@QByteArray@@QEAAAEAV1@PEBD 34531->34533 34534 7ffdf6299ea0 34531->34534 34532->34531 34533->34534 34535 7ffdf6299ea6 ?append@QByteArray@@QEAAAEAV1@PEBD 34534->34535 34536 7ffdf6299ebb 34534->34536 34535->34536 34537 7ffdf6299ed6 34536->34537 34538 7ffdf6299ec1 ?append@QByteArray@@QEAAAEAV1@PEBD 34536->34538 34539 7ffdf62a1690 2 API calls 34537->34539 34538->34537 34540 7ffdf6299edb 10 API calls 34539->34540 34540->34519 34542 7ffdf62a16c6 34541->34542 34543 7ffdf62a16b9 34541->34543 34542->34543 34544 7ffdf62a16db ??0QLoggingCategory@@QEAA@PEBD 34542->34544 34543->34518 34545 7ffdf63812c0 34544->34545 34546 7ffdf62a16fe _Init_thread_footer 34545->34546 34546->34518 34547 7ffdf629a8d0 34548 7ffdf629a9c9 34547->34548 34549 7ffdf629a8eb 34547->34549 34550 7ffdf629a90b 34549->34550 34551 7ffdf629a8fe DestroyIcon 34549->34551 34552 7ffdf629a917 DestroyIcon 34550->34552 34553 7ffdf629a924 GetSystemMetrics GetSystemMetrics 34550->34553 34551->34550 34552->34553 34554 7ffdf6293c00 34553->34554 34555 7ffdf629a949 GetSystemMetrics GetSystemMetrics 34554->34555 34556 7ffdf629a975 34555->34556 34557 7ffdf629a9a8 SendMessageW 34556->34557 34558 7ffdf629a999 SendMessageW 34556->34558 34559 7ffdf629a9b5 SendMessageW 34557->34559 34558->34559 34559->34548 34560 7ffdf62fa690 34561 7ffdf62fbbc0 34560->34561 34562 7ffdf62fa6b7 GetDC EnumFontFamiliesExW ReleaseDC 34561->34562 34563 7ffdf62fc530 34562->34563 34564 7ffdf62fa703 ?family@QFont@@QEBA?AVQString@ ??1QFont@@QEAA ?resolveFontFamilyAlias@QPlatformFontDatabase@@UEBA?AVQString@@AEBV2@ ??8@YA_NAEBVQString@@0 ??1QString@@QEAA 34563->34564 34565 7ffdf62fa75a 34564->34565 34566 7ffdf62fa74f ?registerFontFamily@QPlatformFontDatabase@@SAXAEBVQString@@ 34564->34566 34571 7ffdf62f5780 ??0?$QVector@VQPointF@@@@QEAA RegOpenKeyExW 34565->34571 34566->34565 34570 7ffdf62fa77d 34572 7ffdf62f57e3 memset RegQueryValueExW 34571->34572 34573 7ffdf62f59e1 ??1QString@@QEAA 34571->34573 34575 7ffdf62f5836 ?fromWCharArray@QString@@SA?AV1@PEB_WH ??4QUrl@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 34572->34575 34576 7ffdf62f5861 RegCloseKey ?isEmpty@QString@ 34572->34576 34574 7ffdf6381690 3 API calls 34573->34574 34577 7ffdf62f59fb ??1QString@@QEAA 34574->34577 34575->34576 34578 7ffdf62f59d9 34576->34578 34579 7ffdf62f587f ??0QFile@@QEAA@AEBVQString@@ ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@ 34576->34579 34590 7ffdf6381690 34577->34590 34578->34573 34580 7ffdf62f58ab 34579->34580 34581 7ffdf62f5924 ?readAll@QIODevice@@QEAA?AVQByteArray@ 34579->34581 34582 7ffdf62f58b0 ?isWarningEnabled@QLoggingCategory@ 34580->34582 34587 7ffdf62f5952 34581->34587 34583 7ffdf62f5914 ??1QFile@@UEAA 34582->34583 34584 7ffdf62f58bd 34582->34584 34583->34578 34585 7ffdf62f58c2 ??0QMessageLogger@@QEAA@PEBDH00 ?warning@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD ??6QDebug@@QEAAAEAV0@AEBVQString@@ ??1QDebug@@QEAA 34584->34585 34585->34583 34586 7ffdf62f59bb ??1QByteArray@@QEAA ??1QFile@@UEAA 34586->34578 34587->34586 34588 7ffdf62f59b2 ?dispose@QListData@@SAXPEAUData@1@ 34587->34588 34589 7ffdf62f59a0 ??1QString@@QEAA 34587->34589 34588->34586 34589->34588 34589->34589 34591 7ffdf638169a 34590->34591 34592 7ffdf63816a6 34591->34592 34593 7ffdf6381b04 IsProcessorFeaturePresent 34591->34593 34592->34570 34594 7ffdf6381b22 capture_previous_context __raise_securityfailure 34593->34594 34595 7ffdf6381b1b 34593->34595 34594->34570 34595->34594 34596 7ffdf62f7d10 34597 7ffdf62f7d55 34596->34597 34598 7ffdf62f7d60 ??1QString@@QEAA 34597->34598 34599 7ffdf62f7d76 34598->34599 34600 7ffdf62f7df3 ?fallbacksForFamily@QPlatformFontDatabase@@UEBA?AVQStringList@@AEBVQString@@W4Style@QFont@@W4StyleHint@5@W4Script@QChar@@ 34599->34600 34601 7ffdf62f7de3 ?dispose@QListData@@SAXPEAUData@1@ 34599->34601 34602 7ffdf62f7dd1 ??1QString@@QEAA 34599->34602 34603 7ffdf62f7e1c 34600->34603 34601->34600 34602->34601 34602->34602 34604 7ffdf62f7e72 ?dispose@QListData@@SAXPEAUData@1@ 34603->34604 34605 7ffdf62f7e60 ??1QString@@QEAA 34603->34605 34606 7ffdf62f7e85 34603->34606 34604->34606 34605->34604 34605->34605 34607 7ffdf62f7e8a ?isDebugEnabled@QLoggingCategory@ 34606->34607 34608 7ffdf62f804b 34607->34608 34609 7ffdf62f7e9b 34607->34609 34610 7ffdf62f7ea0 13 API calls 34609->34610 34611 7ffdf62f7fe9 ??6QDebug@@QEAAAEAV0@D 34610->34611 34612 7ffdf62f7fad ??6QDebug@@QEAAAEAV0@AEBVQString@@ 34610->34612 34613 7ffdf62f8002 ??6QTextStream@@QEAAAEAV0@D 34611->34613 34614 7ffdf62f800e ??1QDebug@@QEAA ??1QDebug@@QEAA ??1QDebug@@QEAA ??1QDebug@@QEAA ??1QDebug@@QEAA 34611->34614 34612->34611 34615 7ffdf62f7fc3 ??6QDebug@@QEAAAEAV0@PEBD ??6QDebug@@QEAAAEAV0@AEBVQString@@ 34612->34615 34613->34614 34614->34608 34615->34611 34615->34615 34616 7ff60d076fb8 34619 7ff60d076fcc __scrt_initialize_crt __scrt_acquire_startup_lock __scrt_release_startup_lock 34616->34619 34617 7ff60d077104 34618 7ff60d077121 _exit 34617->34618 34619->34617 34620 7ff60d07709d __scrt_get_show_window_mode _get_narrow_winmain_command_line 34619->34620 34624 7ff60d077095 _register_thread_local_exe_atexit_callback 34619->34624 34626 7ff60d077017 34619->34626 34627 7ff60d0778b0 GetCommandLineW CommandLineToArgvW 34620->34627 34622 7ff60d0770be __scrt_is_managed_app 34622->34617 34623 7ff60d0770c9 34622->34623 34625 7ff60d0770ce _cexit 34623->34625 34623->34626 34624->34620 34625->34626 34628 7ff60d0778ed 34627->34628 34629 7ff60d0778e0 34627->34629 34630 7ff60d0779ec LocalFree 34628->34630 34631 7ff60d077960 WideCharToMultiByte 34628->34631 34633 7ff60d077992 WideCharToMultiByte 34628->34633 34629->34622 34636 7ff60cfc1a40 34630->34636 34631->34628 34633->34631 34634 7ff60d0779cd 34633->34634 34634->34630 34635 7ff60d077a07 Concurrency::wait 34635->34622 34659 7ff60d076760 34636->34659 34639 7ff60cfc1ab5 34640 7ff60cfc1ae2 8 API calls 34639->34640 34641 7ff60cfc1ab9 34639->34641 34642 7ff60cfc1b74 CoCreateInstance 34640->34642 34643 7ff60cfc1bfa 34640->34643 34876 7ff60cfc1db0 __acrt_iob_func __stdio_common_vfwprintf 34641->34876 34644 7ff60cfc1cf5 6 API calls 34642->34644 34645 7ff60cfc1ba4 34642->34645 34649 7ff60cfc1c9e srand rand 34643->34649 34655 7ff60cfc1c11 34643->34655 34661 7ff60cfe3110 ??0QMainWindow@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@ ??0QByteArray@@QEAA 34644->34661 34645->34643 34651 7ff60cfc1bcd SysAllocString 34645->34651 34648 7ff60cfc1adb 34878 7ff60d0767c0 34648->34878 34649->34655 34651->34643 34656 7ff60cfc1be2 SysFreeString 34651->34656 34655->34644 34656->34643 34660 7ff60cfc1a5d memset 34659->34660 34660->34639 34887 7ff60d00d780 ??0QThread@@QEAA@PEAVQObject@@ ??0QByteArray@@QEAA ??0QByteArray@@QEAA 34661->34887 34664 7ff60d00d780 39 API calls 34665 7ff60cfe31af 34664->34665 34891 7ff60d076824 34665->34891 34669 7ff60cfe323c ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ??0QSharedMemory@@QEAA@AEBVQString@@PEAVQObject@@ ??1QString@@QEAA 34903 7ff60cfd0840 ??0QObject@@QEAA@PEAV0@ ??0QMutex@@QEAA@W4RecursionMode@0@ 34669->34903 34673 7ff60cfe32a3 34909 7ff60d00afa0 ??0QObject@@QEAA@PEAV0@ ??0QByteArray@@QEAA 34673->34909 34675 7ff60cfe32b9 ??0QTimer@@QEAA@PEAVQObject@@ ??0QObject@@QEAA@PEAV0@ ??0QSqlDatabase@@QEAA ??0QTimer@@QEAA@PEAVQObject@@ 34910 7ff60d004110 ?objectName@QObject@@QEBA?AVQString@ ??1QString@@QEAA 34675->34910 34677 7ff60cfe332f 34678 7ff60d076824 std::_Facet_Register 3 API calls 34677->34678 34679 7ff60cfe337e ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34678->34679 34680 7ff60d076824 std::_Facet_Register 3 API calls 34679->34680 34681 7ff60cfe3432 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34680->34681 34682 7ff60d076824 std::_Facet_Register 3 API calls 34681->34682 34683 7ff60cfe34e8 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34682->34683 34684 7ff60d076824 std::_Facet_Register 3 API calls 34683->34684 34685 7ff60cfe355e 34684->34685 34686 7ff60cfe356f 17 API calls 34685->34686 35047 7ff60cfe8ef0 ??0QByteArray@@QEAA@AEBV0@ ?append@QString@@QEAAAEAV1@AEBV1@ 34686->35047 34688 7ff60cfe36db 35048 7ff60d03a310 ??4QString@@QEAAAEAV0@AEBV0@ ??4QString@@QEAAAEAV0@AEBV0@ ??4QString@@QEAAAEAV0@AEBV0@ ??4QString@@QEAAAEAV0@AEBV0@ 34688->35048 34690 7ff60cfe370f ??1QString@@QEAA ??1QString@@QEAA ??1QString@@QEAA 34691 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34690->34691 34692 7ff60cfe3750 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34691->34692 34693 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34692->34693 34694 7ff60cfe37cb ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34693->34694 34695 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34694->34695 34696 7ff60cfe3846 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA ?setDefaultFormat@QSettings@@SAXW4Format@1@ 34695->34696 34697 7ff60cff27b0 34 API calls 34696->34697 34698 7ff60cfe38b4 34697->34698 34699 7ff60cfe3954 15 API calls 34698->34699 34701 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34698->34701 34700 7ff60d03a580 217 API calls 34699->34700 34704 7ff60cfe3a6e 34700->34704 34702 7ff60cfe38c9 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ??0QSettings@@QEAA@AEBVQString@@0PEAVQObject@@ ??1QString@@QEAA ??1QString@@QEAA 34701->34702 34702->34699 34703 7ff60cfc1d5a ?show@QWidget@ ?exec@QApplication@ #9 34877 7ff60cfe8040 28 API calls Concurrency::wait 34703->34877 34704->34703 34705 7ff60d039f60 ??0QByteArray@@QEAA@AEBV0@ 34704->34705 34707 7ff60cfe3aad 34704->34707 34706 7ff60cfe3ac2 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@ ??1QString@@QEAA 34705->34706 34708 7ff60cfe3b05 34706->34708 34709 7ff60cfe3b16 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@ ??1QString@@QEAA 34706->34709 34711 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34707->34711 34712 7ff60d039f60 ??0QByteArray@@QEAA@AEBV0@ 34708->34712 34709->34708 34710 7ff60cfe3b61 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@ ??1QString@@QEAA 34709->34710 34710->34708 34714 7ff60cfe3c90 34711->34714 34713 7ff60cfe3bc1 7 API calls 34712->34713 34713->34707 34715 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34714->34715 34716 7ff60cfe3cc8 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ??0QChar@@QEAA@UQLatin1Char@@ ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@ 34715->34716 34717 7ff60d0133b0 34716->34717 34718 7ff60cfe3d30 ??1QString@@QEAA 34717->34718 34719 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34718->34719 34720 7ff60cfe3d5b 17 API calls 34719->34720 34722 7ff60cfe3edf 34720->34722 34723 7ff60cfe42cd 34720->34723 34721 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34721->34722 34722->34721 34725 7ff60cfe3f08 ?addWidget@QGridLayout@@QEAAXPEAVQWidget@@HHV?$QFlags@W4AlignmentFlag@Qt@@@@ 34722->34725 34728 7ff60cfe3f5a ??0QVariant@@QEAA 34722->34728 34731 7ff60cfe3f79 18 API calls 34722->34731 34724 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34723->34724 34726 7ff60cfe4300 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA ?singleShot@QTimer@@SAXHPEBVQObject@@PEBD ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@ ??1Connection@QMetaObject@@QEAA 34724->34726 34725->34722 34727 7ff60cff45c0 30 API calls 34726->34727 34729 7ff60cfe43ca ??0QVariant@@QEAA@PEBD ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@ ?toString@QVariant@@QEBA?AVQString@ 34727->34729 34728->34722 34730 7ff60d0038a0 34729->34730 34732 7ff60cfe442b 11 API calls 34730->34732 34733 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34731->34733 34734 7ff60cfe44fc 7 API calls 34732->34734 34735 7ff60cfe44d9 ?toInt@QVariant@@QEBAHPEA_N ?setCurrentIndex@QComboBox@@QEAAXH 34732->34735 34736 7ff60cfe4126 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34733->34736 34737 7ff60cfe4575 ?toBool@QVariant@ 34734->34737 34744 7ff60cfe45a1 34734->34744 34735->34734 34739 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34736->34739 34740 7ff60cfe458b ?click@QAbstractButton@ 34737->34740 34738 7ff60cfe45ee 34742 7ff60cfce940 101 API calls 34738->34742 34743 7ff60cfe41cf ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34739->34743 34740->34744 34746 7ff60cfe4601 9 API calls 34742->34746 34747 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34743->34747 34744->34738 34745 7ff60cfe45ca ?at@QListData@@QEBAPEAPEAXH 34744->34745 34749 7ff60cfce4f0 ?begin@QListData@ ?detach@QListData@@QEAAPEAUData@1@H ?end@QListData@ ?begin@QListData@ ?dispose@QListData@@SAXPEAUData@1@ 34744->34749 34750 7ff60d018220 135 API calls 34745->34750 34751 7ff60cff8b50 7 API calls 34746->34751 34748 7ff60cfe4259 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34747->34748 34748->34722 34748->34723 34749->34745 34750->34744 34752 7ff60cfe46b6 63 API calls 34751->34752 34753 7ff60cfe4b53 ?exists@QFile@@SA_NAEBVQString@@ 34752->34753 34754 7ff60cfe4b45 34752->34754 34756 7ff60cfe4b66 ?exists@QFile@@SA_NAEBVQString@@ 34753->34756 34757 7ff60cfe4c68 ??0QFileInfo@@QEAA@AEBVQString@@ ??0QFileInfo@@QEAA@AEBVQString@@ ?fileName@QFileInfo@@QEBA?AVQString@ ?fileName@QFileInfo@@QEBA?AVQString@ ??8@YA_NAEBVQString@@0 34753->34757 34754->34753 34755 7ff60cfe4d9f ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?instance@QCoreApplication@@SAPEAV1 ?arguments@QCoreApplication@@SA?AVQStringList@ ?QStringList_contains@QtPrivate@@YA_NPEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@ 34754->34755 34764 7ff60cfe4df2 34755->34764 34758 7ff60cfe4b79 ??4QString@@QEAAAEAV0@AEBV0@ 34756->34758 34759 7ff60cfe4b88 12 API calls 34756->34759 34760 7ff60cfe4ce8 34757->34760 34761 7ff60cfe4cd7 ?exists@QFileInfo@ 34757->34761 34758->34755 34759->34755 34767 7ff60cfe4d0b 34760->34767 34768 7ff60cfe4cf6 ??1QString@@QEAA 34760->34768 34761->34760 34762 7ff60cfe4e4c 8 API calls 34766 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34762->34766 34763 7ff60cfe4e42 ?dispose@QListData@@SAXPEAUData@1@ 34763->34762 34764->34762 34764->34763 34765 7ff60cfe4e30 ??1QString@@QEAA 34764->34765 34765->34763 34765->34765 34769 7ff60cfe4eef 34766->34769 34770 7ff60cfe4d25 34767->34770 34771 7ff60cfe4d11 ??1QString@@QEAA 34767->34771 34768->34767 34776 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34769->34776 34772 7ff60cfe4d74 ??4QString@@QEAAAEAV0@AEBV0@ ??1QFileInfo@@QEAA ??1QFileInfo@@QEAA 34770->34772 34773 7ff60cfe4d2a ?remove@QFile@@SA_NAEBVQString@@ ??0QByteArray@@QEAA@AEBV0@ 34770->34773 34771->34770 34772->34755 34774 7ff60cff6490 29 API calls 34773->34774 34775 7ff60cfe4d57 ?copy@QFile@@SA_NAEBVQString@@0 ??1QString@@QEAA 34774->34775 34775->34772 34777 7ff60cfe4f66 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH 34776->34777 34778 7ff60d039e00 12 API calls 34777->34778 34779 7ff60cfe4ff7 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?menuBar@QMainWindow@@QEBAPEAVQMenuBar@ ?setStyleSheet@QWidget@@QEAAXAEBVQString@@ ??1QString@@QEAA ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH 34778->34779 34780 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34779->34780 34781 7ff60cfe5057 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@ 34780->34781 34782 7ff60cfe50d1 15 API calls 34781->34782 34783 7ff60cfe50c1 ??1QString@@QEAA 34781->34783 34784 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34782->34784 34783->34782 34785 7ff60cfe5216 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@ 34784->34785 34786 7ff60cfe528c 18 API calls 34785->34786 34787 7ff60cfe527c ??1QString@@QEAA 34785->34787 34788 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34786->34788 34787->34786 34789 7ff60cfe543e ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@ 34788->34789 34790 7ff60cfe54b5 13 API calls 34789->34790 34791 7ff60cfe54a4 ??1QString@@QEAA 34789->34791 34792 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34790->34792 34791->34790 34793 7ff60cfe55e5 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@ 34792->34793 34794 7ff60cfe565d ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@ ??1QString@@QEAA 34793->34794 34795 7ff60cfe564c ??1QString@@QEAA 34793->34795 34796 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34794->34796 34795->34794 34797 7ff60cfe56bc ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@ ??1QString@@QEAA 34796->34797 34798 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34797->34798 34799 7ff60cfe5777 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@ ??1QString@@QEAA 34798->34799 34800 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34799->34800 34801 7ff60cfe5836 74 API calls 34800->34801 34802 7ff60cff1b80 34801->34802 34803 7ff60cfe5de9 33 API calls 34802->34803 34804 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34803->34804 34805 7ff60cfe60de ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34804->34805 34806 7ff60cff5430 34805->34806 34807 7ff60cfe6150 14 API calls 34806->34807 34808 7ff60cfe629f 34807->34808 34809 7ff60cfe62b2 ??1QVariant@@QEAA 34808->34809 34810 7ff60cfe62c8 34808->34810 34809->34810 34811 7ff60cfe62e4 34810->34811 34812 7ff60cfe62ce ??1QString@@QEAA 34810->34812 34813 7ff60cfe62ff 7 API calls 34811->34813 34814 7ff60cfe62ea ??1QVariant@@QEAA 34811->34814 34812->34811 34815 7ff60cfe638e ?setChecked@QAbstractButton@@QEAAX_N ?setCurrentIndex@QTabWidget@@QEAAXH 34813->34815 34816 7ff60cfe66b8 ?setCurrentIndex@QTabWidget@@QEAAXH ??0QVariant@@QEAA@_N ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@ ?toBool@QVariant@ 34813->34816 34814->34813 34817 7ff60cfe63b4 34815->34817 34816->34817 34818 7ff60cfe63d3 34817->34818 34819 7ff60cfe63bd ??1QVariant@@QEAA 34817->34819 34820 7ff60cfe63ef 34818->34820 34821 7ff60cfe63d9 ??1QString@@QEAA 34818->34821 34819->34818 34822 7ff60cfe6402 34820->34822 34823 7ff60cfe63f5 ??1QVariant@@QEAA 34820->34823 34821->34820 34824 7ff60cfe640f 34822->34824 34825 7ff60cffc3b0 308 API calls 34822->34825 34823->34822 34826 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34824->34826 34825->34824 34827 7ff60cfe6419 ??0QNetworkAccessManager@@QEAA@PEAVQObject@@ ??0QByteArray@@QEAA@AEBV0@ ??0QString@@QEAA@$$QEAV0@ 34826->34827 34828 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34827->34828 34829 7ff60cfe64cc 13 API calls 34828->34829 34830 7ff60cfe662d 34829->34830 34831 7ff60cfe673e 34830->34831 34832 7ff60cfe6657 ?setCurrentIndex@QComboBox@@QEAAXH 34830->34832 34834 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34831->34834 34832->34831 34833 7ff60cfe6671 ?defaultTypeFor@QTimer@@CA?AW4TimerType@Qt@@H 34832->34833 34835 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34833->34835 34836 7ff60cfe6778 13 API calls 34834->34836 34837 7ff60cfe6688 ?singleShotImpl@QTimer@@CAXHW4TimerType@Qt@@PEBVQObject@@PEAVQSlotObjectBase@QtPrivate@@ 34835->34837 34838 7ff60cfe68a8 34836->34838 34837->34831 34839 7ff60cfe68fd ??1QString@@QEAA 34838->34839 34840 7ff60cfe68f2 ?dispose@QListData@@SAXPEAUData@1@ 34838->34840 34843 7ff60cfe68e0 ??1QString@@QEAA 34838->34843 34841 7ff60cfe69e0 34839->34841 34842 7ff60cfe6917 8 API calls 34839->34842 34840->34839 34845 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34841->34845 34844 7ff60cfd1ae0 34842->34844 34843->34840 34843->34843 34846 7ff60cfe69b2 ??1QString@@QEAA ?startDetached@QProcess@@SA_NAEBVQString@@AEBVQStringList@@ 34844->34846 34849 7ff60cfe69ea 34845->34849 34847 7ff60cfcdd50 ??1QString@@QEAA ?dispose@QListData@@SAXPEAUData@1@ 34846->34847 34848 7ff60cfe69d5 ??1QString@@QEAA 34847->34848 34848->34841 34850 7ff60cfe6a08 ??0QChar@@QEAA@H ??4QString@@QEAAAEAV0@VQChar@@ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH 34849->34850 34851 7ff60cfe8ef0 ??0QByteArray@@QEAA@AEBV0@ ?append@QString@@QEAAAEAV1@AEBV1@ 34850->34851 34852 7ff60cfe6a51 12 API calls 34851->34852 34853 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34852->34853 34854 7ff60cfe6b21 ??0QByteArray@@QEAA@AEBV0@ 34853->34854 34855 7ff60d023770 34854->34855 34856 7ff60cfe6b5a ?statusBar@QMainWindow@@QEBAPEAVQStatusBar@ ?addPermanentWidget@QStatusBar@@QEAAXPEAVQWidget@@H 34855->34856 34857 7ff60cff2b00 35 API calls 34856->34857 34858 7ff60cfe6b81 34857->34858 34859 7ff60cfe6cd2 34858->34859 34860 7ff60cfe6b89 16 API calls 34858->34860 34861 7ff60cfe6cd6 ??0QMessageLogger@@QEAA@PEBDH0 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD ??1QDebug@@QEAA ?size@QListData@ 34859->34861 34860->34861 34862 7ff60d076824 std::_Facet_Register malloc Concurrency::cancel_current_task Concurrency::cancel_current_task 34861->34862 34863 7ff60cfe6d3b 34862->34863 34864 7ff60d013da0 174 API calls 34863->34864 34865 7ff60cfe6d5d ??0QByteArray@@QEAA ??0QByteArray@@QEAA ??0QByteArray@@QEAA ??0QByteArray@@QEAA 34864->34865 34866 7ff60cfe6fd3 19 API calls 34865->34866 34867 7ff60cfe6da4 14 API calls 34865->34867 34866->34703 34868 7ff60cfe6fbe ??1QString@@QEAA 34867->34868 34869 7ff60cfe6eae 6 API calls 34867->34869 34868->34866 34868->34867 34870 7ff60d014750 92 API calls 34869->34870 34873 7ff60cfe6f22 34870->34873 34871 7ff60cffc3b0 308 API calls 34871->34873 34872 7ff60d02bd90 22 API calls 34872->34873 34873->34868 34873->34871 34873->34872 34874 7ff60cfe6fb3 ??1QString@@QEAA 34873->34874 34875 7ff60cfe6f61 ??0QMessageLogger@@QEAA@PEBDH0 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD ??6QDebug@@QEAAAEAV0@AEBVQString@@ ??1QDebug@@QEAA 34873->34875 34874->34868 34875->34874 34876->34648 34879 7ff60d0767c9 34878->34879 34880 7ff60cfc1d99 34879->34880 34881 7ff60d076894 IsProcessorFeaturePresent 34879->34881 34880->34635 34882 7ff60d0768ac 34881->34882 35080 7ff60d076a88 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 34882->35080 34884 7ff60d0768bf 35081 7ff60d076860 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 34884->35081 34888 7ff60d00d7c8 34887->34888 35059 7ff60d0104c0 16 API calls 34888->35059 34890 7ff60cfe3198 34890->34664 34892 7ff60d07683e malloc 34891->34892 34893 7ff60cfe31c1 ??0QTimer@@QEAA@PEAVQObject@@ ??0QByteArray@@QEAA ??0QByteArray@@QEAA ??0QHostAddress@@QEAA ??0QTranslator@@QEAA@PEAVQObject@@ 34892->34893 34894 7ff60d07682f 34892->34894 34898 7ff60d009990 6 API calls 34893->34898 34894->34892 34895 7ff60d07684e 34894->34895 34896 7ff60d07685a Concurrency::cancel_current_task 34895->34896 34897 7ff60d076854 Concurrency::cancel_current_task 34895->34897 34897->34896 34899 7ff60d076824 std::_Facet_Register 3 API calls 34898->34899 34900 7ff60d009a23 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34899->34900 34901 7ff60d076824 std::_Facet_Register 3 API calls 34900->34901 34902 7ff60d009aaa ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 34901->34902 34902->34669 34904 7ff60cfd08c0 34903->34904 34905 7ff60d076824 std::_Facet_Register 3 API calls 34904->34905 34906 7ff60cfd08f1 _Mtx_init_in_situ malloc memset 34905->34906 34906->34904 34907 7ff60cfd09c8 34906->34907 34908 7ff60cfccb90 ??0QObject@@QEAA@PEAV0@ 34907->34908 34908->34673 34909->34675 34911 7ff60d004185 ?resize@QWidget@@QEAAXHH ?fromUtf8@QString@@SA?AV1@PEBDH ?setWindowTitle@QWidget@@QEAAXAEBVQString@@ ??1QString@@QEAA 34910->34911 34912 7ff60d004156 ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34910->34912 34913 7ff60d076824 std::_Facet_Register 3 API calls 34911->34913 34912->34911 34914 7ff60d0041d2 ??0QWidget@@QEAA@PEAV0@V?$QFlags@W4WindowType@Qt@@@@ ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34913->34914 34915 7ff60d076824 std::_Facet_Register 3 API calls 34914->34915 34916 7ff60d00423c 7 API calls 34915->34916 34917 7ff60d076824 std::_Facet_Register 3 API calls 34916->34917 34918 7ff60d0042ee 7 API calls 34917->34918 34919 7ff60d076824 std::_Facet_Register 3 API calls 34918->34919 34920 7ff60d004386 10 API calls 34919->34920 34921 7ff60d076824 std::_Facet_Register 3 API calls 34920->34921 34922 7ff60d004447 6 API calls 34921->34922 34923 7ff60d076824 std::_Facet_Register 3 API calls 34922->34923 34924 7ff60d0044ce 6 API calls 34923->34924 34925 7ff60d076824 std::_Facet_Register 3 API calls 34924->34925 34926 7ff60d00455e ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34925->34926 34927 7ff60d076824 std::_Facet_Register 3 API calls 34926->34927 34928 7ff60d0045d2 8 API calls 34927->34928 34929 7ff60d076824 std::_Facet_Register 3 API calls 34928->34929 34930 7ff60d00467c 8 API calls 34929->34930 34931 7ff60d076824 std::_Facet_Register 3 API calls 34930->34931 34932 7ff60d00472c ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34931->34932 34933 7ff60d00476d ??0QByteArray@@QEAA ?addTab@QTabWidget@@QEAAHPEAVQWidget@@AEBVQString@@ ??1QString@@QEAA 34932->34933 34934 7ff60d076824 std::_Facet_Register 3 API calls 34933->34934 34935 7ff60d0047a0 7 API calls 34934->34935 34936 7ff60d076824 std::_Facet_Register 3 API calls 34935->34936 34937 7ff60d00483d 6 API calls 34936->34937 34938 7ff60d076824 std::_Facet_Register 3 API calls 34937->34938 34939 7ff60d0048c4 ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34938->34939 34940 7ff60d076824 std::_Facet_Register 3 API calls 34939->34940 34941 7ff60d004938 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34940->34941 34942 7ff60d004979 34941->34942 34943 7ff60d076824 std::_Facet_Register 3 API calls 34942->34943 34944 7ff60d004983 6 API calls 34943->34944 34945 7ff60d076824 std::_Facet_Register 3 API calls 34944->34945 34946 7ff60d004a13 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34945->34946 34947 7ff60d004a54 ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H 34946->34947 34948 7ff60d076824 std::_Facet_Register 3 API calls 34947->34948 34949 7ff60d004a6f ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34948->34949 34950 7ff60d076824 std::_Facet_Register 3 API calls 34949->34950 34951 7ff60d004ae9 15 API calls 34950->34951 34952 7ff60d076824 std::_Facet_Register 3 API calls 34951->34952 34953 7ff60d004c0d 8 API calls 34952->34953 34954 7ff60d076824 std::_Facet_Register 3 API calls 34953->34954 34955 7ff60d004ccf ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34954->34955 34956 7ff60d076824 std::_Facet_Register 3 API calls 34955->34956 34957 7ff60d004d49 ??0QCheckBox@@QEAA@PEAVQWidget@@ ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@ 34956->34957 34958 7ff60d076824 std::_Facet_Register 3 API calls 34957->34958 34959 7ff60d004dd3 14 API calls 34958->34959 34960 7ff60d076824 std::_Facet_Register 3 API calls 34959->34960 34961 7ff60d004ef9 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34960->34961 34962 7ff60d004f40 ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H 34961->34962 34963 7ff60d076824 std::_Facet_Register 3 API calls 34962->34963 34964 7ff60d004f5e ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34963->34964 34965 7ff60d076824 std::_Facet_Register 3 API calls 34964->34965 34966 7ff60d004fd8 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34965->34966 34967 7ff60d00501f 34966->34967 34968 7ff60d076824 std::_Facet_Register 3 API calls 34967->34968 34969 7ff60d005029 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@ ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@ 34968->34969 34970 7ff60d076824 std::_Facet_Register 3 API calls 34969->34970 34971 7ff60d0050b6 9 API calls 34970->34971 34972 7ff60d076824 std::_Facet_Register 3 API calls 34971->34972 34973 7ff60d005180 ??0QWidget@@QEAA@PEAV0@V?$QFlags@W4WindowType@Qt@@@@ ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34972->34973 34974 7ff60d076824 std::_Facet_Register 3 API calls 34973->34974 34975 7ff60d0051f1 6 API calls 34974->34975 34976 7ff60d076824 std::_Facet_Register 3 API calls 34975->34976 34977 7ff60d005284 ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34976->34977 34978 7ff60d076824 std::_Facet_Register 3 API calls 34977->34978 34979 7ff60d0052fe ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34978->34979 34980 7ff60d005345 34979->34980 34981 7ff60d076824 std::_Facet_Register 3 API calls 34980->34981 34982 7ff60d00534f 6 API calls 34981->34982 34983 7ff60d076824 std::_Facet_Register 3 API calls 34982->34983 34984 7ff60d0053f1 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34983->34984 34985 7ff60d005438 ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H 34984->34985 34986 7ff60d076824 std::_Facet_Register 3 API calls 34985->34986 34987 7ff60d005459 ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34986->34987 34988 7ff60d076824 std::_Facet_Register 3 API calls 34987->34988 34989 7ff60d0054c5 ??0QComboBox@@QEAA@PEAVQWidget@@ ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@ 34988->34989 34990 7ff60d076824 std::_Facet_Register 3 API calls 34989->34990 34991 7ff60d005552 13 API calls 34990->34991 34992 7ff60d076824 std::_Facet_Register 3 API calls 34991->34992 34993 7ff60d005667 12 API calls 34992->34993 34994 7ff60d076824 std::_Facet_Register 3 API calls 34993->34994 34995 7ff60d005760 8 API calls 34994->34995 34996 7ff60d076824 std::_Facet_Register 3 API calls 34995->34996 34997 7ff60d005828 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 34996->34997 34998 7ff60d00586e 34997->34998 34999 7ff60d076824 std::_Facet_Register 3 API calls 34998->34999 35000 7ff60d005878 ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 34999->35000 35001 7ff60d076824 std::_Facet_Register 3 API calls 35000->35001 35002 7ff60d0058f2 13 API calls 35001->35002 35003 7ff60d076824 std::_Facet_Register 3 API calls 35002->35003 35004 7ff60d005a09 14 API calls 35003->35004 35005 7ff60d076824 std::_Facet_Register 3 API calls 35004->35005 35006 7ff60d005b16 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 35005->35006 35007 7ff60d005b5d 35006->35007 35008 7ff60d076824 std::_Facet_Register 3 API calls 35007->35008 35009 7ff60d005b67 10 API calls 35008->35009 35010 7ff60d076824 std::_Facet_Register 3 API calls 35009->35010 35011 7ff60d005c4b ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 35010->35011 35012 7ff60d005c90 ??0QByteArray@@QEAA ?addTab@QTabWidget@@QEAAHPEAVQWidget@@AEBVQString@@ ??1QString@@QEAA ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@ 35011->35012 35013 7ff60d076824 std::_Facet_Register 3 API calls 35012->35013 35014 7ff60d005cd8 6 API calls 35013->35014 35015 7ff60d076824 std::_Facet_Register 3 API calls 35014->35015 35016 7ff60d005d64 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 35015->35016 35017 7ff60d005da8 35016->35017 35018 7ff60d076824 std::_Facet_Register 3 API calls 35017->35018 35019 7ff60d005db2 ??0QHBoxLayout@@QEAA ?setSpacing@QBoxLayout@@QEAAXH ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 35018->35019 35020 7ff60d076824 std::_Facet_Register 3 API calls 35019->35020 35021 7ff60d005e2a 7 API calls 35020->35021 35022 7ff60d076824 std::_Facet_Register 3 API calls 35021->35022 35023 7ff60d005ec5 7 API calls 35022->35023 35024 7ff60d076824 std::_Facet_Register 3 API calls 35023->35024 35025 7ff60d005f70 9 API calls 35024->35025 35026 7ff60d076824 std::_Facet_Register 3 API calls 35025->35026 35027 7ff60d006030 15 API calls 35026->35027 35028 7ff60d076824 std::_Facet_Register 3 API calls 35027->35028 35029 7ff60d006145 7 API calls 35028->35029 35030 7ff60d076824 std::_Facet_Register 3 API calls 35029->35030 35031 7ff60d0061ec 13 API calls 35030->35031 35032 7ff60d076824 std::_Facet_Register 3 API calls 35031->35032 35033 7ff60d0062f3 13 API calls 35032->35033 35034 7ff60d076824 std::_Facet_Register 3 API calls 35033->35034 35035 7ff60d0063f3 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 35034->35035 35036 7ff60d00643a 35035->35036 35037 7ff60d076824 std::_Facet_Register 3 API calls 35036->35037 35038 7ff60d006444 6 API calls 35037->35038 35039 7ff60d076824 std::_Facet_Register 3 API calls 35038->35039 35040 7ff60d0064e0 9 API calls 35039->35040 35041 7ff60d076824 std::_Facet_Register 3 API calls 35040->35041 35042 7ff60d00659f 12 API calls 35041->35042 35043 7ff60d076824 std::_Facet_Register 3 API calls 35042->35043 35044 7ff60d006688 7 API calls 35043->35044 35076 7ff60d002850 78 API calls 35044->35076 35046 7ff60d00672c ?setCurrentIndex@QTabWidget@@QEAAXH ?connectSlotsByName@QMetaObject@@SAXPEAVQObject@@ 35046->34677 35047->34688 35049 7ff60d076824 std::_Facet_Register 3 API calls 35048->35049 35050 7ff60d03a37e ??0QByteArray@@QEAA@AEBV0@ 35049->35050 35077 7ff60d03a850 ??0QObject@@QEAA@PEAV0@ ??0QByteArray@@QEAA ??0QDate@@QEAA ??0QByteArray@@QEAA ??4QString@@QEAAAEAV0@AEBV0@ 35050->35077 35052 7ff60d03a3ab 35053 7ff60d076824 std::_Facet_Register 3 API calls 35052->35053 35054 7ff60d03a3d5 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 35053->35054 35055 7ff60d076824 std::_Facet_Register 3 API calls 35054->35055 35056 7ff60d03a45c ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@ ??1Connection@QMetaObject@@QEAA 35055->35056 35057 7ff60d076824 std::_Facet_Register 3 API calls 35056->35057 35058 7ff60d03a4d4 6 API calls 35057->35058 35063 7ff60d010bd0 35059->35063 35062 7ff60d01060d 35062->34890 35064 7ff60d010c20 35063->35064 35064->35064 35065 7ff60d010c35 _stat64i32 35064->35065 35066 7ff60d010c51 35065->35066 35067 7ff60d010c96 _invalid_parameter_noinfo_noreturn 35066->35067 35070 7ff60d010c9d Concurrency::wait 35066->35070 35067->35070 35068 7ff60d0767c0 8 API calls 35069 7ff60d0105d0 ??1QByteArray@@QEAA ??1QString@@QEAA 35068->35069 35069->35062 35073 7ff60d010d1b 35070->35073 35074 7ff60d010da9 Concurrency::wait 35070->35074 35075 7ff60d00ca60 7 API calls 2 library calls 35070->35075 35072 7ff60d010ddc _invalid_parameter_noinfo_noreturn 35072->35074 35073->35072 35073->35074 35074->35068 35075->35073 35076->35046 35078 7ff60d076824 std::_Facet_Register 3 API calls 35077->35078 35079 7ff60d03a8c4 ??0QNetworkAccessManager@@QEAA@PEAVQObject@@ ??1QString@@QEAA 35078->35079 35079->35052 35080->34884 35082 7ffdf62be400 ?focusObject@QGuiApplication@@SAPEAVQObject@ 35083 7ffdf62be418 ?focusWindow@QGuiApplication@@SAPEAVQWindow@ 35082->35083 35084 7ffdf62be57b 35082->35084 35083->35084 35085 7ffdf62be42f ?mimeData@QDrag@@QEBAPEAVQMimeData@ 35083->35085 35085->35084 35086 7ffdf62be441 ?type@QWindow@@QEBA?AW4WindowType@Qt@ 35085->35086 35086->35084 35087 7ffdf62be453 ?mimeData@QDrag@@QEBAPEAVQMimeData@ 35086->35087 35088 7ffdf62be468 35087->35088 35088->35084 35089 7ffdf62be470 ?mimeData@QDrag@@QEBAPEAVQMimeData@ 35088->35089 35089->35084 35090 7ffdf62be485 ?inputMethodAccepted@QPlatformInputContext@ 35089->35090 35091 7ffdf62be54d 35090->35091 35092 7ffdf62be49e 35090->35092 35095 7ffdf62be576 ImmAssociateContext 35091->35095 35096 7ffdf62be563 35091->35096 35093 7ffdf62be4a3 ?isDebugEnabled@QLoggingCategory@ 35092->35093 35093->35091 35094 7ffdf62be4b4 35093->35094 35097 7ffdf62be4b9 9 API calls 35094->35097 35095->35084 35097->35091 35098 7ff60d03a1c0 35099 7ff60d03a2a7 Concurrency::wait 35098->35099 35100 7ff60d03a1e2 35098->35100 35100->35099 35101 7ff60d03a1eb ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ 35100->35101 35111 7ff60d03c170 ??0QDialog@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@ 35101->35111 35103 7ff60d03a26b ?exec@QDialog@ 35104 7ff60d03a27c 35103->35104 35109 7ff60d03a28a 35103->35109 35105 7ff60d03a28c 35104->35105 35106 7ff60d03a285 35104->35106 35121 7ff60d03a590 ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX 35105->35121 35120 7ff60d03a5d0 ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX 35106->35120 35122 7ff60d03c460 ??1QDialog@@UEAA Concurrency::wait 35109->35122 35112 7ff60d076824 std::_Facet_Register 3 API calls 35111->35112 35113 7ff60d03c1d7 ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ 35112->35113 35123 7ff60d047020 ??0QDialog@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@ 35113->35123 35115 7ff60d03c211 ?setWindowFlag@QWidget@@QEAAXW4WindowType@Qt@@_N 35128 7ff60d03c5e0 ?objectName@QObject@@QEBA?AVQString@ ??1QString@@QEAA 35115->35128 35117 7ff60d03c230 8 API calls 35118 7ff60d076824 std::_Facet_Register 3 API calls 35117->35118 35119 7ff60d03c2e2 19 API calls 35118->35119 35119->35103 35124 7ff60d076824 std::_Facet_Register 3 API calls 35123->35124 35125 7ff60d04707f ??0QByteArray@@QEAA ?setWindowFlag@QWidget@@QEAAXW4WindowType@Qt@@_N 35124->35125 35126 7ff60d0475d0 35125->35126 35127 7ff60d0470ab 9 API calls 35126->35127 35127->35115 35129 7ff60d03c64c ?resize@QWidget@@QEAAXHH 35128->35129 35130 7ff60d03c61f ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 35128->35130 35131 7ff60d076824 std::_Facet_Register 3 API calls 35129->35131 35130->35129 35132 7ff60d03c66a ??0QVBoxLayout@@QEAA@PEAVQWidget@@ ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 35131->35132 35133 7ff60d076824 std::_Facet_Register 3 API calls 35132->35133 35134 7ff60d03c6ce ??0QVBoxLayout@@QEAA ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA ?setSizeConstraint@QLayout@@QEAAXW4SizeConstraint@1@ 35133->35134 35135 7ff60d076824 std::_Facet_Register 3 API calls 35134->35135 35136 7ff60d03c72f ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@ ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@ 35135->35136 35137 7ff60d076824 std::_Facet_Register 3 API calls 35136->35137 35138 7ff60d03c7ac 19 API calls 35137->35138 35139 7ff60d076824 std::_Facet_Register 3 API calls 35138->35139 35140 7ff60d03c8eb 7 API calls 35139->35140 35141 7ff60d076824 std::_Facet_Register 3 API calls 35140->35141 35142 7ff60d03c979 ??0QHBoxLayout@@QEAA ?fromUtf8@QString@@SA?AV1@PEBDH ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA 35141->35142 35143 7ff60d076824 std::_Facet_Register 3 API calls 35142->35143 35144 7ff60d03c9dc 6 API calls 35143->35144 35145 7ff60d076824 std::_Facet_Register 3 API calls 35144->35145 35146 7ff60d03ca54 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0 35145->35146 35147 7ff60d03ca94 35146->35147 35148 7ff60d076824 std::_Facet_Register 3 API calls 35147->35148 35149 7ff60d03ca9e 30 API calls 35148->35149 35149->35117 35150 7ffdf6298ac0 ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?qt_window_private@@YAPEAVQWindowPrivate@@PEAVQWindow@@ 35151 7ffdf6298b1d 35150->35151 35152 7ffdf6298af0 ?moveTopLeft@QRect@@QEAAXAEBVQPoint@@ 35150->35152 35153 7ffdf6298c25 ?setGeometry@QPlatformWindow@@UEAAXAEBVQRect@@ 35151->35153 35154 7ffdf6298b40 35151->35154 35152->35151 35163 7ffdf6298c40 35154->35163 35158 7ffdf6298b8c ?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@ 35160 7ffdf6298b96 35158->35160 35161 7ffdf6298c15 35158->35161 35159 7ffdf6298b82 IsWindowVisible 35159->35158 35159->35160 35162 7ffdf6298bbb 6 API calls 35160->35162 35162->35161 35164 7ffdf6298c7a ??0QRect@@QEAA@AEBVQPoint@@0 35163->35164 35165 7ffdf62a1690 2 API calls 35164->35165 35166 7ffdf6298cbb ?isDebugEnabled@QLoggingCategory@ 35165->35166 35167 7ffdf6298ccc 35166->35167 35168 7ffdf6298e61 GetWindowPlacement 35166->35168 35192 7ffdf6294960 35167->35192 35171 7ffdf6298e99 35168->35171 35172 7ffdf6298e8c IsWindowVisible 35168->35172 35174 7ffdf6298ea5 GetWindowLongPtrW 35171->35174 35175 7ffdf6298fb8 MoveWindow 35171->35175 35172->35171 35172->35174 35182 7ffdf6298ed9 35174->35182 35191 7ffdf6298ef7 35174->35191 35177 7ffdf6298fea 35175->35177 35176 7ffdf62a1690 2 API calls 35178 7ffdf6298d00 20 API calls 35176->35178 35180 7ffdf62a1690 2 API calls 35177->35180 35178->35168 35179 7ffdf6298f45 ?translated@QRect@@QEBA?AV1@AEBVQPoint@@ SetWindowPlacement 35179->35177 35181 7ffdf6298ff5 ?isDebugEnabled@QLoggingCategory@ 35180->35181 35183 7ffdf629910a 35181->35183 35184 7ffdf629900e 35181->35184 35182->35191 35185 7ffdf6381690 3 API calls 35183->35185 35187 7ffdf6294960 10 API calls 35184->35187 35186 7ffdf6298b51 35185->35186 35186->35158 35186->35159 35186->35161 35188 7ffdf629902d ?marginsRemoved@QRect@@QEBA?AV1@AEBVQMargins@@ 35187->35188 35189 7ffdf62a1690 2 API calls 35188->35189 35190 7ffdf6299042 12 API calls 35189->35190 35190->35183 35191->35179 35193 7ffdf6294991 35192->35193 35194 7ffdf6294a29 GetWindowRect GetParent 35193->35194 35195 7ffdf62949b0 GetWindowPlacement 35193->35195 35197 7ffdf6294a89 35194->35197 35198 7ffdf6294a44 35194->35198 35195->35194 35196 7ffdf62949ca ??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@ 35195->35196 35200 7ffdf629c140 35196->35200 35199 7ffdf6294a96 ??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@ 35197->35199 35198->35197 35201 7ffdf6294a49 ScreenToClient 35198->35201 35202 7ffdf6294ab9 35199->35202 35203 7ffdf6294a14 ?translated@QRect@@QEBA?AV1@AEBVQPoint@@ 35200->35203 35201->35199 35204 7ffdf6381690 3 API calls 35202->35204 35203->35202 35205 7ffdf6294ac8 ?marginsRemoved@QRect@@QEBA?AV1@AEBVQMargins@@ 35204->35205 35205->35176 35206 7ffdf62a5bc0 ??0?$QVector@VQPointF@@@@QEAA 35219 7ffdf62a5870 memset GetMonitorInfoW 35206->35219 35209 7ffdf62a5d7c ??1QString@@QEAA 35210 7ffdf62a5cf5 35213 7ffdf62a5c74 35210->35213 35214 7ffdf62a5d0c ?append@QListData@ 35210->35214 35211 7ffdf62a5c67 35212 7ffdf62a5ced ?prepend@QListData@ 35211->35212 35211->35213 35212->35213 35217 7ffdf62a5c8e ??0QByteArray@@QEAA@AEBV0@ 35213->35217 35215 7ffdf6380e9c 35214->35215 35216 7ffdf62a5d1f ??0QByteArray@@QEAA@AEBV0@ 35215->35216 35218 7ffdf62a5d79 35216->35218 35217->35218 35218->35209 35220 7ffdf62a58bf ?fromWCharArray@QString@@SA?AV1@PEB_WH ??4QUrl@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA ??8QString@@QEBA_NVQLatin1String@@ 35219->35220 35223 7ffdf62a5982 35219->35223 35222 7ffdf62a598b CreateDCW 35220->35222 35220->35223 35221 7ffdf6381690 3 API calls 35224 7ffdf62a5bab 35221->35224 35225 7ffdf62a5ae7 7 API calls 35222->35225 35228 7ffdf62a59a9 35222->35228 35223->35221 35224->35209 35224->35210 35224->35211 35225->35223 35226 7ffdf62a5a1a GetDeviceCaps GetDeviceCaps 35227 7ffdf62a5a52 GetDeviceCaps GetDeviceCaps GetDeviceCaps GetDeviceCaps 35226->35227 35229 7ffdf62a5adc DeleteDC 35227->35229 35230 7ffdf62a5acf 35227->35230 35228->35226 35231 7ffdf62a5a0f 35228->35231 35229->35223 35230->35229 35231->35227 35232 7ffdf6296480 35233 7ffdf62964ae ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?isVisible@QWindow@ 35232->35233 35237 7ffdf62964d5 35232->35237 35234 7ffdf62964dc GetUpdateRect 35233->35234 35235 7ffdf62964c1 GetWindowLongW 35233->35235 35234->35237 35238 7ffdf62964f1 35234->35238 35235->35234 35235->35237 35236 7ffdf6381690 3 API calls 35239 7ffdf6296656 35236->35239 35237->35236 35240 7ffdf629653c BeginPaint DwmIsCompositionEnabled 35238->35240 35242 7ffdf6296517 DwmIsCompositionEnabled 35238->35242 35243 7ffdf629650d ?openGLModuleType@QOpenGLContext@@SA?AW4OpenGLModuleType@1 35238->35243 35241 7ffdf629655a 35240->35241 35244 7ffdf6296580 6 API calls 35241->35244 35245 7ffdf6296574 SelectClipRgn 35241->35245 35246 7ffdf629652e InvalidateRect 35242->35246 35247 7ffdf6296528 35242->35247 35243->35242 35243->35246 35248 7ffdf629663b EndPaint 35244->35248 35249 7ffdf629661a 35244->35249 35245->35244 35246->35240 35247->35240 35247->35246 35248->35237 35249->35248 35250 7ffdf6296630 ?flushWindowSystemEvents@QWindowSystemInterface@@SA_NV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@ 35249->35250 35250->35248 35251 7ffdf6295cc0 ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?isTopLevel@QWindow@ 35252 7ffdf6295e49 35251->35252 35253 7ffdf6295cf1 35251->35253 35253->35252 35264 7ffdf6296af0 GetForegroundWindow 35253->35264 35255 7ffdf6295d1f ?minimumSize@QWindow@@QEBA?AVQSize@ 35255->35252 35256 7ffdf6295d36 35255->35256 35256->35252 35257 7ffdf6295d40 ?maximumSize@QWindow@@QEBA?AVQSize@ 35256->35257 35258 7ffdf6295d79 35257->35258 35259 7ffdf6295d82 ?scaleAndOrigin@QHighDpiScaling@@SA?AUScaleAndOrigin@1@PEBVQWindow@@PEAVQPoint@@ 35257->35259 35258->35259 35262 7ffdf6295dde 35258->35262 35260 7ffdf6297dc0 35259->35260 35261 7ffdf6295dbe ?mapFromGlobal@QWindow@@QEBA?AVQPoint@@AEBV2@ 35260->35261 35261->35262 35265 7ffdf6295d0a 35264->35265 35266 7ffdf6296b04 35264->35266 35265->35252 35265->35255 35266->35265 35267 7ffdf6296b0d IsChild 35266->35267 35267->35265 35268 7ffdf6295740 35269 7ffdf6295769 35268->35269 35270 7ffdf6294960 10 API calls 35269->35270 35271 7ffdf6295778 ?marginsRemoved@QRect@@QEBA?AV1@AEBVQMargins@@ 35270->35271 35272 7ffdf629597c 35271->35272 35273 7ffdf629579e ?window@QPlatformWindow@@QEBAPEAVQWindow@ 35271->35273 35275 7ffdf62957b3 35273->35275 35274 7ffdf6295892 35276 7ffdf62958b7 ?flushWindowSystemEvents@QWindowSystemInterface@@SA_NV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@ 35274->35276 35277 7ffdf62958c2 35274->35277 35275->35274 35278 7ffdf62957d5 ?size@QRect@@QEBA?AVQSize@ 35275->35278 35276->35277 35280 7ffdf62958d2 ?isDebugEnabled@QLoggingCategory@ 35277->35280 35279 7ffdf6295802 35278->35279 35279->35274 35281 7ffdf6295834 6 API calls 35279->35281 35280->35272 35282 7ffdf62958e3 35280->35282 35281->35274 35283 7ffdf62958e8 9 API calls 35282->35283 35283->35272 35284 7ffdf62fc2c0 ?fromWCharArray@QString@@SA?AV1@PEB_WH ?fromWCharArray@QString@@SA?AV1@PEB_WH 35285 7ffdf62fc4bf ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ 35284->35285 35286 7ffdf62fc31f ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ 35284->35286 35303 7ffdf62f5a10 ?isEmpty@QString@ 35285->35303 35287 7ffdf62fc34c ?qHash@@YAIAEBVQString@@I ?qHash@@YAIAEBVQString@@I 35286->35287 35288 7ffdf62fc370 35286->35288 35287->35288 35291 7ffdf62fc387 ??1QString@@QEAA ??1QString@@QEAA 35288->35291 35292 7ffdf62fc3a0 35288->35292 35290 7ffdf62fc4f9 ??1QString@@QEAA ??1QString@@QEAA 35291->35290 35293 7ffdf62fc3a8 ?detach_helper@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH 35292->35293 35294 7ffdf62fc401 ?qHash@@YAIAEBVQString@@I ?qHash@@YAIAEBVQString@@I 35292->35294 35296 7ffdf62fc3dc 35293->35296 35297 7ffdf62fc3ee ?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z 35293->35297 35295 7ffdf62fc43c 35294->35295 35299 7ffdf62fc447 ?willGrow@QHashData@ 35295->35299 35300 7ffdf62fc4a3 ??1QString@@QEAA ??1QString@@QEAA 35295->35300 35296->35297 35298 7ffdf62fc3fe 35296->35298 35297->35298 35298->35294 35301 7ffdf62fc463 ?allocateNode@QHashData@@QEAAPEAXH ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ 35299->35301 35302 7ffdf62fc451 35299->35302 35300->35285 35301->35300 35302->35301 35304 7ffdf62f620d ??1QString@@QEAA ??1QString@@QEAA 35303->35304 35305 7ffdf62f5a5d ??0QChar@@QEAA@UQLatin1Char@@ ?at@QString@@QEBA?BVQChar@@H 35303->35305 35307 7ffdf62f6221 35304->35307 35305->35304 35306 7ffdf62f5a87 ?startsWith@QString@@QEBA_NVQLatin1String@@W4CaseSensitivity@Qt@@ 35305->35306 35306->35304 35308 7ffdf62f5abd ??0?$QVector@VQPointF@@@@QEAA 35306->35308 35309 7ffdf6381690 3 API calls 35307->35309 35311 7ffdf62f5b0b 35308->35311 35312 7ffdf62f5b0e ?weightFromInteger@QPlatformFontDatabase@@SA?AW4Weight@QFont@@H 35308->35312 35310 7ffdf62f622d 35309->35310 35310->35290 35311->35312 35313 7ffdf62fa1d0 35312->35313 35314 7ffdf62f5b39 ?isDebugEnabled@QLoggingCategory@ 35313->35314 35315 7ffdf62f5d17 ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA 35314->35315 35316 7ffdf62f5b50 9 API calls 35314->35316 35319 7ffdf62f5d48 35315->35319 35320 7ffdf62f5df4 ??0QSupportedWritingSystems@@QEAA 35315->35320 35317 7ffdf62f5be9 35316->35317 35318 7ffdf62f5bd8 ??6QTextStream@@QEAAAEAV0@PEBD 35316->35318 35322 7ffdf62f5bff 35317->35322 35323 7ffdf62f5bee ??6QTextStream@@QEAAAEAV0@PEBD 35317->35323 35318->35317 35362 7ffdf62fade0 6 API calls 35319->35362 35324 7ffdf62f5e0c ?writingSystemsFromTrueTypeBits@QPlatformFontDatabase@@SA?AVQSupportedWritingSystems@@QEAI0 ??4QSupportedWritingSystems@@QEAAAEAV0@AEBV0@ ??1QSupportedWritingSystems@@QEAA ?supported@QSupportedWritingSystems@@QEBA_NW4WritingSystem@QFontDatabase@@ 35320->35324 35331 7ffdf62f5e9c 35320->35331 35326 7ffdf62f5c15 10 API calls 35322->35326 35327 7ffdf62f5c04 ??6QTextStream@@QEAAAEAV0@PEBD 35322->35327 35323->35322 35328 7ffdf62f5e6c ??8QString@@QEBA_NVQLatin1String@@ 35324->35328 35329 7ffdf62f5f36 35324->35329 35325 7ffdf62f5d55 35335 7ffdf62f5d61 ?isEmpty@QString@ 35325->35335 35336 7ffdf62f5d7d ?isEmpty@QString@ 35325->35336 35330 7ffdf62fa1d0 35326->35330 35327->35326 35328->35329 35328->35331 35333 7ffdf62f5f3f ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX 35329->35333 35334 7ffdf62f5cb2 ?isDebugEnabled@QLoggingCategory@ 35330->35334 35331->35329 35332 7ffdf62f5f28 ?setSupported@QSupportedWritingSystems@@QEAAXW4WritingSystem@QFontDatabase@@_N 35331->35332 35332->35329 35337 7ffdf62f6008 35333->35337 35338 7ffdf62f5f90 ?isEmpty@QString@ 35333->35338 35339 7ffdf62f5d03 ??1QTextStream@@UEAA ??1QString@@QEAA 35334->35339 35340 7ffdf62f5cbf 35334->35340 35335->35336 35341 7ffdf62f5d6f ??4QString@@QEAAAEAV0@AEBV0@ 35335->35341 35342 7ffdf62f5d8b ??4QString@@QEAAAEAV0@AEBV0@ ??4QString@@QEAAAEAV0@AEBV0@ ??4QString@@QEAAAEAV0@AEBV0@ ??4QString@@QEAAAEAV0@AEBV0@ ??4QString@@QEAAAEAV0@AEBV0@ 35336->35342 35343 7ffdf62f5dcc ??1QString@@QEAA ??1QString@@QEAA ??1QString@@QEAA ??1QString@@QEAA 35336->35343 35344 7ffdf62f6011 ?isEmpty@QString@ 35337->35344 35346 7ffdf62f6089 35337->35346 35338->35337 35345 7ffdf62f5f9d 35338->35345 35339->35315 35348 7ffdf62f5cc4 ??0QMessageLogger@@QEAA@PEBDH00 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@AEBVQString@@ ??1QDebug@@QEAA 35340->35348 35341->35336 35342->35343 35343->35320 35344->35346 35347 7ffdf62f601e 35344->35347 35353 7ffdf62f5fa6 ??0?$QVector@VQPointF@@@@QEAA ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX ??1QString@@QEAA 35345->35353 35349 7ffdf62f6112 ?isEmpty@QString@ 35346->35349 35350 7ffdf62f6097 ?isEmpty@QString@ 35346->35350 35358 7ffdf62f6027 ??0?$QVector@VQPointF@@@@QEAA ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX ??1QString@@QEAA 35347->35358 35348->35339 35351 7ffdf62f6120 ??8@YA_NAEBVQString@@0 35349->35351 35352 7ffdf62f617e ?isEmpty@QString@ 35349->35352 35350->35349 35354 7ffdf62f60a4 35350->35354 35351->35352 35355 7ffdf62f6131 35351->35355 35356 7ffdf62f619c ??8@YA_NAEBVQString@@0 35352->35356 35357 7ffdf62f61ba 8 API calls 35352->35357 35353->35337 35360 7ffdf62f60ad ??0?$QVector@VQPointF@@@@QEAA ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX ??1QString@@QEAA 35354->35360 35361 7ffdf62f613a ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX 35355->35361 35356->35357 35359 7ffdf62f61ad ?registerAliasToFontFamily@QPlatformFontDatabase@@SAXAEBVQString@@0 35356->35359 35357->35307 35358->35346 35359->35357 35360->35349 35361->35352 35363 7ffdf62fae3f 9 API calls 35362->35363 35364 7ffdf62faeae SelectObject ??0?$QVector@VQPointF@@@@QEAA GetFontData 35362->35364 35365 7ffdf62fb035 35363->35365 35366 7ffdf62faef6 ?resize@QByteArray@@QEAAXH ?data@QByteArray@ GetFontData 35364->35366 35367 7ffdf62fafa4 12 API calls 35364->35367 35365->35325 35366->35367 35368 7ffdf62faf29 ??BQByteArray@ 35366->35368 35367->35365 35369 7ffdf62fa860 35368->35369 35370 7ffdf62faf42 8 API calls 35369->35370 35370->35367 35371 7ffdf62fa440 35372 7ffdf62fa1d0 35371->35372 35373 7ffdf62fa463 ?isDebugEnabled@QLoggingCategory@ 35372->35373 35374 7ffdf62fa4b6 ?length@QString@ 35373->35374 35375 7ffdf62fa470 35373->35375 35376 7ffdf62fa569 GetDC ?toWCharArray@QString@@QEBAHPEA_W ?length@QString@ EnumFontFamiliesExW ReleaseDC 35374->35376 35377 7ffdf62fa4c8 35374->35377 35378 7ffdf62fa475 ??0QMessageLogger@@QEAA@PEBDH00 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@AEBVQString@@ ??1QDebug@@QEAA 35375->35378 35379 7ffdf62fa610 ?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z 35376->35379 35380 7ffdf62fa5fe 35376->35380 35381 7ffdf62fa4cd ?isWarningEnabled@QLoggingCategory@ 35377->35381 35378->35374 35382 7ffdf62fa622 35379->35382 35380->35379 35380->35382 35381->35382 35383 7ffdf62fa4de 35381->35383 35384 7ffdf6381690 3 API calls 35382->35384 35385 7ffdf62fa505 6 API calls 35383->35385 35387 7ffdf62fa654 ??0QLoggingCategory@@QEAA@PEBD 35383->35387 35386 7ffdf62fa632 35384->35386 35385->35382 35388 7ffdf63812c0 35387->35388 35389 7ffdf62fa674 _Init_thread_footer 35388->35389 35389->35385 35390 7ffdf62f3540 ?processEvents@QEventDispatcherWin32@@UEAA_NV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@ 35391 7ffdf62e17c0 35392 7ffdf62e1818 DefWindowProcW 35391->35392 35393 7ffdf62e17f3 35391->35393 35394 7ffdf62e1811 35392->35394 35393->35392 35393->35394 35395 7ffdf6681630 35396 7ffdf6683270 35395->35396 35407 7ffdf6759290 35396->35407 35398 7ffdf668328f 35414 7ffdf6683490 ??0QObjectPrivate@@QEAA@H 35398->35414 35400 7ffdf6683297 ??0QObject@@IEAA@AEAVQObjectPrivate@@PEAV0@ 35401 7ffdf66832c6 35400->35401 35403 7ffdf66832e2 35400->35403 35402 7ffdf668340f _Init_thread_footer 35401->35402 35401->35403 35402->35403 35404 7ffdf6683472 _Init_thread_footer 35403->35404 35405 7ffdf6683309 35403->35405 35404->35405 35406 7ffdf6683336 ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@ ??1Connection@QMetaObject@@QEAA ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@ ??1Connection@QMetaObject@@QEAA 35405->35406 35408 7ffdf67592aa malloc 35407->35408 35409 7ffdf67592b4 35408->35409 35410 7ffdf675929b 35408->35410 35409->35398 35410->35408 35411 7ffdf67592ba 35410->35411 35412 7ffdf67592c6 Concurrency::cancel_current_task 35411->35412 35413 7ffdf67592e4 35412->35413 35413->35398 35415 7ffdf66834df 35414->35415 35422 7ffdf66ebfc0 ??0QObject@@QEAA@PEAV0@ 35415->35422 35417 7ffdf6683517 35418 7ffdf6759290 2 API calls 35417->35418 35419 7ffdf6683572 35418->35419 35420 7ffdf668359a ??0QMutex@@QEAA@W4RecursionMode@0@ 35419->35420 35421 7ffdf66835c8 35420->35421 35421->35400 35427 7ffdf66ec500 35422->35427 35425 7ffdf66ec0e0 35425->35417 35426 7ffdf66ebfee 10 API calls 35426->35425 35428 7ffdf66ec51a 35427->35428 35429 7ffdf66ebfe2 35427->35429 35428->35429 35430 7ffdf66ec55c ?lock@QMutex@ 35428->35430 35435 7ffdf66ec684 ??0QBasicMutex@@QEAA _Init_thread_footer 35428->35435 35429->35425 35429->35426 35431 7ffdf66ec580 35430->35431 35432 7ffdf66ec64e ?unlock@QMutexLocker@ 35430->35432 35433 7ffdf6759290 2 API calls 35431->35433 35432->35429 35434 7ffdf66ec588 35433->35434 35446 7ffdf66ee310 ??0QObject@@QEAA@PEAV0@ ??0QMutex@@QEAA@W4RecursionMode@0@ ??0QString@@QEAA@VQLatin1String@@ ??0QFactoryLoader@@QEAA@PEBDAEBVQString@@W4CaseSensitivity@Qt@@ ??1QString@@QEAA 35434->35446 35435->35430 35437 7ffdf66ec590 ?currentThread@QThread@@SAPEAV1 ?mainThread@QCoreApplicationPrivate@@SAPEAVQThread@ 35438 7ffdf66ec5cb 35437->35438 35439 7ffdf66ec5a7 ?qAddPreRoutine@@YAXP6AXXZ ?qAddPostRoutine@@YAXP6AXXZ 35437->35439 35441 7ffdf6759290 2 API calls 35438->35441 35448 7ffdf66efe40 35439->35448 35443 7ffdf66ec5d5 ??0QObject@@QEAA@PEAV0@ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@ ??1Connection@QMetaObject@@QEAA 35441->35443 35442 7ffdf66ec5c9 35442->35432 35444 7ffdf66efe40 107 API calls 35443->35444 35445 7ffdf66ec62c ?mainThread@QCoreApplicationPrivate@@SAPEAVQThread@ ?moveToThread@QObject@@QEAAXPEAVQThread@@ ?deleteLater@QObject@ 35444->35445 35445->35442 35447 7ffdf66ee3d4 35446->35447 35447->35437 35449 7ffdf6759290 2 API calls 35448->35449 35450 7ffdf66efe57 ??0QDaemonThread@@QEAA@PEAVQObject@@ 35449->35450 35451 7ffdf66ee5b0 35450->35451 35452 7ffdf66efe88 6 API calls 35451->35452 35453 7ffdf66f0b20 35452->35453 35454 7ffdf66f0b45 ?lock@QMutex@ 35453->35454 35455 7ffdf66f0b50 35453->35455 35454->35455 35456 7ffdf66f0b75 ?sender@QObject@@IEBAPEAV1 ?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@ 35455->35456 35457 7ffdf66f1081 ?sender@QObject@@IEBAPEAV1 ?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@ 35455->35457 35458 7ffdf66f1389 ?unlock@QMutexLocker@ 35456->35458 35459 7ffdf66f0b97 ?qEnvironmentVariableIntValue@@YAHPEBDPEA_N ?keyMap@QFactoryLoader@@QEBA?AV?$QMultiMap@HVQString@@@ 35456->35459 35477 7ffdf66f10a6 35457->35477 35458->35442 35468 7ffdf66f0bf7 35459->35468 35460 7ffdf66f1109 35460->35458 35462 7ffdf66f1138 ?detach@QListData@@QEAAPEAUData@1@H ?begin@QListData@ ?end@QListData@ ?begin@QListData@ 35460->35462 35463 7ffdf66f1128 35460->35463 35461 7ffdf66f0c10 ?QStringList_contains@QtPrivate@@YA_NPEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@ 35467 7ffdf66f0f53 ?nextNode@QMapNodeBase@@QEBAPEBU1 35461->35467 35461->35468 35469 7ffdf66f1195 ?unlock@QMutexLocker@ ?begin@QListData@ ?end@QListData@ 35462->35469 35470 7ffdf66f1176 35462->35470 35463->35469 35464 7ffdf66f0f68 35465 7ffdf66f100b 35464->35465 35466 7ffdf66f1002 ?dispose@QListData@@SAXPEAUData@1@ 35464->35466 35471 7ffdf66f0ff0 ??1QString@@QEAA 35464->35471 35481 7ffdf66f107c 35465->35481 35482 7ffdf66f103a ??1QString@@QEAA 35465->35482 35483 7ffdf66f1073 ?freeData@QMapDataBase@@SAXPEAU1@ 35465->35483 35466->35465 35467->35461 35467->35464 35468->35461 35468->35464 35472 7ffdf66f0daa ??0QByteArray@@QEAA@AEBV0@ ?append@QListData@ 35468->35472 35473 7ffdf66f0c41 ?begin@QListData@ ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH ?begin@QListData@ ?begin@QListData@ 35468->35473 35480 7ffdf66f0cca ?end@QListData@ ?begin@QListData@ 35468->35480 35488 7ffdf66f0cb0 ??0QByteArray@@QEAA@AEBV0@ 35468->35488 35490 7ffdf66f0d10 ??0QByteArray@@QEAA@AEBV0@ 35468->35490 35492 7ffdf66f0d72 ?dispose@QListData@@SAXPEAUData@1@ 35468->35492 35493 7ffdf66f0d7b ?begin@QListData@ ??0QByteArray@@QEAA@AEBV0@ 35468->35493 35494 7ffdf66f0d60 ??1QString@@QEAA 35468->35494 35475 7ffdf66f11d6 35469->35475 35476 7ffdf66f135e 35469->35476 35470->35469 35474 7ffdf66f1182 memcpy 35470->35474 35471->35466 35471->35471 35479 7ffdf66f0dcb ?indexOf@QFactoryLoader@@QEBAHAEBVQString@@ 35472->35479 35473->35468 35473->35480 35474->35469 35484 7ffdf66f11e0 11 API calls 35475->35484 35476->35458 35485 7ffdf66f137e ?dispose@QListData@@SAXPEAUData@1@ 35476->35485 35477->35460 35497 7ffdf66f0990 35477->35497 35486 7ffdf66f0ddc ?instance@QFactoryLoader@@QEBAPEAVQObject@@H ?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@ 35479->35486 35489 7ffdf66f0dfc 35479->35489 35480->35468 35481->35457 35487 7ffdf66f104d 35482->35487 35483->35481 35484->35476 35484->35484 35485->35458 35486->35489 35491 7ffdf66f1060 ?freeTree@QMapDataBase@@QEAAXPEAUQMapNodeBase@@H 35487->35491 35488->35468 35488->35488 35489->35467 35495 7ffdf66f0e39 ??8QString@@QEBA_NVQLatin1String@@ 35489->35495 35496 7ffdf66f0e6d 9 API calls 35489->35496 35490->35468 35490->35490 35491->35483 35492->35493 35493->35479 35494->35492 35494->35494 35495->35489 35496->35489 35498 7ffdf66f09a4 ?lock@QMutex@ 35497->35498 35499 7ffdf66f09b0 35497->35499 35498->35499 35500 7ffdf66f0a52 35499->35500 35501 7ffdf6759290 2 API calls 35499->35501 35502 7ffdf66f0a5c ?begin@QListData@ ?end@QListData@ 35500->35502 35503 7ffdf66f0ad9 ?unlock@QMutexLocker@ 35500->35503 35504 7ffdf66f09ca ??0QTimer@@QEAA@PEAVQObject@@ ?qEnvironmentVariableIntValue@@YAHPEBDPEA_N ?setInterval@QTimer@@QEAAXH ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@ ??1Connection@QMetaObject@@QEAA 35501->35504 35505 7ffdf66f0abb 35502->35505 35508 7ffdf66f0a80 35502->35508 35503->35460 35504->35500 35511 7ffdf66f00a0 35505->35511 35507 7ffdf66f0ad4 35507->35503 35508->35505 35509 7ffdf66f0abd ?start@QTimer@ 35508->35509 35521 7ffdf66f17d0 8 API calls 35508->35521 35509->35505 35512 7ffdf66f00c4 ?lock@QMutex@ 35511->35512 35513 7ffdf66f00d2 ?isEmpty@QListData@ 35511->35513 35512->35513 35514 7ffdf66f00ed ?begin@QListData@ ?end@QListData@ 35513->35514 35515 7ffdf66f00e0 35513->35515 35514->35515 35520 7ffdf66f0142 35514->35520 35516 7ffdf66f03ad ?unlock@QMutexLocker@ 35515->35516 35516->35507 35517 7ffdf66f022f 11 API calls 35517->35515 35517->35520 35518 7ffdf66f01c0 ?willGrow@QHashData@ 35519 7ffdf66f020b ?allocateNode@QHashData@@QEAAPEAXH 35518->35519 35518->35520 35519->35517 35520->35517 35520->35518 35520->35519 35521->35508 35522 7ffdf629c970 35523 7ffdf629c97e 35522->35523 35524 7ffdf62f33d0 ??0QEventDispatcherWin32@@QEAA@PEAVQObject@@ 35523->35524 35525 7ffdf62f3430 35524->35525 35526 7ffdf62f3405 ?setObjectName@QObject@@QEAAXAEBVQString@@ ??1QString@@QEAA ?createInternalHwnd@QEventDispatcherWin32@ 35525->35526 35527 7ffdf62987f0 35528 7ffdf629893f 35527->35528 35529 7ffdf6298813 35527->35529 35530 7ffdf6298818 ?isDebugEnabled@QLoggingCategory@ 35529->35530 35531 7ffdf6298829 35530->35531 35534 7ffdf62988b1 35530->35534 35533 7ffdf629882e 8 API calls 35531->35533 35532 7ffdf629890a CoLockObjectExternal 35535 7ffdf629892a RevokeDragDrop 35532->35535 35533->35534 35534->35532 35536 7ffdf62988bf ?window@QPlatformWindow@@QEBAPEAVQWindow@ 35534->35536 35535->35528 35537 7ffdf62e1be0 35536->35537 35538 7ffdf62988d6 RegisterDragDrop CoLockObjectExternal 35537->35538 35538->35532 35539 7ffdf66a3830 ??0QObject@@QEAA@PEAV0@ ??0QObject@@QEAA@PEAV0@ 35540 7ffdf6715100 35539->35540 35541 7ffdf66a3889 7 API calls 35540->35541 35544 7ffdf6714230 35541->35544 35543 7ffdf66a3933 18 API calls 35545 7ffdf6759290 2 API calls 35544->35545 35546 7ffdf671424f 35545->35546 35549 7ffdf670eff0 ??0QIODevicePrivate@@QEAA ??0QString@@QEAA 35546->35549 35548 7ffdf671425a 35548->35543 35557 7ffdf66f7970 35549->35557 35551 7ffdf670f048 35552 7ffdf66f7970 4 API calls 35551->35552 35553 7ffdf670f068 35552->35553 35554 7ffdf66f7970 4 API calls 35553->35554 35555 7ffdf670f074 ??0QString@@QEAA 35554->35555 35556 7ffdf670f09f 35555->35556 35556->35548 35558 7ffdf6759290 2 API calls 35557->35558 35559 7ffdf66f7987 ??0QSharedData@@QEAA ??0QString@@QEAA 35558->35559 35559->35551 35560 7ffdf62f8b70 ??0QString@@QEAA@PEBVQChar@@H 35571 7ffdf62fbef0 35560->35571 35562 7ffdf62f8bac 35592 7ffdf62f6b00 35562->35592 35564 7ffdf62f8c01 ?isDebugEnabled@QLoggingCategory@ 35566 7ffdf62f8cac ??1QString@@QEAA 35564->35566 35567 7ffdf62f8c12 35564->35567 35565 7ffdf62f8bca 35565->35564 35568 7ffdf62f8c17 ??0QMessageLogger@@QEAA@PEBDH00 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD ??6QDebug@@QEAAAEAV0@PEBD 35567->35568 35569 7ffdf62f3c50 35568->35569 35570 7ffdf62f8c7e ??6QDebug@@QEAAAEAV0@PEBX ??6QDebug@@QEAAAEAV0@PEBX ??1QDebug@@QEAA ??1QDebug@@QEAA 35569->35570 35570->35566 35572 7ffdf62fbf1c 35571->35572 35573 7ffdf62fbf17 35571->35573 35574 7ffdf62fbf4c ?get@QThreadStorageData@ 35572->35574 35580 7ffdf62fc281 ??0QThreadStorageData@@QEAA@P6AXPEAX@Z 35572->35580 35573->35574 35575 7ffdf62fc1f9 ?get@QThreadStorageData@ 35574->35575 35576 7ffdf62fbf64 35574->35576 35577 7ffdf62fc207 35575->35577 35578 7ffdf62fc222 35575->35578 35579 7ffdf62fbfb3 SystemParametersInfoW 35576->35579 35581 7ffdf62fc20f ?set@QThreadStorageData@@QEAAPEAPEAXPEAX 35577->35581 35578->35562 35582 7ffdf62fbffa 35579->35582 35583 7ffdf62fc027 SystemParametersInfoW 35579->35583 35584 7ffdf63812c0 35580->35584 35581->35578 35582->35583 35586 7ffdf62fc068 35583->35586 35585 7ffdf62fc2a7 _Init_thread_footer 35584->35585 35585->35574 35587 7ffdf62fc0b0 pow 35586->35587 35588 7ffdf62fc110 GetDC CreateCompatibleDC ReleaseDC 35586->35588 35587->35586 35589 7ffdf62fc14f 35588->35589 35590 7ffdf62fc166 ?set@QThreadStorageData@@QEAAPEAPEAXPEAX 35589->35590 35591 7ffdf62fc1d0 35590->35591 35591->35575 35593 7ffdf62f6b4b 35592->35593 35594 7ffdf62f6baa CreateFontIndirectW 35593->35594 35595 7ffdf62f6c55 35593->35595 35597 7ffdf62f6bbc ?qErrnoWarning@ 35594->35597 35598 7ffdf62f6bd8 SelectObject GetTextMetricsW 35594->35598 35636 7ffdf62fa100 35595->35636 35600 7ffdf62f6bd5 35597->35600 35601 7ffdf62f6c1c 35598->35601 35602 7ffdf62f6c06 ?qErrnoWarning@ 35598->35602 35600->35598 35605 7ffdf62f6c39 SelectObject DeleteObject 35601->35605 35602->35605 35603 7ffdf62f7255 35647 7ffdf62fff10 ??0QFontEngine@@IEAA@W4Type@0@ 35603->35647 35604 7ffdf62f6c65 ?fromWCharArray@QString@@SA?AV1@PEB_WH 35642 7ffdf6305850 ?utf16@QString@ 35604->35642 35605->35595 35609 7ffdf62f6ca3 ?length@QString@ ?utf16@QString@ memmove 35610 7ffdf62f6cdf CreateFontIndirectW 35609->35610 35611 7ffdf62f6d0a SelectObject 35610->35611 35612 7ffdf62f6cf1 ?qErrnoWarning@ 35610->35612 35614 7ffdf62f6d38 ?startsWith@QString@@QEBA_NVQLatin1String@@W4CaseSensitivity@Qt@@ 35611->35614 35616 7ffdf62f6d33 35611->35616 35613 7ffdf62f722d ??1QString@@QEAA ??1QString@@QEAA 35612->35613 35613->35603 35615 7ffdf62f7250 35613->35615 35614->35616 35617 7ffdf6381690 3 API calls 35615->35617 35618 7ffdf62f705a 35616->35618 35625 7ffdf62f6db7 35616->35625 35619 7ffdf62f72dd 35617->35619 35620 7ffdf62f7063 7 API calls 35618->35620 35621 7ffdf62f7210 SelectObject DeleteObject 35618->35621 35619->35565 35622 7ffdf62f3c50 35620->35622 35621->35613 35623 7ffdf62f70e9 19 API calls 35622->35623 35624 7ffdf62f720a ??1QString@@QEAA 35623->35624 35624->35621 35626 7ffdf62f6e20 ?isDebugEnabled@QLoggingCategory@ 35625->35626 35627 7ffdf62f6e31 35626->35627 35630 7ffdf62f6f54 35626->35630 35629 7ffdf62f6e36 17 API calls 35627->35629 35628 7ffdf62f7045 35628->35621 35629->35630 35630->35628 35631 7ffdf62f6f7c GetTextFaceW ??0QByteArray@@QEAA@AEBV0@ ??0QByteArray@@QEAA@AEBV0@ 35630->35631 35632 7ffdf62b9510 35631->35632 35633 7ffdf62f6fc3 ?fromWCharArray@QString@@SA?AV1@PEB_WH ??4QUrl@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 35632->35633 35634 7ffdf62f700a 35633->35634 35635 7ffdf62f7032 ??1QString@@QEAA 35634->35635 35635->35624 35637 7ffdf62fa119 35636->35637 35638 7ffdf62fa125 35636->35638 35692 7ffdf62f6a30 35637->35692 35640 7ffdf62f6c5d 35638->35640 35641 7ffdf62fa14b ?qErrnoWarning@ 35638->35641 35640->35603 35640->35604 35641->35640 35707 7ffdf62fb510 ??0?$QVector@VQPointF@@@@QEAA RegOpenKeyExW 35642->35707 35645 7ffdf6381690 3 API calls 35646 7ffdf62f6c8f ??8@YA_NAEBVQString@@0 35645->35646 35646->35609 35646->35610 35648 7ffdf62fff67 35647->35648 35649 7ffdf62fff81 ??0QByteArray@@QEAA@AEBV0@ ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA 35647->35649 35648->35649 35650 7ffdf62fa1d0 35649->35650 35651 7ffdf630008e ?isDebugEnabled@QLoggingCategory@ 35650->35651 35652 7ffdf630009b 35651->35652 35653 7ffdf63000fa CreateFontIndirectW 35651->35653 35658 7ffdf63000a0 6 API calls 35652->35658 35654 7ffdf6300156 SelectObject GetTextMetricsW 35653->35654 35655 7ffdf6300113 ?toLocal8Bit@QString@@QEHAA?AVQByteArray@ ??BQByteArray@ ?qErrnoWarning@ ??1QByteArray@@QEAA 35653->35655 35656 7ffdf630018b ?qErrnoWarning@ 35654->35656 35657 7ffdf63001bf 35654->35657 35659 7ffdf630014f 35655->35659 35656->35657 35718 7ffdf6302230 35657->35718 35658->35653 35659->35654 35661 7ffdf6300206 35662 7ffdf6300229 ??0QVariant@@QEAA@HPEBXI 35661->35662 35663 7ffdf630024c 35662->35663 35664 7ffdf6300260 ??1QString@@QEAA ??1QVariant@@QEAA 35663->35664 35665 7ffdf62fb370 35664->35665 35666 7ffdf6300279 ??0QVariant@@QEAA@HPEBXI 35665->35666 35667 7ffdf63004ec 35666->35667 35668 7ffdf63002bd ??0QString@@QEAA@UQStringDataPtr@@ 35666->35668 35667->35668 35675 7ffdf6300505 _Init_thread_footer 35667->35675 35669 7ffdf63002d9 ?createData@QMapDataBase@@SAPEAU1 35668->35669 35670 7ffdf630033d 35668->35670 35673 7ffdf630030c 35669->35673 35674 7ffdf63002ef 35669->35674 35671 7ffdf63003ac ?createNode@QMapDataBase@@QEAAPEAUQMapNodeBase@@HHPEAU2@_N ??0QByteArray@@QEAA@AEBV0@ ??0QVariant@@QEAA@AEBV0@ 35670->35671 35672 7ffdf6300354 ??M@YA_NAEBVQString@@0 35670->35672 35682 7ffdf6300381 35670->35682 35676 7ffdf63003e2 ??1QString@@QEAA ??1QVariant@@QEAA 35671->35676 35672->35670 35680 7ffdf6300330 ?recalcMostLeftNode@QMapDataBase@ 35673->35680 35728 7ffdf62d1700 6 API calls 35673->35728 35677 7ffdf63002f7 ?setParent@QMapNodeBase@@QEAAXPEAU1@ 35674->35677 35675->35668 35678 7ffdf6300552 35676->35678 35679 7ffdf630040e ??0QString@@QEAA@UQStringDataPtr@@ ??0QVariant@@QEAA@_N 35676->35679 35677->35673 35678->35679 35688 7ffdf630056b _Init_thread_footer 35678->35688 35683 7ffdf62d4c10 35679->35683 35680->35670 35684 7ffdf63003a8 35682->35684 35685 7ffdf6300386 ??M@YA_NAEBVQString@@0 35682->35685 35686 7ffdf6300447 ??1QString@@QEAA ??1QVariant@@QEAA ??0QVariant@@QEAA@AEBV?$QMap@VQString@@VQVariant@@@@ ??4QVariant@@QEAAAEAV0@AEBV0@ ??1QVariant@@QEAA 35683->35686 35684->35671 35685->35684 35687 7ffdf6300398 ??4QVariant@@QEAAAEAV0@AEBV0@ 35685->35687 35689 7ffdf63004b1 35686->35689 35687->35676 35688->35679 35691 7ffdf63004ce 35689->35691 35729 7ffdf62d1700 6 API calls 35689->35729 35691->35615 35693 7ffdf62f6a63 35692->35693 35694 7ffdf62f6acb 35692->35694 35696 7ffdf62f6abd 35693->35696 35698 7ffdf62f6aaa ?qErrnoWarning@ 35693->35698 35694->35693 35699 7ffdf62fbe00 35694->35699 35696->35638 35697 7ffdf62f6ae5 _Init_thread_footer 35697->35693 35698->35638 35700 7ffdf62f4740 35699->35700 35701 7ffdf62fbe1b ??0?$QVector@VQPointF@@@@QEAA ??4QString@@QEAAAEAV0@AEBV0@ ??1QString@@QEAA 35700->35701 35702 7ffdf62fbe79 35701->35702 35703 7ffdf62fbe57 ?utf16@QString@ ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N 35701->35703 35704 7ffdf62fbe9b ??0QMessageLogger@@QEAA@PEBDH0 ?warning@QMessageLogger@ 35702->35704 35705 7ffdf62fbe83 GetProcAddress 35702->35705 35703->35702 35706 7ffdf62fbec0 ??1QString@@QEAA 35704->35706 35705->35704 35705->35706 35706->35697 35708 7ffdf62fb56c RegQueryValueExW 35707->35708 35709 7ffdf62fb692 ?isEmpty@QString@ ??0QByteArray@@QEAA@AEBV0@ ??1QString@@QEAA 35707->35709 35710 7ffdf62fb687 RegCloseKey 35708->35710 35711 7ffdf62fb59f 35708->35711 35709->35645 35710->35709 35711->35710 35712 7ffdf62fb5e9 35711->35712 35713 7ffdf62fb5c8 malloc 35711->35713 35714 7ffdf62fb5fb RegQueryValueExW 35712->35714 35713->35714 35715 7ffdf62fb647 ?fromWCharArray@QString@@SA?AV1@PEB_WH ??4QUrl@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 35714->35715 35716 7ffdf62fb672 35714->35716 35715->35716 35716->35710 35717 7ffdf62fb681 free 35716->35717 35717->35710 35719 7ffdf6302284 SelectObject GetFontData SelectObject 35718->35719 35720 7ffdf6302245 SelectObject GetFontData 35718->35720 35722 7ffdf6302324 6 API calls 35719->35722 35723 7ffdf630239c 35719->35723 35720->35719 35722->35723 35724 7ffdf63023d8 GetOutlineTextMetricsW malloc GetOutlineTextMetricsW 35723->35724 35725 7ffdf6302505 35723->35725 35726 7ffdf6302422 7 API calls 35724->35726 35725->35661 35726->35661 35730 7ffdf66f16b0 ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX 35731 7ffdf66f16e4 35730->35731 35732 7ffdf62f3570 ?sendPostedEvents@QEventDispatcherWin32@ ?sendWindowSystemEvents@QWindowSystemInterface@@SA_NV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@ 35733 7ffdf62f14f0 ?compare@QString@@QEBAHVQLatin1String@@W4CaseSensitivity@Qt@@ 35734 7ffdf62f1548 35733->35734 35735 7ffdf62f1530 35733->35735 35739 7ffdf629c4b0 35735->35739 35737 7ffdf62f27c2 35738 7ffdf62f27d6 ??0QObject@@QEAA@PEAV0@ 35737->35738 35740 7ffdf629c4d4 35739->35740 35747 7ffdf629c530 35740->35747 35742 7ffdf629c4df 35769 7ffdf62e1200 35742->35769 35744 7ffdf629c4f7 35782 7ffdf62a5390 EnumDisplayMonitors 35744->35782 35746 7ffdf629c50c 35746->35737 35805 7ffdf629e380 35747->35805 35749 7ffdf629c54f 35750 7ffdf629c565 ??0QMutex@@QEAA@W4RecursionMode@0@ 35749->35750 35751 7ffdf62e7000 35750->35751 35752 7ffdf629c58e ??0QPlatformServices@@QEAA 35751->35752 35753 7ffdf629c5ae 35752->35753 35754 7ffdf629c5ee ?setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N 35753->35754 35755 7ffdf629c5fb 35753->35755 35754->35755 35756 7ffdf629c626 ?testAttribute@QCoreApplication@@SA_NW4ApplicationAttribute@Qt@@ 35755->35756 35757 7ffdf629c6eb 35755->35757 35756->35757 35759 7ffdf629c639 35756->35759 35828 7ffdf62a0ea0 35757->35828 35811 7ffdf62a22b0 35759->35811 35761 7ffdf629c6fd ?setCapability@QPlatformCursor@@SAXW4Capability@1@ 35761->35742 35763 7ffdf62a1690 2 API calls 35764 7ffdf629c64b ?isDebugEnabled@QLoggingCategory@ 35763->35764 35764->35757 35765 7ffdf629c65c 35764->35765 35766 7ffdf62a1690 2 API calls 35765->35766 35767 7ffdf629c661 35766->35767 35768 7ffdf629c66a 8 API calls 35767->35768 35768->35757 35770 7ffdf62e1222 35769->35770 35860 7ffdf629fce0 ??0QByteArray@@QEAA@AEBV0@ 35770->35860 35772 7ffdf62e124b ??1QString@@QEAA 35773 7ffdf62e1266 35772->35773 35774 7ffdf62e128f 35772->35774 35773->35774 35778 7ffdf62e1282 ?qErrnoWarning@ 35773->35778 35775 7ffdf62e1295 SetClipboardViewer 35774->35775 35776 7ffdf62e12a3 35774->35776 35775->35776 35777 7ffdf62e12a8 ?isDebugEnabled@QLoggingCategory@ 35776->35777 35779 7ffdf62e135a 35777->35779 35780 7ffdf62e12b9 35777->35780 35778->35774 35779->35744 35781 7ffdf62e12be 10 API calls 35780->35781 35781->35779 35803 7ffdf62a53e1 35782->35803 35783 7ffdf62a5771 35791 7ffdf62a5794 35783->35791 35895 7ffdf62c14c0 35783->35895 35784 7ffdf62a5460 ??8@YA_NAEBVQString@@0 35784->35803 35786 7ffdf62a56d9 35786->35783 35787 7ffdf62a5720 ??8@YA_NAEBVQString@@0 35786->35787 35787->35786 35788 7ffdf62a54a1 ??0QPlatformScreen@@QEAA 35788->35803 35789 7ffdf62a5812 35789->35746 35790 7ffdf62a5809 ?dispose@QListData@@SAXPEAUData@1@ 35790->35789 35791->35789 35791->35790 35792 7ffdf62a57ed ??1QString@@QEAA 35791->35792 35792->35791 35793 7ffdf62a54eb ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH 35793->35803 35794 7ffdf62a5622 ?append@QListData@ 35795 7ffdf62a562e ?handleScreenAdded@QWindowSystemInterface@@SAXPEAVQPlatformScreen@@_N 35794->35795 35797 7ffdf62a1690 2 API calls 35795->35797 35796 7ffdf62a5552 memmove 35796->35803 35798 7ffdf62a5644 ?isDebugEnabled@QLoggingCategory@ 35797->35798 35798->35803 35799 7ffdf62a55a0 memmove 35799->35803 35800 7ffdf62a55c6 ?dispose@QListData@@SAXPEAUData@1@ 35800->35803 35801 7ffdf62a1690 2 API calls 35802 7ffdf62a5656 ??0QMessageLogger@@QEAA@PEBDH00 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD 35801->35802 35802->35803 35803->35784 35803->35786 35803->35788 35803->35793 35803->35794 35803->35795 35803->35796 35803->35799 35803->35800 35803->35801 35804 7ffdf62a56ad ??1QDebug@@QEAA ??1QDebug@@QEAA 35803->35804 35804->35803 35806 7ffdf629e393 35805->35806 35839 7ffdf629e400 35806->35839 35809 7ffdf629e3e6 ??1QByteArray@@QEAA 35809->35749 35810 7ffdf629e3c2 ?fromLocal8Bit@QString@@SA?AV1@AEBVQByteArray@@ ?setFilterRules@QLoggingCategory@@SAXAEBVQString@@ ??1QString@@QEAA 35810->35809 35812 7ffdf62a1690 2 API calls 35811->35812 35813 7ffdf62a22bd ?isDebugEnabled@QLoggingCategory@ 35812->35813 35814 7ffdf62a2325 35813->35814 35815 7ffdf62a22ca 35813->35815 35817 7ffdf62a247f 35814->35817 35821 7ffdf62a2351 35814->35821 35816 7ffdf62a1690 2 API calls 35815->35816 35819 7ffdf62a22cf ??0QMessageLogger@@QEAA@PEBDH00 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD ??6QDebug@@QEAAAEAV0@J ??1QDebug@@QEAA 35816->35819 35818 7ffdf629c646 35817->35818 35820 7ffdf62a2495 ?qErrnoWarning@ 35817->35820 35818->35763 35819->35814 35821->35818 35822 7ffdf62a1690 2 API calls 35821->35822 35826 7ffdf62a2381 ??0QMessageLogger@@QEAA@PEBDH0 ?warning@QMessageLogger@@QEBA?AVQDebug@ ?noquote@QDebug@@QEAAAEAV1 35821->35826 35823 7ffdf62a2370 ?isDebugEnabled@QLoggingCategory@ 35822->35823 35823->35818 35823->35826 35825 7ffdf629f010 35827 7ffdf62a23f9 8 API calls 35825->35827 35826->35825 35827->35818 35829 7ffdf62a0eb8 35828->35829 35830 7ffdf62a0ec5 35828->35830 35829->35761 35832 7ffdf62a0eda 35830->35832 35849 7ffdf62abcf0 35830->35849 35833 7ffdf62a0ef0 35832->35833 35834 7ffdf62a0f06 ?options@QSurfaceFormat@@QEBA?AV?$QFlags@W4FormatOption@QSurfaceFormat@@@ ?setCapabilities@QTouchDevice@@QEAAXV?$QFlags@W4CapabilityFlag@QTouchDevice@@@@ 35832->35834 35835 7ffdf62a0f22 ?registerTouchDevice@QWindowSystemInterface@@SAXPEBVQTouchDevice@@ 35832->35835 35833->35761 35834->35835 35836 7ffdf62a0f8c 35835->35836 35837 7ffdf62a0f3d 35835->35837 35836->35761 35837->35836 35838 7ffdf62a0f7b ?nextNode@QHashData@@SAPEAUNode@1@PEAU21@ 35837->35838 35838->35836 35838->35837 35840 7ffdf629e446 35839->35840 35841 7ffdf629e4c4 OleInitializeWOW 35840->35841 35842 7ffdf629e501 35841->35842 35843 7ffdf629e522 GetDC GetDeviceCaps GetKeyboardLayoutList 35842->35843 35844 7ffdf629e558 35843->35844 35848 7ffdf629e58c 35843->35848 35846 7ffdf629e578 GetKeyboardLayoutList 35844->35846 35845 7ffdf629e39b ?qgetenv@@YA?AVQByteArray@@PEBD 35845->35809 35845->35810 35846->35848 35847 7ffdf629e5f5 6 API calls 35847->35845 35848->35845 35848->35847 35850 7ffdf62abd03 GetSystemMetrics 35849->35850 35851 7ffdf62abee1 35849->35851 35852 7ffdf62abd28 GetSystemMetrics GetSystemMetrics 35850->35852 35853 7ffdf62abd21 35850->35853 35851->35832 35854 7ffdf62a1210 35852->35854 35853->35832 35855 7ffdf62abd5a ?isDebugEnabled@QLoggingCategory@ 35854->35855 35856 7ffdf62abd6b 35855->35856 35857 7ffdf62abe60 35855->35857 35858 7ffdf62abd70 15 API calls 35856->35858 35859 7ffdf62abe6a ??0QTouchDevice@@QEAA ?setType@QTouchDevice@@QEAAXW4DeviceType@1@ ?type@QTouchDevice@@QEBA?AW4DeviceType@1 ?setCapabilities@QTouchDevice@@QEAAXV?$QFlags@W4CapabilityFlag@QTouchDevice@@@@ ?setMaximumTouchPoints@QTouchDevice@@QEAAXH 35857->35859 35858->35857 35859->35853 35863 7ffdf62a1c30 GetModuleHandleW 35860->35863 35864 7ffdf62a1c9c ?utf16@QString@ GetClassInfoW 35863->35864 35865 7ffdf62a1cb9 35863->35865 35864->35865 35866 7ffdf62a1ccb 35864->35866 35865->35866 35867 7ffdf62a1cdb ?createUuid@QUuid@@SA?AV1 ?toString@QUuid@@QEBA?AVQString@ ?append@QString@@QEAAAEAV1@AEBV1@ ??1QString@@QEAA 35865->35867 35868 7ffdf62a1d1b ?qHash@@YAIAEBVQString@@I 35866->35868 35870 7ffdf62a1d2a 35866->35870 35867->35866 35868->35870 35869 7ffdf62a206e ??0QByteArray@@QEAA@$$QEAV0@ ??1QString@@QEAA 35873 7ffdf6381690 3 API calls 35869->35873 35870->35869 35871 7ffdf62a1e0a 35870->35871 35872 7ffdf62a1d7a LoadImageW 35870->35872 35877 7ffdf62a1e12 ?utf16@QString@ RegisterClassExW 35871->35877 35874 7ffdf62a1da7 GetSystemMetrics GetSystemMetrics LoadImageW 35872->35874 35875 7ffdf62a1de3 LoadImageW 35872->35875 35876 7ffdf629fd39 GetModuleHandleW ?utf16@QString@ CreateWindowExW ??1QString@@QEAA 35873->35876 35874->35877 35875->35871 35876->35772 35878 7ffdf62a1e37 ?toLocal8Bit@QString@@QEHAA?AVQByteArray@ ??BQByteArray@ ?qErrnoWarning@ ??1QByteArray@@QEAA 35877->35878 35879 7ffdf62a1e69 35877->35879 35878->35879 35880 7ffdf62a1e79 ?detach_helper@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH 35879->35880 35881 7ffdf62a1ed4 ?qHash@@YAIAEBVQString@@I 35879->35881 35882 7ffdf62a1ead 35880->35882 35883 7ffdf62a1ebf ?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z 35880->35883 35884 7ffdf62a1ef6 35881->35884 35882->35883 35885 7ffdf62a1ed0 35882->35885 35883->35885 35886 7ffdf62a1f5b 35884->35886 35887 7ffdf62a1f28 ?allocateNode@QHashData@@QEAAPEAXH ??0QByteArray@@QEAA@AEBV0@ 35884->35887 35888 7ffdf62a1f0a ?rehash@QHashData@@QEAAXH 35884->35888 35885->35881 35889 7ffdf62a1690 2 API calls 35886->35889 35887->35886 35890 7ffdf62a1f25 35888->35890 35891 7ffdf62a1f60 ?isDebugEnabled@QLoggingCategory@ 35889->35891 35890->35887 35891->35869 35892 7ffdf62a1f71 35891->35892 35893 7ffdf62a1690 2 API calls 35892->35893 35894 7ffdf62a1f76 16 API calls 35893->35894 35894->35869 35896 7ffdf62bf310 35895->35896 35897 7ffdf62c14ee ?desktopSettingsAware@QGuiApplication@ 35896->35897 35898 7ffdf62c14fc 35897->35898 35899 7ffdf62c174f 35897->35899 35925 7ffdf62a1730 memset 35898->35925 35901 7ffdf6381690 3 API calls 35899->35901 35902 7ffdf62c175e 35901->35902 35902->35791 35903 7ffdf62c150f 35904 7ffdf62c155b ?pointSize@QFont@ 35903->35904 35905 7ffdf62bea20 35904->35905 35906 7ffdf62c157d ??0QFont@@QEAA@AEBVQString@@HH_N ??1QString@@QEAA ?setStyleHint@QFont@@QEAAXW4StyleHint@1@W4StyleStrategy@1@ SystemParametersInfoW 35905->35906 35907 7ffdf62c15da 35906->35907 35908 7ffdf62c15fd ??0QFont@@QEAA@AEBV0@ 35907->35908 35909 7ffdf6380e9c 35908->35909 35910 7ffdf62c161b ??0QFont@@QEAA@AEBV0@ 35909->35910 35911 7ffdf6380e9c 35910->35911 35912 7ffdf62c1639 ??0QFont@@QEAA@AEBV0@ 35911->35912 35913 7ffdf6380e9c 35912->35913 35914 7ffdf62c1658 ??0QFont@@QEAA@AEBV0@ 35913->35914 35915 7ffdf6380e9c 35914->35915 35916 7ffdf62c1677 ??0QFont@@QEAA@AEBV0@ 35915->35916 35917 7ffdf6380e9c 35916->35917 35918 7ffdf62c1696 ??0QFont@@QEAA@AEBV0@ 35917->35918 35919 7ffdf6380e9c 35918->35919 35920 7ffdf62c16b5 ??0QFont@@QEAA@AEBV0@ 35919->35920 35921 7ffdf6380e9c 35920->35921 35922 7ffdf62c16d4 ??0QFont@@QEAA@AEBV0@ 35921->35922 35923 7ffdf6380e9c 35922->35923 35924 7ffdf62c16f2 7 API calls 35923->35924 35924->35899 35926 7ffdf62a1788 SystemParametersInfoW 35925->35926 35927 7ffdf62a175e 35925->35927 35926->35903 35927->35926 35928 7ffdf62a1762 35927->35928 35928->35903 35929 7ffdf62a35a7 35930 7ffdf62a35af 35929->35930 35931 7ffdf6381690 3 API calls 35930->35931 35932 7ffdf62a4230 35931->35932 35933 7ffdf629b460 35934 7ffdf6292270 35933->35934 35935 7ffdf629b485 ?formatWindowTitle@QPlatformWindow@@KA?AVQString@@AEBV2@0 ??1QString@@QEAA 35934->35935 35936 7ffdf629b4d0 35935->35936 35937 7ffdf629b4ae ??1QString@@QEAA 35936->35937 35938 7ffdf629cda0 ?type@QWindow@@QEBA?AW4WindowType@Qt@ 35939 7ffdf629cdd5 35938->35939 35940 7ffdf629cf24 ?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@ ?geometry@QWindow@@QEBA?AVQRect@ ?scaleAndOrigin@QHighDpiScaling@@SA?AUScaleAndOrigin@1@PEBVQWindow@@PEAVQPoint@@ 35938->35940 35943 7ffdf629cddd ??0QPlatformWindow@@QEAA@PEAVQWindow@@ GetDesktopWindow 35939->35943 35941 7ffdf6297e90 35940->35941 35942 7ffdf629cfa4 ?property@QObject@@QEBA?AVQVariant@@PEBD 35941->35942 35944 7ffdf629d019 ?title@QWindow@@QEBA?AVQString@ 35942->35944 35945 7ffdf629cfcb 35942->35945 35946 7ffdf62a1690 2 API calls 35943->35946 35948 7ffdf629d038 35944->35948 35949 7ffdf629cfd0 ?userType@QVariant@ 35945->35949 35947 7ffdf629ce05 ?isDebugEnabled@QLoggingCategory@ 35946->35947 35950 7ffdf629ce16 35947->35950 35951 7ffdf629d35b 35947->35951 35973 7ffdf6293430 35948->35973 35953 7ffdf629cfe6 ?constData@QVariant@ 35949->35953 35954 7ffdf629cff1 ?convert@QVariant@@QEBA_NHPEAX 35949->35954 35955 7ffdf62a1690 2 API calls 35950->35955 35957 7ffdf629d00b 35953->35957 35954->35957 35958 7ffdf629ce1b ??0QMessageLogger@@QEAA@PEBDH00 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD 35955->35958 35957->35944 35961 7ffdf629ce6a 6 API calls 35958->35961 35959 7ffdf62a1690 2 API calls 35960 7ffdf629d096 ?isDebugEnabled@QLoggingCategory@ 35959->35960 35962 7ffdf629d0a7 35960->35962 35963 7ffdf629d2fc 35960->35963 35964 7ffdf629cee9 ??6@YA?AVQDebug@@V0@AEBVQRect@@ ??1QDebug@@QEAA ??1QDebug@@QEAA ??1QDebug@@QEAA 35961->35964 35965 7ffdf62a1690 2 API calls 35962->35965 35966 7ffdf629d350 ??1QVariant@@QEAA 35963->35966 35980 7ffdf6291780 ??0QPlatformWindow@@QEAA@PEAVQWindow@@ 35963->35980 35964->35951 35967 7ffdf629d0ac 6 API calls 35965->35967 35966->35951 36035 7ffdf62977d0 ?qt_window_private@@YAPEAVQWindowPrivate@@PEAVQWindow@@ 35967->36035 35970 7ffdf629d139 25 API calls 35970->35963 35971 7ffdf629d325 35971->35966 35974 7ffdf6294e40 35973->35974 35975 7ffdf6293476 ??0QByteArray@@QEAA@AEBV0@ 35974->35975 36036 7ffdf6293500 GetModuleHandleW 35975->36036 35978 7ffdf629349c 36070 7ffdf62967e0 35978->36070 35979 7ffdf62934db ??1QString@@QEAA ??1QString@@QEAA 35979->35959 35981 7ffdf629180d 35980->35981 35982 7ffdf629181f ?requestedFormat@QWindow@@QEBA?AVQSurfaceFormat@ 35981->35982 35983 7ffdf6291870 35982->35983 35984 7ffdf629187f ?type@QWindow@@QEBA?AW4WindowType@Qt@ 35983->35984 35985 7ffdf6291891 35984->35985 36010 7ffdf6291d76 ?isTopLevel@QWindow@ 35984->36010 35986 7ffdf62918bc ?openGLModuleType@QOpenGLContext@@SA?AW4OpenGLModuleType@1 35985->35986 35987 7ffdf62918c6 ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?isTopLevel@QWindow@ 35985->35987 35986->35987 35989 7ffdf6291904 35987->35989 35990 7ffdf629190f ?qt_window_private@@YAPEAVQWindowPrivate@@PEAVQWindow@@ 35989->35990 35991 7ffdf6291945 35990->35991 35992 7ffdf6291a6e ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?mask@QWindow@@QEBA?AVQRegion@ ?scaleAndOrigin@QHighDpiScaling@@SA?AUScaleAndOrigin@1@PEBVQWindow@@PEAVQPoint@@ 35991->35992 35993 7ffdf62a1690 2 API calls 35991->35993 35994 7ffdf6298010 35992->35994 35995 7ffdf629196d ?isDebugEnabled@QLoggingCategory@ 35993->35995 35996 7ffdf6291ab9 ?isEmpty@QRegion@ 35994->35996 35997 7ffdf629197a 35995->35997 35998 7ffdf62919cd 35995->35998 35999 7ffdf6291ada SetWindowRgn 35996->35999 36000 7ffdf6291aef ?begin@QRegion@@QEBAPEBVQRect@ ?end@QRegion@@QEBAPEBVQRect@ 35996->36000 36001 7ffdf62a1690 2 API calls 35997->36001 35998->35992 36025 7ffdf6291a1d ?window@QPlatformWindow@@QEBAPEAVQWindow@ 35998->36025 36002 7ffdf6291c24 ??1QRegion@@QEAA ??1QRegion@@QEAA ?isTopLevel@QWindow@ 35999->36002 36003 7ffdf6291b1e CreateRectRgn 36000->36003 36019 7ffdf6291b16 36000->36019 36004 7ffdf629197f ??0QMessageLogger@@QEAA@PEBDH00 ?debug@QMessageLogger@@QEBA?AVQDebug@ ??6QDebug@@QEAAAEAV0@PEBD ??6QDebug@@QEAAAEAV0@N ??1QDebug@@QEAA 36001->36004 36005 7ffdf6291c49 ?icon@QWindow@@QEBA?AVQIcon@ 36002->36005 36006 7ffdf6291d40 ?property@QObject@@QEBA?AVQVariant@@PEBD ?toBool@QVariant@ ??1QVariant@@QEAA 36002->36006 36007 7ffdf6291bc6 ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?isTopLevel@QWindow@ 36003->36007 36018 7ffdf6291b47 36003->36018 36004->35998 36011 7ffdf6291d36 ??1QIcon@@QEAA 36005->36011 36012 7ffdf6291c64 36005->36012 36006->36010 36008 7ffdf6291c04 SetWindowRgn 36007->36008 36009 7ffdf6291be4 OffsetRgn 36007->36009 36008->36002 36014 7ffdf6291c1b DeleteObject 36008->36014 36009->36008 36010->35971 36011->36006 36015 7ffdf6291c7d 36012->36015 36016 7ffdf6291c70 DestroyIcon 36012->36016 36013 7ffdf6291b50 CreateRectRgn 36017 7ffdf6291b71 CreateRectRgn CombineRgn 36013->36017 36013->36018 36014->36002 36021 7ffdf6291c96 GetSystemMetrics GetSystemMetrics 36015->36021 36022 7ffdf6291c89 DestroyIcon 36015->36022 36016->36015 36023 7ffdf6291ba9 DeleteObject 36017->36023 36024 7ffdf6291b9d DeleteObject 36017->36024 36018->36013 36018->36019 36019->36007 36026 7ffdf6293c00 36021->36026 36022->36021 36023->36018 36024->36023 36027 7ffdf6291a41 ?hasAlpha@QSurfaceFormat@ 36025->36027 36028 7ffdf6291cbb GetSystemMetrics GetSystemMetrics 36026->36028 36030 7ffdf629aa80 36027->36030 36029 7ffdf6291ce7 36028->36029 36032 7ffdf6291d15 SendMessageW 36029->36032 36033 7ffdf6291d06 SendMessageW 36029->36033 36031 7ffdf6291a64 ??1QSurfaceFormat@@QEAA 36030->36031 36031->35992 36034 7ffdf6291d22 SendMessageW 36032->36034 36033->36034 36034->36011 36035->35970 36037 7ffdf6293573 36036->36037 36088 7ffdf62a19a0 ?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@ 36037->36088 36039 7ffdf6293585 ?initialGeometry@QPlatformWindow@@SA?AVQRect@@PEBVQWindow@@AEBV2@HH 36040 7ffdf62935b8 36039->36040 36041 7ffdf6293610 ?utf16@QString@ ?utf16@QString@ 36039->36041 36040->36041 36042 7ffdf62935c5 ?qAppName@@YA?AVQString@ 36040->36042 36043 7ffdf62935d4 ?objectName@QObject@@QEBA?AVQString@ 36040->36043 36048 7ffdf629363b 36041->36048 36044 7ffdf62935e6 ??4QUrl@@QEAAAEAV0@$$QEAV0@ 36042->36044 36043->36044 36045 7ffdf62935f7 ??1QString@@QEAA 36044->36045 36046 7ffdf6293601 36044->36046 36045->36046 36046->36041 36047 7ffdf6293606 ??1QString@@QEAA 36046->36047 36047->36041 36049 7ffdf6293732 ?qt_window_private@@YAPEAVQWindowPrivate@@PEAVQWindow@@ 36048->36049 36051 7ffdf6293744 36048->36051 36049->36051 36050 7ffdf62a1690 2 API calls 36052 7ffdf6293794 ?isDebugEnabled@QLoggingCategory@ 36050->36052 36051->36050 36053 7ffdf62937a5 36052->36053 36054 7ffdf6293994 36052->36054 36055 7ffdf62a1690 2 API calls 36053->36055 36108 7ffdf6292df0 36054->36108 36057 7ffdf62937af 9 API calls 36055->36057 36059 7ffdf6291e10 36057->36059 36062 7ffdf629386d 20 API calls 36059->36062 36060 7ffdf62a1690 2 API calls 36061 7ffdf6293a11 ?isDebugEnabled@QLoggingCategory@ 36060->36061 36063 7ffdf6293b1b 36061->36063 36064 7ffdf6293a22 36061->36064 36062->36054 36066 7ffdf6293b20 ?qErrnoWarning@ 36063->36066 36069 7ffdf6293b36 36063->36069 36065 7ffdf62a1690 2 API calls 36064->36065 36067 7ffdf6293a2c 14 API calls 36065->36067 36066->36069 36067->36063 36068 7ffdf6293bbd ??1QString@@QEAA ??1QString@@QEAA 36068->35978 36069->36068 36071 7ffdf62967e9 36070->36071 36072 7ffdf629694c 36070->36072 36073 7ffdf6296817 36071->36073 36074 7ffdf629691e SetWindowPos 36071->36074 36072->35979 36075 7ffdf6296878 SetWindowPos 36073->36075 36078 7ffdf6296828 36073->36078 36074->36072 36076 7ffdf62968a1 ??0QMessageLogger@@QEAA@PEBDH0 ?warning@QMessageLogger@ 36075->36076 36077 7ffdf62968c4 36075->36077 36076->36077 36081 7ffdf62968cc GetSystemMenu 36077->36081 36085 7ffdf62968f8 ?hasAlpha@QSurfaceFormat@ ??1QSurfaceFormat@@QEAA 36077->36085 36079 7ffdf629682e SetWindowPos 36078->36079 36080 7ffdf6296850 36078->36080 36079->36077 36080->36077 36082 7ffdf6296855 SetWindowPos 36080->36082 36083 7ffdf62968e7 EnableMenuItem 36081->36083 36082->36077 36083->36085 36087 7ffdf629bf66 36085->36087 36087->35979 36089 7ffdf62a19ea 36088->36089 36090 7ffdf62a1a32 36089->36090 36091 7ffdf62a1a0b ?property@QObject@@QEBA?AVQVariant@@PEBD ?toBool@QVariant@ 36089->36091 36092 7ffdf62a1a4a ??0?$QVector@VQPointF@@@@QEAA ?append@QString@@QEAAAEAV1@VQLatin1String@@ 36090->36092 36093 7ffdf62a1a40 ??1QVariant@@QEAA 36090->36093 36091->36090 36095 7ffdf62a1aba 36092->36095 36093->36092 36096 7ffdf62a1af2 ?append@QString@@QEAAAEAV1@VQLatin1String@@ 36095->36096 36097 7ffdf62a1b0d 36095->36097 36096->36097 36098 7ffdf62a1b3c 36097->36098 36099 7ffdf62a1b13 ?append@QString@@QEAAAEAV1@VQLatin1String@@ 36097->36099 36100 7ffdf62a1b6b 36098->36100 36101 7ffdf62a1b42 ?append@QString@@QEAAAEAV1@VQLatin1String@@ 36098->36101 36099->36098 36102 7ffdf62a1b9a 36100->36102 36103 7ffdf62a1b71 ?append@QString@@QEAAAEAV1@VQLatin1String@@ 36100->36103 36101->36100 36104 7ffdf62a1bc8 GetSysColorBrush ??0QByteArray@@QEAA@AEBV0@ 36102->36104 36105 7ffdf62a1b9f ?append@QString@@QEAAAEAV1@VQLatin1String@@ 36102->36105 36103->36102 36106 7ffdf62a1c30 49 API calls 36104->36106 36105->36104 36107 7ffdf62a1c07 ??1QString@@QEAA 36106->36107 36107->36039 36109 7ffdf6292e5b CreateWindowExW 36108->36109 36110 7ffdf6292e2e ?isTopLevel@QWindow@ 36108->36110 36109->36060 36111 7ffdf6292e3b 36110->36111 36111->36109 36129 7ffdf6294310 36111->36129 36113 7ffdf6292e53 36113->36109 36114 7ffdf6292e68 ?handle@QScreen@@QEBAPEAVQPlatformScreen@ 36113->36114 36115 7ffdf6292e98 ?contains@QRect@@QEBA_NAEBVQPoint@@_N 36114->36115 36115->36109 36116 7ffdf6292eae ?contains@QRect@@QEBA_NAEBVQPoint@@_N 36115->36116 36116->36109 36117 7ffdf6292ed1 ?virtualSiblings@QScreen@@QEBA?AV?$QList@PEAVQScreen@@@ 36116->36117 36118 7ffdf6292f1c 36117->36118 36119 7ffdf6292f5d ?center@QRect@@QEBA?AVQPoint@ ?center@QRect@@QEBA?AVQPoint@ 36117->36119 36120 7ffdf6292f20 ?handle@QScreen@@QEBAPEAVQPlatformScreen@ 36118->36120 36126 7ffdf6292f58 36118->36126 36121 7ffdf6292fe0 ?handle@QScreen@@QEBAPEAVQPlatformScreen@ 36119->36121 36125 7ffdf6293087 36119->36125 36123 7ffdf6292f3a ?contains@QRect@@QEBA_NAEBVQPoint@@_N 36120->36123 36124 7ffdf6292ff7 ??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@ ??0QRect@@QEAA@AEBVQPoint@@0 ?center@QRect@@QEBA?AVQPoint@ ?center@QRect@@QEBA?AVQPoint@ 36121->36124 36122 7ffdf629312f ?dispose@QListData@@SAXPEAUData@1@ 36122->36109 36123->36118 36123->36126 36127 7ffdf629307f 36124->36127 36128 7ffdf6293091 ?contains@QRect@@QEBA_NAEBVQPoint@@_N 36124->36128 36125->36109 36125->36122 36126->36119 36127->36125 36127->36128 36128->36125 36130 7ffdf629453b 36129->36130 36131 7ffdf629434b 36129->36131 36130->36131 36136 7ffdf6294554 ??0?$QVector@VQPointF@@@@QEAA 36130->36136 36132 7ffdf6294399 36131->36132 36154 7ffdf62d34f0 ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA ??0?$QVector@VQPointF@@@@QEAA 36131->36154 36134 7ffdf62943ac 36132->36134 36137 7ffdf62943cb ?primaryScreen@QGuiApplication@@SAPEAVQScreen@ 36132->36137 36138 7ffdf62943c0 ?screen@QWindow@@QEBAPEAVQScreen@ 36132->36138 36134->36113 36139 7ffdf63812c0 36136->36139 36140 7ffdf62943d1 36137->36140 36138->36140 36141 7ffdf629456d _Init_thread_footer 36139->36141 36142 7ffdf6294403 36140->36142 36143 7ffdf62943d9 ?name@QScreen@@QEBA?AVQString@ ??8@YA_NAEBVQString@@0 36140->36143 36141->36131 36144 7ffdf629441e 36142->36144 36145 7ffdf6294410 ??1QString@@QEAA 36142->36145 36143->36142 36146 7ffdf62944e8 36144->36146 36147 7ffdf6294431 ?virtualSiblings@QScreen@@QEBA?AV?$QList@PEAVQScreen@@@ 36144->36147 36145->36144 36146->36113 36148 7ffdf6294467 36147->36148 36149 7ffdf62944b3 36147->36149 36148->36149 36150 7ffdf6294470 ?name@QScreen@@QEBA?AVQString@ ??8@YA_NAEBVQString@@0 ??1QString@@QEAA 36148->36150 36149->36146 36151 7ffdf62944da ?dispose@QListData@@SAXPEAUData@1@ 36149->36151 36150->36148 36152 7ffdf6294501 36150->36152 36151->36146 36152->36146 36153 7ffdf6294528 ?dispose@QListData@@SAXPEAUData@1@ 36152->36153 36153->36146 36172 7ffdf62d29f0 36154->36172 36157 7ffdf62d3561 ??0QByteArray@@QEAA@$$QEAV0@ ??0QByteArray@@QEAA@$$QEAV0@ ??0QByteArray@@QEAA@$$QEAV0@ 36158 7ffdf62d37fa ??1QString@@QEAA ??1QString@@QEAA ??1QByteArray@@QEAA ??1QByteArray@@QEAA 36157->36158 36161 7ffdf62d35c9 36157->36161 36159 7ffdf62d3830 36158->36159 36162 7ffdf6381690 3 API calls 36159->36162 36160 7ffdf62d3790 ??0QByteArray@@QEAA@$$QEAV0@ ??0QByteArray@@QEAA@$$QEAV0@ ??0QByteArray@@QEAA@$$QEAV0@ 36160->36158 36160->36161 36161->36158 36164 7ffdf629435d ??4QUrl@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA ??1QByteArray@@QEAA ??1QByteArray@@QEAA 36162->36164 36163 7ffdf62d35d4 36163->36160 36165 7ffdf62d3607 6 API calls 36163->36165 36164->36132 36167 7ffdf62d368b 36165->36167 36166 7ffdf62d3703 36166->36160 36167->36166 36168 7ffdf62d3705 memset EnumDisplayDevicesW 36167->36168 36168->36166 36169 7ffdf62d3732 36168->36169 36170 7ffdf62d373b EnumDisplayDevicesW 36169->36170 36171 7ffdf62d3754 ?fromWCharArray@QString@@SA?AV1@PEB_WH ??4QUrl@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 36169->36171 36170->36166 36170->36169 36171->36166 36173 7ffdf62d2a25 ??0?$QVector@VQPointF@@@@QEAA ??4QString@@QEAAAEAV0@AEBV0@ ??1QString@@QEAA ?utf16@QString@ ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N 36172->36173 36174 7ffdf62d2ab7 36172->36174 36175 7ffdf62d2a9e 36173->36175 36176 7ffdf62d2a89 GetProcAddress 36173->36176 36174->36173 36177 7ffdf62d2ad0 _Init_thread_footer 36174->36177 36175->36157 36175->36163 36176->36175 36177->36173 36178 7ffdf62a42a0 36179 7ffdf62a42dc 36178->36179 36180 7ffdf62a44e3 36179->36180 36183 7ffdf62a4364 ?isDebugEnabled@QLoggingCategory@ 36179->36183 36181 7ffdf62a44e7 DefWindowProcW 36180->36181 36182 7ffdf62a44fd 36180->36182 36181->36182 36185 7ffdf62a4527 GetWindowLongPtrW 36182->36185 36190 7ffdf62a4663 36182->36190 36183->36180 36188 7ffdf62a4375 36183->36188 36184 7ffdf6381690 3 API calls 36186 7ffdf62a46fb 36184->36186 36187 7ffdf62a4543 GetWindowPlacement 36185->36187 36185->36190 36189 7ffdf62a455b 36187->36189 36188->36180 36191 7ffdf62a438d ?isDebugEnabled@QLoggingCategory@ 36188->36191 36189->36190 36192 7ffdf62a1690 2 API calls 36189->36192 36190->36184 36191->36180 36193 7ffdf62a439e 36191->36193 36194 7ffdf62a45c4 ?isDebugEnabled@QLoggingCategory@ 36192->36194 36196 7ffdf62a43a3 21 API calls 36193->36196 36194->36190 36195 7ffdf62a45d5 36194->36195 36197 7ffdf62a1690 2 API calls 36195->36197 36196->36180 36198 7ffdf62a45da 8 API calls 36197->36198 36198->36190 36199 7ffdf629cce0 36200 7ffdf629ccfc ??8QString@@QEBA_NVQLatin1String@@ 36199->36200 36202 7ffdf629cd56 ?createPlatformTheme@QPlatformIntegration@@UEBAPEAVQPlatformTheme@@AEBVQString@@ 36200->36202 36203 7ffdf629cd3a 36200->36203 36204 7ffdf62be990 ??0QPlatformTheme@@QEAA 36202->36204 36203->36204 36205 7ffdf62be9dd 36204->36205 36210 7ffdf62c12f0 ?desktopSettingsAware@QGuiApplication@ 36205->36210 36209 7ffdf62bea0c 36211 7ffdf62c1316 36210->36211 36219 7ffdf62c148b 36210->36219 36223 7ffdf62c37b0 69 API calls 36211->36223 36212 7ffdf62c14c0 26 API calls 36213 7ffdf62c14aa 36212->36213 36214 7ffdf6381690 3 API calls 36213->36214 36215 7ffdf62bea04 36214->36215 36222 7ffdf62c1770 23 API calls 36215->36222 36217 7ffdf62c1352 36218 7ffdf62c136c SystemParametersInfoW 36217->36218 36218->36219 36220 7ffdf62c1392 36218->36220 36219->36212 36220->36219 36221 7ffdf62c13a9 12 API calls 36220->36221 36221->36219 36222->36209 36223->36217 36224 7ffdf629a120 ?window@QPlatformWindow@@QEBAPEAVQWindow@ 36225 7ffdf62a1690 2 API calls 36224->36225 36226 7ffdf629a13f ?isDebugEnabled@QLoggingCategory@ 36225->36226 36227 7ffdf629a150 36226->36227 36228 7ffdf629a1ff 36226->36228 36229 7ffdf62a1690 2 API calls 36227->36229 36230 7ffdf629a3ec 36228->36230 36232 7ffdf629a326 GetCapture 36228->36232 36250 7ffdf629b5e0 ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@ ?type@QWindow@@QEBA?AW4WindowType@Qt@ ?isTopLevel@QWindow@ 36228->36250 36231 7ffdf629a155 9 API calls 36229->36231 36231->36228 36233 7ffdf629a340 ?window@QPlatformWindow@@QEBAPEAVQWindow@ ?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@ 36232->36233 36234 7ffdf629a332 36232->36234 36236 7ffdf629a36d SetWindowPos 36233->36236 36237 7ffdf629a35f ShowWindow 36233->36237 36234->36233 36239 7ffdf629a39c ??0QRegion@@QEAA ?isEmpty@QRegion@ 36236->36239 36237->36239 36244 7ffdf629a3ba ?window@QPlatformWindow@@QEBAPEAVQWindow@ ??$handleExposeEvent@UDefaultDelivery@QWindowSystemInterface@@@QWindowSystemInterface@@SAXPEAVQWindow@@AEBVQRegion@@ ??1QRegion@@QEAA 36239->36244 36240 7ffdf629a235 ?geometry@QWindow@@QEBA?AVQRect@ ?geometry@QWindow@@QEBA?AVQRect@ ??0QRegion@@QEAA@AEBVQRect@@W4RegionType@0@ ?isEmpty@QRegion@ 36245 7ffdf629a2a7 ?window@QPlatformWindow@@QEBAPEAVQWindow@ ??$handleExposeEvent@UDefaultDelivery@QWindowSystemInterface@@@QWindowSystemInterface@@SAXPEAVQWindow@@AEBVQRegion@@ ??1QRegion@@QEAA 36240->36245 36241 7ffdf629a2de ?type@QWindow@@QEBA?AW4WindowType@Qt@ 36241->36230 36242 7ffdf629a2f0 ?parent@QWindow@@QEBAPEAV1 36241->36242 36242->36230 36246 7ffdf629a302 ?focusWindow@QGuiApplication@@SAPEAVQWindow@ 36242->36246 36244->36230 36245->36241 36246->36230 36249 7ffdf629a311 SetForegroundWindow 36246->36249 36249->36232 36251 7ffdf629b64e ?windowStates@QWindow@@QEBA?AV?$QFlags@W4WindowState@Qt@@@ 36250->36251 36253 7ffdf629b676 36250->36253 36254 7ffdf629b663 36251->36254 36265 7ffdf629b699 36251->36265 36252 7ffdf629b6f6 ?property@QObject@@QEBA?AVQVariant@@PEBD 36256 7ffdf629b715 ?toBool@QVariant@ 36252->36256 36257 7ffdf629b724 ??1QVariant@@QEAA 36252->36257 36253->36252 36255 7ffdf629b73c 36253->36255 36254->36253 36258 7ffdf629b66c IsWindowVisible 36254->36258 36260 7ffdf629b741 ?windowStates@QWindow@@QEBA?AV?$QFlags@W4WindowState@Qt@@@ 36255->36260 36256->36257 36257->36255 36257->36260 36258->36253 36261 7ffdf629b75b ShowWindow 36260->36261 36262 7ffdf629b754 36260->36262 36263 7ffdf629b7bf 36261->36263 36264 7ffdf629b773 GetWindowLongPtrW 36261->36264 36262->36261 36266 7ffdf629b7f5 36263->36266 36267 7ffdf629b7c4 GetWindowPlacement 36263->36267 36271 7ffdf6299d70 27 API calls 36264->36271 36265->36253 36272 7ffdf629b6cd GetWindowLongPtrW 36265->36272 36270 7ffdf6381690 3 API calls 36266->36270 36267->36266 36269 7ffdf629b7e2 SetWindowPlacement 36267->36269 36269->36266 36273 7ffdf629a21a GetWindowLongPtrW 36270->36273 36274 7ffdf629b79b SetWindowPos 36271->36274 36275 7ffdf6299d70 27 API calls 36272->36275 36273->36240 36273->36241 36274->36263 36275->36253 36276 7ffdf66ff9a0 36277 7ffdf66ff9ee 36276->36277 36280 7ffdf66ff9c7 36276->36280 36285 7ffdf66ff090 36277->36285 36280->36277 36283 7ffdf66ffb2d _Init_thread_footer 36280->36283 36281 7ffdf66ffaa0 36282 7ffdf66ffa24 36282->36281 36284 7ffdf66ffa97 ?dispose@QListData@@SAXPEAUData@1@ 36282->36284 36283->36277 36284->36281 36304 7ffdf6708f80 36285->36304 36287 7ffdf66ff0b4 36288 7ffdf66ff0c1 ?size@QListData@ 36287->36288 36289 7ffdf66ff198 ?begin@QListData@ ?end@QListData@ 36288->36289 36290 7ffdf66ff0e8 36288->36290 36300 7ffdf66ff2a8 36289->36300 36302 7ffdf66ff1bd 36289->36302 36291 7ffdf66ff0f6 ?begin@QListData@ ?detach@QListData@@QEAAPEAUData@1@H ?end@QListData@ ?begin@QListData@ 36290->36291 36292 7ffdf66ff190 ?realloc@QListData@@QEAAXH 36290->36292 36295 7ffdf66ff12a 36291->36295 36292->36289 36293 7ffdf66ff2e1 ?dispose@QListData@@SAXPEAUData@1@ 36294 7ffdf66ff2ec ?begin@QListData@ ?end@QListData@ 36293->36294 36294->36282 36295->36289 36298 7ffdf66ff185 ?dispose@QListData@@SAXPEAUData@1@ 36295->36298 36297 7ffdf66ff1e3 ?begin@QListData@ 36308 7ffdf66ff6e0 ?begin@QListData@ ?detach@QListData@@QEAAPEAUData@1@H ?end@QListData@ ?begin@QListData@ 36297->36308 36298->36289 36300->36293 36300->36294 36301 7ffdf66ff1f9 ?end@QListData@ 36301->36302 36302->36300 36303 7ffdf66ff270 ??1QString@@QEAA ??1QString@@QEAA ??1QString@@QEAA 36302->36303 36307 7ffdf66ff6e0 ?begin@QListData@ ?detach@QListData@@QEAAPEAUData@1@H ?end@QListData@ ?begin@QListData@ 36302->36307 36303->36302 36309 7ffdf67083e0 36304->36309 36306 7ffdf6708f91 36306->36287 36307->36297 36308->36301 36310 7ffdf6708445 36309->36310 36311 7ffdf670844e malloc 36310->36311 36312 7ffdf6708511 36310->36312 36313 7ffdf67084af GetAdaptersAddresses 36311->36313 36317 7ffdf6708465 36311->36317 36312->36317 36353 7ffdf6708552 36312->36353 36316 7ffdf67084d2 free 36313->36316 36313->36353 36314 7ffdf6708c1a 36319 7ffdf6708c55 36314->36319 36320 7ffdf6708c4c free 36314->36320 36315 7ffdf670849f ?dispose@QListData@@SAXPEAUData@1@ 36318 7ffdf6708c8f 36315->36318 36316->36315 36316->36317 36317->36315 36317->36318 36318->36306 36319->36318 36322 7ffdf6708c84 ?dispose@QListData@@SAXPEAUData@1@ 36319->36322 36320->36319 36321 7ffdf6759290 2 API calls 36323 7ffdf670859b ??0QSharedData@@QEAA ??0QString@@QEAA ??0QString@@QEAA ??0QString@@QEAA 36321->36323 36322->36318 36324 7ffdf67086ff ?append@QListData@ 36323->36324 36325 7ffdf6708602 ?begin@QListData@ ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH ?begin@QListData@ ?begin@QListData@ 36323->36325 36332 7ffdf6708650 36324->36332 36326 7ffdf670866f ?end@QListData@ ?begin@QListData@ 36325->36326 36325->36332 36326->36332 36327 7ffdf670865c memcpy 36327->36326 36328 7ffdf67086ae memcpy 36328->36332 36329 7ffdf67086d5 ?dispose@QListData@@SAXPEAUData@1@ 36330 7ffdf67086de ?begin@QListData@ 36329->36330 36330->36332 36331 7ffdf67087d6 ConvertInterfaceLuidToNameW 36333 7ffdf670881e ?isEmpty@QString@ 36331->36333 36334 7ffdf67087f3 ?fromWCharArray@QString@@SA?AV1@PEB_WH ??4QDateTime@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 36331->36334 36332->36326 36332->36327 36332->36328 36332->36329 36332->36330 36332->36331 36335 7ffdf6708854 ?fromWCharArray@QString@@SA?AV1@PEB_WH ??4QDateTime@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 36333->36335 36336 7ffdf670882c ?fromLocal8Bit@QString@@SA?AV1@PEBDH ??4QDateTime@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 36333->36336 36334->36333 36335->36353 36336->36335 36337 7ffdf6708890 ??4QDateTime@@QEAAAEAV0@$$QEAV0@ ??1QString@@QEAA 36337->36353 36338 7ffdf66f7970 4 API calls 36338->36353 36339 7ffdf67088e9 htonl 36339->36353 36340 7ffdf6708995 ??0QMessageLogger@@QEAA@PEBDH0 ?warning@QMessageLogger@ 36340->36353 36341 7ffdf6708935 ConvertInterfaceLuidToNameW 36342 7ffdf6708966 ?number@QString@@SA?AV1@IH 36341->36342 36343 7ffdf670894f ?fromWCharArray@QString@@SA?AV1@PEB_WH 36341->36343 36342->36353 36343->36353 36345 7ffdf6708a11 ??0QDeadlineTimer@@QEAA@W4ForeverConstant@0@W4TimerType@Qt@@ 36345->36353 36346 7ffdf6708a1b ??0QDeadlineTimer@@QEAA@_JW4TimerType@Qt@@ 36346->36353 36347 7ffdf6708988 ??1QString@@QEAA 36347->36353 36348 7ffdf6708a4d ??0QDeadlineTimer@@QEAA@_JW4TimerType@Qt@@ 36348->36353 36349 7ffdf6708a43 ??0QDeadlineTimer@@QEAA@W4ForeverConstant@0@W4TimerType@Qt@@ 36349->36353 36350 7ffdf6708a9e ?begin@QListData@ ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH ?begin@QListData@ ?begin@QListData@ 36351 7ffdf6708b07 ?end@QListData@ ?begin@QListData@ 36350->36351 36350->36353 36351->36353 36352 7ffdf6708bd9 ?append@QListData@ 36352->36353 36353->36314 36353->36321 36353->36337 36353->36338 36353->36339 36353->36340 36353->36341 36353->36342 36353->36345 36353->36346 36353->36348 36353->36349 36353->36350 36353->36351 36353->36352 36354 7ffdf6708ba1 ?dispose@QListData@@SAXPEAUData@1@ 36353->36354 36355 7ffdf6708bad ?begin@QListData@ 36353->36355 36356 7ffdf66f96c0 ??4QString@@QEAAAEAV0@AEBV0@ 36353->36356 36354->36355 36355->36353 36356->36347 36357 7ffdf66fee20 36358 7ffdf66fee40 36357->36358 36361 7ffdf66fee44 36357->36361 36359 7ffdf66ff090 78 API calls 36358->36359 36360 7ffdf66fee7e ?size@QListData@ 36359->36360 36362 7ffdf66fef57 ?begin@QListData@ ?end@QListData@ 36360->36362 36363 7ffdf66feea4 36360->36363 36361->36358 36366 7ffdf66ff070 _Init_thread_footer 36361->36366 36371 7ffdf66fef78 36362->36371 36364 7ffdf66feeb2 ?begin@QListData@ ?detach@QListData@@QEAAPEAUData@1@H ?end@QListData@ ?begin@QListData@ 36363->36364 36365 7ffdf66fef4f ?realloc@QListData@@QEAAXH 36363->36365 36367 7ffdf66feee6 36364->36367 36365->36362 36366->36358 36367->36362 36370 7ffdf66fef44 ?dispose@QListData@@SAXPEAUData@1@ 36367->36370 36368 7ffdf66ff020 36369 7ffdf66ff017 ?dispose@QListData@@SAXPEAUData@1@ 36369->36368 36370->36362 36371->36368 36371->36369

                                            Executed Functions

                                            Function 00007FF60CFE3110 Relevance: 1286.1, APIs: 635, Strings: 98, Instructions: 3332windowtimenetworkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 0 7ff60cfe3110-7ff60cfe38bb ??0QMainWindow@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ??0QByteArray@@QEAA@XZ call 7ff60d00d780 * 2 call 7ff60d076824 ??0QTimer@@QEAA@PEAVQObject@@@Z ??0QByteArray@@QEAA@XZ * 2 ??0QHostAddress@@QEAA@XZ ??0QTranslator@@QEAA@PEAVQObject@@@Z call 7ff60d009990 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QSharedMemory@@QEAA@AEBVQString@@PEAVQObject@@@Z ??1QString@@QEAA@XZ call 7ff60cfd0840 call 7ff60cfccb90 call 7ff60d00afa0 ??0QTimer@@QEAA@PEAVQObject@@@Z ??0QObject@@QEAA@PEAV0@@Z ??0QSqlDatabase@@QEAA@XZ ??0QTimer@@QEAA@PEAVQObject@@@Z call 7ff60d004110 call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 call 7ff60d039b70 ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z * 4 ??6QDebug@@QEAAAEAV0@H@Z ??1QDebug@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z * 3 ?number@QString@@SA?AV1@HH@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QByteArray@@QEAA@AEBV0@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ call 7ff60cfe8ef0 call 7ff60d03a310 ??1QString@@QEAA@XZ * 3 call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ?setDefaultFormat@QSettings@@SAXW4Format@1@@Z call 7ff60cff27b0 39 7ff60cfe3954-7ff60cfe3a69 ?fileName@QSettings@@QEBA?AVQString@@XZ ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ ??1QString@@QEAA@XZ ??0QVariant@@QEAA@H@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toInt@QVariant@@QEBAHPEA_N@Z ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??0QDate@@QEAA@XZ call 7ff60d03a580 0->39 40 7ff60cfe38c1-7ff60cfe394e call 7ff60d076824 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z * 2 ??0QSettings@@QEAA@AEBVQString@@0PEAVQObject@@@Z ??1QString@@QEAA@XZ * 2 0->40 43 7ff60cfe3a6e-7ff60cfe3a70 39->43 40->39 45 7ff60cfe3a76-7ff60cfe3a7c 43->45 46 7ff60cfe70d9-7ff60cfe70fe 43->46 45->46 47 7ff60cfe3a82-7ff60cfe3a87 45->47 47->46 48 7ff60cfe3a8d-7ff60cfe3aab 47->48 49 7ff60cfe3aad-7ff60cfe3ab4 48->49 50 7ff60cfe3ab9-7ff60cfe3b03 call 7ff60d039f60 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z ??1QString@@QEAA@XZ 48->50 51 7ff60cfe3c3a-7ff60cfe3c43 49->51 58 7ff60cfe3b05-7ff60cfe3b11 50->58 59 7ff60cfe3b16-7ff60cfe3b56 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z ??1QString@@QEAA@XZ 50->59 53 7ff60cfe3c45-7ff60cfe3c4c 51->53 54 7ff60cfe3c4e-7ff60cfe3c64 51->54 53->54 56 7ff60cfe3c70-7ff60cfe3c82 54->56 57 7ff60cfe3c66-7ff60cfe3c6e 54->57 60 7ff60cfe3c86-7ff60cfe3ed9 call 7ff60d076824 call 7ff60cfcd200 call 7ff60d076824 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QChar@@QEAA@UQLatin1Char@@@Z ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z call 7ff60d0133b0 ??1QString@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QVariant@@QEAA@XZ ?count@QComboBox@@QEBAHXZ ??0QIcon@@QEAA@XZ ?insertItem@QComboBox@@QEAAXHAEBVQIcon@@AEBVQString@@AEBVQVariant@@@Z ??1QIcon@@QEAA@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??0QVariant@@QEAA@_N@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toBool@QVariant@@QEBA_NXZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ 56->60 57->60 61 7ff60cfe3bae-7ff60cfe3c34 call 7ff60d039f60 ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ ??1QString@@QEAA@XZ * 2 58->61 62 7ff60cfe3b61-7ff60cfe3ba1 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z ??1QString@@QEAA@XZ 59->62 63 7ff60cfe3b58-7ff60cfe3b5f 59->63 77 7ff60cfe3edf 60->77 78 7ff60cfe42d7 60->78 61->51 62->61 65 7ff60cfe3ba3 62->65 63->61 65->61 79 7ff60cfe3ee0-7ff60cfe42c7 call 7ff60d076824 call 7ff60d017170 ?addWidget@QGridLayout@@QEAAXPEAVQWidget@@HHV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60cfcb7d0 ??0QVariant@@QEAA@XZ call 7ff60d017b40 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QChar@@QEAA@UQLatin1Char@@@Z ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z ??0QChar@@QEAA@UQLatin1Char@@@Z ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z ?count@QComboBox@@QEBAHXZ ??0QIcon@@QEAA@XZ ?insertItem@QComboBox@@QEAAXHAEBVQIcon@@AEBVQString@@AEBVQVariant@@@Z ??1QIcon@@QEAA@XZ ??1QString@@QEAA@XZ * 4 ??1QVariant@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ 77->79 80 7ff60cfe42dc-7ff60cfe44d7 call 7ff60cffd410 call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ?singleShot@QTimer@@SAXHPEBVQObject@@PEBD@Z ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60cff45c0 ??0QVariant@@QEAA@PEBD@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toString@QVariant@@QEBA?AVQString@@XZ call 7ff60d0038a0 ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??0QVariant@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QVariant@@QEAA@XZ ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ??4QVariant@@QEAAAEAV0@$$QEAV0@@Z ??1QVariant@@QEAA@XZ * 2 ??1QString@@QEAA@XZ 78->80 120 7ff60cfe42cd-7ff60cfe42d5 79->120 98 7ff60cfe44fc-7ff60cfe4573 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QVariant@@QEAA@XZ ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ??4QVariant@@QEAAAEAV0@$$QEAV0@@Z ??1QVariant@@QEAA@XZ * 2 ??1QString@@QEAA@XZ 80->98 99 7ff60cfe44d9-7ff60cfe44f6 ?toInt@QVariant@@QEBAHPEA_N@Z ?setCurrentIndex@QComboBox@@QEAAXH@Z 80->99 101 7ff60cfe4575-7ff60cfe4589 ?toBool@QVariant@@QEBA_NXZ 98->101 102 7ff60cfe45a1-7ff60cfe45a9 98->102 99->98 106 7ff60cfe4594 101->106 107 7ff60cfe458b-7ff60cfe4592 101->107 103 7ff60cfe45f2-7ff60cfe4b43 call 7ff60cfce940 ??1QVariant@@QEAA@XZ ??0QVariant@@QEAA@PEBD@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toString@QVariant@@QEBA?AVQString@@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??0QByteArray@@QEAA@AEBV0@@Z call 7ff60cff8b50 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z * 2 ??0QByteArray@@QEAA@AEBV0@@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??0QByteArray@@QEAA@AEBV0@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ ??0QByteArray@@QEAA@AEBV0@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ ??0QVariant@@QEAA@AEBVQString@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toString@QVariant@@QEBA?AVQString@@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ * 5 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z * 2 ??0QByteArray@@QEAA@AEBV0@@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??0QByteArray@@QEAA@AEBV0@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ ??0QByteArray@@QEAA@AEBV0@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ ??0QVariant@@QEAA@AEBVQString@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toString@QVariant@@QEBA?AVQString@@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ * 5 ??0QVariant@@QEAA@PEBD@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toString@QVariant@@QEBA?AVQString@@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??0QVariant@@QEAA@PEBD@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toString@QVariant@@QEBA?AVQString@@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??9QString@@QEBA_NPEBD@Z 102->103 104 7ff60cfe45ab 102->104 123 7ff60cfe4b53-7ff60cfe4b60 ?exists@QFile@@SA_NAEBVQString@@@Z 103->123 124 7ff60cfe4b45-7ff60cfe4b4d 103->124 109 7ff60cfe45b0-7ff60cfe45b9 104->109 108 7ff60cfe459b ?click@QAbstractButton@@QEAAXXZ 106->108 107->108 108->102 112 7ff60cfe45bb-7ff60cfe45c5 call 7ff60cfce4f0 109->112 113 7ff60cfe45ca-7ff60cfe45ec ?at@QListData@@QEBAPEAPEAXH@Z call 7ff60d018220 109->113 112->113 113->109 125 7ff60cfe45ee 113->125 120->80 127 7ff60cfe4b66-7ff60cfe4b77 ?exists@QFile@@SA_NAEBVQString@@@Z 123->127 128 7ff60cfe4c68-7ff60cfe4cd5 ??0QFileInfo@@QEAA@AEBVQString@@@Z * 2 ?fileName@QFileInfo@@QEBA?AVQString@@XZ * 2 ??8@YA_NAEBVQString@@0@Z 123->128 124->123 126 7ff60cfe4d9f-7ff60cfe4df0 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?instance@QCoreApplication@@SAPEAV1@XZ ?arguments@QCoreApplication@@SA?AVQStringList@@XZ ?QStringList_contains@QtPrivate@@YA_NPEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@@Z 124->126 125->103 129 7ff60cfe4df2-7ff60cfe4df5 126->129 130 7ff60cfe4e09-7ff60cfe4e2b 126->130 131 7ff60cfe4b79-7ff60cfe4b83 ??4QString@@QEAAAEAV0@AEBV0@@Z 127->131 132 7ff60cfe4b88-7ff60cfe4c63 ??4QString@@QEAAAEAV0@PEBD@Z ??0QVariant@@QEAA@PEBD@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?setValue@QSettings@@QEAAXAEBVQString@@AEBVQVariant@@@Z ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??0QVariant@@QEAA@PEBD@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?setValue@QSettings@@QEAAXAEBVQString@@AEBVQVariant@@@Z ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ?sync@QSettings@@QEAAXXZ 127->132 133 7ff60cfe4ced 128->133 134 7ff60cfe4cd7-7ff60cfe4ce6 ?exists@QFileInfo@@QEBA_NXZ 128->134 135 7ff60cfe4e4c-7ff60cfe50bf ??1QString@@QEAA@XZ ??0QVariant@@QEAA@_N@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toBool@QVariant@@QEBA_NXZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ call 7ff60d076824 call 7ff60d0112b0 call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z call 7ff60d039e00 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?menuBar@QMainWindow@@QEBAPEAVQMenuBar@@XZ ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z call 7ff60d076824 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@@Z 129->135 136 7ff60cfe4df7-7ff60cfe4e07 129->136 137 7ff60cfe4e42-7ff60cfe4e4b ?dispose@QListData@@SAXPEAUData@1@@Z 130->137 138 7ff60cfe4e2d 130->138 131->126 132->126 140 7ff60cfe4cf0-7ff60cfe4cf4 133->140 134->133 139 7ff60cfe4ce8-7ff60cfe4ceb 134->139 160 7ff60cfe50d1-7ff60cfe527a ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?menuBar@QMainWindow@@QEBAPEAVQMenuBar@@XZ ?addMenu@QMenuBar@@QEAAPEAVQAction@@PEAVQMenu@@@Z ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?menuBar@QMainWindow@@QEBAPEAVQMenuBar@@XZ ?addMenu@QMenuBar@@QEAAPEAVQAction@@PEAVQMenu@@@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z call 7ff60d076824 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@@Z 135->160 161 7ff60cfe50c1-7ff60cfe50cb ??1QString@@QEAA@XZ 135->161 136->130 136->135 137->135 141 7ff60cfe4e30-7ff60cfe4e40 ??1QString@@QEAA@XZ 138->141 139->140 143 7ff60cfe4d0b-7ff60cfe4d0f 140->143 144 7ff60cfe4cf6-7ff60cfe4d0a ??1QString@@QEAA@XZ 140->144 141->137 141->141 146 7ff60cfe4d25-7ff60cfe4d28 143->146 147 7ff60cfe4d11-7ff60cfe4d1f ??1QString@@QEAA@XZ 143->147 144->143 149 7ff60cfe4d74-7ff60cfe4d99 ??4QString@@QEAAAEAV0@AEBV0@@Z ??1QFileInfo@@QEAA@XZ * 2 146->149 150 7ff60cfe4d2a-7ff60cfe4d6e ?remove@QFile@@SA_NAEBVQString@@@Z ??0QByteArray@@QEAA@AEBV0@@Z call 7ff60cff6490 ?copy@QFile@@SA_NAEBVQString@@0@Z ??1QString@@QEAA@XZ 146->150 147->146 149->126 150->149 164 7ff60cfe528c-7ff60cfe54a2 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?menuBar@QMainWindow@@QEBAPEAVQMenuBar@@XZ ?addMenu@QMenuBar@@QEAAPEAVQAction@@PEAVQMenu@@@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z call 7ff60d076824 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@@Z 160->164 165 7ff60cfe527c-7ff60cfe5286 ??1QString@@QEAA@XZ 160->165 161->160 168 7ff60cfe54b5-7ff60cfe564a ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?menuBar@QMainWindow@@QEBAPEAVQMenuBar@@XZ ?addMenu@QMenuBar@@QEAAPEAVQAction@@PEAVQMenu@@@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z call 7ff60d076824 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ??0QMenu@@QEAA@AEBVQString@@PEAVQWidget@@@Z 164->168 169 7ff60cfe54a4-7ff60cfe54af ??1QString@@QEAA@XZ 164->169 165->164 172 7ff60cfe565d-7ff60cfe629d ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?addAction@QMenu@@QEAAPEAVQAction@@AEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ?menuBar@QMainWindow@@QEBAPEAVQMenuBar@@XZ ?addMenu@QMenuBar@@QEAAPEAVQAction@@PEAVQMenu@@@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ?setTextInteractionFlags@QLabel@@QEAAXV?$QFlags@W4TextInteractionFlag@Qt@@@@@Z ?setOpenExternalLinks@QLabel@@QEAAX_N@Z ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?setTextInteractionFlags@QLabel@@QEAAXV?$QFlags@W4TextInteractionFlag@Qt@@@@@Z ?setOpenExternalLinks@QLabel@@QEAAX_N@Z ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?setTextInteractionFlags@QLabel@@QEAAXV?$QFlags@W4TextInteractionFlag@Qt@@@@@Z ?setOpenExternalLinks@QLabel@@QEAAX_N@Z ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ?setIconSize@QAbstractButton@@QEAAXAEBVQSize@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QIcon@@QEAA@AEBVQString@@@Z ?setIcon@QAbstractButton@@QEAAXAEBVQIcon@@@Z ??1QIcon@@QEAA@XZ ??1QString@@QEAA@XZ ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?setToolTip@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ?setIconSize@QAbstractButton@@QEAAXAEBVQSize@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QIcon@@QEAA@AEBVQString@@@Z ?setIcon@QAbstractButton@@QEAAXAEBVQIcon@@@Z ??1QIcon@@QEAA@XZ ??1QString@@QEAA@XZ ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?setToolTip@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ?setIconSize@QAbstractButton@@QEAAXAEBVQSize@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QIcon@@QEAA@AEBVQString@@@Z ?setIcon@QAbstractButton@@QEAAXAEBVQIcon@@@Z ??1QIcon@@QEAA@XZ ??1QString@@QEAA@XZ ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?setToolTip@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ?setIconSize@QAbstractButton@@QEAAXAEBVQSize@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QIcon@@QEAA@AEBVQString@@@Z ?setIcon@QAbstractButton@@QEAAXAEBVQIcon@@@Z ??1QIcon@@QEAA@XZ ??1QString@@QEAA@XZ ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z ?setToolTip@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60cff1b80 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?setTextInteractionFlags@QLabel@@QEAAXV?$QFlags@W4TextInteractionFlag@Qt@@@@@Z ?setOpenExternalLinks@QLabel@@QEAAX_N@Z ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QChar@@QEAA@UQLatin1Char@@@Z ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z ?setText@QLabel@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ * 2 ?setToolTip@QWidget@@QEAAXAEBVQString@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QIcon@@QEAA@AEBVQString@@@Z ?setIcon@QAbstractButton@@QEAAXAEBVQIcon@@@Z ??1QIcon@@QEAA@XZ ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setIconSize@QAbstractButton@@QEAAXAEBVQSize@@@Z ??4QString@@QEAAAEAV0@PEBD@Z ?setTextInteractionFlags@QLabel@@QEAAXV?$QFlags@W4TextInteractionFlag@Qt@@@@@Z ?setOpenExternalLinks@QLabel@@QEAAX_N@Z ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QChar@@QEAA@UQLatin1Char@@@Z ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z ?setText@QLabel@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ * 2 ?setToolTip@QWidget@@QEAAXAEBVQString@@@Z call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ call 7ff60cff5430 ??0QVariant@@QEAA@PEBD@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toString@QVariant@@QEBA?AVQString@@XZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??0QVariant@@QEAA@AEBVQString@@@Z ?findData@QComboBox@@QEBAHAEBVQVariant@@HV?$QFlags@W4MatchFlag@Qt@@@@@Z ??1QVariant@@QEAA@XZ ??0QVariant@@QEAA@_N@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toBool@QVariant@@QEBA_NXZ 168->172 173 7ff60cfe564c-7ff60cfe5657 ??1QString@@QEAA@XZ 168->173 169->168 186 7ff60cfe629f-7ff60cfe62a2 172->186 187 7ff60cfe62a9 172->187 173->172 186->187 189 7ff60cfe62a4-7ff60cfe62a7 186->189 188 7ff60cfe62ac-7ff60cfe62b0 187->188 190 7ff60cfe62b2-7ff60cfe62c7 ??1QVariant@@QEAA@XZ 188->190 191 7ff60cfe62c8-7ff60cfe62cc 188->191 189->188 190->191 192 7ff60cfe62e4-7ff60cfe62e8 191->192 193 7ff60cfe62ce-7ff60cfe62e3 ??1QString@@QEAA@XZ 191->193 194 7ff60cfe62ff-7ff60cfe6388 ??0QVariant@@QEAA@H@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toInt@QVariant@@QEBAHPEA_N@Z ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ 192->194 195 7ff60cfe62ea-7ff60cfe62f9 ??1QVariant@@QEAA@XZ 192->195 193->192 196 7ff60cfe638e-7ff60cfe63b3 ?setChecked@QAbstractButton@@QEAAX_N@Z ?setCurrentIndex@QTabWidget@@QEAAXH@Z 194->196 197 7ff60cfe66b8-7ff60cfe6730 ?setCurrentIndex@QTabWidget@@QEAAXH@Z ??0QVariant@@QEAA@_N@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toBool@QVariant@@QEBA_NXZ 194->197 195->194 198 7ff60cfe63b4 196->198 197->198 199 7ff60cfe6736-7ff60cfe6739 197->199 200 7ff60cfe63b7-7ff60cfe63bb 198->200 199->200 201 7ff60cfe63d3-7ff60cfe63d7 200->201 202 7ff60cfe63bd-7ff60cfe63d2 ??1QVariant@@QEAA@XZ 200->202 203 7ff60cfe63ef-7ff60cfe63f3 201->203 204 7ff60cfe63d9-7ff60cfe63ee ??1QString@@QEAA@XZ 201->204 202->201 205 7ff60cfe6402-7ff60cfe6405 203->205 206 7ff60cfe63f5-7ff60cfe63fc ??1QVariant@@QEAA@XZ 203->206 204->203 207 7ff60cfe640f-7ff60cfe6651 call 7ff60d076824 ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z ??0QByteArray@@QEAA@AEBV0@@Z ??0QString@@QEAA@$$QEAV0@@Z call 7ff60d076824 ??0QString@@QEAA@$$QEAV0@@Z * 2 ??1QString@@QEAA@XZ ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1QString@@QEAA@XZ * 2 ??1Connection@QMetaObject@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z ??0QNetworkRequest@@QEAA@AEBVQUrl@@@Z ??1QUrl@@QEAA@XZ ??1QString@@QEAA@XZ ?get@QNetworkAccessManager@@QEAAPEAVQNetworkReply@@AEBVQNetworkRequest@@@Z 205->207 208 7ff60cfe6407-7ff60cfe640a call 7ff60cffc3b0 205->208 206->205 216 7ff60cfe673e-7ff60cfe675e 207->216 217 7ff60cfe6657-7ff60cfe666b ?setCurrentIndex@QComboBox@@QEAAXH@Z 207->217 208->207 218 7ff60cfe6763-7ff60cfe68a6 call 7ff60d076824 ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z ??1Connection@QMetaObject@@QEAA@XZ ??0QVariant@@QEAA@H@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toInt@QVariant@@QEBAHPEA_N@Z ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?instance@QCoreApplication@@SAPEAV1@XZ ?arguments@QCoreApplication@@SA?AVQStringList@@XZ ?QStringList_contains@QtPrivate@@YA_NPEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@@Z 216->218 217->218 219 7ff60cfe6671-7ff60cfe66b3 ?defaultTypeFor@QTimer@@CA?AW4TimerType@Qt@@H@Z call 7ff60d076824 ?singleShotImpl@QTimer@@CAXHW4TimerType@Qt@@PEBVQObject@@PEAVQSlotObjectBase@QtPrivate@@@Z 217->219 225 7ff60cfe68bc-7ff60cfe68db 218->225 226 7ff60cfe68a8-7ff60cfe68ab 218->226 219->218 229 7ff60cfe68f2-7ff60cfe68fb ?dispose@QListData@@SAXPEAUData@1@@Z 225->229 230 7ff60cfe68dd 225->230 227 7ff60cfe68fd-7ff60cfe6911 ??1QString@@QEAA@XZ 226->227 228 7ff60cfe68ad-7ff60cfe68ba 226->228 231 7ff60cfe69e0-7ff60cfe6b83 call 7ff60d076824 call 7ff60d025860 call 7ff60d025920 ??0QChar@@QEAA@H@Z ??4QString@@QEAAAEAV0@VQChar@@@Z ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z call 7ff60cfe8ef0 ??1QString@@QEAA@XZ ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QChar@@QEAA@UQLatin1Char@@@Z ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z ?setWindowTitle@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ * 2 call 7ff60d076824 ??0QByteArray@@QEAA@AEBV0@@Z call 7ff60d023770 ?statusBar@QMainWindow@@QEBAPEAVQStatusBar@@XZ ?addPermanentWidget@QStatusBar@@QEAAXPEAVQWidget@@H@Z call 7ff60cff2b00 227->231 232 7ff60cfe6917-7ff60cfe69da ??0QByteArray@@QEAA@XZ ??4QString@@QEAAAEAV0@PEBD@Z ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z call 7ff60cfd1ae0 ??1QString@@QEAA@XZ ?startDetached@QProcess@@SA_NAEBVQString@@AEBVQStringList@@@Z call 7ff60cfcdd50 ??1QString@@QEAA@XZ 227->232 228->225 228->227 229->227 233 7ff60cfe68e0-7ff60cfe68f0 ??1QString@@QEAA@XZ 230->233 252 7ff60cfe6cd2 231->252 253 7ff60cfe6b89-7ff60cfe6cd0 ?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z * 2 ?warning@QMessageBox@@SA?AW4StandardButton@1@PEAVQWidget@@AEBVQString@@1V?$QFlags@W4StandardButton@QMessageBox@@@@W421@@Z ??1QString@@QEAA@XZ * 2 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ??0QChar@@QEAA@UQLatin1Char@@@Z ?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z ??0QByteArray@@QEAA@AEBV0@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ * 3 ?setWindowTitle@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ 231->253 232->231 233->229 233->233 254 7ff60cfe6cd6-7ff60cfe6d9e ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??1QDebug@@QEAA@XZ ?size@QListData@@QEBAHXZ call 7ff60d076824 call 7ff60d013da0 ??0QByteArray@@QEAA@XZ * 4 252->254 253->254 259 7ff60cfe6fd3-7ff60cfe70d8 ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??1QDebug@@QEAA@XZ ??1QString@@QEAA@XZ * 5 ??1QNetworkRequest@@QEAA@XZ ??1QString@@QEAA@XZ * 9 254->259 260 7ff60cfe6da4-7ff60cfe6ea8 ?number@QString@@SA?AV1@HH@Z ??0QVariant@@QEAA@_N@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??0QByteArray@@QEAA@AEBV0@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ ?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z ?toBool@QVariant@@QEBA_NXZ ??1QVariant@@QEAA@XZ ??1QString@@QEAA@XZ * 2 ??1QVariant@@QEAA@XZ 254->260 259->46 261 7ff60cfe6fbe-7ff60cfe6fcd ??1QString@@QEAA@XZ 260->261 262 7ff60cfe6eae-7ff60cfe6f25 ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@H@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??1QDebug@@QEAA@XZ call 7ff60d014750 260->262 261->259 261->260 265 7ff60cfe6f43-7ff60cfe6f5f call 7ff60d02bd90 262->265 266 7ff60cfe6f27-7ff60cfe6f3d call 7ff60cffc3b0 262->266 271 7ff60cfe6fb3-7ff60cfe6fbd ??1QString@@QEAA@XZ 265->271 272 7ff60cfe6f61-7ff60cfe6fb2 ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ 265->272 266->261 266->265 271->261 272->271
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Object@@$Variant@@$Meta$?from$?set$Connection@$Data@$ArrayAscii_helper@Typed$String@@@$Debug@@$Array@@Byte$Widget@@$Type@$V0@@$Connection$ObjectQt@@@$Private@@Qt@@Settings@@$Base@Icon@@Impl@Slot$?connectMessageU3@@$?tr@$Cursor@@Logger@@$?add?value@V2@@$Button@@Char@@@$Action@@Flags@Utf8@$?append@AbstractBar@@V1@@$Box@@Menu@@$ComboMenu$Label@@Object@@@$?connect@Tool$?debug@Action@CursorCursor@Cursor@@@InteractionQt@@@@@Shape@TextTimer@@$Char@@Sheet@StringString@Style$?arg@Data@@Latin1ListMainWidget@@@Window@@$Bar@Flag@Icon@Icon@@@Tip@$?menuApplication@@CoreIconNetworkSize@Size@@@Window$Bool@ExternalLinks@List@@Menu@Menu@@@Name@OpenVariant@@@$?count@?insertCaseInt@Layout@@Sensitivity@V0@$$$?arguments@?dispose@?instance@?number@A@$$CurrentData@1@@FileIndex@Info@@Item@Size@@Text@Title@Widget@$?at@?exists@?single?startsAccessAttribute@Checked@Concurrency::cancel_current_taskContextFile@@List@@@List_contains@Manager@@Mode@0@@Policy@Request@@StandardStatusTimerUrl@@Value@With@mallocmemset$?begin@?clear@?click@?complete?current?default?end@?file?find?get@?object?resize@?size@?start?status?stop@?sync@?text@?trimmed@?warning@Address@@AlignmentBox@@@@Button@Button@1@ContentsDatabase@@Date@@DefaultDetached@Edit@@File@For@Format@Format@1@@GridHostItems@LineLower@Margins@MatchMemory@@Mtx_init_in_situMutex@@ParsingPermanentPrivate@@@Process@@Qt@@_RecursionReply@@Request@@@SharedShotShot@Socket@@Spacing@String@@0String@@1Suffix@Thread@@Translator@@TypeUrl@@@V0@_W421@@Widget
                                            • String ID: $LINE $ (*** TRIAL ***)$$NAME$%1: %2$--slide listing--$..\srtminiserver\mainwindow.cpp$/autostart$1onConferenceTriggered()$1onIgnoreStreamIDS()$1onLicPeriodCheck()$1onLoadConfigTriggered()$1onRemoteControlTriggered()$1onResetStreamIDS()$1onSaveConfigTriggered()$1onStatTimer()$1onTestNDITriggered()$1on_OpenLineRecFolder(int)$1on_SetLineRecFolder(int)$2needOpenRecFolder(int)$2needSetRecFolder(int)$2timeout()$2triggered()$6e5d8293-04a2-4b2c-a9d1-56e7f58713FF$:/REFRESH$:COLOR_BAR$:COPY$:SETTINGS$<a style='color:white;text-decoration:none;' href='%1'><img src=:/QUESTION /></a>$===SRT call autostart$===SRT call autostart end$===try srt call start$ARROW_LRMODE$COLORBAR_ON_DISCONNECT$COLORBAR_TEXT$Change custom proxy$Conference Addon (DEPRECATED)$Config$Copy$Crash reports$DISPLAYED_COLORBAR_IMAGE$FAIL srt call autostart err:$GaraninApps$INSTANCE NAME:$Ignore Stream IDs$Instance $KEYSERVER_URL: $LANG$LAST_TEMP_COLORBAR_IMAGE$Line$Load lines config$Logs$MAX_LINES$NDI_NAME_TEXT$NETWORK_IFACE$Open logs folder$P16*$P4*$P8*$QMenu {background-color: #222633;color: rgb(255,255,255);}QMenu::item::selected {background-color: rgb(49,49,49);}$QMenuBar {background-color: #222633;color: rgb(255,255,255);}QMenuBar::item {color: rgb(255,255,255);}QMenuBar::item::selected {background-color: rgb(49,49,49);}$QPushButton {border:none;padding:0;margin:0;}$Quick Actions$Remote Control$Reset Stream IDs$SDIOutAddon.exe$SETTINGS:$SRTMiniServer$SRTMiniServer $INSTANCE-$SRTMiniServer (%1)$START_LISTEN_RUN$Save lines config$Show report$SrtCall/$Test NDI Generator$Tools$UDP_MULTICAST_ENABLE$Warning$Your license is not applied for this version.TRIAL mode activated.$auto$autoconnect_proxy$cert:$decoder$http://core1.garaninapps.com/api/srtproxy/list$http://downloads.garaninapps.com/srtminiserver_win.json$http://keys3.garaninapps.com$https://srtminiserver.com/help/dynamic_dns.html$https://srtminiserver.com/remoteslides/$https://srtminiserver.com/store.html$https://srtminiserver.com/trial-info/$line$no_ndi$q$sdiout_auto$selectedProxyServer$start SDIOutAddon Addon$tab_index$timecode_maxdelay$use all
                                            • API String ID: 552701702-3172525486
                                            • Opcode ID: 04ce73a3a9553217067a4bb4fc63d951873e417e81099f7da245ddf6189cd592
                                            • Instruction ID: 56600de6eaea4e1db26c4447332d0701f90b9697c8e89c531fc2071faac54840
                                            • Opcode Fuzzy Hash: 04ce73a3a9553217067a4bb4fc63d951873e417e81099f7da245ddf6189cd592
                                            • Instruction Fuzzy Hash: 9F832D32A05B82DAEB20DF20E8542ED3361FB85749FA15231D68F87668EF7CD649C744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D004110 Relevance: 808.8, APIs: 411, Strings: 50, Instructions: 2059COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 273 7ff60d004110-7ff60d004154 ?objectName@QObject@@QEBA?AVQString@@XZ ??1QString@@QEAA@XZ 274 7ff60d004185-7ff60d00675b ?resize@QWidget@@QEAAXHH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setWindowTitle@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QWidget@@QEAA@PEAV0@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QVBoxLayout@@QEAA@PEAVQWidget@@@Z ?setSpacing@QBoxLayout@@QEAAXH@Z ?setContentsMargins@QLayout@@QEAAXHHHH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setContentsMargins@QLayout@@QEAAXHHHH@Z call 7ff60d076824 ??0QTabWidget@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMaximumSize@QWidget@@QEAAXAEBVQSize@@@Z ?setTabShape@QTabWidget@@QEAAXW4TabShape@1@@Z call 7ff60d076824 ??0QWidget@@QEAA@PEAV0@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setAccessibleName@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QVBoxLayout@@QEAA@PEAVQWidget@@@Z ?setSpacing@QBoxLayout@@QEAAXH@Z ?setContentsMargins@QLayout@@QEAAXHHHH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setAlignment@QLabel@@QEAAXV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QLineEdit@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z ?setReadOnly@QLineEdit@@QEAAX_N@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QPushButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMaximumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z ??0QByteArray@@QEAA@XZ ?addTab@QTabWidget@@QEAAHPEAVQWidget@@AEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QWidget@@QEAA@PEAV0@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setAccessibleName@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QVBoxLayout@@QEAA@PEAVQWidget@@@Z ?setSpacing@QBoxLayout@@QEAAXH@Z ?setContentsMargins@QLayout@@QEAAXHHHH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setAlignment@QLabel@@QEAAXV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QLineEdit@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSizePolicy@@QEAA@W4Policy@0@0W4ControlType@0@@Z ?setHorizontalStretch@QSizePolicy@@QEAAXH@Z ?setVerticalStretch@QSizePolicy@@QEAAXH@Z ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ??0QSize@@QEAA@HH@Z ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z ?setReadOnly@QLineEdit@@QEAAX_N@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QPushButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMaximumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QCheckBox@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSizePolicy@@QEAA@W4Policy@0@0W4ControlType@0@@Z ?setHorizontalStretch@QSizePolicy@@QEAAXH@Z ?setVerticalStretch@QSizePolicy@@QEAAXH@Z ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ??0QSize@@QEAA@HH@Z ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z ??0QByteArray@@QEAA@XZ ?addTab@QTabWidget@@QEAAHPEAVQWidget@@AEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QWidget@@QEAA@PEAV0@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QVBoxLayout@@QEAA@PEAVQWidget@@@Z ?setSpacing@QBoxLayout@@QEAAXH@Z ?setContentsMargins@QLayout@@QEAAXHHHH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setAlignment@QLabel@@QEAAXV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QComboBox@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setText@QLabel@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setAlignment@QLabel@@QEAAXV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QPushButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSizePolicy@@QEAA@W4Policy@0@0W4ControlType@0@@Z ?setHorizontalStretch@QSizePolicy@@QEAAXH@Z ?setVerticalStretch@QSizePolicy@@QEAAXH@Z ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QPushButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMaximumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSizePolicy@@QEAA@W4Policy@0@0W4ControlType@0@@Z ?setHorizontalStretch@QSizePolicy@@QEAAXH@Z ?setVerticalStretch@QSizePolicy@@QEAAXH@Z ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ?setAlignment@QLabel@@QEAAXV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QCheckBox@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSizePolicy@@QEAA@W4Policy@0@0W4ControlType@0@@Z ?setHorizontalStretch@QSizePolicy@@QEAAXH@Z ?setVerticalStretch@QSizePolicy@@QEAAXH@Z ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ??0QSize@@QEAA@HH@Z ?setMaximumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z call 7ff60d076824 ??0QPushButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setText@QAbstractButton@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setCheckable@QAbstractButton@@QEAAX_N@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z ??0QByteArray@@QEAA@XZ ?addTab@QTabWidget@@QEAAHPEAVQWidget@@AEBVQString@@@Z ??1QString@@QEAA@XZ ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QGridLayout@@QEAA@XZ ?setSpacing@QGridLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ call 7ff60d076824 ??0QComboBox@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QComboBox@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z ??0QSize@@QEAA@HH@Z ?setMaximumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QPushButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ??0QCursor@@QEAA@W4CursorShape@Qt@@@Z ?setCursor@QWidget@@QEAAXAEBVQCursor@@@Z ??1QCursor@@QEAA@XZ ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QHBoxLayout@@QEAA@XZ ?setSpacing@QBoxLayout@@QEAAXH@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setSizeConstraint@QLayout@@QEAAXW4SizeConstraint@1@@Z ?setContentsMargins@QLayout@@QEAAXHHHH@Z call 7ff60d076824 ??0QRadioButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setChecked@QAbstractButton@@QEAAX_N@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QRadioButton@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setStyleSheet@QWidget@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z call 7ff60d076824 ??0QSpacerItem@@QEAA@HHW4Policy@QSizePolicy@@0@Z call 7ff60d076824 ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setAlignment@QLabel@@QEAAXV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z call 7ff60d076824 ??0QComboBox@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSize@@QEAA@HH@Z ?setMaximumSize@QWidget@@QEAAXAEBVQSize@@@Z ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z ?addLayout@QBoxLayout@@QEAAXPEAVQLayout@@H@Z ?setCentralWidget@QMainWindow@@QEAAXPEAVQWidget@@@Z call 7ff60d076824 ??0QStatusBar@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ??0QSizePolicy@@QEAA@W4Policy@0@0W4ControlType@0@@Z ?setHorizontalStretch@QSizePolicy@@QEAAXH@Z ?setVerticalStretch@QSizePolicy@@QEAAXH@Z ?sizePolicy@QWidget@@QEBA?AVQSizePolicy@@XZ ?hasHeightForWidth@QSizePolicy@@QEBA_NXZ ?setHeightForWidth@QSizePolicy@@QEAAX_N@Z ?setSizePolicy@QWidget@@QEAAXVQSizePolicy@@@Z ?setStatusBar@QMainWindow@@QEAAXPEAVQStatusBar@@@Z call 7ff60d076824 ??0QToolBar@@QEAA@PEAVQWidget@@@Z ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?setMovable@QToolBar@@QEAAX_N@Z ?setOrientation@QToolBar@@QEAAXW4Orientation@Qt@@@Z ?addToolBar@QMainWindow@@QEAAXW4ToolBarArea@Qt@@PEAVQToolBar@@@Z call 7ff60d002850 ?setCurrentIndex@QTabWidget@@QEAAXH@Z ?connectSlotsByName@QMetaObject@@SAXPEAVQObject@@@Z 273->274 275 7ff60d004156-7ff60d00417f ?fromUtf8@QString@@SA?AV1@PEBDH@Z ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ 273->275 275->274
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ?set$String@@$Widget@@$Layout@@$Size$String@@@$?fromUtf8@$Name@$Object@@$Object$Policy@@$Flags@Qt@@@@@$?add$AlignmentFlag@$Policy@$Widget@$Widget@@@$Label@@$HeightWidth@$Spacing@Window$Button@@Type@$Size@Size@@Size@@@$Item@@Policy@@0@SpacerStretch@$Layout@$?has?sizePolicy@@@Text@$Maximum$AbstractAlignment@Array@@Box@@ByteContentsControlHorizontalMargins@MinimumPolicy@0@0PushToolType@0@@Vertical$?translate@Application@@Core$Bar@@ComboEdit@@LineSheet@Style$MainStatusTab@Window@@$AccessibleBar@Bar@@@CheckConcurrency::cancel_current_taskCursor@@GridOnly@Orientation@Qt@@@RadioReadShape@$?connect?index?object?resize@Area@CentralCheckable@Checked@Constraint@Constraint@1@@CurrentCursorCursor@Cursor@@@Index@MetaMovable@Object@@@Qt@@Shape@1@@SlotsTitle@malloc
                                            • String ID: MainWindow$border:none;$boxRbArrowsMode$cbProxyServer$cbxDecoders$cbxLinesNames$cbxWindows$centralWidget$ckbAutoConnectProxy$ckbShowDynDNS$cmdConnectProxy$cmdCopyINT$cmdCopyLOC$cmdCopyPA$forConnectFromINTERNETLineEdit$forConnectFromLocalNetworkLineEdit$gridLayout$horizontalLayout$horizontalLayout_2$horizontalLayout_3$horizontalLayout_4$horizontalLayout_5$horizontalLayout_6$horizontalLayout_7$horizontalLayout_8$horizontalLayout_9$label_2$label_3$lblAutoStart$lblEasyWay$lblHelpBottomLinesName$lblHelpDynDNS$lblNetConditions$lblProxyAddon$lblProxyConditions$lblPublicAddress$mainToolBar$pbCustomProxy$pbRefreshWindows$rbLR$rbUD$statusBar$tab$tabWidget$tab_2$tab_3$verticalLayout$verticalLayout_2$verticalLayout_3$verticalLayout_4
                                            • API String ID: 27468836-3545281026
                                            • Opcode ID: 0a21d3f53fd1e6b06b6dcc8b5a66817b89151b5d886acc79f06f27fe731a1966
                                            • Instruction ID: c6d68533bc86384f963f33fe8277876e619033a7f49a9d8e9b80f418ba9dd49a
                                            • Opcode Fuzzy Hash: 0a21d3f53fd1e6b06b6dcc8b5a66817b89151b5d886acc79f06f27fe731a1966
                                            • Instruction Fuzzy Hash: 43332C31A14E4296EB509F21F8546AE7360FF89B85FA05235DA9F83768EF7CE508C704
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F6B00 Relevance: 152.7, APIs: 72, Strings: 15, Instructions: 470windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 481 7ffdf62f6b00-7ffdf62f6ba4 call 7ffdf62f8500 484 7ffdf62f6baa-7ffdf62f6bba CreateFontIndirectW 481->484 485 7ffdf62f6c55-7ffdf62f6c5f call 7ffdf62fa100 481->485 487 7ffdf62f6bbc-7ffdf62f6bd5 ?qErrnoWarning@@YAXPEBDZZ call 7ffdf62fc740 484->487 488 7ffdf62f6bd8-7ffdf62f6c04 SelectObject GetTextMetricsW 484->488 493 7ffdf62f7255-7ffdf62f72a4 call 7ffdf6380e9c call 7ffdf62fff10 485->493 494 7ffdf62f6c65-7ffdf62f6ca1 ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z call 7ffdf6305850 ??8@YA_NAEBVQString@@0@Z 485->494 487->488 491 7ffdf62f6c1c-7ffdf62f6c36 488->491 492 7ffdf62f6c06-7ffdf62f6c1a ?qErrnoWarning@@YAXPEBDZZ 488->492 496 7ffdf62f6c39-7ffdf62f6c4f SelectObject DeleteObject 491->496 492->496 504 7ffdf62f72a9-7ffdf62f72b1 493->504 502 7ffdf62f6ca3-7ffdf62f6cd9 ?length@QString@@QEBAHXZ ?utf16@QString@@QEBAPEBGXZ memmove 494->502 503 7ffdf62f6cdf-7ffdf62f6cef CreateFontIndirectW 494->503 496->485 502->503 505 7ffdf62f6d0a-7ffdf62f6d31 SelectObject 503->505 506 7ffdf62f6cf1-7ffdf62f6d05 ?qErrnoWarning@@YAXPEBDZZ 503->506 507 7ffdf62f72b3 504->507 508 7ffdf62f72bd-7ffdf62f72cb call 7ffdf6302d00 504->508 510 7ffdf62f6d38-7ffdf62f6d6a ?startsWith@QString@@QEBA_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z 505->510 511 7ffdf62f6d33-7ffdf62f6d36 505->511 509 7ffdf62f722d-7ffdf62f724e ??1QString@@QEAA@XZ * 2 506->509 507->508 517 7ffdf62f72ce-7ffdf62f72ee call 7ffdf6381690 508->517 509->493 512 7ffdf62f7250-7ffdf62f7253 509->512 515 7ffdf62f6d8b 510->515 516 7ffdf62f6d6c-7ffdf62f6d6f 510->516 514 7ffdf62f6d8e-7ffdf62f6da9 511->514 512->517 520 7ffdf62f6daf-7ffdf62f6db1 514->520 515->514 516->515 519 7ffdf62f6d71-7ffdf62f6d74 516->519 519->515 522 7ffdf62f6d76-7ffdf62f6d80 519->522 523 7ffdf62f705a-7ffdf62f705d 520->523 524 7ffdf62f6db7-7ffdf62f6dd7 520->524 526 7ffdf62f6d86-7ffdf62f6d89 522->526 527 7ffdf62f6d82-7ffdf62f6d84 522->527 528 7ffdf62f7063-7ffdf62f7205 ?qt_error_string@@YA?AVQString@@H@Z ??0QMessageLogger@@QEAA@PEBDH0@Z ?warning@QMessageLogger@@QEBA?AVQDebug@@XZ ?noquote@QDebug@@QEAAAEAV1@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z call 7ffdf62f3c50 ??6QDebug@@QEAAAEAV0@D@Z ??0QDebugStateSaver@@QEAA@AEAVQDebug@@@Z ?noquote@QDebug@@QEAAAEAV1@XZ ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@D@Z ??1QString@@QEAA@XZ ??1QDebugStateSaver@@QEAA@XZ ??1QDebug@@QEAA@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@J@Z ??1QDebug@@QEAA@XZ * 3 523->528 529 7ffdf62f7210-7ffdf62f7227 SelectObject DeleteObject 523->529 532 7ffdf62f6dd9-7ffdf62f6de9 524->532 533 7ffdf62f6dff-7ffdf62f6e02 524->533 526->514 527->515 527->526 535 7ffdf62f720a ??1QString@@QEAA@XZ 528->535 529->509 532->533 543 7ffdf62f6deb-7ffdf62f6dfb 532->543 536 7ffdf62f6e18 533->536 537 7ffdf62f6e04-7ffdf62f6e16 call 7ffdf62fc7b0 533->537 535->529 538 7ffdf62f6e1b-7ffdf62f6e2b call 7ffdf62fa1d0 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 536->538 537->536 537->538 545 7ffdf62f6f54-7ffdf62f6f57 538->545 546 7ffdf62f6e31-7ffdf62f6f4e call 7ffdf62fa1d0 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??6QDebug@@QEAAAEAV0@N@Z ??6QDebug@@QEAAAEAV0@PEBD@Z * 2 ?qt_QMetaEnum_debugOperator@@YA?AVQDebug@@AEAV1@HPEBUQMetaObject@@PEBD@Z ??1QDebug@@QEAA@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@_N@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@PEBD@Z * 2 ??6QDebug@@QEAAAEAV0@_N@Z ??1QDebug@@QEAA@XZ * 2 538->546 543->533 549 7ffdf62f7045-7ffdf62f7055 545->549 550 7ffdf62f6f5d-7ffdf62f7008 call 7ffdf6380e9c call 7ffdf6303dd0 GetTextFaceW ??0QByteArray@@QEAA@AEBV0@@Z * 2 call 7ffdf62b9510 ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z ??4QUrl@@QEAAAEAV0@$$QEAV0@@Z ??1QString@@QEAA@XZ 545->550 546->545 549->529 559 7ffdf62f700a 550->559 560 7ffdf62f7015-7ffdf62f7040 call 7ffdf63061c0 call 7ffdf62b1d70 ??1QString@@QEAA@XZ 550->560 559->560 560->535
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$String@@$Object$Array@@ByteV0@@$Logger@@MessageSelect$?fromArray@CharDebugErrnoString@@@Warning@@$?length@?noquote@CreateDeleteFontIndirectMetaSaver@@StateTextV0@_$??8@?debug@?qt_?qt_error_string@@?starts?utf16@?warning@Bit@CaseCategory@@Debug@@@Empty@Enabled@Enum_debugFaceH00@Latin1Local8LoggingMetricsObject@@Operator@@Qt@@@Sensitivity@String@@0@Url@@V0@$$With@memmovememset
                                            • String ID: dpi=$", lfWidth=$%s: CreateFontIndirect failed$%s: GetTextMetrics failed$) for $, lfHeight=$DirectWrite: CreateFontFaceFromHDC() failed ($HintingPreference$LOGFONT("$MingLiU$QWindowsFontDatabase::createEngine$color=$dpi$hintingPreference=$useDirectWrite=
                                            • API String ID: 3429225515-4042161376
                                            • Opcode ID: dcc417a218691e34dadace363d8066e011207729225f42727b1cbd70fcc039a8
                                            • Instruction ID: 0589f725e9b7bcfe40d59fa0ad90f2cd2ccf7fadb0dec66a7266eece7c732aa5
                                            • Opcode Fuzzy Hash: dcc417a218691e34dadace363d8066e011207729225f42727b1cbd70fcc039a8
                                            • Instruction Fuzzy Hash: 68326F22B08A4286EB10AF75E8649E963B4FF84B84F558131DA5E43FADEF3CD549C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66EFE40 Relevance: 140.6, APIs: 69, Strings: 11, Instructions: 557threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 565 7ffdf66efe40-7ffdf66f0b43 call 7ffdf6759290 ??0QDaemonThread@@QEAA@PEAVQObject@@@Z call 7ffdf66ee5b0 ?setObjectName@QObject@@QEAAXAEBVQString@@@Z ??1QString@@QEAA@XZ ?mainThread@QCoreApplicationPrivate@@SAPEAVQThread@@XZ ?moveToThread@QObject@@QEAAXPEAVQThread@@@Z * 2 ?start@QThread@@QEAAXW4Priority@1@@Z 571 7ffdf66f0b45-7ffdf66f0b4b ?lock@QMutex@@QEAAXXZ 565->571 572 7ffdf66f0b50-7ffdf66f0b6f 565->572 571->572 573 7ffdf66f0b75-7ffdf66f0b91 ?sender@QObject@@IEBAPEAV1@XZ ?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z 572->573 574 7ffdf66f1081-7ffdf66f10a4 ?sender@QObject@@IEBAPEAV1@XZ ?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z 572->574 577 7ffdf66f1389-7ffdf66f13b2 ?unlock@QMutexLocker@@QEAAXXZ 573->577 578 7ffdf66f0b97-7ffdf66f0bf5 ?qEnvironmentVariableIntValue@@YAHPEBDPEA_N@Z ?keyMap@QFactoryLoader@@QEBA?AV?$QMultiMap@HVQString@@@@XZ 573->578 575 7ffdf66f10a6-7ffdf66f10b2 574->575 576 7ffdf66f10bd-7ffdf66f10c2 574->576 575->576 579 7ffdf66f10b4-7ffdf66f10b8 call 7ffdf66f07a0 575->579 580 7ffdf66f10db-7ffdf66f10de 576->580 581 7ffdf66f10c4-7ffdf66f10cc 576->581 582 7ffdf66f0bf7-7ffdf66f0bfb 578->582 583 7ffdf66f0bfd 578->583 579->576 587 7ffdf66f1109-7ffdf66f110e 580->587 588 7ffdf66f10e0-7ffdf66f10e8 580->588 581->580 586 7ffdf66f10ce-7ffdf66f10d6 call 7ffdf6757450 581->586 584 7ffdf66f0c00-7ffdf66f0c03 582->584 583->584 589 7ffdf66f0c09 584->589 590 7ffdf66f0f9d-7ffdf66f0fb0 584->590 586->580 587->577 591 7ffdf66f1114-7ffdf66f1126 587->591 588->587 593 7ffdf66f10ea-7ffdf66f10ff call 7ffdf66f07a0 588->593 594 7ffdf66f0c10-7ffdf66f0c29 ?QStringList_contains@QtPrivate@@YA_NPEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@@Z 589->594 598 7ffdf66f0fca-7ffdf66f0fec 590->598 599 7ffdf66f0fb2-7ffdf66f0fb5 590->599 595 7ffdf66f1138-7ffdf66f1174 ?detach@QListData@@QEAAPEAUData@1@H@Z ?begin@QListData@@QEBAPEAPEAXXZ ?end@QListData@@QEBAPEAPEAXXZ ?begin@QListData@@QEBAPEAPEAXXZ 591->595 596 7ffdf66f1128-7ffdf66f112b 591->596 593->587 619 7ffdf66f1101-7ffdf66f1104 call 7ffdf66f0990 593->619 604 7ffdf66f0f53-7ffdf66f0f62 ?nextNode@QMapNodeBase@@QEBAPEBU1@XZ 594->604 605 7ffdf66f0c2f-7ffdf66f0c3b 594->605 606 7ffdf66f1195-7ffdf66f11d0 ?unlock@QMutexLocker@@QEAAXXZ ?begin@QListData@@QEBAPEAPEAXXZ ?end@QListData@@QEBAPEAPEAXXZ 595->606 608 7ffdf66f1176-7ffdf66f1180 595->608 596->606 607 7ffdf66f112d-7ffdf66f1136 596->607 602 7ffdf66f1002-7ffdf66f1005 ?dispose@QListData@@SAXPEAUData@1@@Z 598->602 603 7ffdf66f0fee 598->603 600 7ffdf66f100b-7ffdf66f1014 599->600 601 7ffdf66f0fb7-7ffdf66f0fc8 599->601 614 7ffdf66f102c-7ffdf66f1038 600->614 615 7ffdf66f1016-7ffdf66f1019 600->615 601->598 601->600 602->600 610 7ffdf66f0ff0-7ffdf66f1000 ??1QString@@QEAA@XZ 603->610 604->594 611 7ffdf66f0f68-7ffdf66f0f6f 604->611 612 7ffdf66f0daa-7ffdf66f0dc8 ??0QByteArray@@QEAA@AEBV0@@Z ?append@QListData@@QEAAPEAPEAXXZ 605->612 613 7ffdf66f0c41-7ffdf66f0ca4 ?begin@QListData@@QEBAPEAPEAXXZ ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z ?begin@QListData@@QEBAPEAPEAXXZ * 2 605->613 617 7ffdf66f11d6 606->617 618 7ffdf66f135e-7ffdf66f1367 606->618 607->606 608->606 616 7ffdf66f1182-7ffdf66f1190 memcpy 608->616 610->602 610->610 622 7ffdf66f0f9a 611->622 623 7ffdf66f0f71-7ffdf66f0f78 611->623 621 7ffdf66f0dcb-7ffdf66f0dda ?indexOf@QFactoryLoader@@QEBAHAEBVQString@@@Z 612->621 624 7ffdf66f0cca-7ffdf66f0d03 ?end@QListData@@QEBAPEAPEAXXZ ?begin@QListData@@QEBAPEAPEAXXZ 613->624 625 7ffdf66f0ca6-7ffdf66f0ca9 613->625 628 7ffdf66f103a-7ffdf66f104b ??1QString@@QEAA@XZ 614->628 629 7ffdf66f1073-7ffdf66f1076 ?freeData@QMapDataBase@@SAXPEAU1@@Z 614->629 626 7ffdf66f101b-7ffdf66f102a 615->626 627 7ffdf66f107c 615->627 616->606 630 7ffdf66f11e0-7ffdf66f1358 ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z * 10 ?invokeMethod@QMetaObject@@SA_NPEAVQObject@@PEBDW4ConnectionType@Qt@@VQGenericArgument@@333333333@Z 617->630 631 7ffdf66f1369-7ffdf66f136c 618->631 632 7ffdf66f137e-7ffdf66f1383 ?dispose@QListData@@SAXPEAUData@1@@Z 618->632 619->587 633 7ffdf66f0ddc-7ffdf66f0dfa ?instance@QFactoryLoader@@QEBAPEAVQObject@@H@Z ?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z 621->633 634 7ffdf66f0e11 621->634 622->590 638 7ffdf66f0f7a-7ffdf66f0f81 623->638 639 7ffdf66f0f8d-7ffdf66f0f95 call 7ffdf66eed60 623->639 641 7ffdf66f0d29-7ffdf66f0d2e 624->641 642 7ffdf66f0d05 624->642 640 7ffdf66f0cb0-7ffdf66f0cc4 ??0QByteArray@@QEAA@AEBV0@@Z 625->640 626->614 626->627 627->574 635 7ffdf66f1052-7ffdf66f1059 628->635 636 7ffdf66f104d call 7ffdf66efb20 628->636 629->627 630->618 630->630 631->577 637 7ffdf66f136e-7ffdf66f137c 631->637 632->577 633->634 643 7ffdf66f0dfc-7ffdf66f0e02 633->643 646 7ffdf66f0e13-7ffdf66f0e1a 634->646 650 7ffdf66f105b call 7ffdf66efb20 635->650 651 7ffdf66f1060-7ffdf66f106d ?freeTree@QMapDataBase@@QEAAXPEAUQMapNodeBase@@H@Z 635->651 636->635 637->577 637->632 638->639 644 7ffdf66f0f83-7ffdf66f0f8b 638->644 639->622 640->640 645 7ffdf66f0cc6 640->645 652 7ffdf66f0d42-7ffdf66f0d5d 641->652 653 7ffdf66f0d30-7ffdf66f0d33 641->653 648 7ffdf66f0d10-7ffdf66f0d27 ??0QByteArray@@QEAA@AEBV0@@Z 642->648 662 7ffdf66f0e09-7ffdf66f0e0f 643->662 644->622 645->624 656 7ffdf66f0e20-7ffdf66f0e2a 646->656 657 7ffdf66f0f4e 646->657 648->641 648->648 650->651 651->629 654 7ffdf66f0d72-7ffdf66f0d75 ?dispose@QListData@@SAXPEAUData@1@@Z 652->654 655 7ffdf66f0d5f 652->655 659 7ffdf66f0d7b-7ffdf66f0da8 ?begin@QListData@@QEBAPEAPEAXXZ ??0QByteArray@@QEAA@AEBV0@@Z 653->659 660 7ffdf66f0d35-7ffdf66f0d40 653->660 654->659 661 7ffdf66f0d60-7ffdf66f0d70 ??1QString@@QEAA@XZ 655->661 664 7ffdf66f0e30-7ffdf66f0e37 656->664 657->604 659->621 660->652 660->659 661->654 661->661 662->634 662->646 664->664 665 7ffdf66f0e39-7ffdf66f0e58 ??8QString@@QEBA_NVQLatin1String@@@Z 664->665 666 7ffdf66f0e5a-7ffdf66f0e5e 665->666 667 7ffdf66f0e60-7ffdf66f0e68 call 7ffdf66eed60 665->667 668 7ffdf66f0e6d-7ffdf66f0f48 ?moveToThread@QObject@@QEAAXPEAVQThread@@@Z ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z ??1Connection@QMetaObject@@QEAA@XZ 666->668 667->668 668->657
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Data@@List$Meta$Generic$Argument@@Return$?begin@Connection@$ByteString@@$Array@@ConnectionQt@@@Type@$?connect@Base@@Thread@V0@@$?cast@?dispose@?end@?moveDataData@1@@FactoryLoader@@String@@@Thread@@Thread@@@V2@@$?free?sender@?unlock@Data@1@Locker@@Map@MutexNodePrivate@@String$?append@?detach@?detach_grow@?index?instance@?invoke?key?lock@?main?next?set?start@ApplicationArgument@@333333333@ArrayCaseCoreDaemonData@EnvironmentLatin1List@@List_contains@Method@MultiMutex@@Name@Node@ObjectObject@@@Priority@1@@Ptr@@@Qt@@Sensitivity@String@@@@Tree@U1@@Value@@Variablemallocmemcpy
                                            • String ID: 1configurationAdded(QNetworkConfigurationPrivatePointer)$1configurationChanged(QNetworkConfigurationPrivatePointer)$1configurationRemoved(QNetworkConfigurationPrivatePointer)$1updateConfigurations()$2configurationAdded(QNetworkConfigurationPrivatePointer)$2configurationChanged(QNetworkConfigurationPrivatePointer)$2configurationRemoved(QNetworkConfigurationPrivatePointer)$2updateCompleted()$QT_EXCLUDE_GENERIC_BEARER$generic$initialize
                                            • API String ID: 2893259685-3116662586
                                            • Opcode ID: e5b3ccdbb102bd0099cbdfc0bb5653ac2f42c5fd28705bc2e53c26da7d95626b
                                            • Instruction ID: 80ea41c98e2ff066a256d588d26772d902d477744d4c36bf0c90d97ec87ca3c4
                                            • Opcode Fuzzy Hash: e5b3ccdbb102bd0099cbdfc0bb5653ac2f42c5fd28705bc2e53c26da7d95626b
                                            • Instruction Fuzzy Hash: DD526232B08A8695EB108F25E8746B97368FF44B94F444171DA1E07EE8EF3CD986C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629CDA0 Relevance: 122.8, APIs: 61, Strings: 9, Instructions: 337windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 670 7ffdf629cda0-7ffdf629cdcf ?type@QWindow@@QEBA?AW4WindowType@Qt@@XZ 671 7ffdf629cdd5-7ffdf629ce10 call 7ffdf6380e9c ??0QPlatformWindow@@QEAA@PEAVQWindow@@@Z GetDesktopWindow call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 670->671 672 7ffdf629cf24-7ffdf629cfc9 ?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@@XZ ?geometry@QWindow@@QEBA?AVQRect@@XZ ?scaleAndOrigin@QHighDpiScaling@@SA?AUScaleAndOrigin@1@PEBVQWindow@@PEAVQPoint@@@Z call 7ffdf6297e90 ?property@QObject@@QEBA?AVQVariant@@PEBD@Z 670->672 684 7ffdf629ce16-7ffdf629cf1f call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z * 2 ??6QDebug@@QEAAAEAV0@_K@Z ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z * 2 ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??1QDebug@@QEAA@XZ * 3 671->684 685 7ffdf629d35b-7ffdf629d375 671->685 677 7ffdf629d019-7ffdf629d0a1 ?title@QWindow@@QEBA?AVQString@@XZ call 7ffdf62945b0 call 7ffdf6293430 ??1QString@@QEAA@XZ * 2 call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 672->677 678 7ffdf629cfcb-7ffdf629cfe4 call 7ffdf629df50 ?userType@QVariant@@QEBAHXZ 672->678 699 7ffdf629d0a7-7ffdf629d2f6 call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@D@Z ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z call 7ffdf62977d0 ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@_N@Z ??6QDebug@@QEAAAEAV0@D@Z ?qt_QMetaEnum_flagDebugOperator@@YA?AVQDebug@@AEAV1@_KPEBUQMetaObject@@PEBD@Z ??1QDebug@@QEAA@XZ * 2 ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQMargins@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@PEBX@Z ??6QDebug@@QEAAAEAV0@D@Z ?qt_QMetaEnum_flagDebugOperator@@YA?AVQDebug@@AEAV1@_KPEBUQMetaObject@@PEBD@Z ??1QDebug@@QEAA@XZ * 2 ??6QDebug@@QEAAAEAV0@D@Z ??1QDebug@@QEAA@XZ * 7 677->699 700 7ffdf629d2fc-7ffdf629d300 677->700 688 7ffdf629cfe6-7ffdf629cfef ?constData@QVariant@@QEBAPEBXXZ 678->688 689 7ffdf629cff1-7ffdf629d009 ?convert@QVariant@@QEBA_NHPEAX@Z 678->689 684->685 692 7ffdf629d015 688->692 693 7ffdf629d00b-7ffdf629d010 689->693 694 7ffdf629d012 689->694 692->677 693->692 694->692 699->700 703 7ffdf629d350-7ffdf629d355 ??1QVariant@@QEAA@XZ 700->703 704 7ffdf629d302-7ffdf629d30f call 7ffdf6291780 700->704 703->685 707 7ffdf629d315-7ffdf629d323 ?isTopLevel@QWindow@@QEBA_NXZ 704->707 709 7ffdf629d325-7ffdf629d32f call 7ffdf62a2590 707->709 710 7ffdf629d338-7ffdf629d343 call 7ffdf62c6190 707->710 709->710 715 7ffdf629d331 709->715 710->703 716 7ffdf629d345-7ffdf629d34b call 7ffdf62c6100 710->716 715->710 716->703
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Window@@$Logger@@MessageStream@@TextV1@@$Category@@LoggingString@@Type@Variant@@Window$??6@?debug@DebugEnabled@H00@Window@@@$?const?flags@?geometry@?property@?scale?title@?type@?userData@DesktopFlags@HighInit_thread_footerObject@@Origin@Origin@1@PlatformPoint@@@Qt@@Qt@@@@Rect@@Rect@@@ScaleScaling@@V0@_malloc
                                            • String ID: Obtained : $ Requested: $ frame incl.=$ handle=$ margins=$Desktop window:$QWindowsIntegration::createPlatformWindow$WindowType$_q_windowsCustomMargins
                                            • API String ID: 3378367475-792223184
                                            • Opcode ID: 964648a10685d754689c75a22564bc0b0829a1da5981d5f4793b8a769884a764
                                            • Instruction ID: df9fe5f31c973befe8baee02f5b8822ab7d1ab27374c5c0202fb1f26fe2eede1
                                            • Opcode Fuzzy Hash: 964648a10685d754689c75a22564bc0b0829a1da5981d5f4793b8a769884a764
                                            • Instruction Fuzzy Hash: 94024E32B08B4686EB10AF64E8645E873B4FB94B95F458131DA5E43FA9EF3CD549C340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67083E0 Relevance: 98.5, APIs: 54, Strings: 2, Instructions: 524COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 788 7ffdf67083e0-7ffdf6708448 call 7ffdf67591d1 791 7ffdf670844e-7ffdf6708463 malloc 788->791 792 7ffdf6708511-7ffdf6708513 788->792 793 7ffdf67084af-7ffdf67084cc GetAdaptersAddresses 791->793 794 7ffdf6708465-7ffdf670847d 791->794 795 7ffdf6708552-7ffdf6708570 792->795 796 7ffdf6708515-7ffdf670852d 792->796 793->795 801 7ffdf67084d2-7ffdf67084f3 free 793->801 799 7ffdf670849f-7ffdf67084aa ?dispose@QListData@@SAXPEAUData@1@@Z 794->799 800 7ffdf670847f-7ffdf6708482 794->800 797 7ffdf6708576-7ffdf6708589 795->797 798 7ffdf6708c3b-7ffdf6708c4a 795->798 796->799 802 7ffdf6708533-7ffdf6708536 796->802 805 7ffdf6708591-7ffdf67085fc call 7ffdf6759290 ??0QSharedData@@QEAA@XZ ??0QString@@QEAA@XZ * 3 797->805 806 7ffdf6708c55-7ffdf6708c6d 798->806 807 7ffdf6708c4c-7ffdf6708c4f free 798->807 803 7ffdf6708c97-7ffdf6708cb4 call 7ffdf6759aa0 799->803 800->803 808 7ffdf6708488-7ffdf6708497 800->808 801->799 809 7ffdf67084f5-7ffdf67084f8 801->809 802->803 804 7ffdf670853c-7ffdf670854d 802->804 810 7ffdf6708499 804->810 820 7ffdf67086ff-7ffdf6708705 ?append@QListData@@QEAAPEAPEAXXZ 805->820 821 7ffdf6708602-7ffdf670864e ?begin@QListData@@QEBAPEAPEAXXZ ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z ?begin@QListData@@QEBAPEAPEAXXZ * 2 805->821 812 7ffdf6708c6f-7ffdf6708c72 806->812 813 7ffdf6708c84-7ffdf6708c89 ?dispose@QListData@@SAXPEAUData@1@@Z 806->813 807->806 808->810 809->803 815 7ffdf67084fe-7ffdf670850f 809->815 810->799 810->803 817 7ffdf6708c8f 812->817 818 7ffdf6708c74-7ffdf6708c82 812->818 813->817 815->810 817->803 818->813 818->817 822 7ffdf6708708-7ffdf6708711 820->822 823 7ffdf670866f-7ffdf67086a0 ?end@QListData@@QEBAPEAPEAXXZ ?begin@QListData@@QEBAPEAPEAXXZ 821->823 824 7ffdf6708650-7ffdf670865a 821->824 825 7ffdf670871e-7ffdf6708741 822->825 826 7ffdf6708713-7ffdf670871b 822->826 828 7ffdf67086be-7ffdf67086c2 823->828 829 7ffdf67086a2-7ffdf67086ac 823->829 824->823 827 7ffdf670865c-7ffdf670866a memcpy 824->827 830 7ffdf6708743 825->830 831 7ffdf6708747-7ffdf670874b 825->831 826->825 827->823 833 7ffdf67086c4-7ffdf67086c7 828->833 834 7ffdf67086d5-7ffdf67086d8 ?dispose@QListData@@SAXPEAUData@1@@Z 828->834 829->828 832 7ffdf67086ae-7ffdf67086b9 memcpy 829->832 830->831 836 7ffdf670874d 831->836 837 7ffdf6708751-7ffdf6708755 831->837 832->828 835 7ffdf67086de-7ffdf67086fd ?begin@QListData@@QEBAPEAPEAXXZ 833->835 838 7ffdf67086c9-7ffdf67086d3 833->838 834->835 835->822 836->837 839 7ffdf6708757 837->839 840 7ffdf670875b-7ffdf6708766 837->840 838->834 838->835 839->840 841 7ffdf67087d6-7ffdf67087f1 ConvertInterfaceLuidToNameW 840->841 842 7ffdf6708768-7ffdf670877e 840->842 843 7ffdf670881e-7ffdf670882a ?isEmpty@QString@@QEBA_NXZ 841->843 844 7ffdf67087f3-7ffdf6708818 ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z ??4QDateTime@@QEAAAEAV0@$$QEAV0@@Z ??1QString@@QEAA@XZ 841->844 842->841 845 7ffdf6708854-7ffdf6708881 ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z ??4QDateTime@@QEAAAEAV0@$$QEAV0@@Z ??1QString@@QEAA@XZ 843->845 846 7ffdf670882c-7ffdf670884e ?fromLocal8Bit@QString@@SA?AV1@PEBDH@Z ??4QDateTime@@QEAAAEAV0@$$QEAV0@@Z ??1QString@@QEAA@XZ 843->846 844->843 847 7ffdf6708883-7ffdf67088a1 call 7ffdf66ffec0 ??4QDateTime@@QEAAAEAV0@$$QEAV0@@Z ??1QString@@QEAA@XZ 845->847 848 7ffdf67088a7-7ffdf67088ae 845->848 846->845 847->848 850 7ffdf67088b4-7ffdf67088b9 848->850 851 7ffdf6708c08-7ffdf6708c14 848->851 854 7ffdf67088bf-7ffdf67088da call 7ffdf66fe120 call 7ffdf66f7970 850->854 855 7ffdf6708bf3-7ffdf6708bfa 850->855 851->805 852 7ffdf6708c1a-7ffdf6708c33 851->852 852->798 861 7ffdf67089bd-7ffdf6708a0f call 7ffdf6692c00 call 7ffdf66f79d0 call 7ffdf6700420 call 7ffdf66f79d0 call 7ffdf67004b0 854->861 862 7ffdf67088e0-7ffdf67088e7 854->862 855->850 857 7ffdf6708c00-7ffdf6708c05 855->857 857->851 889 7ffdf6708a11-7ffdf6708a19 ??0QDeadlineTimer@@QEAA@W4ForeverConstant@0@W4TimerType@Qt@@@Z 861->889 890 7ffdf6708a1b-7ffdf6708a21 ??0QDeadlineTimer@@QEAA@_JW4TimerType@Qt@@@Z 861->890 863 7ffdf6708903-7ffdf6708907 862->863 864 7ffdf67088e9-7ffdf67088fe htonl call 7ffdf66f92e0 862->864 867 7ffdf670890d-7ffdf6708920 call 7ffdf66f9340 863->867 868 7ffdf6708995-7ffdf67089b7 ??0QMessageLogger@@QEAA@PEBDH0@Z ?warning@QMessageLogger@@QEBAXPEBDZZ 863->868 864->861 867->861 876 7ffdf6708926-7ffdf670892c call 7ffdf67591e9 867->876 868->861 880 7ffdf6708931-7ffdf6708933 876->880 882 7ffdf6708935-7ffdf670894d ConvertInterfaceLuidToNameW 880->882 883 7ffdf6708966-7ffdf6708973 ?number@QString@@SA?AV1@IH@Z 880->883 882->883 885 7ffdf670894f-7ffdf6708964 ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z 882->885 886 7ffdf6708979-7ffdf6708993 call 7ffdf66f96c0 ??1QString@@QEAA@XZ 883->886 885->886 886->861 892 7ffdf6708a27-7ffdf6708a41 889->892 890->892 893 7ffdf6708a4d-7ffdf6708a53 ??0QDeadlineTimer@@QEAA@_JW4TimerType@Qt@@@Z 892->893 894 7ffdf6708a43-7ffdf6708a4b ??0QDeadlineTimer@@QEAA@W4ForeverConstant@0@W4TimerType@Qt@@@Z 892->894 895 7ffdf6708a59-7ffdf6708a98 call 7ffdf67003e0 call 7ffdf6700410 893->895 894->895 900 7ffdf6708a9e-7ffdf6708aea ?begin@QListData@@QEBAPEAPEAXXZ ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z ?begin@QListData@@QEBAPEAPEAXXZ * 2 895->900 901 7ffdf6708bcb-7ffdf6708be6 call 7ffdf66fe0a0 ?append@QListData@@QEAAPEAPEAXXZ 895->901 902 7ffdf6708b07-7ffdf6708b34 ?end@QListData@@QEBAPEAPEAXXZ ?begin@QListData@@QEBAPEAPEAXXZ 900->902 903 7ffdf6708aec-7ffdf6708aef 900->903 911 7ffdf6708be9-7ffdf6708bee call 7ffdf66fe1a0 901->911 906 7ffdf6708b36 902->906 907 7ffdf6708b58-7ffdf6708b5c 902->907 905 7ffdf6708af2-7ffdf6708b05 call 7ffdf66fe0a0 903->905 905->902 910 7ffdf6708b40-7ffdf6708b56 call 7ffdf66fe0a0 906->910 912 7ffdf6708b5e-7ffdf6708b63 907->912 913 7ffdf6708b70-7ffdf6708b8b 907->913 910->907 911->855 919 7ffdf6708bad-7ffdf6708bc9 ?begin@QListData@@QEBAPEAPEAXXZ call 7ffdf66fe0a0 912->919 920 7ffdf6708b65-7ffdf6708b6e 912->920 914 7ffdf6708b8d 913->914 915 7ffdf6708ba1-7ffdf6708baa ?dispose@QListData@@SAXPEAUData@1@@Z 913->915 921 7ffdf6708b90-7ffdf6708b9f call 7ffdf66fe1a0 914->921 915->919 919->911 920->913 920->919 921->915
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@$List$?begin@$String@@$?dispose@Data@1@@memcpy$?append@?detach_grow@?end@AdaptersAddressesData@1@Sharedfreemalloc
                                            • String ID: $Got unknown socket family %d
                                            • API String ID: 3909885361-1948063521
                                            • Opcode ID: cc49d97b066f84b7a56e5b31922028aa9d1808e669f827b588908a4d531b1ee0
                                            • Instruction ID: 46364dcdb1d734419aede4ed89829d702369eb8548f04e3f2a6cbd6420d5b81b
                                            • Opcode Fuzzy Hash: cc49d97b066f84b7a56e5b31922028aa9d1808e669f827b588908a4d531b1ee0
                                            • Instruction Fuzzy Hash: 10427032B19A8296EB509F25E870AB97368FB84B54F444235DA6E47EDCEF3CD845C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A1C30 Relevance: 94.8, APIs: 44, Strings: 10, Instructions: 276windowregistryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 927 7ffdf62a1c30-7ffdf62a1c9a GetModuleHandleW 928 7ffdf62a1cd7-7ffdf62a1cd9 927->928 929 7ffdf62a1c9c-7ffdf62a1cb7 ?utf16@QString@@QEBAPEBGXZ GetClassInfoW 927->929 932 7ffdf62a1d0a-7ffdf62a1d19 928->932 933 7ffdf62a1cdb-7ffdf62a1d04 ?createUuid@QUuid@@SA?AV1@XZ ?toString@QUuid@@QEBA?AVQString@@XZ ?append@QString@@QEAAAEAV1@AEBV1@@Z ??1QString@@QEAA@XZ 928->933 930 7ffdf62a1cb9-7ffdf62a1cbd 929->930 931 7ffdf62a1ccb-7ffdf62a1cd5 929->931 930->931 934 7ffdf62a1cbf-7ffdf62a1cc9 930->934 931->932 935 7ffdf62a1d2a-7ffdf62a1d3d call 7ffdf62a0000 932->935 936 7ffdf62a1d1b-7ffdf62a1d27 ?qHash@@YAIAEBVQString@@I@Z 932->936 933->932 934->933 939 7ffdf62a206e-7ffdf62a20a5 ??0QByteArray@@QEAA@$$QEAV0@@Z ??1QString@@QEAA@XZ call 7ffdf6381690 935->939 940 7ffdf62a1d43-7ffdf62a1d74 935->940 936->935 941 7ffdf62a1e0a 940->941 942 7ffdf62a1d7a-7ffdf62a1da5 LoadImageW 940->942 946 7ffdf62a1e0e 941->946 944 7ffdf62a1da7-7ffdf62a1de1 GetSystemMetrics * 2 LoadImageW 942->944 945 7ffdf62a1de3-7ffdf62a1e08 LoadImageW 942->945 948 7ffdf62a1e12-7ffdf62a1e35 ?utf16@QString@@QEBAPEBGXZ RegisterClassExW 944->948 945->946 946->948 949 7ffdf62a1e37-7ffdf62a1e63 ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ ??BQByteArray@@QEBAPEBDXZ ?qErrnoWarning@@YAXPEBDZZ ??1QByteArray@@QEAA@XZ 948->949 950 7ffdf62a1e69-7ffdf62a1e77 948->950 949->950 951 7ffdf62a1e79-7ffdf62a1eab ?detach_helper@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH@Z 950->951 952 7ffdf62a1ed4-7ffdf62a1f00 ?qHash@@YAIAEBVQString@@I@Z call 7ffdf62a0000 950->952 953 7ffdf62a1ead-7ffdf62a1eb0 951->953 954 7ffdf62a1ebf-7ffdf62a1eca ?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z@Z 951->954 959 7ffdf62a1f5b-7ffdf62a1f6b call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 952->959 960 7ffdf62a1f02-7ffdf62a1f08 952->960 957 7ffdf62a1ed0 953->957 958 7ffdf62a1eb2-7ffdf62a1ebd 953->958 954->957 957->952 958->954 958->957 959->939 967 7ffdf62a1f71-7ffdf62a2068 call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z ??6QDebug@@QEAAAEAV0@K@Z ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@PEBX@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@_N@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@G@Z ??1QDebug@@QEAA@XZ 959->967 961 7ffdf62a1f28-7ffdf62a1f58 ?allocateNode@QHashData@@QEAAPEAXH@Z ??0QByteArray@@QEAA@AEBV0@@Z 960->961 962 7ffdf62a1f0a-7ffdf62a1f25 ?rehash@QHashData@@QEAAXH@Z call 7ffdf62a0000 960->962 961->959 962->961 967->939
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$String@@$Array@@Byte$Data@@Hash$ImageLoadV1@@$?utf16@ClassHash@@Logger@@MessageMetricsStream@@SystemTextUuid@@V0@@$?allocate?append@?create?debug@?detach_helper@?free_helper@?rehash@A@$$Bit@Category@@DebugEnabled@ErrnoH00@HandleInfoLocal8LoggingModuleNode@Node@1@Node@1@@RegisterString@String@@@Uuid@V0@_Warning@@
                                            • String ID: atom=$ brush=$ icon=$ style=0x$@$IDI_ICON1$OpenGLDummyWindow$P$QApplication::regClass: Registering window class '%s' failed.$QWindowsContext::registerWindowClass
                                            • API String ID: 2943025083-357600035
                                            • Opcode ID: 6b22b87744d534e83682f18f5c680bb724feed060eb5963be1a8358b573c1f65
                                            • Instruction ID: 7b74749601eedd34955a35f10a4792621d84839cf79b604781234c10e3d88179
                                            • Opcode Fuzzy Hash: 6b22b87744d534e83682f18f5c680bb724feed060eb5963be1a8358b573c1f65
                                            • Instruction Fuzzy Hash: 31D18F36B08B4287EB10AF61E8649A977E9FB84B94F458135DA6E47FA8DF3CD444C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6291780 Relevance: 93.1, APIs: 52, Strings: 1, Instructions: 364windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 970 7ffdf6291780-7ffdf629188b ??0QPlatformWindow@@QEAA@PEAVQWindow@@@Z call 7ffdf6380e9c call 7ffdf62911d0 ?requestedFormat@QWindow@@QEBA?AVQSurfaceFormat@@XZ call 7ffdf62a10d0 call 7ffdf629ee80 ?type@QWindow@@QEBA?AW4WindowType@Qt@@XZ 979 7ffdf6291891-7ffdf62918ba 970->979 980 7ffdf6291d84-7ffdf6291d95 970->980 982 7ffdf62918bc-7ffdf62918c4 ?openGLModuleType@QOpenGLContext@@SA?AW4OpenGLModuleType@1@XZ 979->982 983 7ffdf62918d0-7ffdf62918de 979->983 984 7ffdf62918c6-7ffdf62918ca 982->984 985 7ffdf62918cc 982->985 987 7ffdf62918e7-7ffdf6291943 ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ ?isTopLevel@QWindow@@QEBA_NXZ call 7ffdf629bc10 call 7ffdf6297a60 ?qt_window_private@@YAPEAVQWindowPrivate@@PEAVQWindow@@@Z 983->987 988 7ffdf62918e0 983->988 984->983 985->983 993 7ffdf6291945 987->993 994 7ffdf6291948-7ffdf629194d 987->994 988->987 993->994 995 7ffdf629194f 994->995 996 7ffdf6291952-7ffdf6291962 994->996 995->996 997 7ffdf6291968-7ffdf6291978 call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 996->997 998 7ffdf6291a6e-7ffdf6291ad8 ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ * 2 ?mask@QWindow@@QEBA?AVQRegion@@XZ ?scaleAndOrigin@QHighDpiScaling@@SA?AUScaleAndOrigin@1@PEBVQWindow@@PEAVQPoint@@@Z call 7ffdf6298010 ?isEmpty@QRegion@@QEBA_NXZ 996->998 1003 7ffdf629197a-7ffdf62919c7 call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@N@Z ??1QDebug@@QEAA@XZ 997->1003 1004 7ffdf62919cd-7ffdf62919e4 997->1004 1005 7ffdf6291ada-7ffdf6291aea SetWindowRgn 998->1005 1006 7ffdf6291aef-7ffdf6291b14 ?begin@QRegion@@QEBAPEBVQRect@@XZ ?end@QRegion@@QEBAPEBVQRect@@XZ 998->1006 1003->1004 1008 7ffdf62919e6 1004->1008 1009 7ffdf62919e9-7ffdf62919ee 1004->1009 1010 7ffdf6291c24-7ffdf6291c43 ??1QRegion@@QEAA@XZ * 2 ?isTopLevel@QWindow@@QEBA_NXZ 1005->1010 1011 7ffdf6291b16-7ffdf6291b19 1006->1011 1012 7ffdf6291b1e-7ffdf6291b41 CreateRectRgn 1006->1012 1008->1009 1016 7ffdf62919f0 1009->1016 1017 7ffdf62919f3-7ffdf62919f8 1009->1017 1014 7ffdf6291c49-7ffdf6291c5e ?icon@QWindow@@QEBA?AVQIcon@@XZ 1010->1014 1015 7ffdf6291d40-7ffdf6291d74 ?property@QObject@@QEBA?AVQVariant@@PEBD@Z ?toBool@QVariant@@QEBA_NXZ ??1QVariant@@QEAA@XZ 1010->1015 1018 7ffdf6291bc6-7ffdf6291be2 ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ ?isTopLevel@QWindow@@QEBA_NXZ 1011->1018 1012->1018 1019 7ffdf6291b47-7ffdf6291b4f 1012->1019 1024 7ffdf6291d36-7ffdf6291d3a ??1QIcon@@QEAA@XZ 1014->1024 1025 7ffdf6291c64-7ffdf6291c6e 1014->1025 1022 7ffdf6291d76 1015->1022 1023 7ffdf6291d7d 1015->1023 1016->1017 1026 7ffdf62919fa 1017->1026 1027 7ffdf62919fd-7ffdf6291a0d 1017->1027 1020 7ffdf6291c04-7ffdf6291c19 SetWindowRgn 1018->1020 1021 7ffdf6291be4-7ffdf6291bfe OffsetRgn 1018->1021 1028 7ffdf6291b50-7ffdf6291b6f CreateRectRgn 1019->1028 1020->1010 1029 7ffdf6291c1b-7ffdf6291c1e DeleteObject 1020->1029 1021->1020 1022->1023 1023->980 1024->1015 1030 7ffdf6291c7d-7ffdf6291c87 1025->1030 1031 7ffdf6291c70-7ffdf6291c76 DestroyIcon 1025->1031 1026->1027 1027->998 1034 7ffdf6291a0f-7ffdf6291a1b 1027->1034 1032 7ffdf6291b71-7ffdf6291b9b CreateRectRgn CombineRgn 1028->1032 1033 7ffdf6291bb2-7ffdf6291bb9 1028->1033 1029->1010 1037 7ffdf6291c96-7ffdf6291d04 GetSystemMetrics * 2 call 7ffdf6293c00 GetSystemMetrics * 2 call 7ffdf6293c00 1030->1037 1038 7ffdf6291c89-7ffdf6291c8f DestroyIcon 1030->1038 1031->1030 1039 7ffdf6291ba9-7ffdf6291bac DeleteObject 1032->1039 1040 7ffdf6291b9d-7ffdf6291ba6 DeleteObject 1032->1040 1033->1028 1035 7ffdf6291bbb-7ffdf6291bc3 1033->1035 1034->998 1041 7ffdf6291a1d-7ffdf6291a68 ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ ?hasAlpha@QSurfaceFormat@@QEBA_NXZ call 7ffdf629aa80 ??1QSurfaceFormat@@QEAA@XZ 1034->1041 1035->1018 1049 7ffdf6291d15-7ffdf6291d1b SendMessageW 1037->1049 1050 7ffdf6291d06-7ffdf6291d13 SendMessageW 1037->1050 1038->1037 1039->1033 1040->1039 1041->998 1051 7ffdf6291d22-7ffdf6291d30 SendMessageW 1049->1051 1050->1051 1051->1024
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Window@@$PlatformRegion@@$?window@Message$Debug@@MetricsSystemWindow$CreateDeleteFormat@@Level@ObjectRectSendSurfaceVariant@@$Data@@DestroyHashIconIcon@@Logger@@ModuleOpenRect@@Type@Window@@@$?allocate?begin@?debug@?end@?has?icon@?mask@?open?property@?qt_window_private@@?rehash@?requested?scale?type@Alpha@Bool@Category@@CombineContext@@DebugEmpty@Enabled@Format@H00@HighLoggingNode@Object@@OffsetOrigin@Origin@1@Point@@@Private@@Qt@@ScaleScaling@@Type@1@malloc
                                            • String ID: QWindowsWindow::setOpacity
                                            • API String ID: 4068540682-54840919
                                            • Opcode ID: 81f333a01f4e35ee07e395bb86e53616022adff81194c8bb01ebf6e504be85b6
                                            • Instruction ID: 616c5d3a0e25e4d01458b20ab746c160189813871ba757d3cf159801addeeb6a
                                            • Opcode Fuzzy Hash: 81f333a01f4e35ee07e395bb86e53616022adff81194c8bb01ebf6e504be85b6
                                            • Instruction Fuzzy Hash: E2027222B04B4183EB559F72E464AA973A8FF95B84F448235DE6E53B99DF3CE049D300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A42A0 Relevance: 75.5, APIs: 35, Strings: 8, Instructions: 275windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1171 7ffdf62a42a0-7ffdf62a42f8 call 7ffdf62a26d0 1174 7ffdf62a4308-7ffdf62a4359 call 7ffdf62a2bf0 1171->1174 1175 7ffdf62a42fa-7ffdf62a42fd 1171->1175 1179 7ffdf62a435f-7ffdf62a436f call 7ffdf62a1210 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 1174->1179 1180 7ffdf62a44e3-7ffdf62a44e5 1174->1180 1175->1174 1176 7ffdf62a42ff-7ffdf62a4303 1175->1176 1176->1174 1179->1180 1190 7ffdf62a4375-7ffdf62a4382 call 7ffdf62f3590 1179->1190 1181 7ffdf62a44e7-7ffdf62a44f8 DefWindowProcW 1180->1181 1182 7ffdf62a44fd-7ffdf62a4503 1180->1182 1181->1182 1184 7ffdf62a46da-7ffdf62a470b call 7ffdf6381690 1182->1184 1185 7ffdf62a4509-7ffdf62a451d 1182->1185 1188 7ffdf62a4527-7ffdf62a453d GetWindowLongPtrW 1185->1188 1189 7ffdf62a451f-7ffdf62a4521 1185->1189 1188->1184 1193 7ffdf62a4543-7ffdf62a4559 GetWindowPlacement 1188->1193 1189->1184 1189->1188 1190->1180 1199 7ffdf62a4388-7ffdf62a4398 call 7ffdf62a1210 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 1190->1199 1195 7ffdf62a4565-7ffdf62a4571 1193->1195 1196 7ffdf62a455b-7ffdf62a455f 1193->1196 1197 7ffdf62a457c-7ffdf62a45ab 1195->1197 1198 7ffdf62a4573-7ffdf62a4577 1195->1198 1196->1184 1196->1195 1197->1184 1200 7ffdf62a45b1-7ffdf62a45b9 1197->1200 1198->1197 1199->1180 1206 7ffdf62a439e-7ffdf62a44dd call 7ffdf62a1210 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@PEBX@Z ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@PEBD@Z * 2 ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z ??6QDebug@@QEAAAEAV0@K@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@_N@Z ??1QDebug@@QEAA@XZ 1199->1206 1202 7ffdf62a45bf-7ffdf62a45cf call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 1200->1202 1203 7ffdf62a4672-7ffdf62a468d 1200->1203 1214 7ffdf62a45d5-7ffdf62a465d call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z * 2 ??6QDebug@@QEAAAEAV0@PEBX@Z ??6@YA?AVQDebug@@V0@AEBVQMargins@@@Z ??1QDebug@@QEAA@XZ * 2 1202->1214 1215 7ffdf62a4663-7ffdf62a4670 call 7ffdf6298970 1202->1215 1207 7ffdf62a469f-7ffdf62a46a2 1203->1207 1208 7ffdf62a468f-7ffdf62a469a 1203->1208 1206->1180 1209 7ffdf62a46ad-7ffdf62a46b0 1207->1209 1210 7ffdf62a46a4-7ffdf62a46a9 1207->1210 1208->1207 1209->1184 1213 7ffdf62a46b2-7ffdf62a46bf 1209->1213 1210->1209 1217 7ffdf62a46c7-7ffdf62a46d0 1213->1217 1218 7ffdf62a46c1 1213->1218 1214->1215 1215->1184 1217->1184 1221 7ffdf62a46d2-7ffdf62a46d5 call 7ffdf6380ed8 1217->1221 1218->1217 1221->1184
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Logger@@Message$??6@Category@@DebugEnabled@Logging$?debug@H00@Margins@@@Window$Stream@@TextV1@@Window@@$?window@LongPlacementPlatformProcV0@_Window@@@
                                            • String ID: at $ et=0x$ handled=$ msg=0x$ wp=$EVENT: hwd=$WM_NCCALCSIZE for$qWindowsWndProc
                                            • API String ID: 896697855-1425763513
                                            • Opcode ID: d023754dda9504ddcd42045a43c29bf6450e83424029cf40505417cf15b57675
                                            • Instruction ID: 45b4cd209c731e805f63c9d0446e40e9d23488b7209ce90d0a5b54dda6b80f45
                                            • Opcode Fuzzy Hash: d023754dda9504ddcd42045a43c29bf6450e83424029cf40505417cf15b57675
                                            • Instruction Fuzzy Hash: 34C19122B08B4283EB14AB65E8649B963A8FF84B94F098135DD5D47FADEF7CE444C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D03A580 Relevance: 68.4, APIs: 36, Strings: 3, Instructions: 173windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1225 7ff60d03a580-7ff60d03b9a3 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?locate@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@AEBV2@V?$QFlags@W4LocateOption@QStandardPaths@@@@@Z ??1QString@@QEAA@XZ ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ 1227 7ff60d03b9f8-7ff60d03ba07 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z 1225->1227 1228 7ff60d03b9a5-7ff60d03b9f6 ??0QFile@@QEAA@AEBVQString@@@Z ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ ??0QString@@QEAA@AEBVQByteArray@@@Z ??1QByteArray@@QEAA@XZ ??1QFile@@UEAA@XZ 1225->1228 1229 7ff60d03ba0b-7ff60d03ba1e ??1QString@@QEAA@XZ 1227->1229 1228->1229 1230 7ff60d03ba41-7ff60d03bad9 call 7ff60d039b50 ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z ?locate@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@AEBV2@V?$QFlags@W4LocateOption@QStandardPaths@@@@@Z ??1QString@@QEAA@XZ ??0QMessageLogger@@QEAA@PEBDH0@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ 1229->1230 1231 7ff60d03ba20-7ff60d03ba3c ??0QByteArray@@QEAA@AEBV0@@Z call 7ff60d03b110 1229->1231 1236 7ff60d03badb-7ff60d03bb2c ??0QFile@@QEAA@AEBVQString@@@Z ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ ??0QString@@QEAA@AEBVQByteArray@@@Z ??1QByteArray@@QEAA@XZ ??1QFile@@UEAA@XZ 1230->1236 1237 7ff60d03bb2e-7ff60d03bb3d ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z 1230->1237 1238 7ff60d03bba1 1231->1238 1239 7ff60d03bb41-7ff60d03bb6b ??1QString@@QEAA@XZ ??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z ??1QString@@QEAA@XZ 1236->1239 1237->1239 1240 7ff60d03bba4-7ff60d03bbc5 ??1QString@@QEAA@XZ 1238->1240 1241 7ff60d03bb6d-7ff60d03bb70 call 7ff60d039ad0 1239->1241 1242 7ff60d03bb7f-7ff60d03bb9c ??0QByteArray@@QEAA@AEBV0@@Z call 7ff60d03b630 1239->1242 1245 7ff60d03bb75-7ff60d03bb7d 1241->1245 1242->1238 1245->1240
                                            APIs
                                            • ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60D03B939
                                            • ?locate@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@AEBV2@V?$QFlags@W4LocateOption@QStandardPaths@@@@@Z.QT5CORE ref: 00007FF60D03B952
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03B95D
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF60D03B96F
                                            • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FF60D03B97C
                                            • ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE ref: 00007FF60D03B98A
                                            • ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FF60D03B995
                                            • ??0QFile@@QEAA@AEBVQString@@@Z.QT5CORE ref: 00007FF60D03B9AD
                                            • ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z.QT5CORE ref: 00007FF60D03B9BD
                                            • ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ.QT5CORE ref: 00007FF60D03B9CB
                                            • ??0QString@@QEAA@AEBVQByteArray@@@Z.QT5CORE ref: 00007FF60D03B9DA
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FF60D03B9E5
                                            • ??1QFile@@UEAA@XZ.QT5CORE ref: 00007FF60D03B9F0
                                            • ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60D03BA01
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03BA0F
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03BA28
                                            • ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60D03BA5F
                                            • ?locate@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@AEBV2@V?$QFlags@W4LocateOption@QStandardPaths@@@@@Z.QT5CORE ref: 00007FF60D03BA78
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03BA83
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF60D03BA95
                                            • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FF60D03BAA2
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FF60D03BAB3
                                            • ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE ref: 00007FF60D03BAC0
                                            • ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FF60D03BACB
                                            • ??0QFile@@QEAA@AEBVQString@@@Z.QT5CORE ref: 00007FF60D03BAE3
                                            • ?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z.QT5CORE ref: 00007FF60D03BAF3
                                            • ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ.QT5CORE ref: 00007FF60D03BB01
                                            • ??0QString@@QEAA@AEBVQByteArray@@@Z.QT5CORE ref: 00007FF60D03BB10
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FF60D03BB1B
                                            • ??1QFile@@UEAA@XZ.QT5CORE ref: 00007FF60D03BB26
                                            • ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60D03BB37
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03BB45
                                            • ??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z.QT5CORE ref: 00007FF60D03BB53
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03BB5D
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03BB8D
                                              • Part of subcall function 00007FF60D03B630: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008,?), ref: 00007FF60D03B65C
                                              • Part of subcall function 00007FF60D03B630: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008,?), ref: 00007FF60D03B669
                                              • Part of subcall function 00007FF60D03B630: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008,?), ref: 00007FF60D03B67A
                                              • Part of subcall function 00007FF60D03B630: ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008,?), ref: 00007FF60D03B686
                                              • Part of subcall function 00007FF60D03B630: ??1QDebug@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008,?), ref: 00007FF60D03B691
                                              • Part of subcall function 00007FF60D03B630: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008,?), ref: 00007FF60D03B6B9
                                              • Part of subcall function 00007FF60D03B630: ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008,?), ref: 00007FF60D03B6E4
                                              • Part of subcall function 00007FF60D03B630: ?split@QString@@QEBA?AVQStringList@@AEBV1@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FF60D03B704
                                              • Part of subcall function 00007FF60D03B630: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03B70F
                                              • Part of subcall function 00007FF60D03B630: ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60D03B744
                                              • Part of subcall function 00007FF60D03B630: ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60D03B75A
                                              • Part of subcall function 00007FF60D03B630: ?fromString@QDate@@SA?AV1@AEBVQString@@0@Z.QT5CORE ref: 00007FF60D03B770
                                              • Part of subcall function 00007FF60D03B630: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03B786
                                              • Part of subcall function 00007FF60D03B630: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03B7F4
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03BBA8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Debug@@$Byte$?fromArray@@$ArrayAscii_helper@Data@Typed$File@@Logger@@MessageStandard$String@@@$Flags@V0@@$?debug@$?locate@?open@?readAll@Array@@@Device@@Device@@@@@Flag@LocateLocation@1@ModeOpenOption@Paths@@Paths@@@@@$?split@Behavior@1@CaseDate@@List@@Qt@@@Sensitivity@SplitStringString@String@@0@V0@$$
                                            • String ID: pro/key.crt$trial fname$trial/key.crt
                                            • API String ID: 1298016467-1044991157
                                            • Opcode ID: ba78630fabff5619e3917c4de20d7081482441342b2ace8bc664fe7725655c30
                                            • Instruction ID: fa198768aee11da18afae5f3e06484f07d91639f423f6cf4548328a5c4a02478
                                            • Opcode Fuzzy Hash: ba78630fabff5619e3917c4de20d7081482441342b2ace8bc664fe7725655c30
                                            • Instruction Fuzzy Hash: 04812D32B08A42DAEB00DF64E8546EC3371FB95749FA05132CA4F96AA8EF7CD509C744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60CFC1A40 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 202windowcommemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            • ver 2.4.3 (build 134), xrefs: 00007FF60CFC1A9A
                                            • MFORMAT INIT:, xrefs: 00007FF60CFC1D1D
                                            • MainWindow { background-color: #050F15; }QWidget{color: black;}QDialog {background-color: #050F15; border:4px solid lightgray;}QDialog#TUrlChoiseDlg > QPushButton {color:white;font-size:25px;background-color:#0E2B47;}QStatusBar {background-color:transparent; c, xrefs: 00007FF60CFC1B01
                                            • QT_BEARER_POLL_TIMEOUT, xrefs: 00007FF60CFC1B4B
                                            • %s, xrefs: 00007FF60CFC1ACF
                                            • SRTMiniServer, xrefs: 00007FF60CFC1A8F
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Application@@Debug@@$Byte$Array@@Logger@@MessageStringString@@$?debug@?exec@?from?instance@?number@?qputenv@@?set?show@AllocArrayArray@@@Ascii_helper@CoreCreateData@FreeInstanceSheet@String@@@StyleTypedV0@_Widget@@__acrt_iob_func__stdio_common_vfwprintfav_log_set_levelmemsetprintf
                                            • String ID: %s$MFORMAT INIT:$MainWindow { background-color: #050F15; }QWidget{color: black;}QDialog {background-color: #050F15; border:4px solid lightgray;}QDialog#TUrlChoiseDlg > QPushButton {color:white;font-size:25px;background-color:#0E2B47;}QStatusBar {background-color:transparent; c$QT_BEARER_POLL_TIMEOUT$SRTMiniServer$ver 2.4.3 (build 134)
                                            • API String ID: 366498195-1543199677
                                            • Opcode ID: 1b5c110c632d938aebfde15e49f5e3e2893661a19dd2817ca364be622e3fc186
                                            • Instruction ID: a331ef8af64f106ba6a262bcde05783db3c2e264768b21bbf27e0b80e3e9d01a
                                            • Opcode Fuzzy Hash: 1b5c110c632d938aebfde15e49f5e3e2893661a19dd2817ca364be622e3fc186
                                            • Instruction Fuzzy Hash: 79916F32B28A42D6EB10DF25E8945A97361FF84784F645232EA4F877A5EF7CD508CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A5870 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 207COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: CapsDevice$String@@$?fromArray@CharCreateDeleteInfoLatin1MonitorString@@@Url@@V0@$$V0@@memset
                                            • String ID: %s: Unable to obtain handle for monitor '%s', defaulting to %g DPI.$WinDisc$monitorData
                                            • API String ID: 397620118-524077370
                                            • Opcode ID: 7e44acf968412ca75c51a4ec35e63b874baaf26f506d7e51b00dd75cfb328c8f
                                            • Instruction ID: 46235227857f6d78290c10c4f7ebce086cd81ffca4befc1380df29ee8cfe329c
                                            • Opcode Fuzzy Hash: 7e44acf968412ca75c51a4ec35e63b874baaf26f506d7e51b00dd75cfb328c8f
                                            • Instruction Fuzzy Hash: 61A19033B28A419BE710DF74D450AAE73A5FB89744F049235EA1E67E98EF38E095C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6302230 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 173COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteFont$Engine@@ObjectSelectString@@$?getDataMetricsOutlineTextUrl@@V0@$$V0@@$?encode?from?length@?loadArray@CharFile@@Fixed@@@KerningMap@Name@Pairs@SfntString@@@Table@freemalloc
                                            • String ID: CFF $cmap$pamc
                                            • API String ID: 61011042-4095685674
                                            • Opcode ID: 3e2c11ca7ec68a11a0123252ce4ad2f5d3b197de2130e3c1e28521f9ef807c29
                                            • Instruction ID: 72ade847ebf5817300a34763c90bfff24610506bf840a59591c4940b48d57c3d
                                            • Opcode Fuzzy Hash: 3e2c11ca7ec68a11a0123252ce4ad2f5d3b197de2130e3c1e28521f9ef807c29
                                            • Instruction Fuzzy Hash: 29819E727046828BEB609F75E8607E937A4FB49798F088135DA2A47F98DF38D549C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62D34F0 Relevance: 37.7, APIs: 25, Instructions: 201COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteV0@@$A@$$String@@$??0?$F@@@@PointVector@$Url@@V0@$$$?load@?utf16@AddressE__@@Library@@ProcSystem
                                            • String ID:
                                            • API String ID: 1125703135-0
                                            • Opcode ID: b5eef81233551aea58a322298a061804c84d4b1586667fd165478ad58a08ca5b
                                            • Instruction ID: 2d642d1c38190002c503b5d60ae17d94d1ec4fc4ab333328d8504d32b72173ca
                                            • Opcode Fuzzy Hash: b5eef81233551aea58a322298a061804c84d4b1586667fd165478ad58a08ca5b
                                            • Instruction Fuzzy Hash: B9A14372709A4297EB60DF64E490AADB7B4FB84744F444031D69E87E98DF3CE549CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62E1200 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 82windowclipboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$String@@$Logger@@Message$?debug@?utf16@Array@@ByteCategory@@ClipboardCreateDebugEnabled@ErrnoH00@HandleLoggingModuleV0@@V0@_ViewerWarning@@Window
                                            • String ID: AddClipboardFormatListener() failed.$QWindowsClipboard::registerViewer$Qt5ClipboardView$format listener:$m_clipboardViewer:$next:
                                            • API String ID: 1810827003-2802464883
                                            • Opcode ID: d4e667823de9cd76428318bd894f7bc6723a2048596805bc849acf351ec3777a
                                            • Instruction ID: 033c8a62d49e189a385b60afde18bc2cb24bc1d3d2e443eeef79f9939266567f
                                            • Opcode Fuzzy Hash: d4e667823de9cd76428318bd894f7bc6723a2048596805bc849acf351ec3777a
                                            • Instruction Fuzzy Hash: 56414226B08B4293EB00EB61F8649A933A5FF95B90F484135D96D83EA9EF3CE554C340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66F00A0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 206COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Generic$Argument@@Return$Data@@$Hash$List$Object@@$?allocate?begin@?detach_helper@?end@?free_helper@?invoke?lock@?unlock@?willArgument@@222222222@Empty@Grow@Locker@@MetaMethod@MutexMutex@@Node@Node@1@Node@1@@
                                            • String ID: requestUpdate
                                            • API String ID: 823351508-1218863351
                                            • Opcode ID: 7dfa295c943cfd66bf4f77ce242626c179ff09aaf2f6eb05172888d827db6574
                                            • Instruction ID: ce5bece1fafde38e8931eb5e17283ea7b4b9b998cfc074f8c482a6bf09f4459e
                                            • Opcode Fuzzy Hash: 7dfa295c943cfd66bf4f77ce242626c179ff09aaf2f6eb05172888d827db6574
                                            • Instruction Fuzzy Hash: C6A19C32B08A95C5E711DF29D864AE973A5FF88B48F858122DA5E13F68EF38D585C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6296480 Relevance: 27.1, APIs: 18, Instructions: 136windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Window@@$Window$System$Region@@$?window@CompositionEnabledInterface@@ModuleOpenPaintPlatformRectRect@@$??$handle?flush?openBeginClipContext@@DefaultDelivery@Empty@EventEvent@EventsEvents@ExposeFlag@Flags@Interface@@@InvalidateLongLoop@@@@@Point@@ProcessRegionRegion@@@SelectSize@@@Type@Type@0@@Type@1@UpdateVisible@
                                            • String ID:
                                            • API String ID: 2946135873-0
                                            • Opcode ID: 41dec08c3f831ded019d59447002dd1a65b5fba96cf1ca645f40dae1b9e7df21
                                            • Instruction ID: d46a6cf2d15b770a19ed0290194639fa6fa1ff917927e64958d47c5bab4aa0f6
                                            • Opcode Fuzzy Hash: 41dec08c3f831ded019d59447002dd1a65b5fba96cf1ca645f40dae1b9e7df21
                                            • Instruction Fuzzy Hash: 28514A32B086128BFB14DFB5D464AAC33E5BB85748F444135CA1E87E9DDE2CE40ADB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629E400 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 133windowcomCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF62A6DA0: ??0QLocale@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF629E446), ref: 00007FFDF62A6DB9
                                              • Part of subcall function 00007FFDF62A6DA0: memset.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00007FFDF629E446), ref: 00007FFDF62A6DDC
                                              • Part of subcall function 00007FFDF62A6DA0: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF629E446), ref: 00007FFDF62A6E4A
                                              • Part of subcall function 00007FFDF62A6DA0: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF629E446), ref: 00007FFDF62A6E55
                                            • OleInitializeWOW.OLE32 ref: 00007FFDF629E4DB
                                              • Part of subcall function 00007FFDF62A06B0: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A06DB
                                              • Part of subcall function 00007FFDF62A06B0: ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A06E8
                                              • Part of subcall function 00007FFDF62A06B0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A06FB
                                              • Part of subcall function 00007FFDF62A06B0: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A070D
                                              • Part of subcall function 00007FFDF62A06B0: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A0718
                                              • Part of subcall function 00007FFDF62A06B0: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A075E
                                              • Part of subcall function 00007FFDF62A06B0: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A0769
                                              • Part of subcall function 00007FFDF62A06B0: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A07A9
                                              • Part of subcall function 00007FFDF62A06B0: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A07B4
                                              • Part of subcall function 00007FFDF62A06B0: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A07F4
                                              • Part of subcall function 00007FFDF62A06B0: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A07FF
                                              • Part of subcall function 00007FFDF62A06B0: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A083F
                                              • Part of subcall function 00007FFDF62A06B0: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFDF629E501), ref: 00007FFDF62A084A
                                              • Part of subcall function 00007FFDF62A0530: ?current@QOperatingSystemVersion@@SA?AV1@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0550
                                              • Part of subcall function 00007FFDF62A0530: ?compare@QOperatingSystemVersion@@CAHAEBV1@0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0564
                                              • Part of subcall function 00007FFDF62A0530: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A058B
                                              • Part of subcall function 00007FFDF62A0530: ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0598
                                              • Part of subcall function 00007FFDF62A0530: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A05AB
                                              • Part of subcall function 00007FFDF62A0530: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A05BD
                                              • Part of subcall function 00007FFDF62A0530: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A05C8
                                              • Part of subcall function 00007FFDF62A0530: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A060D
                                              • Part of subcall function 00007FFDF62A0530: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0618
                                              • Part of subcall function 00007FFDF62A0530: ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0658
                                              • Part of subcall function 00007FFDF62A0530: ?load@QSystemLibrary@@SAPEAUHINSTANCE__@@PEB_W_N@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0663
                                              • Part of subcall function 00007FFDF62A0530: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0680
                                              • Part of subcall function 00007FFDF62A0530: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629E50D), ref: 00007FFDF62A0691
                                            • GetDC.USER32 ref: 00007FFDF629E52C
                                            • GetDeviceCaps.GDI32 ref: 00007FFDF629E53E
                                            • GetKeyboardLayoutList.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E54B
                                            • GetKeyboardLayoutList.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E581
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E605
                                            • ?warning@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E613
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E623
                                            • ??6QDebug@@QEAAAEAV0@AEBVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E62F
                                            • ??1QDebug@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E63A
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E645
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$System$?load@?utf16@E__@@Library@@$Debug@@$Object@@$??0?$ByteConnection@F@@@@KeyboardLayoutListLogger@@MessageMetaOperatingPointV0@@Vector@Version@@$?compare@?connect?current@?warning@AddressArray@@Array@@@Base@CapsConnectionDeviceImpl@InitializeLocale@@ObjectPrivate@@ProcQt@@SlotType@U3@@V1@0@memset
                                            • String ID: QWindowsContext: OleInitialize() failed:
                                            • API String ID: 3249308831-1565728777
                                            • Opcode ID: f42ace6f45ca6e41dbb5da9e2a0d804069763704a6c27af5cedb84b4f8b1d6e1
                                            • Instruction ID: a9a2c52bdbd6454a4f9c45d18f193db65aa3031c0a885bb2434444abf3dfaad5
                                            • Opcode Fuzzy Hash: f42ace6f45ca6e41dbb5da9e2a0d804069763704a6c27af5cedb84b4f8b1d6e1
                                            • Instruction Fuzzy Hash: A4514D32708A4286EB249B25F8645AEB3E8FF94794F544135D7AE82BE9DF3CE045D700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62967E0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 149windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            • QWidget: Incompatible window flags: the window can't be on top and on bottom at the same time, xrefs: 00007FFDF62968B7
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Window$Format@@Logger@@MenuMessageSurface$?has?warning@Alpha@EnableItemSystem
                                            • String ID: QWidget: Incompatible window flags: the window can't be on top and on bottom at the same time
                                            • API String ID: 3764170481-2631108776
                                            • Opcode ID: 87dc2f9602d6f97a40d0db4e69a47f9b538e3fa025e5afe5e2bdbdf1d81dc0ee
                                            • Instruction ID: e4cc92a82231b7d08bea0015aa2049df94e3c8f00a39168ca4d195a133b908fa
                                            • Opcode Fuzzy Hash: 87dc2f9602d6f97a40d0db4e69a47f9b538e3fa025e5afe5e2bdbdf1d81dc0ee
                                            • Instruction Fuzzy Hash: 55519032B1865183F724CF35A464A6A76A5FB85BD8F048231EA6983EDDDF3CD145AB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F5A10 Relevance: 177.2, APIs: 88, Strings: 13, Instructions: 460windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 410 7ffdf62f5a10-7ffdf62f5a57 ?isEmpty@QString@@QEBA_NXZ 411 7ffdf62f620d-7ffdf62f621f ??1QString@@QEAA@XZ * 2 410->411 412 7ffdf62f5a5d-7ffdf62f5a81 ??0QChar@@QEAA@UQLatin1Char@@@Z ?at@QString@@QEBA?BVQChar@@H@Z 410->412 414 7ffdf62f6221-7ffdf62f623c call 7ffdf6381690 411->414 412->411 413 7ffdf62f5a87-7ffdf62f5ab7 ?startsWith@QString@@QEBA_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z 412->413 413->411 415 7ffdf62f5abd-7ffdf62f5b09 ??0?$QVector@VQPointF@@@@QEAA@XZ 413->415 418 7ffdf62f5b0b 415->418 419 7ffdf62f5b0e-7ffdf62f5b4a ?weightFromInteger@QPlatformFontDatabase@@SA?AW4Weight@QFont@@H@Z call 7ffdf62fa1d0 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 415->419 418->419 422 7ffdf62f5d17-7ffdf62f5d42 ??0?$QVector@VQPointF@@@@QEAA@XZ * 4 419->422 423 7ffdf62f5b50-7ffdf62f5bd6 ??0?$QVector@VQPointF@@@@QEAA@XZ ??0QTextStream@@QEAA@PEAVQString@@V?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z ??6QTextStream@@QEAAAEAV0@PEBD@Z ??6QTextStream@@QEAAAEAV0@D@Z ??6QTextStream@@QEAAAEAV0@AEBVQString@@@Z ??6QTextStream@@QEAAAEAV0@D@Z ??6QTextStream@@QEAAAEAV0@H@Z ??6QTextStream@@QEAAAEAV0@PEBD@Z ??6QTextStream@@QEAAAEAV0@H@Z 419->423 426 7ffdf62f5d48-7ffdf62f5d50 call 7ffdf62fade0 422->426 427 7ffdf62f5df4-7ffdf62f5e06 ??0QSupportedWritingSystems@@QEAA@XZ 422->427 424 7ffdf62f5be9-7ffdf62f5bec 423->424 425 7ffdf62f5bd8-7ffdf62f5be3 ??6QTextStream@@QEAAAEAV0@PEBD@Z 423->425 429 7ffdf62f5bff-7ffdf62f5c02 424->429 430 7ffdf62f5bee-7ffdf62f5bf9 ??6QTextStream@@QEAAAEAV0@PEBD@Z 424->430 425->424 433 7ffdf62f5d55-7ffdf62f5d5f call 7ffdf62fb2f0 426->433 431 7ffdf62f5e0c-7ffdf62f5e66 ?writingSystemsFromTrueTypeBits@QPlatformFontDatabase@@SA?AVQSupportedWritingSystems@@QEAI0@Z ??4QSupportedWritingSystems@@QEAAAEAV0@AEBV0@@Z ??1QSupportedWritingSystems@@QEAA@XZ ?supported@QSupportedWritingSystems@@QEBA_NW4WritingSystem@QFontDatabase@@@Z 427->431 432 7ffdf62f5ea4-7ffdf62f5eae 427->432 434 7ffdf62f5c15-7ffdf62f5cbd ??6QTextStream@@QEAAAEAV0@PEBD@Z ??6QTextStream@@QEAAAEAV0@H@Z ??6QTextStream@@QEAAAEAV0@PEBD@Z ??6QTextStream@@QEAAAEAV0@H@Z ??6QTextStream@@QEAAAEAV0@PEBD@Z ??6QTextStream@@QEAAAEAV0@H@Z ??6QTextStream@@QEAAAEAV0@PEBD@Z ??6QTextStream@@QEAAAEAV0@H@Z ??6QTextStream@@QEAAAEAV0@PEBD@Z ??6QTextStream@@QEAAAEAV0@H@Z call 7ffdf62fa1d0 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 429->434 435 7ffdf62f5c04-7ffdf62f5c0f ??6QTextStream@@QEAAAEAV0@PEBD@Z 429->435 430->429 436 7ffdf62f5e6c-7ffdf62f5e96 ??8QString@@QEBA_NVQLatin1String@@@Z 431->436 437 7ffdf62f5f36-7ffdf62f5f8e call 7ffdf62f72f0 ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX@Z 431->437 432->437 438 7ffdf62f5eb4-7ffdf62f5eca 432->438 447 7ffdf62f5d61-7ffdf62f5d6d ?isEmpty@QString@@QEBA_NXZ 433->447 448 7ffdf62f5d7d-7ffdf62f5d89 ?isEmpty@QString@@QEBA_NXZ 433->448 451 7ffdf62f5d03-7ffdf62f5d11 ??1QTextStream@@UEAA@XZ ??1QString@@QEAA@XZ 434->451 452 7ffdf62f5cbf-7ffdf62f5cfd call 7ffdf62fa1d0 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??1QDebug@@QEAA@XZ 434->452 435->434 436->437 442 7ffdf62f5e9c-7ffdf62f5e9f 436->442 449 7ffdf62f6008-7ffdf62f600f 437->449 450 7ffdf62f5f90-7ffdf62f5f9b ?isEmpty@QString@@QEBA_NXZ 437->450 443 7ffdf62f5f28-7ffdf62f5f30 ?setSupported@QSupportedWritingSystems@@QEAAXW4WritingSystem@QFontDatabase@@_N@Z 438->443 442->443 443->437 447->448 453 7ffdf62f5d6f-7ffdf62f5d77 ??4QString@@QEAAAEAV0@AEBV0@@Z 447->453 455 7ffdf62f5d8b-7ffdf62f5dc6 ??4QString@@QEAAAEAV0@AEBV0@@Z * 5 448->455 456 7ffdf62f5dcc-7ffdf62f5dee ??1QString@@QEAA@XZ * 4 448->456 457 7ffdf62f6011-7ffdf62f601c ?isEmpty@QString@@QEBA_NXZ 449->457 458 7ffdf62f608e-7ffdf62f6091 449->458 450->449 454 7ffdf62f5f9d-7ffdf62f6004 call 7ffdf62f72f0 ??0?$QVector@VQPointF@@@@QEAA@XZ ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX@Z ??1QString@@QEAA@XZ 450->454 451->422 452->451 453->448 454->449 455->456 456->427 461 7ffdf62f6089 457->461 462 7ffdf62f601e-7ffdf62f6083 call 7ffdf62f72f0 ??0?$QVector@VQPointF@@@@QEAA@XZ ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX@Z ??1QString@@QEAA@XZ 457->462 464 7ffdf62f6093-7ffdf62f6095 458->464 465 7ffdf62f6112-7ffdf62f611e ?isEmpty@QString@@QEBA_NXZ 458->465 461->458 462->461 464->465 466 7ffdf62f6097-7ffdf62f60a2 ?isEmpty@QString@@QEBA_NXZ 464->466 467 7ffdf62f6120-7ffdf62f612f ??8@YA_NAEBVQString@@0@Z 465->467 468 7ffdf62f617e-7ffdf62f619a ?isEmpty@QString@@QEBA_NXZ 465->468 466->465 471 7ffdf62f60a4-7ffdf62f610e call 7ffdf62f72f0 ??0?$QVector@VQPointF@@@@QEAA@XZ ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX@Z ??1QString@@QEAA@XZ 466->471 467->468 472 7ffdf62f6131-7ffdf62f6178 call 7ffdf62f72f0 ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX@Z 467->472 473 7ffdf62f619c-7ffdf62f61ab ??8@YA_NAEBVQString@@0@Z 468->473 474 7ffdf62f61ba-7ffdf62f620b ??1QSupportedWritingSystems@@QEAA@XZ ??1QString@@QEAA@XZ * 7 468->474 471->465 472->468 473->474 478 7ffdf62f61ad-7ffdf62f61b4 ?registerAliasToFontFamily@QPlatformFontDatabase@@SAXAEBVQString@@0@Z 473->478 474->414 478->474
                                            APIs
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE ref: 00007FFDF62F5A4F
                                            • ??0QChar@@QEAA@UQLatin1Char@@@Z.QT5CORE ref: 00007FFDF62F5A64
                                            • ?at@QString@@QEBA?BVQChar@@H@Z.QT5CORE ref: 00007FFDF62F5A78
                                            • ?startsWith@QString@@QEBA_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FFDF62F5AAF
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5AD9
                                            • ?weightFromInteger@QPlatformFontDatabase@@SA?AW4Weight@QFont@@H@Z.QT5GUI(?), ref: 00007FFDF62F5B28
                                            • ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF62F5B3C
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5B54
                                            • ??0QTextStream@@QEAA@PEAVQString@@V?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z.QT5CORE ref: 00007FFDF62F5B65
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5B7F
                                            • ??6QTextStream@@QEAAAEAV0@D@Z.QT5CORE ref: 00007FFDF62F5B8A
                                            • ??6QTextStream@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE ref: 00007FFDF62F5B96
                                            • ??6QTextStream@@QEAAAEAV0@D@Z.QT5CORE ref: 00007FFDF62F5BA1
                                            • ??6QTextStream@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FFDF62F5BAC
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5BBC
                                            • ??6QTextStream@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FFDF62F5BC7
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5BE3
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5BF9
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5C0F
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5C25
                                            • ??6QTextStream@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FFDF62F5C30
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5C40
                                            • ??6QTextStream@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FFDF62F5C4E
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5C5E
                                            • ??6QTextStream@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FFDF62F5C6A
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5C7A
                                            • ??6QTextStream@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FFDF62F5C89
                                            • ??6QTextStream@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62F5C99
                                            • ??6QTextStream@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FFDF62F5CA7
                                            • ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF62F5CB5
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF62F5CD9
                                            • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FFDF62F5CE6
                                            • ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE ref: 00007FFDF62F5CF3
                                            • ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5CFD
                                            • ??1QTextStream@@UEAA@XZ.QT5CORE ref: 00007FFDF62F5D07
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5D11
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5D1B
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5D25
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5D2F
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5D39
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE ref: 00007FFDF62F5D65
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF62F5D77
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE ref: 00007FFDF62F5D81
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF62F5D92
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF62F5D9F
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF62F5DAC
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF62F5DB9
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF62F5DC6
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5DD0
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5DDA
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5DE4
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5DEE
                                            • ??0QSupportedWritingSystems@@QEAA@XZ.QT5GUI ref: 00007FFDF62F5DF9
                                            • ?writingSystemsFromTrueTypeBits@QPlatformFontDatabase@@SA?AVQSupportedWritingSystems@@QEAI0@Z.QT5GUI ref: 00007FFDF62F5E31
                                            • ??4QSupportedWritingSystems@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FFDF62F5E3F
                                            • ??1QSupportedWritingSystems@@QEAA@XZ.QT5GUI ref: 00007FFDF62F5E4A
                                            • ?supported@QSupportedWritingSystems@@QEBA_NW4WritingSystem@QFontDatabase@@@Z.QT5GUI ref: 00007FFDF62F5E5E
                                            • ??8QString@@QEBA_NVQLatin1String@@@Z.QT5CORE ref: 00007FFDF62F5E8E
                                            • ?setSupported@QSupportedWritingSystems@@QEAAXW4WritingSystem@QFontDatabase@@_N@Z.QT5GUI ref: 00007FFDF62F5F30
                                            • ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX@Z.QT5GUI ref: 00007FFDF62F5F85
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE ref: 00007FFDF62F5F93
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5FAE
                                            • ?registerFont@QPlatformFontDatabase@@SAXAEBVQString@@00W4Weight@QFont@@W4Style@4@W4Stretch@4@_N4H4AEBVQSupportedWritingSystems@@PEAX@Z.QT5GUI ref: 00007FFDF62F5FF3
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F5FFE
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE ref: 00007FFDF62F6014
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62F602F
                                              • Part of subcall function 00007FFDF62FADE0: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FADFF
                                              • Part of subcall function 00007FFDF62FADE0: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE09
                                              • Part of subcall function 00007FFDF62FADE0: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE13
                                              • Part of subcall function 00007FFDF62FADE0: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE1D
                                              • Part of subcall function 00007FFDF62FADE0: GetDC.USER32 ref: 00007FFDF62FAE25
                                              • Part of subcall function 00007FFDF62FADE0: CreateFontIndirectW.GDI32 ref: 00007FFDF62FAE31
                                              • Part of subcall function 00007FFDF62FADE0: ReleaseDC.USER32 ref: 00007FFDF62FAE44
                                              • Part of subcall function 00007FFDF62FADE0: ??0QByteArray@@QEAA@$$QEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE51
                                              • Part of subcall function 00007FFDF62FADE0: ??0QByteArray@@QEAA@$$QEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE5F
                                              • Part of subcall function 00007FFDF62FADE0: ??0QByteArray@@QEAA@$$QEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE6D
                                              • Part of subcall function 00007FFDF62FADE0: ??0QByteArray@@QEAA@$$QEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE7B
                                              • Part of subcall function 00007FFDF62FADE0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE85
                                              • Part of subcall function 00007FFDF62FADE0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE8F
                                              • Part of subcall function 00007FFDF62FADE0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAE99
                                              • Part of subcall function 00007FFDF62FADE0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,0000FFFF,?,00007FFDF62F5D55), ref: 00007FFDF62FAEA3
                                              • Part of subcall function 00007FFDF62FB2F0: ??BQByteArray@@QEBAPEBDXZ.QT5CORE(?,?,0000FFFF,00007FFDF62F5D5D), ref: 00007FFDF62FB307
                                              • Part of subcall function 00007FFDF62FB2F0: ?length@QString@@QEBAHXZ.QT5CORE(?,?,0000FFFF,00007FFDF62F5D5D), ref: 00007FFDF62FB315
                                              • Part of subcall function 00007FFDF62FB2F0: ?unicode@QChar@@QEBAGXZ.QT5CORE(?,?,0000FFFF,00007FFDF62F5D5D), ref: 00007FFDF62FB337
                                              • Part of subcall function 00007FFDF62FB2F0: ?length@QString@@QEBAHXZ.QT5CORE(?,?,0000FFFF,00007FFDF62F5D5D), ref: 00007FFDF62FB347
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F6210
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F6219
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Stream@@Text$??0?$F@@@@PointVector@$V0@@$Writing$SupportedSystems@@$Font$Array@@ByteEmpty@$A@$$Database@@Platform$Char@@Debug@@Font@@Latin1String@@@Weight@$?length@?registerCategory@@DebugEnabled@Font@FromLogger@@LoggingMessageStretch@4@_String@@00Style@4@System@$?at@?debug@?set?starts?supported@?unicode@?weight?writingBits@CaseChar@@@CreateDatabase@@@Database@@_Device@@@@@Flag@Flags@H00@IndirectInteger@ModeOpenQt@@@ReleaseSensitivity@Supported@SystemsTrueTypeWith@
                                            • String ID: DEVICE$ RASTER$ Size=$ Style=$ TRUETYPE$ TTF=$ Weight=$ scalable=$ stretch=$Segoe UI$WST_$addFontToDatabase$d
                                            • API String ID: 2062803053-3181495196
                                            • Opcode ID: 60df43b82587438844761b465bcd141362fe0031bfbf7d25d7bf616afbeec32b
                                            • Instruction ID: 11723e6d9e53fd33253c70db3d14cab33887c61070d9c72eb39713a74bf72f42
                                            • Opcode Fuzzy Hash: 60df43b82587438844761b465bcd141362fe0031bfbf7d25d7bf616afbeec32b
                                            • Instruction Fuzzy Hash: 99325C22B08A4296FB009FB0E8649AD77B9FB94B58F494031DA5E53EADDF3CD549C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6293500 Relevance: 121.2, APIs: 59, Strings: 10, Instructions: 420windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 719 7ffdf6293500-7ffdf62935b6 GetModuleHandleW call 7ffdf62a10d0 call 7ffdf62a19a0 ?initialGeometry@QPlatformWindow@@SA?AVQRect@@PEBVQWindow@@AEBV2@HH@Z 724 7ffdf62935b8-7ffdf62935bc 719->724 725 7ffdf6293610-7ffdf6293675 ?utf16@QString@@QEBAPEBGXZ * 2 call 7ffdf6380e9c call 7ffdf6291250 719->725 724->725 727 7ffdf62935be-7ffdf62935c3 724->727 737 7ffdf6293677-7ffdf629367f 725->737 738 7ffdf6293681-7ffdf62936ca call 7ffdf6380e9c call 7ffdf62f7920 * 2 725->738 729 7ffdf62935c5-7ffdf62935d2 ?qAppName@@YA?AVQString@@XZ 727->729 730 7ffdf62935d4-7ffdf62935e0 ?objectName@QObject@@QEBA?AVQString@@XZ 727->730 731 7ffdf62935e6-7ffdf62935f5 ??4QUrl@@QEAAAEAV0@$$QEAV0@@Z 729->731 730->731 733 7ffdf62935f7-7ffdf62935fb ??1QString@@QEAA@XZ 731->733 734 7ffdf6293601-7ffdf6293604 731->734 733->734 734->725 736 7ffdf6293606-7ffdf629360a ??1QString@@QEAA@XZ 734->736 736->725 739 7ffdf62936cd-7ffdf62936f0 call 7ffdf62a10d0 call 7ffdf62a24d0 737->739 738->739 750 7ffdf6293717-7ffdf629372c 739->750 751 7ffdf62936f2-7ffdf62936fc 739->751 754 7ffdf629372e-7ffdf6293730 750->754 755 7ffdf6293770-7ffdf629377e 750->755 752 7ffdf62936fe 751->752 753 7ffdf6293704-7ffdf629370d 751->753 752->753 753->750 757 7ffdf629370f-7ffdf6293712 call 7ffdf6380ed8 753->757 754->755 758 7ffdf6293732-7ffdf6293742 ?qt_window_private@@YAPEAVQWindowPrivate@@PEAVQWindow@@@Z 754->758 756 7ffdf6293785-7ffdf629379f call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 755->756 765 7ffdf62937a5-7ffdf629398e call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??6QDebug@@QEAAAEAV0@D@Z call 7ffdf6291e10 ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@J@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQMargins@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQMargins@@@Z ??1QDebug@@QEAA@XZ * 6 756->765 766 7ffdf6293994-7ffdf6293a1c call 7ffdf6292df0 CreateWindowExW call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 756->766 757->750 758->755 759 7ffdf6293744-7ffdf629376e call 7ffdf62969d0 758->759 759->756 765->766 775 7ffdf6293b1b-7ffdf6293b1e 766->775 776 7ffdf6293a22-7ffdf6293b15 call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@PEBX@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??6QDebug@@QEAAAEAV0@D@Z ??6@YA?AVQDebug@@V0@AEBVQMargins@@@Z ??1QDebug@@QEAA@XZ * 4 766->776 778 7ffdf6293b36-7ffdf6293b61 775->778 779 7ffdf6293b20-7ffdf6293b34 ?qErrnoWarning@@YAXPEBDZZ 775->779 776->775 781 7ffdf6293b65-7ffdf6293b96 778->781 779->781 782 7ffdf6293b98-7ffdf6293ba2 781->782 783 7ffdf6293bbd-7ffdf6293bf0 ??1QString@@QEAA@XZ * 2 781->783 784 7ffdf6293baa-7ffdf6293bb3 782->784 785 7ffdf6293ba4 782->785 784->783 786 7ffdf6293bb5-7ffdf6293bb8 call 7ffdf6380ed8 784->786 785->784 786->783
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$String@@$??6@$String@@@$Logger@@Message$?append@Latin1Margins@@@Variant@@WindowWindow@@Window@@@$?debug@?utf16@Category@@DebugEnabled@H00@LoggingObject@@Rect@@@$??0?$?flags@?initial?object?property@?qt_window_private@@Bool@CreateErrnoF@@@@Flags@Geometry@HandleModuleName@Name@@PlatformPointPrivate@@Qt@@@@Rect@@Type@Url@@V0@$$V0@@Vector@Warning@@
                                            • String ID: requested: $ class=$ custom margins: $ invisible margins: $ obtained geometry: $ title=$%s: CreateWindowEx failed$CreateWindowEx: $CreateWindowEx: returns $WindowCreationData::create
                                            • API String ID: 673872497-1297568575
                                            • Opcode ID: f985ad0a96db52d648e870a48dffa9de7342739bc6dc8f106543a8914ab6fe6e
                                            • Instruction ID: 4ef2dbf7b3db07094eabb67e1a7d64d9eda4c89aa8c2d816323c2c9e82282e5e
                                            • Opcode Fuzzy Hash: f985ad0a96db52d648e870a48dffa9de7342739bc6dc8f106543a8914ab6fe6e
                                            • Instruction Fuzzy Hash: A4226D36B04B8286EB10DF75E8646E833B4FB88B88F458035DA5D47BA9EF38D549C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FFF10 Relevance: 86.1, APIs: 46, Strings: 3, Instructions: 368windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1052 7ffdf62fff10-7ffdf62fff65 ??0QFontEngine@@IEAA@W4Type@0@@Z 1053 7ffdf62fff67-7ffdf62fff7c 1052->1053 1054 7ffdf62fff81-7ffdf6300099 ??0QByteArray@@QEAA@AEBV0@@Z ??0?$QVector@VQPointF@@@@QEAA@XZ * 4 call 7ffdf62fa1d0 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 1052->1054 1053->1054 1057 7ffdf630009b-7ffdf63000f4 call 7ffdf62fa1d0 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z ??6QDebug@@QEAAAEAV0@J@Z ??1QDebug@@QEAA@XZ 1054->1057 1058 7ffdf63000fa-7ffdf6300111 CreateFontIndirectW 1054->1058 1057->1058 1059 7ffdf6300156-7ffdf6300189 SelectObject GetTextMetricsW 1058->1059 1060 7ffdf6300113-7ffdf630014f ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ ??BQByteArray@@QEBAPEBDXZ ?qErrnoWarning@@YAXPEBDZZ ??1QByteArray@@QEAA@XZ call 7ffdf62fc740 1058->1060 1063 7ffdf630018b-7ffdf63001bc ?qErrnoWarning@@YAXPEBDZZ 1059->1063 1064 7ffdf63001bf-7ffdf6300201 call 7ffdf6302230 1059->1064 1060->1059 1063->1064 1068 7ffdf6300206-7ffdf630020d 1064->1068 1069 7ffdf6300214-7ffdf63002b7 call 7ffdf62fb440 ??0QVariant@@QEAA@HPEBXI@Z call 7ffdf6300770 call 7ffdf62d4c10 ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ call 7ffdf62fb370 ??0QVariant@@QEAA@HPEBXI@Z 1068->1069 1070 7ffdf630020f call 7ffdf6303b50 1068->1070 1080 7ffdf63004ec-7ffdf63004ff call 7ffdf63814ac 1069->1080 1081 7ffdf63002bd-7ffdf63002d7 ??0QString@@QEAA@UQStringDataPtr@@@Z 1069->1081 1070->1069 1080->1081 1092 7ffdf6300505-7ffdf630054d _Init_thread_footer 1080->1092 1083 7ffdf63002d9-7ffdf63002ed ?createData@QMapDataBase@@SAPEAU1@XZ 1081->1083 1084 7ffdf630033d-7ffdf6300352 1081->1084 1088 7ffdf630030c-7ffdf6300310 1083->1088 1089 7ffdf63002ef-7ffdf6300308 call 7ffdf62d15d0 ?setParent@QMapNodeBase@@QEAAXPEAU1@@Z 1083->1089 1085 7ffdf63003ac-7ffdf63003dc ?createNode@QMapDataBase@@QEAAPEAUQMapNodeBase@@HHPEAU2@_N@Z ??0QByteArray@@QEAA@AEBV0@@Z ??0QVariant@@QEAA@AEBV0@@Z 1084->1085 1086 7ffdf6300354-7ffdf6300367 ??M@YA_NAEBVQString@@0@Z 1084->1086 1094 7ffdf63003e2-7ffdf6300408 ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ 1085->1094 1090 7ffdf6300369-7ffdf6300373 1086->1090 1091 7ffdf6300375-7ffdf6300379 1086->1091 1095 7ffdf6300327-7ffdf630032b call 7ffdf62d1700 1088->1095 1096 7ffdf6300312-7ffdf6300315 1088->1096 1089->1088 1097 7ffdf630037c-7ffdf630037f 1090->1097 1091->1097 1092->1081 1099 7ffdf6300552-7ffdf6300565 call 7ffdf63814ac 1094->1099 1100 7ffdf630040e-7ffdf63004af ??0QString@@QEAA@UQStringDataPtr@@@Z ??0QVariant@@QEAA@_N@Z call 7ffdf62d4c10 ??1QString@@QEAA@XZ ??1QVariant@@QEAA@XZ ??0QVariant@@QEAA@AEBV?$QMap@VQString@@VQVariant@@@@@Z ??4QVariant@@QEAAAEAV0@AEBV0@@Z ??1QVariant@@QEAA@XZ 1094->1100 1102 7ffdf6300330-7ffdf6300337 ?recalcMostLeftNode@QMapDataBase@@QEAAXXZ 1095->1102 1101 7ffdf6300317-7ffdf6300325 1096->1101 1096->1102 1097->1086 1104 7ffdf6300381-7ffdf6300384 1097->1104 1099->1100 1112 7ffdf630056b-7ffdf63005b3 _Init_thread_footer 1099->1112 1113 7ffdf63004c5-7ffdf63004c9 call 7ffdf62d1700 1100->1113 1114 7ffdf63004b1-7ffdf63004b4 1100->1114 1101->1095 1101->1102 1102->1084 1107 7ffdf63003a8 1104->1107 1108 7ffdf6300386-7ffdf6300396 ??M@YA_NAEBVQString@@0@Z 1104->1108 1107->1085 1108->1107 1111 7ffdf6300398-7ffdf63003a6 ??4QVariant@@QEAAAEAV0@AEBV0@@Z 1108->1111 1111->1094 1112->1100 1117 7ffdf63004ce-7ffdf63004eb 1113->1117 1116 7ffdf63004b6-7ffdf63004c3 1114->1116 1114->1117 1116->1113 1116->1117
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Variant@@$Array@@Byte$DataV0@@$Font$??0?$Base@@Debug@@F@@@@PointVector@$ObjectSelect$Engine@@MetricsText$?create?getErrnoInit_thread_footerLogger@@Map@MessageNodeNode@OutlinePtr@@@StringString@@0@Warning@@$?debug@?length@?load@?recalc?set?utf16@AddressBit@Category@@CreateCriticalData@DebugE__@@Enabled@EnterH00@IndirectLeftLibrary@@Local8LoggingMostParent@ProcSectionSfntString@@@SystemTable@Type@0@@U1@@U2@_Url@@V0@$$Variant@@@@@malloc
                                            • String ID: %s: CreateFontIndirect failed for family '%s'$%s: GetTextMetrics failed$QWindowsFontEngine::QWindowsFontEngine
                                            • API String ID: 2259239318-1363371599
                                            • Opcode ID: aed85cfb9d537dc5a0b47a6f7c01f32685aa30524a4c696e30363132bf5a728f
                                            • Instruction ID: a34d73fe346256b1dfd3ccaea59d34f318333bc3207c773b08e23b238da0e195
                                            • Opcode Fuzzy Hash: aed85cfb9d537dc5a0b47a6f7c01f32685aa30524a4c696e30363132bf5a728f
                                            • Instruction Fuzzy Hash: A9125032B04A4297EB05EF74E960AE833A8FB55758F584131DA6E43AE9DF3CE559C300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6298C40 Relevance: 86.1, APIs: 43, Strings: 6, Instructions: 302windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1118 7ffdf6298c40-7ffdf6298cc6 ??0QRect@@QEAA@AEBVQPoint@@0@Z call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 1122 7ffdf6298ccc-7ffdf6298e5b call 7ffdf6294960 ?marginsRemoved@QRect@@QEBA?AV1@AEBVQMargins@@@Z call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQMargins@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??1QDebug@@QEAA@XZ * 6 1118->1122 1123 7ffdf6298e61-7ffdf6298e8a GetWindowPlacement 1118->1123 1122->1123 1127 7ffdf6298e9c-7ffdf6298e9f 1123->1127 1128 7ffdf6298e8c-7ffdf6298e97 IsWindowVisible 1123->1128 1130 7ffdf6298ea5-7ffdf6298ed7 GetWindowLongPtrW 1127->1130 1132 7ffdf6298fb8-7ffdf6298fe4 MoveWindow 1127->1132 1128->1130 1131 7ffdf6298e99 1128->1131 1134 7ffdf6298ed9-7ffdf6298ef5 call 7ffdf62a10d0 call 7ffdf62a2240 1130->1134 1135 7ffdf6298f3f-7ffdf6298f42 1130->1135 1131->1127 1136 7ffdf6298fea-7ffdf6299008 call 7ffdf62a1690 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ 1132->1136 1148 7ffdf6298ef7-7ffdf6298efc 1134->1148 1149 7ffdf6298efe-7ffdf6298f0b call 7ffdf62a6450 1134->1149 1138 7ffdf6298f45-7ffdf6298fb6 ?translated@QRect@@QEBA?AV1@AEBVQPoint@@@Z SetWindowPlacement 1135->1138 1143 7ffdf629910a-7ffdf6299121 call 7ffdf6381690 1136->1143 1144 7ffdf629900e-7ffdf6299104 call 7ffdf6294960 ?marginsRemoved@QRect@@QEBA?AV1@AEBVQMargins@@@Z call 7ffdf62a1690 ??0QMessageLogger@@QEAA@PEBDH00@Z ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ ??6QDebug@@QEAAAEAV0@D@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z ??6QDebug@@QEAAAEAV0@PEBD@Z ??6QDebug@@QEAAAEAV0@_N@Z ??6@YA?AVQDebug@@V0@AEBVQRect@@@Z ??1QDebug@@QEAA@XZ * 3 1136->1144 1138->1136 1144->1143 1152 7ffdf6298f0e-7ffdf6298f11 1148->1152 1149->1152 1152->1135 1157 7ffdf6298f13-7ffdf6298f3d 1152->1157 1157->1138
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$??6@Rect@@$Window$Logger@@MessageRect@@@Window@@$Category@@LoggingMargins@@@Placement$?debug@?margins?translated@?window@DebugEnabled@H00@PlatformPoint@@@Removed@Window@@@$?contains@Init_thread_footerLongMovePoint@@Point@@0@Point@@_Size@@@V0@_Visible
                                            • String ID: from $ resulting $ frame: $ new frame: $ to $QWindowsBaseWindow::setGeometry_sys
                                            • API String ID: 972927508-1440467865
                                            • Opcode ID: e8143b6a1625361cd3832c53460e88ca40120af244b451685133be8d742a2dd9
                                            • Instruction ID: 46adc40d4135cf9680918163694a41de7542d710e5b77437b55804289faf04aa
                                            • Opcode Fuzzy Hash: e8143b6a1625361cd3832c53460e88ca40120af244b451685133be8d742a2dd9
                                            • Instruction Fuzzy Hash: 0EE12B36B18A4297DB009FA5E8604AD77B4FB84B85B448036EA5E43FA9DF7CD509CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FADE0 Relevance: 77.1, APIs: 42, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteString@@V0@@$A@$$$??0?$F@@@@PointVector@$Url@@V0@$$$FontObject$DataReleaseSelect$?data@?resize@CreateDeleteIndirect
                                            • String ID: name$name
                                            • API String ID: 389826523-2543285679
                                            • Opcode ID: 4c95747d7c62e8a07b1054de7847d7941e868ba2c15ecbeb14eecc365828c74b
                                            • Instruction ID: c90f6a2ffc3cfed077bd3dcdf4e7912f788159e04e40b0c704e0c5c8b27382ff
                                            • Opcode Fuzzy Hash: 4c95747d7c62e8a07b1054de7847d7941e868ba2c15ecbeb14eecc365828c74b
                                            • Instruction Fuzzy Hash: 6471EC62B14917A7EB00EFB1E8648EC2375FB94B59B598031D91E53DA9EF3CD54AC300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6299D70 Relevance: 61.4, APIs: 25, Strings: 10, Instructions: 117windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Array@@$?append@$Debug@@$??6@Logger@@MessagePlatformWindow@@$?debug@?number@?window@Array@@@Category@@DebugEnabled@H00@LoggingLongSurface@@@V1@@V1@_WindowWindow@@@
                                            • String ID: WS_CHILD$ WS_CLIPCHILDREN$ WS_CLIPSIBLINGS$ WS_DLGFRAME$ WS_MAXIMIZEBOX$ WS_MINIMIZEBOX$ WS_POPUP$ WS_SYSMENU$ WS_THICKFRAME$QWindowsWindow::setStyle
                                            • API String ID: 3261088342-3177746206
                                            • Opcode ID: 8ad41b6ab076ba4618e6628cfec730b99fb6099927632468873b2b51477ff49c
                                            • Instruction ID: 8d20c89fcfe4541a1ef2ade40c33806f414a03fe6ea0392d1087a2becff4f463
                                            • Opcode Fuzzy Hash: 8ad41b6ab076ba4618e6628cfec730b99fb6099927632468873b2b51477ff49c
                                            • Instruction Fuzzy Hash: 0E518322B08A4293EB10AF74F864AE96365FBC1755F898131C56E43EEEEE3CD109C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F7D10 Relevance: 58.0, APIs: 30, Strings: 3, Instructions: 223windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Data@@List$FontString@@$Database@@$?dispose@Data@1@@MetaString@@@$?begin@?end@$?qt_Enum_debugList@@Logger@@MessageObject@@Operator@@StringWriting$?debug@?fallbacks?families@?from?size@?writingArray@@ByteCategory@@Char@@@Database@@@@DebugDefaultEmpty@Enabled@Family@Font@@H00@Hint@5@LangLatin1@List@LoggingPlatformScript@Stream@@StyleStyle@System@System@1@@Systems@TextUserV0@@
                                            • String ID: QWindowsFontDatabase::fallbacksForFamily$Style$StyleHint
                                            • API String ID: 1338076830-1179042823
                                            • Opcode ID: 49270d2ece49cdc338daaeaae1875397167f8ff45ef6096f429c67eab911f46f
                                            • Instruction ID: 5faeeb992f81b0cb3b5cf6daf6d28d0ef7134148d37b4a2662aea6250248d4c9
                                            • Opcode Fuzzy Hash: 49270d2ece49cdc338daaeaae1875397167f8ff45ef6096f429c67eab911f46f
                                            • Instruction Fuzzy Hash: 48A14936B09A4286EB109FB5E8609EC23B9FB54B99B494135DE1E43FA9DF3CD509C340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629A120 Relevance: 57.9, APIs: 32, Strings: 1, Instructions: 165windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Window@@$Window$Debug@@$Region@@$Platform$?window@System$Rect@@$??$handle??6@?geometry@Category@@DefaultDelivery@Empty@Event@ExposeInterface@@Interface@@@Logger@@LoggingMessageRegion@@@Type@$?debug@?flags@?focus?parent@?type@Application@@CaptureDebugEnabled@Flags@H00@Init_thread_footerLongQt@@Qt@@@@RegionShowSurface@@@Type@0@@V0@_Window@Window@@@
                                            • String ID: QWindowsWindow::setVisible
                                            • API String ID: 3453942269-973687656
                                            • Opcode ID: 8887ecb58c79dedf98df2250aee1ad991c231bdd2c74bb1e690bce98bcb634e2
                                            • Instruction ID: 3b87358d5ad050ff7709d7d5a59da6a2318a50e84cec4b53413e6a282183a07c
                                            • Opcode Fuzzy Hash: 8887ecb58c79dedf98df2250aee1ad991c231bdd2c74bb1e690bce98bcb634e2
                                            • Instruction Fuzzy Hash: 88715E22B0874287EB60AB75E864BA973A5FB85B55F488035CA9E43B9DDF3CD449C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62ABCF0 Relevance: 49.1, APIs: 24, Strings: 4, Instructions: 117windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemMetrics.USER32 ref: 00007FFDF62ABD15
                                            • GetSystemMetrics.USER32 ref: 00007FFDF62ABD3F
                                            • GetSystemMetrics.USER32 ref: 00007FFDF62ABD4D
                                            • ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABD5D
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABD94
                                            • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABDA2
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABDB2
                                            • ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABDC2
                                            • ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABDD2
                                            • ??6QDebug@@QEAAAEAV0@J@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABDDD
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABDED
                                            • ??6QDebug@@QEAAAEAV0@J@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABDF8
                                            • ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE08
                                            • ??6QDebug@@QEAAAEAV0@P6AAEAVQTextStream@@AEAV1@@Z@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE18
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE28
                                            • ??6QDebug@@QEAAAEAV0@J@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE34
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE44
                                            • ??6QDebug@@QEAAAEAV0@J@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE4F
                                            • ??1QDebug@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE5A
                                            • ??0QTouchDevice@@QEAA@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE6D
                                            • ?setType@QTouchDevice@@QEAAXW4DeviceType@1@@Z.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE80
                                            • ?type@QTouchDevice@@QEBA?AW4DeviceType@1@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABE8E
                                            • ?setCapabilities@QTouchDevice@@QEAAXV?$QFlags@W4CapabilityFlag@QTouchDevice@@@@@Z.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABEA4
                                            • ?setMaximumTouchPoints@QTouchDevice@@QEAAXH@Z.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,00007FFDF62A0EDA), ref: 00007FFDF62ABEAF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Touch$Device@@$Stream@@TextV1@@$?setMetricsSystem$DeviceLogger@@Message$?debug@?type@Capabilities@CapabilityCategory@@DebugDevice@@@@@Enabled@Flag@Flags@H00@LoggingMaximumPoints@Type@Type@1@Type@1@@
                                            • String ID: Digitizers:$Max touch points:$Ready:$Tablet PC:
                                            • API String ID: 1074269435-3611611755
                                            • Opcode ID: 2bef38b386863913f2b56ee0f0bf40de75677071431523924f2bfa33c5d2c8dc
                                            • Instruction ID: 85b62b87d79ea2ccf00e2d3cc8b06c2f3338b74ab21f907fe98ac863580882a6
                                            • Opcode Fuzzy Hash: 2bef38b386863913f2b56ee0f0bf40de75677071431523924f2bfa33c5d2c8dc
                                            • Instruction Fuzzy Hash: 86517126B08B0283EB04ABB1F8246B923E9FF84B91F458035DD5E43FA9DE7CE4158700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D0104C0 Relevance: 47.4, APIs: 18, Strings: 9, Instructions: 147windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@Byte$Debug@@$Init@locale@std@@Locimp@12@_Logger@@MessageV0@@$?append@?application?data@?debug@?fromApplication@@Bit@CoreLocal8Path@String@@@Utf8@V1@@_invalid_parameter_noinfo_noreturn_stat64i32
                                            • String ID: /WEB$/api/v1/crosslines$/api/v1/hello$/api/v1/line/(\d+)/disconnect$/api/v1/line/(\d+)/resetbuffer$/api/v1/line/(\d+)/streamid$/api/v1/read$/image.jpg$getWEBFolder:
                                            • API String ID: 4255260187-296516890
                                            • Opcode ID: 8e7436b6fcd4fdc078b7c5c834cbfa2da7d59dc10842da190a3aec3a0569fcc5
                                            • Instruction ID: 70cd17686daad07f63007461d4806463f8c89ebadeb2a01d76cf44b8042789c2
                                            • Opcode Fuzzy Hash: 8e7436b6fcd4fdc078b7c5c834cbfa2da7d59dc10842da190a3aec3a0569fcc5
                                            • Instruction Fuzzy Hash: 2471FD32A05B42E9EB11DF61E8441EC3774FF44358FA41236DA4E92A68FF78D69AC344
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F5780 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 143registrywindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Debug@@File@@$?dispose@Array@@ByteData@1@@Data@@ListLogger@@MessageOpenString@@@$??0?$?from?open@?read?warning@All@Array@Category@@CharCloseDevice@@Device@@@@@Empty@Enabled@F@@@@Flag@Flags@H00@LoggingModePointQueryUrl@@V0@$$V0@@ValueVector@Warningmemset
                                            • String ID: EUDC\1252$SystemDefaultEUDCFont$Unable to open default EUDC font:
                                            • API String ID: 1216839686-3770364387
                                            • Opcode ID: ef8e345c9ef45600d100b9bd43e96832bf0336a106d90ca98e619bfae7d47cc6
                                            • Instruction ID: b1547f1ae60c468267b3d4fee29cab8ef1fbadb2366bdfd3cd2b888a28c4addc
                                            • Opcode Fuzzy Hash: ef8e345c9ef45600d100b9bd43e96832bf0336a106d90ca98e619bfae7d47cc6
                                            • Instruction Fuzzy Hash: 2B616232718A82D3EB109F65E8649AA73A4FF90794F444132DA9E43EADDF3CD549C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A19A0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 165COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$?append@Latin1String@@@$Variant@@$??0?$?flags@?property@Array@@Bool@BrushByteColorF@@@@Flags@Object@@PointQt@@@@Type@V0@@Vector@WindowWindow@@
                                            • String ID: DropShadow$Icon$OwnDC$Popup$Qt5QWindow$SaveBits$Tool$ToolTip$_q_windowsDropShadow
                                            • API String ID: 3133559267-1001497984
                                            • Opcode ID: 75877db365945e7d2d582fddbeac82861bcf2c97084d64449190aed6ed1617d7
                                            • Instruction ID: 6f51549ece94cf65a1564ec43a24cec7921316cccf634be0a1d775347faaf88e
                                            • Opcode Fuzzy Hash: 75877db365945e7d2d582fddbeac82861bcf2c97084d64449190aed6ed1617d7
                                            • Instruction Fuzzy Hash: 7B718C32B04B12AAF7009FA4D8945FC33B9BB54768F444931DE6D52E98EFB8D288C340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FA440 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 122windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Category@@Logger@@LoggingMessage$String@@$?length@Enabled@H00@Init_thread_footerString@@@$?debug@?free_helper@?warning@Array@CharData@@DebugEnumFamiliesFontHashNode@1@@ReleaseWarning
                                            • String ID: Unable to enumerate family '$qt.qpa.fonts
                                            • API String ID: 3244261470-3558839791
                                            • Opcode ID: cb6cf8e06c2c2125a33903cd67acd959e604744acba50c775d728a0d0fa29dbc
                                            • Instruction ID: 3f08c82f30727b7ef48f26ea4d9a0d77a5a45807b109237427f4f0dec64b2df6
                                            • Opcode Fuzzy Hash: cb6cf8e06c2c2125a33903cd67acd959e604744acba50c775d728a0d0fa29dbc
                                            • Instruction Fuzzy Hash: 77515125B08647C2EB10AB74E874AB963A8FF94B45F458135D96E83EE9DF3CD049C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A22B0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 117windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Logger@@Message$Category@@Logging$ByteDebugEnabled@$?debug@?noquote@?warning@Array@@Array@@@H00@Init_thread_footer
                                            • String ID: ) failed: $, using $QWindowsContext::setProcessDpiAwareness$SetProcessDPIAware() failed$SetProcessDpiAwareness(
                                            • API String ID: 172095700-2330795746
                                            • Opcode ID: b0616860d3ff119c406ce881539768ffe182f8c807bcb98c5df8e73876c4ef31
                                            • Instruction ID: 5d4bccb9ad90fdfffb412672bfc307d7b4e43c4a678bb420bacd975c6d204433
                                            • Opcode Fuzzy Hash: b0616860d3ff119c406ce881539768ffe182f8c807bcb98c5df8e73876c4ef31
                                            • Instruction Fuzzy Hash: 22518921B0974292EB14AB61F824BB923E9BF84B80F494035D96D87FEDEF7CE4458300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6295740 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 155windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@Window@@$Rect@@$Window$PlatformSystem$??6@?window@Region@@$Interface@@Logger@@MessagePoint@@Size@@@$??$handle?debug@?flush?margins?size@?translated@Category@@DebugDefaultDelivery@Empty@Enabled@EventEvent@EventsEvents@ExposeFlag@Flags@H00@Interface@@@LoggingLoop@@@@@Margins@@@PlacementPoint@@@ProcessRect@@@RegionRegion@@@Removed@Size@@Surface@@@Type@0@@Window@@@
                                            • String ID: QWindowsWindow::handleGeometryChange
                                            • API String ID: 733305306-3577234724
                                            • Opcode ID: 0e34cd8cd6c0b83daf480887591fe9bd4afa12b8c3daf7870e6fd29293d99924
                                            • Instruction ID: 68ddf9efa709a27a6860768e3a1b6182995d12d4e50956b577e38777dada452a
                                            • Opcode Fuzzy Hash: 0e34cd8cd6c0b83daf480887591fe9bd4afa12b8c3daf7870e6fd29293d99924
                                            • Instruction Fuzzy Hash: 6F613C33B04A069BEB04DF78D5A45EC33A4FB84788B448131DA5E57E99EF38E559C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62BE400 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 91windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Window@@$?mimeData@Data@@Drag@@Mime$?focusApplication@@Category@@Logger@@LoggingMessagePlatform$??6@?debug@?input?type@?window@Accepted@AssociateContextContext@@DebugEnabled@H00@Init_thread_footerInputMethodObject@Object@@Qt@@Type@V0@_WindowWindow@Window@@@
                                            • String ID: QWindowsInputContext::updateEnabled$accepted=
                                            • API String ID: 1867459339-1051743838
                                            • Opcode ID: 791a1fdacafdba55d21f533b1998f026f014d065960e18d7f604d4f16d7f4661
                                            • Instruction ID: f4d3b11d270581520bd6ca173908eb2558a99fc9d716ceadbba792fc0643cdb0
                                            • Opcode Fuzzy Hash: 791a1fdacafdba55d21f533b1998f026f014d065960e18d7f604d4f16d7f4661
                                            • Instruction Fuzzy Hash: CA415332F09A0283EB54AB65E8749B923E5FF84B91F484035D96E47FE9EE2CE445C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A5390 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 300windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@Debug@@List$??8@?dispose@Data@1@@Logger@@MessagePlatformString@@0@memmove$?append@?debug@?detach_grow@?handleAdded@Category@@Data@1@DebugDisplayEnabled@EnumH00@Interface@@LoggingMonitorsScreenScreen@@Screen@@_String@@SystemWindow
                                            • String ID: New Monitor:
                                            • API String ID: 2686493274-2490063001
                                            • Opcode ID: 4bf9eab38f14c2641e7a43df18a7714a47cd0acbaefbed381e413119bb1be820
                                            • Instruction ID: 39def677a5d07352c7f5c9c5e44922afddb53762b949abe06b3c3e3c4fa0229c
                                            • Opcode Fuzzy Hash: 4bf9eab38f14c2641e7a43df18a7714a47cd0acbaefbed381e413119bb1be820
                                            • Instruction Fuzzy Hash: 63D1C632B18A8292DB10DF64D460ABE77A5FB81B94F058132DA6D57BE9DF7CD445C300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FC2C0 Relevance: 33.2, APIs: 22, Instructions: 165COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@ByteV0@@$Data@@HashHash@@$?fromArray@Char$?allocate?detach_helper@?free_helper@?willGrow@Node@Node@1@Node@1@@
                                            • String ID:
                                            • API String ID: 939731722-0
                                            • Opcode ID: 2bab91701eeb22162f8036f84dd80cc3a28acd9805e6fd0ddc131cad3741c3e3
                                            • Instruction ID: fbff4a7577bfb62efecb41c5a42fff7a9296014e5841f1b364079ec4e2b64c18
                                            • Opcode Fuzzy Hash: 2bab91701eeb22162f8036f84dd80cc3a28acd9805e6fd0ddc131cad3741c3e3
                                            • Instruction Fuzzy Hash: FC717E36B04A5296EB10DFA5E8608ED77B4FB94B94B458031CE2E93EA9DF38D549C300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629B5E0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 148windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Window$Window@@$Flags@Qt@@@@Variant@@$?windowLongPlacementState@States@Type@$?flags@?property@?type@?window@Bool@Level@Object@@PlatformQt@@ShowVisible
                                            • String ID: ,$_q_showWithoutActivating
                                            • API String ID: 1492462161-3675458727
                                            • Opcode ID: 5b84b9ad4c640b734f049e9d2e8acc3a4fe4a5611cfce2b08158ea28a21a1074
                                            • Instruction ID: 7fe3678ceb6cf7bd377287ed40f0742254f0e2e368d4806c1f6fa6ceb6b5ddeb
                                            • Opcode Fuzzy Hash: 5b84b9ad4c640b734f049e9d2e8acc3a4fe4a5611cfce2b08158ea28a21a1074
                                            • Instruction Fuzzy Hash: E151AF22B0864282EB509F61E464BBE63A4FBC5B99F584130CE6E87ADDCF3CE445D700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62C14C0 Relevance: 31.6, APIs: 21, Instructions: 140COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF62BF310: ??1QFont@@QEAA@XZ.QT5GUI(?,00000246C821BF60,?,00007FFDF62C14EE), ref: 00007FFDF62BF36B
                                            • ?desktopSettingsAware@QGuiApplication@@SA_NXZ.QT5GUI ref: 00007FFDF62C14EE
                                              • Part of subcall function 00007FFDF62A1730: memset.VCRUNTIME140(?,?,?,?,00000246C821BF60,00007FFDF62C150F), ref: 00007FFDF62A1747
                                              • Part of subcall function 00007FFDF62F4B40: ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z.QT5CORE(?,?,?,?,00000246C821BF60,00007FFDF62C1522), ref: 00007FFDF62F4B71
                                              • Part of subcall function 00007FFDF62F4B40: ??0QFont@@QEAA@AEBVQString@@HH_N@Z.QT5GUI ref: 00007FFDF62F4B89
                                              • Part of subcall function 00007FFDF62F4B40: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F4B94
                                              • Part of subcall function 00007FFDF62F4B40: ?setStyle@QFont@@QEAAXW4Style@1@@Z.QT5GUI ref: 00007FFDF62F4BA5
                                              • Part of subcall function 00007FFDF62F4B40: ?weightFromInteger@QPlatformFontDatabase@@SA?AW4Weight@QFont@@H@Z.QT5GUI ref: 00007FFDF62F4BB2
                                              • Part of subcall function 00007FFDF62F4B40: ?setWeight@QFont@@QEAAXH@Z.QT5GUI ref: 00007FFDF62F4BBD
                                              • Part of subcall function 00007FFDF62F4B40: ?setPointSizeF@QFont@@QEAAXN@Z.QT5GUI ref: 00007FFDF62F4BE9
                                              • Part of subcall function 00007FFDF62F4B40: ?setUnderline@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62F4BF9
                                              • Part of subcall function 00007FFDF62F4B40: ?setOverline@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62F4C04
                                              • Part of subcall function 00007FFDF62F4B40: ?setStrikeOut@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62F4C14
                                            • ?pointSize@QFont@@QEBAHXZ.QT5GUI ref: 00007FFDF62C1566
                                            • ??0QFont@@QEAA@AEBVQString@@HH_N@Z.QT5GUI ref: 00007FFDF62C1591
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62C159C
                                            • ?setStyleHint@QFont@@QEAAXW4StyleHint@1@W4StyleStrategy@1@@Z.QT5GUI ref: 00007FFDF62C15B0
                                            • SystemParametersInfoW.USER32 ref: 00007FFDF62C15C4
                                              • Part of subcall function 00007FFDF6380E9C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF6291204), ref: 00007FFDF6380EB6
                                              • Part of subcall function 00007FFDF62FC530: GetObjectW.GDI32 ref: 00007FFDF62FC569
                                              • Part of subcall function 00007FFDF62FC530: ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z.QT5CORE ref: 00007FFDF62FC582
                                              • Part of subcall function 00007FFDF62FC530: ??0QFont@@QEAA@AEBVQString@@HH_N@Z.QT5GUI ref: 00007FFDF62FC59A
                                              • Part of subcall function 00007FFDF62FC530: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FC5A4
                                              • Part of subcall function 00007FFDF62FC530: ?setStyle@QFont@@QEAAXW4Style@1@@Z.QT5GUI ref: 00007FFDF62FC5B5
                                              • Part of subcall function 00007FFDF62FC530: ?weightFromInteger@QPlatformFontDatabase@@SA?AW4Weight@QFont@@H@Z.QT5GUI ref: 00007FFDF62FC5C2
                                              • Part of subcall function 00007FFDF62FC530: ?setWeight@QFont@@QEAAXH@Z.QT5GUI ref: 00007FFDF62FC5CD
                                              • Part of subcall function 00007FFDF62FC530: ?setPointSizeF@QFont@@QEAAXN@Z.QT5GUI ref: 00007FFDF62FC5FB
                                              • Part of subcall function 00007FFDF62FC530: ?setUnderline@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62FC60B
                                              • Part of subcall function 00007FFDF62FC530: ?setOverline@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62FC616
                                              • Part of subcall function 00007FFDF62FC530: ?setStrikeOut@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62FC626
                                              • Part of subcall function 00007FFDF62FC530: ?family@QFont@@QEBA?AVQString@@XZ.QT5GUI ref: 00007FFDF62FC64E
                                              • Part of subcall function 00007FFDF62FC530: ??8QString@@QEBA_NVQLatin1String@@@Z.QT5CORE ref: 00007FFDF62FC65B
                                              • Part of subcall function 00007FFDF62FC530: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FC668
                                              • Part of subcall function 00007FFDF62FC530: ?setFamily@QFont@@QEAAXAEBVQString@@@Z.QT5GUI ref: 00007FFDF62FC68A
                                              • Part of subcall function 00007FFDF62FC530: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FC694
                                              • Part of subcall function 00007FFDF62FC530: ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF62FC6A2
                                              • Part of subcall function 00007FFDF6380E9C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDF6380ED2
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C1604
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C1622
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C1641
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C1660
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C167F
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C169E
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C16BD
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C16DB
                                            • ??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FFDF62C16FA
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FFDF62C170B
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FFDF62C1716
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FFDF62C1721
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FFDF62C172C
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FFDF62C1737
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FFDF62C1741
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Font@@$?set$String@@$V0@@$Weight@$Style$?from?weightArray@CharDatabase@@FontFromInteger@Out@Overline@PlatformPointSizeStrikeString@@@Style@Style@1@@Underline@$?desktop?family@?pointApplication@@Aware@Category@@Concurrency::cancel_current_taskDebugEnabled@Family@Hint@Hint@1@InfoLatin1LoggingObjectParametersSettingsSize@Strategy@1@@Systemmallocmemset
                                            • String ID:
                                            • API String ID: 2877009166-0
                                            • Opcode ID: 7a339a32c99e6fc5fb08164172b985cb3e08ee42f4703974b16d904209106ea1
                                            • Instruction ID: a54a7b8051456899c85a115f9a023584abe8467119d2d0ffb14574774efa2033
                                            • Opcode Fuzzy Hash: 7a339a32c99e6fc5fb08164172b985cb3e08ee42f4703974b16d904209106ea1
                                            • Instruction Fuzzy Hash: F0615D32B08B4693EB44EBB0E864BE963A4FB85744F845431D69E07AD9DFBCE548C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629C530 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 111windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF629E380: ?qgetenv@@YA?AVQByteArray@@PEBD@Z.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3B1
                                              • Part of subcall function 00007FFDF629E380: ?fromLocal8Bit@QString@@SA?AV1@AEBVQByteArray@@@Z.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3CC
                                              • Part of subcall function 00007FFDF629E380: ?setFilterRules@QLoggingCategory@@SAXAEBVQString@@@Z.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3D5
                                              • Part of subcall function 00007FFDF629E380: ??1QString@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3E0
                                              • Part of subcall function 00007FFDF629E380: ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3EB
                                              • Part of subcall function 00007FFDF62E03A0: ??0QInternalMimeData@@QEAA@XZ.QT5GUI(?,?,?,00007FFDF629C55C,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF62E03BB
                                              • Part of subcall function 00007FFDF62E03A0: ?qAddPostRoutine@@YAXP6AXXZ@Z.QT5CORE(?,?,?,00007FFDF629C55C,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF62E03EB
                                              • Part of subcall function 00007FFDF62E1AD0: ??0QPlatformDrag@@QEAA@XZ.QT5GUI(?,?,?,00007FFDF629C565,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF62E1ADD
                                              • Part of subcall function 00007FFDF62E1AD0: ??0QInternalMimeData@@QEAA@XZ.QT5GUI(?,?,?,00007FFDF629C565,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF62E1AF1
                                            • ??0QMutex@@QEAA@W4RecursionMode@0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629C56E
                                              • Part of subcall function 00007FFDF62E7000: ??0QPlatformAccessibility@@QEAA@XZ.QT5GUI(?,?,00000000,00007FFDF629C58E,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF62E7009
                                            • ??0QPlatformServices@@QEAA@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629C595
                                              • Part of subcall function 00007FFDF62F2A70: ?qRegisterResourceData@@YA_NHPEBE00@Z.QT5CORE(?,?,?,?,00007FFDF629C5AE,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF62F2A8E
                                              • Part of subcall function 00007FFDF629D9D0: ?startsWith@QString@@QEBA_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FFDF629DA62
                                              • Part of subcall function 00007FFDF629D9D0: ?endsWith@QString@@QEBA_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FFDF629DAAB
                                            • ?setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N@Z.QT5CORE ref: 00007FFDF629C5F3
                                            • ?testAttribute@QCoreApplication@@SA_NW4ApplicationAttribute@Qt@@@Z.QT5CORE ref: 00007FFDF629C62B
                                            • ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF629C64E
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF629C67E
                                            • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FFDF629C68F
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF629C69F
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF629C6AF
                                            • ??6QDebug@@QEAAAEAV0@J@Z.QT5CORE ref: 00007FFDF629C6BC
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF629C6CC
                                            • ??6QDebug@@QEAAAEAV0@J@Z.QT5CORE ref: 00007FFDF629C6D7
                                            • ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FFDF629C6E5
                                            • ?setCapability@QPlatformCursor@@SAXW4Capability@1@@Z.QT5GUI ref: 00007FFDF629C702
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$String@@$Attribute@Platform$?setByteData@@Qt@@@$ApplicationApplication@@Array@@CaseCategory@@CoreInternalLatin1Logger@@LoggingMessageMimeSensitivity@With@$?debug@?ends?from?qgetenv@@?starts?testAccessibility@@Array@@@Bit@Capability@Capability@1@@Cursor@@DebugDrag@@E00@Enabled@FilterH00@Local8Mode@0@@Mutex@@PostQt@@_RecursionRegisterResourceRoutine@@Rules@Services@@String@@@
                                            • String ID: DpiAwareness=$QWindowsIntegrationPrivate::QWindowsIntegrationPrivate$effective process DPI awareness=
                                            • API String ID: 810104716-2489009734
                                            • Opcode ID: 1aaaf8a89bd3a649de80d94fbc0c01564f1bfaaa373417d5d31dabefc8c7a476
                                            • Instruction ID: 703d4eac5db09df3ffbfdafdfb18fc3e1c872caed8f20f9a9215c42a7abb3031
                                            • Opcode Fuzzy Hash: 1aaaf8a89bd3a649de80d94fbc0c01564f1bfaaa373417d5d31dabefc8c7a476
                                            • Instruction Fuzzy Hash: 94514F32B0864293EB14AB70E460AB973A9FF80744F448135D6AE83EDADF7CE509C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66EBFC0 Relevance: 29.8, APIs: 11, Strings: 6, Instructions: 67COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EBFCD
                                              • Part of subcall function 00007FFDF66EC500: ?lock@QMutex@@QEAAXXZ.QT5CORE(?,?,?,?,?,?,00007FFDF66EBFE2,?,?,?,?,?,00007FFDF6683517,?,?,00000000), ref: 00007FFDF66EC564
                                              • Part of subcall function 00007FFDF66EC500: ?currentThread@QThread@@SAPEAV1@XZ.QT5CORE ref: 00007FFDF66EC593
                                              • Part of subcall function 00007FFDF66EC500: ?mainThread@QCoreApplicationPrivate@@SAPEAVQThread@@XZ.QT5CORE ref: 00007FFDF66EC59C
                                              • Part of subcall function 00007FFDF66EC500: ?qAddPreRoutine@@YAXP6AXXZ@Z.QT5CORE ref: 00007FFDF66EC5AE
                                              • Part of subcall function 00007FFDF66EC500: ?qAddPostRoutine@@YAXP6AXXZ@Z.QT5CORE ref: 00007FFDF66EC5BB
                                              • Part of subcall function 00007FFDF66EC500: ?unlock@QMutexLocker@@QEAAXXZ.QT5CORE ref: 00007FFDF66EC653
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC010
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC01B
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC03C
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC047
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC068
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC073
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC094
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC09F
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC0C7
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC0D2
                                              • Part of subcall function 00007FFDF66EFC40: ?lock@QMutex@@QEAAXXZ.QT5CORE ref: 00007FFDF66EFC65
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFC89
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFCA0
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFCB7
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFCCD
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFCE3
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFCF9
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFD0F
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFD25
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFD3E
                                              • Part of subcall function 00007FFDF66EFC40: ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66EFD57
                                              • Part of subcall function 00007FFDF66EFC40: ?invokeMethod@QMetaObject@@SA_NPEAVQObject@@PEBDVQGenericArgument@@222222222@Z.QT5CORE ref: 00007FFDF66EFDC0
                                              • Part of subcall function 00007FFDF66EFC40: ?unlock@QMutexLocker@@QEAAXXZ.QT5CORE ref: 00007FFDF66EFDCD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$GenericMeta$Argument@@Connection@Return$?connect@ConnectionQt@@@Type@$?lock@?unlock@Locker@@MutexMutex@@Routine@@Thread@Thread@@$?current?invoke?mainApplicationArgument@@222222222@CoreMethod@PostPrivate@@V0@@
                                            • String ID: 2configurationAdded(QNetworkConfiguration)$2configurationChanged(QNetworkConfiguration)$2configurationRemoved(QNetworkConfiguration)$2configurationUpdateComplete()$2onlineStateChanged(bool)$2updateCompleted()
                                            • API String ID: 3270969667-3342877338
                                            • Opcode ID: ce0c0b5bca2eafb7d167724e60653c25c92909a4ca7c1c4a114ea8042eaf994e
                                            • Instruction ID: ae6331bbded37a376dc5c137eb337eee5b04d3467487fe56a97d324ce306399f
                                            • Opcode Fuzzy Hash: ce0c0b5bca2eafb7d167724e60653c25c92909a4ca7c1c4a114ea8042eaf994e
                                            • Instruction Fuzzy Hash: 5C310F71618B4292DB108F40F8744AA7378FB99B84F540176EA9D43EACEF3DDA49C744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66EC500 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 84threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?lock@QMutex@@QEAAXXZ.QT5CORE(?,?,?,?,?,?,00007FFDF66EBFE2,?,?,?,?,?,00007FFDF6683517,?,?,00000000), ref: 00007FFDF66EC564
                                            • ?currentThread@QThread@@SAPEAV1@XZ.QT5CORE ref: 00007FFDF66EC593
                                            • ?mainThread@QCoreApplicationPrivate@@SAPEAVQThread@@XZ.QT5CORE ref: 00007FFDF66EC59C
                                            • ?qAddPreRoutine@@YAXP6AXXZ@Z.QT5CORE ref: 00007FFDF66EC5AE
                                            • ?qAddPostRoutine@@YAXP6AXXZ@Z.QT5CORE ref: 00007FFDF66EC5BB
                                            • ??0QObject@@QEAA@PEAV0@@Z.QT5CORE ref: 00007FFDF66EC5DD
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66EC613
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66EC61E
                                              • Part of subcall function 00007FFDF66EFE40: ??0QDaemonThread@@QEAA@PEAVQObject@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EFE5F
                                              • Part of subcall function 00007FFDF66EFE40: ?setObjectName@QObject@@QEAAXAEBVQString@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EFE8F
                                              • Part of subcall function 00007FFDF66EFE40: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EFE9A
                                              • Part of subcall function 00007FFDF66EFE40: ?mainThread@QCoreApplicationPrivate@@SAPEAVQThread@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EFEA0
                                              • Part of subcall function 00007FFDF66EFE40: ?moveToThread@QObject@@QEAAXPEAVQThread@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EFEAD
                                              • Part of subcall function 00007FFDF66EFE40: ?moveToThread@QObject@@QEAAXPEAVQThread@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EFEBA
                                              • Part of subcall function 00007FFDF66EFE40: ?start@QThread@@QEAAXW4Priority@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EFEC9
                                              • Part of subcall function 00007FFDF66EFE40: ?lock@QMutex@@QEAAXXZ.QT5CORE ref: 00007FFDF66F0B45
                                              • Part of subcall function 00007FFDF66EFE40: ?sender@QObject@@IEBAPEAV1@XZ.QT5CORE ref: 00007FFDF66F0B78
                                              • Part of subcall function 00007FFDF66EFE40: ?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z.QT5CORE ref: 00007FFDF66F0B88
                                              • Part of subcall function 00007FFDF66EFE40: ?qEnvironmentVariableIntValue@@YAHPEBDPEA_N@Z.QT5CORE ref: 00007FFDF66F0BB8
                                              • Part of subcall function 00007FFDF66EFE40: ?keyMap@QFactoryLoader@@QEBA?AV?$QMultiMap@HVQString@@@@XZ.QT5CORE ref: 00007FFDF66F0BD4
                                              • Part of subcall function 00007FFDF66EFE40: ?QStringList_contains@QtPrivate@@YA_NPEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FFDF66F0C21
                                            • ?mainThread@QCoreApplicationPrivate@@SAPEAVQThread@@XZ.QT5CORE ref: 00007FFDF66EC62C
                                            • ?moveToThread@QObject@@QEAAXPEAVQThread@@@Z.QT5CORE ref: 00007FFDF66EC638
                                            • ?deleteLater@QObject@@QEAAXXZ.QT5CORE ref: 00007FFDF66EC641
                                            • ?unlock@QMutexLocker@@QEAAXXZ.QT5CORE ref: 00007FFDF66EC653
                                            • ??0QBasicMutex@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00007FFDF66EBFE2,?,?,?,?,?,00007FFDF6683517,?,?,00000000), ref: 00007FFDF66EC687
                                            • _Init_thread_footer.LIBCMT ref: 00007FFDF66EC694
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Thread@$Thread@@$Private@@$?main?moveApplicationCoreMetaMutex@@Thread@@@$?lock@Connection@Map@Qt@@@Routine@@StringString@@$?cast@?connect@?current?delete?key?sender@?set?start@?unlock@BasicCaseConnectionDaemonEnvironmentFactoryInit_thread_footerLater@List@@List_contains@Loader@@Locker@@MultiMutexName@ObjectObject@@@PostPriority@1@@Sensitivity@String@@@String@@@@Type@V0@@V2@@Value@@Variablemalloc
                                            • String ID: 1addPreAndPostRoutine()$2destroyed()
                                            • API String ID: 3334590629-3033731886
                                            • Opcode ID: d0639e72c20dba94b22da7b02865ac3df37fee5c5b3fc8a04fe91b36dadaa902
                                            • Instruction ID: 10e9cfa1a507cd274c8589bfba404d49d35d2e6a1786cea0a2dbb80b16db0441
                                            • Opcode Fuzzy Hash: d0639e72c20dba94b22da7b02865ac3df37fee5c5b3fc8a04fe91b36dadaa902
                                            • Instruction Fuzzy Hash: 4441E921B08A4282EB049B12E8749797369BF94B84F440175D96E43FEDEF3CE986CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6294310 Relevance: 25.6, APIs: 17, Instructions: 142COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??4QUrl@@QEAAAEAV0@$$QEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF6294368
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF6294373
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF629437E
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF6294389
                                            • ?screen@QWindow@@QEBAPEAVQScreen@@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF62943C3
                                            • ?primaryScreen@QGuiApplication@@SAPEAVQScreen@@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF62943CB
                                            • ?name@QScreen@@QEBA?AVQString@@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF62943E4
                                            • ??8@YA_NAEBVQString@@0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF62943F9
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF6294418
                                            • ?virtualSiblings@QScreen@@QEBA?AV?$QList@PEAVQScreen@@@@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF629443C
                                            • ?name@QScreen@@QEBA?AVQString@@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF629447E
                                            • ??8@YA_NAEBVQString@@0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF629448E
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF629449F
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF62944E2
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF6294530
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF6292E53), ref: 00007FFDF629455B
                                            • _Init_thread_footer.LIBCMT ref: 00007FFDF6294574
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Screen@@String@@$??8@?dispose@?name@Array@@ByteData@1@@Data@@ListString@@0@$??0?$?primary?screen@?virtualApplication@@F@@@@Init_thread_footerList@PointScreen@Screen@@@@Siblings@Url@@V0@$$V0@@Vector@Window@@
                                            • String ID:
                                            • API String ID: 2228891076-0
                                            • Opcode ID: 6baa4a2d016c6349babd76d74eb9b3f66e8f5f157f69613482467b8b877c0cf7
                                            • Instruction ID: 33fae447a06f3dd13c233f24377321b77690d7725120b13e6bbcf02d7ac3439a
                                            • Opcode Fuzzy Hash: 6baa4a2d016c6349babd76d74eb9b3f66e8f5f157f69613482467b8b877c0cf7
                                            • Instruction Fuzzy Hash: 4B617622B0894282EB60EF60E9605B963A5FFD1764F998131C96E43EEDDF2CE449D710
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6298AC0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 101windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteWindow@@$Logger@@MessagePlatformString@@Window$?event?move?qt_window_private@@?set?warning@?window@Bit@Event@@@Filter@Geometry@Left@Local8Object@@Point@@@Private@@Rect@@Rect@@@VisibleWindow@@@
                                            • String ID: %s: %s$QWindowsWindow::setGeometry
                                            • API String ID: 727306446-1033964765
                                            • Opcode ID: 058320bbe16274536a071f36e1ca8c2ae4423131828c8a88502c188a538a8221
                                            • Instruction ID: 2a35d26b8b68eebd7ba693d2c9439cccdba30df285e044b4f95a38e7e51345e6
                                            • Opcode Fuzzy Hash: 058320bbe16274536a071f36e1ca8c2ae4423131828c8a88502c188a538a8221
                                            • Instruction Fuzzy Hash: 4D410A63B046528AEB50DF75E860AE833B4FB58B5CF494135DA1E92A9DEF3CE584C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62987F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 79windowregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF629881B
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF6298844
                                            • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF6298852
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF6298862
                                            • ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ.QT5GUI(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF6298876
                                            • ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z.QT5GUI(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF6298889
                                            • ??6QDebug@@QEAAAEAV0@_N@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF6298895
                                            • ??1QDebug@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF62988A0
                                            • ??1QDebug@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF62988AB
                                            • ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ.QT5GUI(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF62988C5
                                            • RegisterDragDrop.OLE32 ref: 00007FFDF62988E4
                                              • Part of subcall function 00007FFDF62A1450: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,00000000,00000000,00007FFDF6298818,?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF62A14AC
                                              • Part of subcall function 00007FFDF62A1450: _Init_thread_footer.LIBCMT ref: 00007FFDF62A14C5
                                            • CoLockObjectExternal.OLE32(?,?,?,?,?,?,?,?,00000000,00007FFDF6294233), ref: 00007FFDF6298917
                                            • RevokeDragDrop.OLE32 ref: 00007FFDF629892E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Window@@$?window@Category@@DragDropLogger@@LoggingMessagePlatform$??6@?debug@DebugEnabled@ExternalH00@Init_thread_footerLockObjectRegisterRevokeV0@_Window@@@
                                            • String ID: QWindowsWindow::setDropSiteEnabled
                                            • API String ID: 1301423406-3096030987
                                            • Opcode ID: f0b3dae632206ed1c1c8f17c8d6a5468d54631d93c2d78ca4981b57936fd84de
                                            • Instruction ID: 9bb9c40ee40f09ea4ae99555b6ee1f658b6cf1f0f6915673700253816db15329
                                            • Opcode Fuzzy Hash: f0b3dae632206ed1c1c8f17c8d6a5468d54631d93c2d78ca4981b57936fd84de
                                            • Instruction Fuzzy Hash: 3E314236B08B4583EB04AB65E4647A973A5FFC5B84F488031DA6E47BA9DF3CE414C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6292DF0 Relevance: 24.3, APIs: 16, Instructions: 253COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Rect@@$Screen@@$Point@@$?center@?contains@Point@@_$?handle@Platform$?dispose@?virtualData@1@@Data@@Level@ListList@Point@@0@Screen@@@@Siblings@Size@@@Window@@
                                            • String ID:
                                            • API String ID: 2129943404-0
                                            • Opcode ID: 4f00600494a7cdc726688a5b58fdf145887d9e27f95df164264d02ba096ae8ca
                                            • Instruction ID: 7da8ef41230fc6ab75129323a3d516398d8af1f9d87022ee95212af6bab09daa
                                            • Opcode Fuzzy Hash: 4f00600494a7cdc726688a5b58fdf145887d9e27f95df164264d02ba096ae8ca
                                            • Instruction Fuzzy Hash: AAC12973B15A428BEB14CFB8D4909AC37B5F788B88B454125DE5E97B98DF38E449CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F8B70 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$String@@$Object$CreateErrnoInfoLogger@@MessageParametersSelectSystemWarning@@$??8@?debug@?from?get@?length@Array@CapsCategory@@CharChar@@CompatibleData@@DebugDeleteDeviceEnabled@FontH00@IndirectLoggingMetricsReleaseStorageString@@0@TextThread
                                            • String ID: FONTDEF$QWindowsFontDatabase::fontEngine
                                            • API String ID: 3774102356-296183570
                                            • Opcode ID: d82a02c77786a22702164648bd4fae6334c41e330de5998d56779980236d77a3
                                            • Instruction ID: d27aac17e99d80eabd03323c3d31c56bdc4cb1b9dfdef70277850e7168ac5ba9
                                            • Opcode Fuzzy Hash: d82a02c77786a22702164648bd4fae6334c41e330de5998d56779980236d77a3
                                            • Instruction Fuzzy Hash: 7E318922708A82C2DB50AF65F824AA973A4FF84B90F098031DE5E87FADDE3CD545C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66F0990 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 83timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?lock@QMutex@@QEAAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F09A4
                                            • ??0QTimer@@QEAA@PEAVQObject@@@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F09D3
                                            • ?qEnvironmentVariableIntValue@@YAHPEBDPEA_N@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F09F3
                                            • ?setInterval@QTimer@@QEAAXH@Z.QT5CORE ref: 00007FFDF66F0A0C
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66F0A41
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66F0A4C
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F0A65
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F0A72
                                            • ?start@QTimer@@QEAAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F0AC1
                                            • ?unlock@QMutexLocker@@QEAAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F0ADE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@Timer@@$Connection@Data@@ListMeta$?begin@?connect@?end@?lock@?set?start@?unlock@ConnectionEnvironmentInterval@Locker@@MutexMutex@@Object@@@Qt@@@Type@Value@@Variable
                                            • String ID: 1pollEngines()$2timeout()$QT_BEARER_POLL_TIMEOUT
                                            • API String ID: 728005902-2682786888
                                            • Opcode ID: 977a3d22c105ae4efde1d8968d319cdcb010b4bb4d11bc5eebf66312b07ee499
                                            • Instruction ID: f9aec01aea4188cb2e0b17d99a2866bfaf9d45231c3220cb82eeb6219283a6c7
                                            • Opcode Fuzzy Hash: 977a3d22c105ae4efde1d8968d319cdcb010b4bb4d11bc5eebf66312b07ee499
                                            • Instruction Fuzzy Hash: 2D412D36B08B8686EB009F21E4746A977A8FB84B94F040475EA6E07F9DEF3CD485C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66FF090 Relevance: 22.7, APIs: 15, Instructions: 160COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6700110: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,00000000,00000000,00007FFDF66FF0C1,?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF6700143
                                              • Part of subcall function 00007FFDF6700110: ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,00000000,00000000,00007FFDF66FF0C1,?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF6700157
                                              • Part of subcall function 00007FFDF6700110: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,00000000,00000000,00007FFDF66FF0C1,?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF6700192
                                              • Part of subcall function 00007FFDF6700110: ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,00000000,00000000,00007FFDF66FF0C1,?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF67001A6
                                            • ?size@QListData@@QEBAHXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF0D0
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF0F6
                                            • ?detach@QListData@@QEAAPEAUData@1@H@Z.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF104
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF110
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF11C
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF188
                                            • ?realloc@QListData@@QEAAXH@Z.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF192
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF19D
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF1AB
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF1E7
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF1FD
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF274
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF27E
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF288
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,00000000,00000000,00007FFDF66FEE7E), ref: 00007FFDF66FF2E6
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@$?end@$String@@$?dispose@Data@1@@$?detach@?realloc@?size@Data@1@
                                            • String ID:
                                            • API String ID: 3180553871-0
                                            • Opcode ID: 8194881865c4502df8e204512dd92fa9f5e6f772e369b032ac0766141efd5709
                                            • Instruction ID: ce3d56b9bf05b8331133c1ded66c2c7d1219030649eda3265d9157159f2f3d56
                                            • Opcode Fuzzy Hash: 8194881865c4502df8e204512dd92fa9f5e6f772e369b032ac0766141efd5709
                                            • Instruction Fuzzy Hash: B9617272B09A4282EB50DB64E46457973A8FB45B90F444571DA2E43FECEF3CD846CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D03A310 Relevance: 21.1, APIs: 14, Instructions: 124COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FF60D03A338
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FF60D03A34A
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FF60D03A35C
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FF60D03A36E
                                              • Part of subcall function 00007FF60D076824: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF60D07683E
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03A394
                                              • Part of subcall function 00007FF60D03A850: ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A873
                                              • Part of subcall function 00007FF60D03A850: ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A888
                                              • Part of subcall function 00007FF60D03A850: ??0QDate@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A893
                                              • Part of subcall function 00007FF60D03A850: ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A89D
                                              • Part of subcall function 00007FF60D03A850: ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A8AB
                                              • Part of subcall function 00007FF60D03A850: ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT5NETWORK(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A8D1
                                              • Part of subcall function 00007FF60D03A850: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A8E8
                                              • Part of subcall function 00007FF60D076824: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF60D076854
                                              • Part of subcall function 00007FF60D076824: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF60D07685A
                                            • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A430
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A43E
                                            • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A4A8
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A4B6
                                            • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A520
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A52E
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A538
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A547
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,00000001,00007FF60CFE370F), ref: 00007FF60D03A556
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$String@@$V0@@$Connection@Meta$?connectArray@@Base@ByteConnectionImpl@ObjectPrivate@@Qt@@SlotType@U3@@$Concurrency::cancel_current_task$AccessDate@@Manager@@NetworkObject@@@malloc
                                            • String ID:
                                            • API String ID: 388013295-0
                                            • Opcode ID: ea7904a7f400c4e8fcefc2bce3770add5672887597297de3ee4f919f6d1a9518
                                            • Instruction ID: e8364013e0bfa6badb137283fd7c4098cacbf79cc880447ed9da327333ce88c7
                                            • Opcode Fuzzy Hash: ea7904a7f400c4e8fcefc2bce3770add5672887597297de3ee4f919f6d1a9518
                                            • Instruction Fuzzy Hash: 17513932608BC19AD7609F01F8547AAB7A4FB84784F604235DACE87B68EF7CD159CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62C12F0 Relevance: 21.1, APIs: 14, Instructions: 103windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?desktopSettingsAware@QGuiApplication@@SA_NXZ.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF62BEA04), ref: 00007FFDF62C1308
                                              • Part of subcall function 00007FFDF6380E9C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF6291204), ref: 00007FFDF6380EB6
                                              • Part of subcall function 00007FFDF62C2650: ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C26A2
                                              • Part of subcall function 00007FFDF62C2650: ?light@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FFDF62C26B6
                                              • Part of subcall function 00007FFDF62C2650: ?dark@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FFDF62C26CA
                                              • Part of subcall function 00007FFDF62C2650: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C26DE
                                              • Part of subcall function 00007FFDF62C2650: ??0QColor@@QEAA@W4GlobalColor@Qt@@@Z.QT5GUI ref: 00007FFDF62C26ED
                                              • Part of subcall function 00007FFDF62C2650: ??0QColor@@QEAA@W4GlobalColor@Qt@@@Z.QT5GUI ref: 00007FFDF62C26FC
                                              • Part of subcall function 00007FFDF62C2650: ??0QColor@@QEAA@W4GlobalColor@Qt@@@Z.QT5GUI ref: 00007FFDF62C270B
                                              • Part of subcall function 00007FFDF62C2650: ??0QColor@@QEAA@W4GlobalColor@Qt@@@Z.QT5GUI ref: 00007FFDF62C271A
                                              • Part of subcall function 00007FFDF62C2650: ??0QPalette@@QEAA@AEBVQColor@@000000@Z.QT5GUI ref: 00007FFDF62C2753
                                              • Part of subcall function 00007FFDF62C2650: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C2767
                                              • Part of subcall function 00007FFDF62C2650: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C277D
                                              • Part of subcall function 00007FFDF62C2650: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C2793
                                              • Part of subcall function 00007FFDF62C2650: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C27A7
                                              • Part of subcall function 00007FFDF62C2650: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C27BC
                                              • Part of subcall function 00007FFDF62C2650: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C27C6
                                              • Part of subcall function 00007FFDF62C2650: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C27D0
                                              • Part of subcall function 00007FFDF62C2650: GetSysColor.USER32 ref: 00007FFDF62C27DB
                                              • Part of subcall function 00007FFDF62C2650: ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C2804
                                              • Part of subcall function 00007FFDF6380E9C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDF6380ED2
                                              • Part of subcall function 00007FFDF62C37B0: ??0QPalette@@QEAA@AEBV0@@Z.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00000010,?,?,00007FFDF62C1352), ref: 00007FFDF62C37D3
                                              • Part of subcall function 00007FFDF62C37B0: GetSysColor.USER32 ref: 00007FFDF62C37DE
                                              • Part of subcall function 00007FFDF62C37B0: ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C3807
                                              • Part of subcall function 00007FFDF62C37B0: GetSysColor.USER32 ref: 00007FFDF62C3812
                                              • Part of subcall function 00007FFDF62C37B0: ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C383B
                                              • Part of subcall function 00007FFDF62C37B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C384F
                                              • Part of subcall function 00007FFDF62C37B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C3864
                                              • Part of subcall function 00007FFDF62C37B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C386E
                                              • Part of subcall function 00007FFDF62C37B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C3882
                                              • Part of subcall function 00007FFDF62C37B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C3897
                                              • Part of subcall function 00007FFDF62C37B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C38A1
                                              • Part of subcall function 00007FFDF62C37B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C38B5
                                              • Part of subcall function 00007FFDF62C37B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C38CA
                                              • Part of subcall function 00007FFDF62C37B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C38D4
                                              • Part of subcall function 00007FFDF62C37B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C38E8
                                              • Part of subcall function 00007FFDF62C37B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C38FB
                                              • Part of subcall function 00007FFDF62C37B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C3905
                                              • Part of subcall function 00007FFDF62C37B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C3919
                                              • Part of subcall function 00007FFDF62C37B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C392E
                                              • Part of subcall function 00007FFDF62C37B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C3938
                                              • Part of subcall function 00007FFDF62C37B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C394C
                                              • Part of subcall function 00007FFDF62C37B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C3961
                                              • Part of subcall function 00007FFDF62C09B0: ??0QPalette@@QEAA@AEBV0@@Z.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF62C136C), ref: 00007FFDF62C09D9
                                              • Part of subcall function 00007FFDF62C09B0: GetSysColor.USER32 ref: 00007FFDF62C09E4
                                              • Part of subcall function 00007FFDF62C09B0: ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C0A0D
                                              • Part of subcall function 00007FFDF62C09B0: GetSysColor.USER32 ref: 00007FFDF62C0A18
                                              • Part of subcall function 00007FFDF62C09B0: ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C0A41
                                              • Part of subcall function 00007FFDF62C09B0: GetSysColor.USER32 ref: 00007FFDF62C0A4C
                                              • Part of subcall function 00007FFDF62C09B0: ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C0A75
                                              • Part of subcall function 00007FFDF62C09B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C0A89
                                              • Part of subcall function 00007FFDF62C09B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C0A9B
                                              • Part of subcall function 00007FFDF62C09B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C0AA5
                                              • Part of subcall function 00007FFDF62C09B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C0AB9
                                              • Part of subcall function 00007FFDF62C09B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C0ACB
                                              • Part of subcall function 00007FFDF62C09B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C0AD5
                                              • Part of subcall function 00007FFDF62C09B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C0AE9
                                              • Part of subcall function 00007FFDF62C09B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C0AFA
                                              • Part of subcall function 00007FFDF62C09B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C0B04
                                              • Part of subcall function 00007FFDF62C09B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C0B18
                                              • Part of subcall function 00007FFDF62C09B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C0B2A
                                              • Part of subcall function 00007FFDF62C09B0: ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C0B34
                                              • Part of subcall function 00007FFDF62C09B0: ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C0B48
                                              • Part of subcall function 00007FFDF62C09B0: ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C0B5B
                                            • SystemParametersInfoW.USER32 ref: 00007FFDF62C1384
                                            • ??0QPalette@@QEAA@AEBV0@@Z.QT5GUI(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF62BEA04), ref: 00007FFDF62C13AF
                                            • GetSysColor.USER32 ref: 00007FFDF62C13BD
                                            • ?setRgb@QColor@@QEAAXHHHH@Z.QT5GUI ref: 00007FFDF62C13E7
                                            • ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C13FD
                                            • ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C140F
                                            • ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C141A
                                            • ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C1430
                                            • ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C1444
                                            • ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C144F
                                            • ??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FFDF62C1465
                                            • ?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FFDF62C147A
                                            • ??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FFDF62C1485
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Color$Brush@@Color@@$?set$Palette@@$Qt@@@$Brush@Brush@@@Group@1@Role@1@$BrushStyle@$Rgb@$Color@Global$V0@@$?dark@?desktop?light@Application@@Aware@Color@@000000@Concurrency::cancel_current_taskInfoParametersSettingsSystemmalloc
                                            • String ID:
                                            • API String ID: 2365897899-0
                                            • Opcode ID: 02663c11d9f668223fc37d7b686f436bcd2ab1e8da3598bbb1a83ca069a3c9df
                                            • Instruction ID: b05ccbea5e2ee1d2c1eb57bfde8754fc1cacca5af4641f980f5b2356205f865c
                                            • Opcode Fuzzy Hash: 02663c11d9f668223fc37d7b686f436bcd2ab1e8da3598bbb1a83ca069a3c9df
                                            • Instruction Fuzzy Hash: 3741A032B08A4283EB50AB61E424AEA63A5FF84B95F444035D99E47FD9DF7CD544C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6681630 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 105COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                              • Part of subcall function 00007FFDF6683490: ??0QObjectPrivate@@QEAA@H@Z.QT5CORE(?,?,00000000,00007FFDF6683297), ref: 00007FFDF66834A3
                                              • Part of subcall function 00007FFDF6683490: ??0QMutex@@QEAA@W4RecursionMode@0@@Z.QT5CORE ref: 00007FFDF66835A0
                                            • ??0QObject@@IEAA@AEAVQObjectPrivate@@PEAV0@@Z.QT5CORE ref: 00007FFDF66832A0
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6683362
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF668336D
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6683399
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66833A4
                                            • _Init_thread_footer.LIBCMT ref: 00007FFDF6683416
                                            • _Init_thread_footer.LIBCMT ref: 00007FFDF6683479
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$?connect@ConnectionInit_thread_footerObjectPrivate@@Qt@@@Type@$Mode@0@@Mutex@@RecursionV0@@malloc
                                            • String ID: 1_q_configurationChanged(QNetworkConfiguration)$1_q_onlineStateChanged(bool)$2configurationChanged(QNetworkConfiguration)$2onlineStateChanged(bool)
                                            • API String ID: 2913475054-1936501521
                                            • Opcode ID: 4526b836f7f5a337a2d3f11dd50159e74262cbfecd5ae283704fdf2ff1baf3fb
                                            • Instruction ID: 8565979ddd5c1eccea9bcc87b4c24088986eb7c4ae39d4a9e9f3e8754bfa5f80
                                            • Opcode Fuzzy Hash: 4526b836f7f5a337a2d3f11dd50159e74262cbfecd5ae283704fdf2ff1baf3fb
                                            • Instruction Fuzzy Hash: 25510B21B08A4395E700DB70E9718B93368EF44760F4442B6D57D42EEEEF3CE9868B40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FBE00 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 51windowlibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Logger@@Message$??0?$?load@?utf16@?warning@AddressDataE__@@F@@@@Library@@PointProcPtr@@@StringSystemV0@@Vector@
                                            • String ID: DWriteCreateFactory$Unable to load dwrite.dll
                                            • API String ID: 3014551535-536298143
                                            • Opcode ID: 89c3ad6135cbdc0cf07aa5337a9c29c8c9fb03bc24a06efb61bffe4376d82d58
                                            • Instruction ID: deac1166a7cc27c60cedc9b828a506e183f483c701000c65cfe4ab59d3268e82
                                            • Opcode Fuzzy Hash: 89c3ad6135cbdc0cf07aa5337a9c29c8c9fb03bc24a06efb61bffe4376d82d58
                                            • Instruction Fuzzy Hash: 1A21A422B0D64292EB10AB74F464AA977E4EF98755F480131DA5E42FADEF2CD148CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FBEF0 Relevance: 18.2, APIs: 12, Instructions: 206threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@StorageThread$?get@?set@InfoParametersSystem$CompatibleCreateCriticalEnterInit_thread_footerReleaseSectionmalloc
                                            • String ID:
                                            • API String ID: 433356260-0
                                            • Opcode ID: 29b06b65a64784af6cce7820a74c72b435fc0c592c6a7865f4f135debf84de15
                                            • Instruction ID: fd09b9b23da28a8afbe2fe3978dbff0a6b71ef6c539dc8d60bd6cab732d8f5f9
                                            • Opcode Fuzzy Hash: 29b06b65a64784af6cce7820a74c72b435fc0c592c6a7865f4f135debf84de15
                                            • Instruction Fuzzy Hash: 37A19436B08BC286E7519B79E4207AA73A8FF55794F048235DA5D53BA8DF3CE445C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62BC120 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 69windowregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QPlatformInputContext@@QEAA@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC12B
                                            • RegisterWindowMessageW.USER32(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC142
                                            • ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC159
                                            • GetKeyboardLayout.USER32 ref: 00007FFDF62BC174
                                            • ?qt_localeFromLCID@@YA?AVQLocale@@K@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC184
                                            • CreateBitmap.GDI32 ref: 00007FFDF62BC1A8
                                            • ?inputMethod@QGuiApplication@@SAPEAVQInputMethod@@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC1CD
                                              • Part of subcall function 00007FFDF6380E9C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF6291204), ref: 00007FFDF6380EB6
                                            • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC232
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC240
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@InputMeta$??0?$?connect?input?qt_localeApplication@@Base@BitmapConnectionContext@@CreateF@@@@FromImpl@KeyboardLayoutLocale@@MessageMethod@Method@@ObjectPlatformPointPrivate@@Qt@@RegisterSlotType@U3@@Vector@Windowmalloc
                                            • String ID: MSIMEMouseOperation
                                            • API String ID: 2834244316-1919246749
                                            • Opcode ID: 23ad134479de05867900d0bb13ea568e2936c7e97c9eb8c13325275b2c367f58
                                            • Instruction ID: b60f79e28ffe43c9de76b3c1432af416b2409a2611ea608e325e334e4420091a
                                            • Opcode Fuzzy Hash: 23ad134479de05867900d0bb13ea568e2936c7e97c9eb8c13325275b2c367f58
                                            • Instruction Fuzzy Hash: E7315832608B4297EB509F64F5505A977E8FB88B50F448135DA9D43FA8DF3CE168CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66FEE20 Relevance: 16.7, APIs: 11, Instructions: 155COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@$?dispose@?end@Data@1@@$?detach@?realloc@?size@CriticalData@1@EnterInit_thread_footerSection
                                            • String ID:
                                            • API String ID: 2334027617-0
                                            • Opcode ID: 2e56a49140fd86ff447328b629110f7414199780ebd9379aeba205551dc76af0
                                            • Instruction ID: 4c565afdc48fdd6e27d5a2bd676bf6c34bbee13f5e5b5f2e19a7b7f9974aa571
                                            • Opcode Fuzzy Hash: 2e56a49140fd86ff447328b629110f7414199780ebd9379aeba205551dc76af0
                                            • Instruction Fuzzy Hash: 6E616D32B0AA8292EB509B29E474A793364EB84B64F544171DA2D43FECEF3CD845C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FB510 Relevance: 15.1, APIs: 10, Instructions: 97registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: QueryString@@Value$??0?$?fromArray@CharCloseF@@@@OpenPointUrl@@V0@$$V0@@Vector@freemalloc
                                            • String ID:
                                            • API String ID: 4225361595-0
                                            • Opcode ID: f45f6baccd3c904712e40c2f865374103fad5525e501e89d317635587510014e
                                            • Instruction ID: 9adf7f46ee9df015c42834f44df66dffe707cf90318aa6ff0c772e18fd34b02a
                                            • Opcode Fuzzy Hash: f45f6baccd3c904712e40c2f865374103fad5525e501e89d317635587510014e
                                            • Instruction Fuzzy Hash: AC417232708A8186EB60DF61E854BAEB7A4FB89B94F044131E99D87F98DF3CD145CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D009990 Relevance: 15.1, APIs: 10, Instructions: 87timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D0099A4
                                            • ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D0099B9
                                            • ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D0099C4
                                            • ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D0099CF
                                            • ??0QTcpSocket@@QEAA@PEAVQObject@@@Z.QT5NETWORK(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D0099DC
                                            • ??0QTimer@@QEAA@PEAVQObject@@@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D0099F4
                                              • Part of subcall function 00007FF60D076824: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF60D07683E
                                            • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D009A82
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF60CFE323C), ref: 00007FF60D009A8D
                                              • Part of subcall function 00007FF60D076824: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF60D076854
                                              • Part of subcall function 00007FF60D076824: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF60D07685A
                                            • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE ref: 00007FF60D009AFF
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FF60D009B0D
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$Array@@Byte$?connectBase@Concurrency::cancel_current_taskConnectionImpl@ObjectObject@@@Private@@Qt@@SlotType@U3@@$Socket@@Timer@@V0@@malloc
                                            • String ID:
                                            • API String ID: 426250642-0
                                            • Opcode ID: d506fd7fe21091b0ddd857f80b877d9a87e2c2ab2c4b1130fdbc30869b4510ec
                                            • Instruction ID: ff96109a13bec8f920924d93de45f1ae0f8c9adb6c5d272662a1b6357e0f0026
                                            • Opcode Fuzzy Hash: d506fd7fe21091b0ddd857f80b877d9a87e2c2ab2c4b1130fdbc30869b4510ec
                                            • Instruction Fuzzy Hash: FE411732508F8296D7208F51F8802AAB7B4FB84754F904235D6CE83B69EF7DE599CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FA690 Relevance: 15.1, APIs: 10, Instructions: 56COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF62FBBC0: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,00007FFDF62F48E3), ref: 00007FFDF62FBBDB
                                              • Part of subcall function 00007FFDF62FBBC0: ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,00007FFDF62F48E3), ref: 00007FFDF62FBBE8
                                              • Part of subcall function 00007FFDF62FBBC0: RemoveFontMemResourceEx.GDI32(?,?,?,?,00007FFDF62F48E3), ref: 00007FFDF62FBC0B
                                              • Part of subcall function 00007FFDF62FBBC0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,00007FFDF62F48E3), ref: 00007FFDF62FBCA1
                                              • Part of subcall function 00007FFDF62FBBC0: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,00007FFDF62F48E3), ref: 00007FFDF62FBCBC
                                              • Part of subcall function 00007FFDF62FBBC0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,00007FFDF62F48E3), ref: 00007FFDF62FBD11
                                              • Part of subcall function 00007FFDF62FBBC0: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,00007FFDF62F48E3), ref: 00007FFDF62FBD2C
                                            • GetDC.USER32 ref: 00007FFDF62FA6B9
                                            • EnumFontFamiliesExW.GDI32 ref: 00007FFDF62FA6E8
                                            • ReleaseDC.USER32 ref: 00007FFDF62FA6F3
                                              • Part of subcall function 00007FFDF62FC530: GetObjectW.GDI32 ref: 00007FFDF62FC569
                                              • Part of subcall function 00007FFDF62FC530: ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z.QT5CORE ref: 00007FFDF62FC582
                                              • Part of subcall function 00007FFDF62FC530: ??0QFont@@QEAA@AEBVQString@@HH_N@Z.QT5GUI ref: 00007FFDF62FC59A
                                              • Part of subcall function 00007FFDF62FC530: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FC5A4
                                              • Part of subcall function 00007FFDF62FC530: ?setStyle@QFont@@QEAAXW4Style@1@@Z.QT5GUI ref: 00007FFDF62FC5B5
                                              • Part of subcall function 00007FFDF62FC530: ?weightFromInteger@QPlatformFontDatabase@@SA?AW4Weight@QFont@@H@Z.QT5GUI ref: 00007FFDF62FC5C2
                                              • Part of subcall function 00007FFDF62FC530: ?setWeight@QFont@@QEAAXH@Z.QT5GUI ref: 00007FFDF62FC5CD
                                              • Part of subcall function 00007FFDF62FC530: ?setPointSizeF@QFont@@QEAAXN@Z.QT5GUI ref: 00007FFDF62FC5FB
                                              • Part of subcall function 00007FFDF62FC530: ?setUnderline@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62FC60B
                                              • Part of subcall function 00007FFDF62FC530: ?setOverline@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62FC616
                                              • Part of subcall function 00007FFDF62FC530: ?setStrikeOut@QFont@@QEAAX_N@Z.QT5GUI ref: 00007FFDF62FC626
                                              • Part of subcall function 00007FFDF62FC530: ?family@QFont@@QEBA?AVQString@@XZ.QT5GUI ref: 00007FFDF62FC64E
                                              • Part of subcall function 00007FFDF62FC530: ??8QString@@QEBA_NVQLatin1String@@@Z.QT5CORE ref: 00007FFDF62FC65B
                                              • Part of subcall function 00007FFDF62FC530: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FC668
                                              • Part of subcall function 00007FFDF62FC530: ?setFamily@QFont@@QEAAXAEBVQString@@@Z.QT5GUI ref: 00007FFDF62FC68A
                                              • Part of subcall function 00007FFDF62FC530: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FC694
                                              • Part of subcall function 00007FFDF62FC530: ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF62FC6A2
                                            • ?family@QFont@@QEBA?AVQString@@XZ.QT5GUI ref: 00007FFDF62FA70B
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FFDF62FA716
                                            • ?resolveFontFamilyAlias@QPlatformFontDatabase@@UEBA?AVQString@@AEBV2@@Z.QT5GUI ref: 00007FFDF62FA729
                                            • ??8@YA_NAEBVQString@@0@Z.QT5CORE ref: 00007FFDF62FA737
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FA745
                                            • ?registerFontFamily@QPlatformFontDatabase@@SAXAEBVQString@@@Z.QT5GUI ref: 00007FFDF62FA754
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FA767
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Font@@$?setFont$Data@@List$Database@@PlatformString@@@$?dispose@?family@Data@1@@Family@Weight@$??8@?begin@?end@?from?register?resolve?weightAlias@Array@Category@@CharDebugEnabled@EnumFamiliesFamilyFromInteger@Latin1LoggingObjectOut@Overline@PointReleaseRemoveResourceSizeStrikeString@@0@Style@Style@1@@Underline@V2@@
                                            • String ID:
                                            • API String ID: 1639580978-0
                                            • Opcode ID: c93e2f024df509bfccb002b69b33b9d1612f4c31b38b295fdca208cb6567caa1
                                            • Instruction ID: 46c205d449ac64400d3a7f78e695e71d976f71932e13a38aac84802db710dbf7
                                            • Opcode Fuzzy Hash: c93e2f024df509bfccb002b69b33b9d1612f4c31b38b295fdca208cb6567caa1
                                            • Instruction Fuzzy Hash: 95212162B2C68292DB50AB70F465BEA63A4FF84B84F455036E95E47E9DDF2CD148C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62D29F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$??0?$?load@?utf16@AddressE__@@F@@@@Init_thread_footerLibrary@@PointProcSystemV0@@Vector@
                                            • String ID: Direct3DCreate9
                                            • API String ID: 1136395496-2790205071
                                            • Opcode ID: 80d51bb5f0213e570c76c5ffa7d11de39070ff420f9802bd643db01c785f957c
                                            • Instruction ID: f427cc5668f423a9b03eb92467b44b5996dfacc8fdb113d72ad8008ab7ce7d95
                                            • Opcode Fuzzy Hash: 80d51bb5f0213e570c76c5ffa7d11de39070ff420f9802bd643db01c785f957c
                                            • Instruction Fuzzy Hash: 0A312F32F1AB4397EB40AB64E960B6473A8FF65714F084235D66D43AE8DF3CA198C310
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D076FB8 Relevance: 13.6, APIs: 9, Instructions: 94COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
                                            • String ID:
                                            • API String ID: 4178791639-0
                                            • Opcode ID: 3452e99be117c936ee7a3cca370841b8ec829d19776f5a31c5c249e03cf31877
                                            • Instruction ID: 318584f6c1b911b79ba7b061d591faa3dcbdf760b76c374359cff7b92597197b
                                            • Opcode Fuzzy Hash: 3452e99be117c936ee7a3cca370841b8ec829d19776f5a31c5c249e03cf31877
                                            • Instruction Fuzzy Hash: 9F314921E4C243A1FA64AF64A4513F92291AF813C4FB45634EA4FCF2D7FE6DA845C349
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629A8D0 Relevance: 13.6, APIs: 9, Instructions: 59windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: MetricsSystem$MessageSend$DestroyIcon
                                            • String ID:
                                            • API String ID: 716659538-0
                                            • Opcode ID: 7fe19fbf9da8fbfc6fdc38b90b6a81077fd5543be0747dad931ed74d307f69ca
                                            • Instruction ID: f5db963d9ef9f2c61d451e0998f84792987e5ae1682713f8c58895118af5bd50
                                            • Opcode Fuzzy Hash: 7fe19fbf9da8fbfc6fdc38b90b6a81077fd5543be0747dad931ed74d307f69ca
                                            • Instruction Fuzzy Hash: F9214426B05B5183FB489BB19464BA873A8FF84B84F548135DA2E43BC9CF3DE4659300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60CFD0840 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,00000000,?,?,00007FF60CFE328C), ref: 00007FF60CFD085C
                                            • ??0QMutex@@QEAA@W4RecursionMode@0@@Z.QT5CORE(?,?,00007FF60CFE328C), ref: 00007FF60CFD0874
                                              • Part of subcall function 00007FF60D076824: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF60D07683E
                                            • _Mtx_init_in_situ.MSVCP140(?,?,00007FF60CFE328C), ref: 00007FF60CFD0905
                                            • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00007FF60CFE328C), ref: 00007FF60CFD091C
                                            • memset.VCRUNTIME140(?,?,00007FF60CFE328C), ref: 00007FF60CFD092F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: malloc$Mode@0@@Mtx_init_in_situMutex@@Object@@RecursionV0@@memset
                                            • String ID: @)($@)(
                                            • API String ID: 499055603-642521220
                                            • Opcode ID: 584be7d1875250f0b48c7e166cb546adb6e9a1d2ef3de1187fddeb7953c054ab
                                            • Instruction ID: 45d5703b4b6f61a3ac965bc2c37ae989575c6c2ddb358bbda4d8e19ad7e9e463
                                            • Opcode Fuzzy Hash: 584be7d1875250f0b48c7e166cb546adb6e9a1d2ef3de1187fddeb7953c054ab
                                            • Instruction Fuzzy Hash: FA41283AA00B81DAE310DF20F94429E77A8F74574CF618225DF8D47618EF78D5A9EB44
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66EE310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EE31B
                                            • ??0QMutex@@QEAA@W4RecursionMode@0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66EBFE2), ref: 00007FFDF66EE33C
                                            • ??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FFDF66EE36B
                                            • ??0QFactoryLoader@@QEAA@PEBDAEBVQString@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FFDF66EE387
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF66EE392
                                              • Part of subcall function 00007FFDF66EB5F0: ?normalizedType@QMetaObject@@SA?AVQByteArray@@PEBD@Z.QT5CORE ref: 00007FFDF66EB633
                                              • Part of subcall function 00007FFDF66EB5F0: ?registerNormalizedType@QMetaType@@SAHAEBVQByteArray@@P6AXPEAX@ZP6APEAX1PEBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PEBUQMetaObject@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66EE3D4), ref: 00007FFDF66EB667
                                              • Part of subcall function 00007FFDF66EB5F0: ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66EE3D4), ref: 00007FFDF66EB674
                                              • Part of subcall function 00007FFDF66F06D0: ?normalizedType@QMetaObject@@SA?AVQByteArray@@PEBD@Z.QT5CORE ref: 00007FFDF66F0713
                                              • Part of subcall function 00007FFDF66F06D0: ?registerNormalizedType@QMetaType@@SAHAEBVQByteArray@@P6AXPEAX@ZP6APEAX1PEBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PEBUQMetaObject@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66EE3D9), ref: 00007FFDF66F0747
                                              • Part of subcall function 00007FFDF66F06D0: ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66EE3D9), ref: 00007FFDF66F0754
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Meta$Array@@Byte$Type@$Object@@String@@$?normalized?registerFlag@Flags@NormalizedObject@@@TypeType@@Type@@@@$CaseFactoryLatin1Loader@@Mode@0@@Mutex@@Qt@@@RecursionSensitivity@String@@@V0@@
                                            • String ID: /bearer$org.qt-project.Qt.QBearerEngineFactoryInterface
                                            • API String ID: 3105894908-2899753972
                                            • Opcode ID: cde3ec7a76f0447b6072e042afef386fa0dad04d5a1ffb5325d1990b6dedaa35
                                            • Instruction ID: 6c962d31e609a4ecdc06eeea1765a263a11923c3694266312ad45160d1d0d189
                                            • Opcode Fuzzy Hash: cde3ec7a76f0447b6072e042afef386fa0dad04d5a1ffb5325d1990b6dedaa35
                                            • Instruction Fuzzy Hash: B221F972608B4A86EB109F64E87076977B8FB48B48F500175DA9C43BA8EF7DD585C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6294960 Relevance: 10.6, APIs: 7, Instructions: 108COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Rect@@Window$Point@@Size@@@$?translated@ClientLongParentPlacementPoint@@@RectScreen
                                            • String ID:
                                            • API String ID: 3157457706-0
                                            • Opcode ID: a14c0c4b07bdae3e7ad5014cdeb743477b427a3d35edb3ea517e97c65fee6739
                                            • Instruction ID: f750f70d108da351ac47b7efe74c1c0a349e83c809490e1ba45f7e553ecb3079
                                            • Opcode Fuzzy Hash: a14c0c4b07bdae3e7ad5014cdeb743477b427a3d35edb3ea517e97c65fee6739
                                            • Instruction Fuzzy Hash: 14511673B146019FE714DFB9D4509EC37B5AB88B88B45813ADE0A63F8CEE389509CB54
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D03A850 Relevance: 10.5, APIs: 7, Instructions: 47networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A873
                                            • ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A888
                                            • ??0QDate@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A893
                                            • ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A89D
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A8AB
                                              • Part of subcall function 00007FF60D076824: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF60D07683E
                                            • ??0QNetworkAccessManager@@QEAA@PEAVQObject@@@Z.QT5NETWORK(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A8D1
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,00000000,?,00007FF60D03A3AB), ref: 00007FF60D03A8E8
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteString@@V0@@$AccessDate@@Manager@@NetworkObject@@Object@@@malloc
                                            • String ID:
                                            • API String ID: 3495467707-0
                                            • Opcode ID: 1497478357ffaab02da242d7c893b404493a47b058a6e4c3d8c7c3c08646b86b
                                            • Instruction ID: 4029b394326c31a522c8b6258e5787323117d33c2345cbc3f2b48e9312899062
                                            • Opcode Fuzzy Hash: 1497478357ffaab02da242d7c893b404493a47b058a6e4c3d8c7c3c08646b86b
                                            • Instruction Fuzzy Hash: 23113A72A08B4192EB10DF11F84896977A9FB88B91F624230DE8E86774EF7CD54AC304
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629E380 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6380E9C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF6291204), ref: 00007FFDF6380EB6
                                              • Part of subcall function 00007FFDF629E400: OleInitializeWOW.OLE32 ref: 00007FFDF629E4DB
                                              • Part of subcall function 00007FFDF629E400: GetDC.USER32 ref: 00007FFDF629E52C
                                              • Part of subcall function 00007FFDF629E400: GetDeviceCaps.GDI32 ref: 00007FFDF629E53E
                                              • Part of subcall function 00007FFDF629E400: GetKeyboardLayoutList.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E54B
                                              • Part of subcall function 00007FFDF629E400: GetKeyboardLayoutList.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF629E39B,?,?,00000000,00007FFDF629C54F), ref: 00007FFDF629E581
                                            • ?qgetenv@@YA?AVQByteArray@@PEBD@Z.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3B1
                                            • ?fromLocal8Bit@QString@@SA?AV1@AEBVQByteArray@@@Z.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3CC
                                            • ?setFilterRules@QLoggingCategory@@SAXAEBVQString@@@Z.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3D5
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3E0
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF629C54F,?,?,?,?,?,?,?,?,?,00007FFDF629C4DF), ref: 00007FFDF629E3EB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Array@@KeyboardLayoutListString@@$?from?qgetenv@@?setArray@@@Bit@CapsCategory@@DeviceFilterInitializeLocal8LoggingRules@String@@@malloc
                                            • String ID: QT_QPA_VERBOSE
                                            • API String ID: 2569953207-688947982
                                            • Opcode ID: 90b2fab9819d8738aa6b74186041ecc765a5521450b8a8f60412d76a10b99df7
                                            • Instruction ID: 4b0ff1b71f32a2a16355e9075b8d5f75f27c10029f774bfca7957f52c2ab3f21
                                            • Opcode Fuzzy Hash: 90b2fab9819d8738aa6b74186041ecc765a5521450b8a8f60412d76a10b99df7
                                            • Instruction Fuzzy Hash: 12F06222B18A4383DB00AB60F4649B963A4FF94B45F49A031E56F03BEDDE3CD449C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A5BC0 Relevance: 9.1, APIs: 6, Instructions: 116COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$V0@@$Array@@ByteData@@List$??0?$?append@?from?prepend@Array@CharF@@@@InfoLatin1MonitorPointString@@@Url@@V0@$$Vector@memset
                                            • String ID:
                                            • API String ID: 2414927885-0
                                            • Opcode ID: 34adda2d028765efee49214cc55f537d7b212ca63e24fad93ce6f1a1f073cb6b
                                            • Instruction ID: 62538d264223cd2249f086c8e56e2d6db4066a9ddf67792b155726878dd57050
                                            • Opcode Fuzzy Hash: 34adda2d028765efee49214cc55f537d7b212ca63e24fad93ce6f1a1f073cb6b
                                            • Instruction Fuzzy Hash: 00518933A04A82CAE7009F38D0506EC73B5FB9974CF05A225EE5D57AA9EF78E584C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6295CC0 Relevance: 9.1, APIs: 6, Instructions: 115COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Window@@$Size@Size@@$?map?maximum?minimum?scale?window@FromGlobal@HighLevel@Origin@Origin@1@PlatformPoint@@Point@@@ScaleScaling@@V2@@
                                            • String ID:
                                            • API String ID: 969568068-0
                                            • Opcode ID: f5d65a586ac0dea837f64501c7736b08baf65b6654f0aee4af9230c268983dea
                                            • Instruction ID: 064d8429506137e21b9c9f68ed6400e3c3be874eaceaea92ad3c7d4c337f8927
                                            • Opcode Fuzzy Hash: f5d65a586ac0dea837f64501c7736b08baf65b6654f0aee4af9230c268983dea
                                            • Instruction Fuzzy Hash: 87417E32B04B028AEB54CF66D460AAD3774BB85B98F148035CE6DA7A9CDF39D485D700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D0778B0 Relevance: 7.6, APIs: 5, Instructions: 108COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF60D0770BE), ref: 00007FF60D0778BF
                                            • CommandLineToArgvW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF60D0770BE), ref: 00007FF60D0778CD
                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF60D0770BE), ref: 00007FF60D077981
                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF60D0770BE), ref: 00007FF60D0779B2
                                            • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF60D0770BE), ref: 00007FF60D0779F5
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ByteCharCommandLineMultiWide$ArgvFreeLocal
                                            • String ID:
                                            • API String ID: 4060259846-0
                                            • Opcode ID: 71ace43b1454cbbedb4b20cbd1568bff122bacc4825fa76463e3a0d5321b0603
                                            • Instruction ID: a2aec0aa122b338515e74dec04f48b3be4b34b661c6a6ec5fbea525472a3436c
                                            • Opcode Fuzzy Hash: 71ace43b1454cbbedb4b20cbd1568bff122bacc4825fa76463e3a0d5321b0603
                                            • Instruction Fuzzy Hash: C4416232A08B8186D750DF15B84016AB7A4FB89BE0F644335EEAE87B95EF3DD454CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D03A1C0 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03A1F8
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03A20E
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03A224
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03A23A
                                              • Part of subcall function 00007FF60D03C170: ??0QDialog@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z.QT5WIDGETS ref: 00007FF60D03C1B0
                                              • Part of subcall function 00007FF60D03C170: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03C1E3
                                              • Part of subcall function 00007FF60D03C170: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03C1F3
                                              • Part of subcall function 00007FF60D03C170: ?setWindowFlag@QWidget@@QEAAXW4WindowType@Qt@@_N@Z.QT5WIDGETS ref: 00007FF60D03C21D
                                              • Part of subcall function 00007FF60D03C170: ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60D03C23B
                                              • Part of subcall function 00007FF60D03C170: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03C24C
                                              • Part of subcall function 00007FF60D03C170: ?append@QString@@QEAAAEAV1@AEBV1@@Z.QT5CORE ref: 00007FF60D03C264
                                              • Part of subcall function 00007FF60D03C170: ?setWindowTitle@QWidget@@QEAAXAEBVQString@@@Z.QT5WIDGETS ref: 00007FF60D03C270
                                              • Part of subcall function 00007FF60D03C170: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03C27B
                                              • Part of subcall function 00007FF60D03C170: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D03C286
                                              • Part of subcall function 00007FF60D03C170: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D03C2A3
                                              • Part of subcall function 00007FF60D03C170: ??0QString@@QEAA@$$QEAV0@@Z.QT5CORE ref: 00007FF60D03C2C2
                                              • Part of subcall function 00007FF60D03C170: ??0QString@@QEAA@$$QEAV0@@Z.QT5CORE ref: 00007FF60D03C2F1
                                            • ?exec@QDialog@@UEAAHXZ.QT5WIDGETS ref: 00007FF60D03A271
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: V0@@$Array@@Byte$String@@$Window$Widget@@$?setA@$$Dialog@@Type@$?append@?exec@?fromArrayAscii_helper@Data@Flag@Flags@Qt@@@@@Qt@@_String@@@Title@TypedV1@@
                                            • String ID:
                                            • API String ID: 3111602105-0
                                            • Opcode ID: 02dcfc06fdf7be39d8ff073e597ef7df3c8c0a87df015ca54106d26965da6615
                                            • Instruction ID: 47017887b91ad1acac3d76b4acfbb81ee197162dbd9b825c879616c8d6208af0
                                            • Opcode Fuzzy Hash: 02dcfc06fdf7be39d8ff073e597ef7df3c8c0a87df015ca54106d26965da6615
                                            • Instruction Fuzzy Hash: B8318072B08A8186EB10DF15E85066E6365FF84BC0F644636EA9FC3B99EF3DD8508704
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629FCE0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF629FD0D
                                              • Part of subcall function 00007FFDF62A1C30: GetModuleHandleW.KERNEL32 ref: 00007FFDF62A1C88
                                              • Part of subcall function 00007FFDF62A1C30: ?utf16@QString@@QEBAPEBGXZ.QT5CORE ref: 00007FFDF62A1C9F
                                              • Part of subcall function 00007FFDF62A1C30: GetClassInfoW.USER32 ref: 00007FFDF62A1CAF
                                              • Part of subcall function 00007FFDF62A1C30: ?createUuid@QUuid@@SA?AV1@XZ.QT5CORE ref: 00007FFDF62A1CDF
                                              • Part of subcall function 00007FFDF62A1C30: ?toString@QUuid@@QEBA?AVQString@@XZ.QT5CORE ref: 00007FFDF62A1CED
                                              • Part of subcall function 00007FFDF62A1C30: ?append@QString@@QEAAAEAV1@AEBV1@@Z.QT5CORE ref: 00007FFDF62A1CF9
                                              • Part of subcall function 00007FFDF62A1C30: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62A1D04
                                              • Part of subcall function 00007FFDF62A1C30: ?qHash@@YAIAEBVQString@@I@Z.QT5CORE ref: 00007FFDF62A1D21
                                              • Part of subcall function 00007FFDF62A1C30: LoadImageW.USER32 ref: 00007FFDF62A1D98
                                              • Part of subcall function 00007FFDF62A1C30: GetSystemMetrics.USER32 ref: 00007FFDF62A1DAB
                                              • Part of subcall function 00007FFDF62A1C30: GetSystemMetrics.USER32 ref: 00007FFDF62A1DB7
                                              • Part of subcall function 00007FFDF62A1C30: LoadImageW.USER32 ref: 00007FFDF62A1DD7
                                            • GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF62D7447), ref: 00007FFDF629FD3B
                                            • ?utf16@QString@@QEBAPEBGXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDF62D7447), ref: 00007FFDF629FD4C
                                            • CreateWindowExW.USER32 ref: 00007FFDF629FD9A
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF629FDAB
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$?utf16@HandleImageLoadMetricsModuleSystemUuid@@$?append@?createArray@@ByteClassCreateHash@@InfoString@Uuid@V0@@V1@@Window
                                            • String ID:
                                            • API String ID: 359114985-0
                                            • Opcode ID: 8aa5463ea2137e58ff5abd2332db762b8f3759d08f9094684ccbfa3ff9c6ded1
                                            • Instruction ID: 0abf05986f467ac3405301e2e14f6467defad62c6e091f1620ec59454fc0cfcb
                                            • Opcode Fuzzy Hash: 8aa5463ea2137e58ff5abd2332db762b8f3759d08f9094684ccbfa3ff9c6ded1
                                            • Instruction Fuzzy Hash: 0521503260878686D7209F61F45469AB7A4F789BE4F584239EEAD43F99CF3CD1448B40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66FF9A0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@?dispose@?end@Data@1@@Init_thread_footer
                                            • String ID:
                                            • API String ID: 4115183119-0
                                            • Opcode ID: 0d9a1dc72535c92f52e2cad76d236c7dfaeb5771b71948feb16e2bf1e9c9f201
                                            • Instruction ID: a31c95a8dccbbf792c4a5929e01c87a614ad2148fb10307d44e4b147b0907eea
                                            • Opcode Fuzzy Hash: 0d9a1dc72535c92f52e2cad76d236c7dfaeb5771b71948feb16e2bf1e9c9f201
                                            • Instruction Fuzzy Hash: 98411C32B09A8286EB109F29E47096973A8EB84B50B544235D67D43FEDEF3DD9468B40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A0EA0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 50163e0c4f2069167ca1fd90d21a807d5babe4cbbf714c05aed28f1f3fecb0dd
                                            • Instruction ID: ac4c137e1827ccebb177e95304339f76820412e97d7fab9f40ca06ef725a590d
                                            • Opcode Fuzzy Hash: 50163e0c4f2069167ca1fd90d21a807d5babe4cbbf714c05aed28f1f3fecb0dd
                                            • Instruction Fuzzy Hash: 8931BB22F0864292FB549B16E550B7963A4EF48BD8F085030EE6E9BBCDDE7CE8508744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6305850 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?utf16@QString@@QEBAPEBGXZ.QT5CORE ref: 00007FFDF63058E8
                                              • Part of subcall function 00007FFDF62FB510: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE ref: 00007FFDF62FB536
                                              • Part of subcall function 00007FFDF62FB510: RegOpenKeyExW.ADVAPI32 ref: 00007FFDF62FB55E
                                              • Part of subcall function 00007FFDF62FB510: RegQueryValueExW.ADVAPI32 ref: 00007FFDF62FB591
                                              • Part of subcall function 00007FFDF62FB510: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDF62FB5CB
                                              • Part of subcall function 00007FFDF62FB510: RegQueryValueExW.ADVAPI32 ref: 00007FFDF62FB63D
                                              • Part of subcall function 00007FFDF62FB510: ?fromWCharArray@QString@@SA?AV1@PEB_WH@Z.QT5CORE ref: 00007FFDF62FB655
                                              • Part of subcall function 00007FFDF62FB510: ??4QUrl@@QEAAAEAV0@$$QEAV0@@Z.QT5CORE ref: 00007FFDF62FB661
                                              • Part of subcall function 00007FFDF62FB510: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62FB66C
                                              • Part of subcall function 00007FFDF62FB510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDF62FB681
                                              • Part of subcall function 00007FFDF62FB510: RegCloseKey.ADVAPI32 ref: 00007FFDF62FB68C
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE ref: 00007FFDF630590C
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF6305920
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF630592B
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$QueryV0@@Value$??0?$?from?utf16@Array@Array@@ByteCharCloseEmpty@F@@@@OpenPointUrl@@V0@$$Vector@freemalloc
                                            • String ID:
                                            • API String ID: 1635077169-0
                                            • Opcode ID: 5fdbff7383ef78e8c0f49ea5cd42e0c193aef33654bc0cbc0a31566acb867196
                                            • Instruction ID: 63ef418ac6232bd47e7d5cbf6b7c7c166a4bc7310a64a90915fb5b1291cbc7d8
                                            • Opcode Fuzzy Hash: 5fdbff7383ef78e8c0f49ea5cd42e0c193aef33654bc0cbc0a31566acb867196
                                            • Instruction Fuzzy Hash: 03218615618AC582F7115B28E426AF5A3F5FF987D9F085230DE9803AB9EF3DE186C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629C090 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetWindowLongPtrW.USER32 ref: 00007FFDF629C0C2
                                              • Part of subcall function 00007FFDF6299D70: ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF6299D84
                                              • Part of subcall function 00007FFDF6299D70: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF6299DAA
                                              • Part of subcall function 00007FFDF6299D70: ?number@QByteArray@@SA?AV1@_KH@Z.QT5CORE ref: 00007FFDF6299DC0
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@AEBV1@@Z.QT5CORE ref: 00007FFDF6299DD1
                                              • Part of subcall function 00007FFDF6299D70: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF6299DDF
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299DF8
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299E13
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299E2E
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299E49
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299E64
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299E7F
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299E9A
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299EB5
                                              • Part of subcall function 00007FFDF6299D70: ?append@QByteArray@@QEAAAEAV1@PEBD@Z.QT5CORE ref: 00007FFDF6299ED0
                                              • Part of subcall function 00007FFDF6299D70: ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF6299EF1
                                              • Part of subcall function 00007FFDF6299D70: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FFDF6299EFF
                                              • Part of subcall function 00007FFDF6299D70: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF6299F0F
                                              • Part of subcall function 00007FFDF6299D70: ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ.QT5GUI ref: 00007FFDF6299F26
                                              • Part of subcall function 00007FFDF6299D70: ??6@YA?AVQDebug@@V0@PEBVQPlatformSurface@@@Z.QT5GUI ref: 00007FFDF6299F3F
                                              • Part of subcall function 00007FFDF6299D70: ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z.QT5GUI ref: 00007FFDF6299F50
                                              • Part of subcall function 00007FFDF6299D70: ??6QDebug@@QEAAAEAV0@AEBVQByteArray@@@Z.QT5CORE ref: 00007FFDF6299F61
                                            • GetWindowLongPtrW.USER32 ref: 00007FFDF629C0F7
                                            • GetCapture.USER32 ref: 00007FFDF629C116
                                            • ReleaseCapture.USER32 ref: 00007FFDF629C122
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Array@@$?append@$Debug@@$??6@CaptureLogger@@LongMessagePlatformWindowWindow@@$?debug@?number@?window@Array@@@Category@@DebugEnabled@H00@LoggingReleaseSurface@@@V1@@V1@_Window@@@
                                            • String ID:
                                            • API String ID: 1168251963-0
                                            • Opcode ID: 99a4eb74e3e70c6f1aaedb7d6bbb54e07b842470f1b1723bfefb1967d4cf6c7a
                                            • Instruction ID: 5e226e260de4f4139375b4919419547644299568946cc5d9de435ffc513d46a2
                                            • Opcode Fuzzy Hash: 99a4eb74e3e70c6f1aaedb7d6bbb54e07b842470f1b1723bfefb1967d4cf6c7a
                                            • Instruction Fuzzy Hash: CA117362F0890283EB546B79D86447C22B9EFCAFA5F188131C92E46BEDCE3CD4859310
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629D8DB Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?requested@QPlatformInputContextFactory@@SA?AVQString@@XZ.QT5GUI ref: 00007FFDF629D8EE
                                            • ?isNull@QString@@QEBA_NXZ.QT5CORE ref: 00007FFDF629D8F9
                                            • ?create@QPlatformInputContextFactory@@SAPEAVQPlatformInputContext@@AEBVQString@@@Z.QT5GUI ref: 00007FFDF629D937
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF629D965
                                              • Part of subcall function 00007FFDF6380E9C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF6291204), ref: 00007FFDF6380EB6
                                              • Part of subcall function 00007FFDF62BC120: ??0QPlatformInputContext@@QEAA@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC12B
                                              • Part of subcall function 00007FFDF62BC120: RegisterWindowMessageW.USER32(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC142
                                              • Part of subcall function 00007FFDF62BC120: ??0?$QVector@VQPointF@@@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC159
                                              • Part of subcall function 00007FFDF62BC120: GetKeyboardLayout.USER32 ref: 00007FFDF62BC174
                                              • Part of subcall function 00007FFDF62BC120: ?qt_localeFromLCID@@YA?AVQLocale@@K@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC184
                                              • Part of subcall function 00007FFDF62BC120: CreateBitmap.GDI32 ref: 00007FFDF62BC1A8
                                              • Part of subcall function 00007FFDF62BC120: ?inputMethod@QGuiApplication@@SAPEAVQInputMethod@@XZ.QT5GUI(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC1CD
                                              • Part of subcall function 00007FFDF62BC120: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC232
                                              • Part of subcall function 00007FFDF62BC120: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF629D915), ref: 00007FFDF62BC240
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Input$Platform$Object@@String@@$Connection@ContextContext@@Factory@@Meta$??0?$?connect?create@?input?qt_locale?requested@Application@@Base@BitmapConnectionCreateF@@@@FromImpl@KeyboardLayoutLocale@@MessageMethod@Method@@Null@ObjectPointPrivate@@Qt@@RegisterSlotString@@@Type@U3@@Vector@Windowmalloc
                                            • String ID:
                                            • API String ID: 2591607139-0
                                            • Opcode ID: 7f4979beb38131c5a12365d380cf8952f26fc387d51bd56cfcad7536920aee67
                                            • Instruction ID: aa5b2ebd742ea887fc3abc25f995703108afe1c45d2bbcb6cbad5adc890e85c7
                                            • Opcode Fuzzy Hash: 7f4979beb38131c5a12365d380cf8952f26fc387d51bd56cfcad7536920aee67
                                            • Instruction Fuzzy Hash: 34018026709D4681EF44AB61E4706B963A4EF84B48F484530EA9F4BEEDDF2CD889D310
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629C970 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6380E9C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF6291204), ref: 00007FFDF6380EB6
                                            • ??0QEventDispatcherWin32@@QEAA@PEAVQObject@@@Z.QT5CORE ref: 00007FFDF62F33D9
                                            • ?setObjectName@QObject@@QEAAXAEBVQString@@@Z.QT5CORE ref: 00007FFDF62F340B
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62F3416
                                            • ?createInternalHwnd@QEventDispatcherWin32@@IEAAXXZ.QT5CORE ref: 00007FFDF62F341F
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: DispatcherEventWin32@@$?create?setHwnd@InternalName@ObjectObject@@Object@@@String@@String@@@malloc
                                            • String ID:
                                            • API String ID: 4121027395-0
                                            • Opcode ID: 429b9cf696380ab6c15960212ae059710ee90605bd24be306e4afc1ccdd6b6fc
                                            • Instruction ID: a0d96e871d75a25a58b2745013ddc7546caa45153e2801a9cbe39ff57abe7bbf
                                            • Opcode Fuzzy Hash: 429b9cf696380ab6c15960212ae059710ee90605bd24be306e4afc1ccdd6b6fc
                                            • Instruction Fuzzy Hash: 86F06221B19742D7EB04ABB1F8649A923E4EF89B44F485030D96E47B9DEF3CD1898740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F14F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?compare@QString@@QEBAHVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FFDF62F1526
                                              • Part of subcall function 00007FFDF6380E9C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF6291204), ref: 00007FFDF6380EB6
                                              • Part of subcall function 00007FFDF6380E9C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDF6380ED2
                                            • ??0QObject@@QEAA@PEAV0@@Z.QT5CORE ref: 00007FFDF62F27DE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$?compare@CaseConcurrency::cancel_current_taskLatin1Object@@Qt@@@Sensitivity@V0@@malloc
                                            • String ID: windows
                                            • API String ID: 2245036053-3823601051
                                            • Opcode ID: dad501411b0e62721227bfd5fcf9d6eda6d5d5c78e115cbc3192afaf9e396538
                                            • Instruction ID: 98f94a234f31014a6883aa914d8bd200aa4ff699061036f4af33c11707b0a7fc
                                            • Opcode Fuzzy Hash: dad501411b0e62721227bfd5fcf9d6eda6d5d5c78e115cbc3192afaf9e396538
                                            • Instruction Fuzzy Hash: 1E11C622B19B4682EB10AB61E9615B963E8FF8C784F484134DE9C47B9CEF3CD1958B00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F6A30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ErrnoInit_thread_footerWarning@@
                                            • String ID: DWriteCreateFactory failed
                                            • API String ID: 1977386182-439803201
                                            • Opcode ID: aa8cf9cc25beba3794105967942bd94a050176681d39862ef65213899370a390
                                            • Instruction ID: 8eb6a8cd712ceb30c1038a315153106223f2dc69b801ebc944d7b8b314a6bb73
                                            • Opcode Fuzzy Hash: aa8cf9cc25beba3794105967942bd94a050176681d39862ef65213899370a390
                                            • Instruction Fuzzy Hash: 39215E25B19A4682EB40AB64E8A0BAA23E9FF54745F484035D92D82BE8DF3CE558D710
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62FA100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?qErrnoWarning@@YAXPEBDZZ.QT5CORE(?,?,00007FFDF62F6C5D,?), ref: 00007FFDF62FA159
                                              • Part of subcall function 00007FFDF62F6A30: ?qErrnoWarning@@YAXPEBDZZ.QT5CORE ref: 00007FFDF62F6AB1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ErrnoWarning@@
                                            • String ID: %s: GetGdiInterop failed$initDirectWrite
                                            • API String ID: 3819680178-3227400310
                                            • Opcode ID: f0c88bf885b556876e7a2203bb8fb55b995acab1564d7b78a15bed15ed062289
                                            • Instruction ID: 986f0e3b5e852c4d39b6f4ce1d3ac769e1b40eee9d058edce3760e1d99771f5b
                                            • Opcode Fuzzy Hash: f0c88bf885b556876e7a2203bb8fb55b995acab1564d7b78a15bed15ed062289
                                            • Instruction Fuzzy Hash: 57018162B08581D2EF44CF25E4A0BBA23A4FF44B84F899031D72D87A99DF28D4A5D704
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A1690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Init_thread_footerLogging
                                            • String ID: qt.qpa.windows
                                            • API String ID: 189896515-1025278669
                                            • Opcode ID: 21a5c4d8f0b606bd0ab67f06c00f2ed27481a3d067ae290976b8b823a84b18c7
                                            • Instruction ID: 5ce1fd557a227e36abae19d173159c18c224c3a034120e82ec9cbdfd8bbf8fa4
                                            • Opcode Fuzzy Hash: 21a5c4d8f0b606bd0ab67f06c00f2ed27481a3d067ae290976b8b823a84b18c7
                                            • Instruction Fuzzy Hash: 64012C71F1890BC3EB00AB65E8608B833E9AFA5760F4C4131C53D43AE9DF2CA599D710
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D010BD0 Relevance: 4.7, APIs: 3, Instructions: 157COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo_noreturn$_stat64i32
                                            • String ID:
                                            • API String ID: 1866921897-0
                                            • Opcode ID: 76c9ad0c803706fc416fb83ee43f31a6602fe4745476cb125df6d3f0ea558acf
                                            • Instruction ID: 8d19741b1c61286fa2539e4ce355d3f3d3d79f60e96ad9b9475ffa1db7a63786
                                            • Opcode Fuzzy Hash: 76c9ad0c803706fc416fb83ee43f31a6602fe4745476cb125df6d3f0ea558acf
                                            • Instruction Fuzzy Hash: 4651B466F0468294FB109FA5D4443AC2762BB017ACFA04335DEAE976C5EF78A4C5C304
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF670EFF0 Relevance: 4.5, APIs: 3, Instructions: 43COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QIODevicePrivate@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF67307A7,?,?,?,00007FFDF6746CBE,?,?,00000000,00007FFDF6730752), ref: 00007FFDF670EFFD
                                            • ??0QString@@QEAA@XZ.QT5CORE ref: 00007FFDF670F02F
                                              • Part of subcall function 00007FFDF66F7970: ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00000000,00007FFDF67307A7,?,?,?,00007FFDF6746CBE,?,?,00000000,00007FFDF6730752), ref: 00007FFDF66F798D
                                              • Part of subcall function 00007FFDF66F7970: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00000000,00007FFDF67307A7,?,?,?,00007FFDF6746CBE,?,?,00000000,00007FFDF6730752), ref: 00007FFDF66F7997
                                            • ??0QString@@QEAA@XZ.QT5CORE ref: 00007FFDF670F07B
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Data@@DevicePrivate@@Shared
                                            • String ID:
                                            • API String ID: 4099607318-0
                                            • Opcode ID: ffabd04c902eeb293ae6ccd46fbae0910f63006960b0155d49e9212a00516368
                                            • Instruction ID: 1bb6945d1ab5def7475166da0f09bd265f836fad894e430b4fdd95bd8be7a16a
                                            • Opcode Fuzzy Hash: ffabd04c902eeb293ae6ccd46fbae0910f63006960b0155d49e9212a00516368
                                            • Instruction Fuzzy Hash: F321EA32614B8690D7409F34E8647ED3368FB54B78F584335CABD4AAE9EF789085C760
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D00D780 Relevance: 4.5, APIs: 3, Instructions: 31threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QThread@@QEAA@PEAVQObject@@@Z.QT5CORE(?,?,00000000,00007FF60CFE3198), ref: 00007FF60D00D798
                                            • ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,00000000,00007FF60CFE3198), ref: 00007FF60D00D7AD
                                            • ??0QByteArray@@QEAA@XZ.QT5CORE(?,?,00000000,00007FF60CFE3198), ref: 00007FF60D00D7B8
                                              • Part of subcall function 00007FF60D0104C0: ??0QByteArray@@QEAA@XZ.QT5CORE ref: 00007FF60D0104DC
                                              • Part of subcall function 00007FF60D0104C0: ?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ.QT5CORE ref: 00007FF60D0104ED
                                              • Part of subcall function 00007FF60D0104C0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60D0104FB
                                              • Part of subcall function 00007FF60D0104C0: ?fromUtf8@QString@@SA?AV1@PEBDH@Z.QT5CORE ref: 00007FF60D010519
                                              • Part of subcall function 00007FF60D0104C0: ?append@QString@@QEAAAEAV1@AEBV1@@Z.QT5CORE ref: 00007FF60D010527
                                              • Part of subcall function 00007FF60D0104C0: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D010532
                                              • Part of subcall function 00007FF60D0104C0: ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FF60D010540
                                              • Part of subcall function 00007FF60D0104C0: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D010551
                                              • Part of subcall function 00007FF60D0104C0: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D01055C
                                              • Part of subcall function 00007FF60D0104C0: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF60D01056E
                                              • Part of subcall function 00007FF60D0104C0: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FF60D01057B
                                              • Part of subcall function 00007FF60D0104C0: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FF60D01058C
                                              • Part of subcall function 00007FF60D0104C0: ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE ref: 00007FF60D010599
                                              • Part of subcall function 00007FF60D0104C0: ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FF60D0105A4
                                              • Part of subcall function 00007FF60D0104C0: ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ.QT5CORE ref: 00007FF60D0105B2
                                              • Part of subcall function 00007FF60D0104C0: ?data@QByteArray@@QEAAPEADXZ.QT5CORE ref: 00007FF60D0105BC
                                              • Part of subcall function 00007FF60D0104C0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FF60D0105D5
                                              • Part of subcall function 00007FF60D0104C0: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D0105E0
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@Byte$Debug@@$Logger@@MessageV0@@$?append@?application?data@?debug@?fromApplication@@Bit@CoreLocal8Object@@@Path@String@@@Thread@@Utf8@V1@@
                                            • String ID:
                                            • API String ID: 2604805318-0
                                            • Opcode ID: a4e09ceff794e9bc11d3b7451f91c54ffb0e88dc9e874a1eea322535104677fb
                                            • Instruction ID: 9bba152f70b5316541748b1e3065caf7a92ba1ff686551a49d3993276a487ff8
                                            • Opcode Fuzzy Hash: a4e09ceff794e9bc11d3b7451f91c54ffb0e88dc9e874a1eea322535104677fb
                                            • Instruction Fuzzy Hash: DFF04F31609B41A3D7049F61EA842697360FB99794F541230D78E83B65EF7CE5B8C304
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629B460 Relevance: 4.5, APIs: 3, Instructions: 25COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?formatWindowTitle@QPlatformWindow@@KA?AVQString@@AEBV2@0@Z.QT5GUI ref: 00007FFDF629B490
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF629B49B
                                              • Part of subcall function 00007FFDF629B4D0: ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF629B4E6
                                              • Part of subcall function 00007FFDF629B4D0: ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF629B50F
                                              • Part of subcall function 00007FFDF629B4D0: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FFDF629B520
                                              • Part of subcall function 00007FFDF629B4D0: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF629B530
                                              • Part of subcall function 00007FFDF629B4D0: ?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ.QT5GUI ref: 00007FFDF629B547
                                              • Part of subcall function 00007FFDF629B4D0: ??6@YA?AVQDebug@@V0@PEBVQPlatformSurface@@@Z.QT5GUI ref: 00007FFDF629B560
                                              • Part of subcall function 00007FFDF629B4D0: ??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z.QT5GUI ref: 00007FFDF629B574
                                              • Part of subcall function 00007FFDF629B4D0: ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE ref: 00007FFDF629B580
                                              • Part of subcall function 00007FFDF629B4D0: ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FFDF629B58E
                                              • Part of subcall function 00007FFDF629B4D0: ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FFDF629B59C
                                              • Part of subcall function 00007FFDF629B4D0: ?utf16@QString@@QEBAPEBGXZ.QT5CORE ref: 00007FFDF629B5A5
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF629B4B3
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$String@@$PlatformWindow@@$??6@Logger@@Message$?debug@?format?utf16@?window@Category@@DebugEnabled@H00@LoggingString@@@Surface@@@Title@V2@0@WindowWindow@@@
                                            • String ID:
                                            • API String ID: 1920353416-0
                                            • Opcode ID: f4cc330307f71af70a8a042c9bf2a2769811d395a3910f3748ef3479760af183
                                            • Instruction ID: 59038ea82562f02ade5157525d7f623f08433c9bec52debe28a0e0341411d32b
                                            • Opcode Fuzzy Hash: f4cc330307f71af70a8a042c9bf2a2769811d395a3910f3748ef3479760af183
                                            • Instruction Fuzzy Hash: ACF0302671CA8692DF00DBA0F5604AAF765FBD47E4F448031EA9D47EAEDE6CD149CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6683490 Relevance: 3.1, APIs: 2, Instructions: 111COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QObjectPrivate@@QEAA@H@Z.QT5CORE(?,?,00000000,00007FFDF6683297), ref: 00007FFDF66834A3
                                              • Part of subcall function 00007FFDF66EBFC0: ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EBFCD
                                              • Part of subcall function 00007FFDF66EBFC0: ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC010
                                              • Part of subcall function 00007FFDF66EBFC0: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC01B
                                              • Part of subcall function 00007FFDF66EBFC0: ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC03C
                                              • Part of subcall function 00007FFDF66EBFC0: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC047
                                              • Part of subcall function 00007FFDF66EBFC0: ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC068
                                              • Part of subcall function 00007FFDF66EBFC0: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC073
                                              • Part of subcall function 00007FFDF66EBFC0: ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC094
                                              • Part of subcall function 00007FFDF66EBFC0: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC09F
                                              • Part of subcall function 00007FFDF66EBFC0: ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC0C7
                                              • Part of subcall function 00007FFDF66EBFC0: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6683517,?,?,00000000,00007FFDF6683297), ref: 00007FFDF66EC0D2
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                              • Part of subcall function 00007FFDF668A420: ??0QObject@@QEAA@PEAV0@@Z.QT5CORE(?,?,?,?,?,?,00000000,00007FFDF6683297), ref: 00007FFDF668A42B
                                            • ??0QMutex@@QEAA@W4RecursionMode@0@@Z.QT5CORE ref: 00007FFDF66835A0
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$?connect@ConnectionQt@@@Type@$V0@@$Mode@0@@Mutex@@ObjectPrivate@@Recursionmalloc
                                            • String ID:
                                            • API String ID: 3516141922-0
                                            • Opcode ID: ba8c1ef2d4084a1d2eee432ea7bfc38843f828a25f61a5d7e6aee22268078f1a
                                            • Instruction ID: 9567173050f63ffbbd9bc9e11cc721e1efe2c050f7c4565262ee4987a505c35f
                                            • Opcode Fuzzy Hash: ba8c1ef2d4084a1d2eee432ea7bfc38843f828a25f61a5d7e6aee22268078f1a
                                            • Instruction Fuzzy Hash: EC514732604B8186E759DF75E4A07EAB7A8FB84350F408065CBAE17B95DF3CE59AC700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF629CCE0 Relevance: 3.1, APIs: 2, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Latin1PlatformString@@String@@@Theme@@
                                            • String ID:
                                            • API String ID: 3635375232-0
                                            • Opcode ID: 41194762d77498fb8ae2bdceaebecbd6223c637822d5f805ff08f211b9c91624
                                            • Instruction ID: 6a745bf926f4721700505b14adb73c00778db6a9b499b6168fc5622ad16096e9
                                            • Opcode Fuzzy Hash: 41194762d77498fb8ae2bdceaebecbd6223c637822d5f805ff08f211b9c91624
                                            • Instruction Fuzzy Hash: 9121D422B08B8582E7549F25E8206A963A4FB4CBD8F484230DAAD47BDDDF3CD5548740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62A1730 Relevance: 3.0, APIs: 2, Instructions: 37COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: InfoParametersSystemmemset
                                            • String ID:
                                            • API String ID: 1986754214-0
                                            • Opcode ID: 2c875b41a6b0f485fa9a342d2074e944999f39015c9d04ba360f1d294cf0fe3e
                                            • Instruction ID: 43e2d67f048a4f348c3be64822ce6174c1a65fe61d289e1227a144c1c02a9471
                                            • Opcode Fuzzy Hash: 2c875b41a6b0f485fa9a342d2074e944999f39015c9d04ba360f1d294cf0fe3e
                                            • Instruction Fuzzy Hash: C3F0A437B1469242E7909B55FA51AE967A0BB987D0F5C4434DE2C87BE8CE3CCA828600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6759290 Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                            Download Yara Rule
                                            APIs
                                            • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                            • Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDF67592C6
                                              • Part of subcall function 00007FFDF6759FDC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFDF6759FE5
                                              • Part of subcall function 00007FFDF6759FDC: _CxxThrowException.VCRUNTIME140 ref: 00007FFDF6759FF6
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Concurrency::cancel_current_taskExceptionThrowmallocstd::bad_alloc::bad_alloc
                                            • String ID:
                                            • API String ID: 514126270-0
                                            • Opcode ID: 2898d4732711519da945847ba148994d0bc43ae7f296a5d68232197b99e7e2c3
                                            • Instruction ID: 20636a966a0784fa2ee4e392774ebd4e48f59f749a922c495cf8d5ea2ec45011
                                            • Opcode Fuzzy Hash: 2898d4732711519da945847ba148994d0bc43ae7f296a5d68232197b99e7e2c3
                                            • Instruction Fuzzy Hash: 61F01710F1964B41FF1466A624729B431498F59370E1806B0ED3C09FCFFF1CAC978610
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66F7970 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                            • ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00000000,00007FFDF67307A7,?,?,?,00007FFDF6746CBE,?,?,00000000,00007FFDF6730752), ref: 00007FFDF66F798D
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00000000,00007FFDF67307A7,?,?,?,00007FFDF6746CBE,?,?,00000000,00007FFDF6730752), ref: 00007FFDF66F7997
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@SharedString@@malloc
                                            • String ID:
                                            • API String ID: 3873550563-0
                                            • Opcode ID: e3fdd7aa2b3ab64b4c857d5b85a483bc96ff1d0605d9bca9127454416848d90b
                                            • Instruction ID: abb0cda982112a9fd9a4f60620b5e64b0477a6ac5d4d456b7455be438d6d21b9
                                            • Opcode Fuzzy Hash: e3fdd7aa2b3ab64b4c857d5b85a483bc96ff1d0605d9bca9127454416848d90b
                                            • Instruction Fuzzy Hash: EAF05E32605B4586D7449F25E95432833A4E748B98F144238DA6D47BC9EF38C8A1C780
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6296AF0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ChildForegroundWindow
                                            • String ID:
                                            • API String ID: 2801720684-0
                                            • Opcode ID: 47ce3806748b34f8f27605e527586fd7d17946c2021d6bad7527dc35fad37e66
                                            • Instruction ID: bc16cbe87e510483ffc691d04a56a4e1e1c859baf70197cfab62050a9de9cf0b
                                            • Opcode Fuzzy Hash: 47ce3806748b34f8f27605e527586fd7d17946c2021d6bad7527dc35fad37e66
                                            • Instruction Fuzzy Hash: B8E08C81F0620242FF241FA2646497803E8BF59B84B4C6034C82C8A7CCFE2CE8D5B310
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6293430 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6294E40: ?property@QObject@@QEBA?AVQVariant@@PEBD@Z.QT5CORE(?,?,?,?,?,00007FFDF6293476), ref: 00007FFDF6294E71
                                              • Part of subcall function 00007FFDF6294E40: ?userType@QVariant@@QEBAHXZ.QT5CORE ref: 00007FFDF6294E8A
                                              • Part of subcall function 00007FFDF6294E40: ?constData@QVariant@@QEBAPEBXXZ.QT5CORE ref: 00007FFDF6294E9A
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF629347E
                                              • Part of subcall function 00007FFDF6293500: GetModuleHandleW.KERNEL32 ref: 00007FFDF6293564
                                              • Part of subcall function 00007FFDF6293500: ?initialGeometry@QPlatformWindow@@SA?AVQRect@@PEBVQWindow@@AEBV2@HH@Z.QT5GUI ref: 00007FFDF62935A1
                                              • Part of subcall function 00007FFDF6293500: ?qAppName@@YA?AVQString@@XZ.QT5CORE ref: 00007FFDF62935CC
                                              • Part of subcall function 00007FFDF6293500: ??4QUrl@@QEAAAEAV0@$$QEAV0@@Z.QT5CORE ref: 00007FFDF62935EC
                                              • Part of subcall function 00007FFDF6293500: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF62935FB
                                              • Part of subcall function 00007FFDF6293500: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF629360A
                                              • Part of subcall function 00007FFDF6293500: ?utf16@QString@@QEBAPEBGXZ.QT5CORE ref: 00007FFDF6293613
                                              • Part of subcall function 00007FFDF6293500: ?utf16@QString@@QEBAPEBGXZ.QT5CORE ref: 00007FFDF6293624
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Variant@@$?utf16@V0@@Window@@$?const?initial?property@?userArray@@ByteData@Geometry@HandleModuleName@@Object@@PlatformRect@@Type@Url@@V0@$$
                                            • String ID:
                                            • API String ID: 3932469724-0
                                            • Opcode ID: 40480abfe07e19b6e8910ea886de98d0aa8137713583ce621f8a91129d760f9e
                                            • Instruction ID: ee83183aa26b4cd62b719d6ac6f3f0b05949afccf1be68b8969a5bcda174a831
                                            • Opcode Fuzzy Hash: 40480abfe07e19b6e8910ea886de98d0aa8137713583ce621f8a91129d760f9e
                                            • Instruction Fuzzy Hash: BD217F36B18B4486DB60CB12E454AAD73A9F758B84F155239DF6C83F88DF39E554CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62E17C0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                            Download Yara Rule
                                            APIs
                                            • DefWindowProcW.USER32 ref: 00007FFDF62E1823
                                              • Part of subcall function 00007FFDF62E0C70: ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF62E0CB2
                                              • Part of subcall function 00007FFDF62E0C70: ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF62E0CEB
                                              • Part of subcall function 00007FFDF62E0C70: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FFDF62E0CFC
                                              • Part of subcall function 00007FFDF62E0C70: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62E0D0C
                                              • Part of subcall function 00007FFDF62E0C70: ??6QDebug@@QEAAAEAV0@PEBX@Z.QT5CORE ref: 00007FFDF62E0D18
                                              • Part of subcall function 00007FFDF62E0C70: ??6QDebug@@QEAAAEAV0@K@Z.QT5CORE ref: 00007FFDF62E0D24
                                              • Part of subcall function 00007FFDF62E0C70: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF62E0D30
                                              • Part of subcall function 00007FFDF62E0C70: ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FFDF62E0D3E
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Logger@@Message$?debug@Category@@DebugEnabled@H00@LoggingProcWindow
                                            • String ID:
                                            • API String ID: 4190882994-0
                                            • Opcode ID: 6604f262cd56e605bba0fe1006e68aa5257a69ffb87b43c7368d2d54994edc2b
                                            • Instruction ID: a79c46c93f5351652616bc13f3eada177269fdbcc413e7b72e2e33b0c29458e0
                                            • Opcode Fuzzy Hash: 6604f262cd56e605bba0fe1006e68aa5257a69ffb87b43c7368d2d54994edc2b
                                            • Instruction Fuzzy Hash: 53016D32B08B5185EB00CF42A458AA973A8EB59FD0F694031EE6D57B89CF39D8518780
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66F16B0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX@Z.QT5CORE ref: 00007FFDF66F16D6
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$?activate@Meta
                                            • String ID:
                                            • API String ID: 1938966063-0
                                            • Opcode ID: b84765f7ad1992f5e84454d8811872f62633ec9dd7c87442e1f5c51b8f348ed0
                                            • Instruction ID: 5e9de7119a26868f828e07442683b63214dd531795c71b92cb68b5dfbe17de2f
                                            • Opcode Fuzzy Hash: b84765f7ad1992f5e84454d8811872f62633ec9dd7c87442e1f5c51b8f348ed0
                                            • Instruction Fuzzy Hash: 48F08235B19A4486EB108B38D064B69B3A4FF88B95F584631C96D47AE8DF7DD441CA40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F3540 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?processEvents@QEventDispatcherWin32@@UEAA_NV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z.QT5CORE ref: 00007FFDF62F3553
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Event$?processDispatcherEventsEvents@Flag@Flags@Loop@@@@@ProcessWin32@@
                                            • String ID:
                                            • API String ID: 2620541275-0
                                            • Opcode ID: 531b54c90e3c3842c49030f1733a7c5b5fc37438fa29cf56c64aaa36d6b40b03
                                            • Instruction ID: 1a55f801add4400e02fc79a8acf3f1332dfa97de12165a2a63565a28c36a6c41
                                            • Opcode Fuzzy Hash: 531b54c90e3c3842c49030f1733a7c5b5fc37438fa29cf56c64aaa36d6b40b03
                                            • Instruction Fuzzy Hash: 3ED05272A0838087CB088FAAF18046872B0F74CB94B288525EB2807B19CB38C4A28B00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF62F3570 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088501566.00007FFDF6291000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDF6290000, based on PE: true
                                            • Associated: 0000000F.00000002.3088483684.00007FFDF6290000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088573460.00007FFDF6383000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088614367.00007FFDF63E4000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088631576.00007FFDF63E5000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63E6000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088648192.00007FFDF63EA000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088681077.00007FFDF63EC000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6290000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ?sendDispatcherEventEvents@PostedWin32@@
                                            • String ID:
                                            • API String ID: 1915275062-0
                                            • Opcode ID: 83bd28f6fa2fe8ff9a623e2e097d9edfd71d24fe22b91ddb530925818d15e8d7
                                            • Instruction ID: 6dc68a92aad062d4b29f3fb74d697166a1bc17ecc363b48cc46b64d7a950e55d
                                            • Opcode Fuzzy Hash: 83bd28f6fa2fe8ff9a623e2e097d9edfd71d24fe22b91ddb530925818d15e8d7
                                            • Instruction Fuzzy Hash: EFC08C22B15705C3E7186BF1B4608682364EB08B04B090030CA2405E8AAD3890E08700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Non-executed Functions

                                            Function 00007FFDF66E57D0 Relevance: 128.3, APIs: 63, Strings: 10, Instructions: 565windowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Generic$Argument@@Return$Object@@$Variant@@$Meta$ConnectionType@$Array@@ByteConnection@Data@@$?invokeArgument@@333333333@ListMethod@Qt@@Qt@@@Url@@V0@@$?connect@Logger@@Message$?begin@?compare@?debug@?dispose@?end@?free_helper@?from?setBasicCaseData@1@@DateEncoded@HashInt@Mode@1@@Mutex@@Node@1@@Parent@ParsingSensitivity@Time@@V0@$$V1@@
                                            • String ID: 1_q_cacheLoadReadyRead()$2readChannelFinished()$2readyRead()$QNetworkReplyImpl: setCachingEnabled(true) called after setCachingEnabled(false)$QUrl$_q_cacheLoadReadyRead$_q_metaDataChanged$int$location$onRedirected
                                            • API String ID: 2802102830-794269202
                                            • Opcode ID: b0e751978ccf85949aa371367b05ecbda3f6c31bf9aeaa8bb7dced8b68791a49
                                            • Instruction ID: 8dced85503ac10a30fd7468df56e85296b6d47b850922d7a0d4cce1f1bc58d37
                                            • Opcode Fuzzy Hash: b0e751978ccf85949aa371367b05ecbda3f6c31bf9aeaa8bb7dced8b68791a49
                                            • Instruction Fuzzy Hash: 6D528432B08EC695E7218F28D864AE973B5FF98748F844131DA5D17E68EF38D686C704
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D02EE40 Relevance: 80.7, APIs: 39, Strings: 7, Instructions: 189COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?objectName@QObject@@QEBA?AVQString@@XZ.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EE64
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EE75
                                            • ?fromUtf8@QString@@SA?AV1@PEBDH@Z.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EE8E
                                            • ?setObjectName@QObject@@QEAAXAEBVQString@@@Z.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EE9B
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EEA6
                                            • ?resize@QWidget@@QEAAXHH@Z.QT5WIDGETS(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EEBA
                                            • ??0QSize@@QEAA@HH@Z.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EEC9
                                            • ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z.QT5WIDGETS(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EED5
                                            • ??0QHBoxLayout@@QEAA@PEAVQWidget@@@Z.QT5WIDGETS(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EEF2
                                            • ?fromUtf8@QString@@SA?AV1@PEBDH@Z.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EF21
                                            • ?setObjectName@QObject@@QEAAXAEBVQString@@@Z.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EF2E
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00007FF60D02E83F,?,?,?,?,FFFFFFFF,00000001,?,00007FF60D01721D), ref: 00007FF60D02EF39
                                            • ?setContentsMargins@QLayout@@QEAAXHHHH@Z.QT5WIDGETS ref: 00007FF60D02EF56
                                            • ??0QLabel@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z.QT5WIDGETS ref: 00007FF60D02EF76
                                            • ?fromUtf8@QString@@SA?AV1@PEBDH@Z.QT5CORE ref: 00007FF60D02EFA6
                                            • ?setObjectName@QObject@@QEAAXAEBVQString@@@Z.QT5CORE ref: 00007FF60D02EFB4
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D02EFBF
                                            • ??0QFont@@QEAA@XZ.QT5GUI ref: 00007FF60D02EFC9
                                            • ?fromUtf8@QString@@SA?AV1@PEBDH@Z.QT5CORE ref: 00007FF60D02EFE1
                                            • ?setFamily@QFont@@QEAAXAEBVQString@@@Z.QT5GUI ref: 00007FF60D02EFEF
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D02EFFA
                                            • ?setPointSize@QFont@@QEAAXH@Z.QT5GUI ref: 00007FF60D02F009
                                            • ?setFont@QWidget@@QEAAXAEBVQFont@@@Z.QT5WIDGETS ref: 00007FF60D02F017
                                            • ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z.QT5WIDGETS ref: 00007FF60D02F02A
                                            • ??0QComboBox@@QEAA@PEAVQWidget@@@Z.QT5WIDGETS ref: 00007FF60D02F047
                                            • ?fromUtf8@QString@@SA?AV1@PEBDH@Z.QT5CORE ref: 00007FF60D02F077
                                            • ?setObjectName@QObject@@QEAAXAEBVQString@@@Z.QT5CORE ref: 00007FF60D02F085
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D02F090
                                            • ??0QSize@@QEAA@HH@Z.QT5CORE ref: 00007FF60D02F09F
                                            • ?setMinimumSize@QWidget@@QEAAXAEBVQSize@@@Z.QT5WIDGETS ref: 00007FF60D02F0AC
                                            • ?addWidget@QBoxLayout@@QEAAXPEAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z.QT5WIDGETS ref: 00007FF60D02F0BF
                                            • ?translate@QCoreApplication@@SA?AVQString@@PEBD00H@Z.QT5CORE ref: 00007FF60D02F0E2
                                            • ?setWindowTitle@QWidget@@QEAAXAEBVQString@@@Z.QT5WIDGETS ref: 00007FF60D02F0EF
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D02F0FA
                                            • ?translate@QCoreApplication@@SA?AVQString@@PEBD00H@Z.QT5CORE ref: 00007FF60D02F11D
                                            • ?setText@QLabel@@QEAAXAEBVQString@@@Z.QT5WIDGETS ref: 00007FF60D02F12B
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60D02F136
                                            • ?connectSlotsByName@QMetaObject@@SAXPEAVQObject@@@Z.QT5CORE ref: 00007FF60D02F13F
                                            • ??1QFont@@QEAA@XZ.QT5GUI ref: 00007FF60D02F14A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$?set$Widget@@$String@@@$Name@Object@@$?fromUtf8@$Font@@Layout@@Object$Flags@Qt@@@@@Size@$?add?translate@AlignmentApplication@@CoreFlag@Label@@MinimumSize@@Size@@@Widget@Widget@@@Window$?connect?object?resize@Box@@ComboContentsFamily@Font@Font@@@Margins@MetaObject@@@PointSlotsText@Title@Type@
                                            • String ID: Form$Input FPS$Verdana$WDGInputFPS$comboBox$horizontalLayout$label
                                            • API String ID: 154868210-3845346711
                                            • Opcode ID: 3857e566b6bb0cba4a324dff5496d0fd0d4ec7090085ff39e083cc5c67e12479
                                            • Instruction ID: 700d9f20a32973af22d5293a23269be9ad99b7fbf3586b7e0b013898e9563885
                                            • Opcode Fuzzy Hash: 3857e566b6bb0cba4a324dff5496d0fd0d4ec7090085ff39e083cc5c67e12479
                                            • Instruction Fuzzy Hash: 69916231A14F4296EB109F21EC541AD7360FF85B85BA05635DAAF83BA8EF7CD509C708
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66AF770 Relevance: 64.9, APIs: 36, Strings: 1, Instructions: 149COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QUrl@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF78A
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF794
                                            • ?setPassword@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF7A7
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF7B1
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF7BB
                                            • ?setFragment@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF7CB
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF7D5
                                            • ??0QCryptographicHash@@QEAA@W4Algorithm@0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF7E4
                                            • ?toEncoded@QUrl@@QEBA?AVQByteArray@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF7F8
                                            • ?addData@QCryptographicHash@@QEAAXAEBVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF805
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF80F
                                            • ?result@QCryptographicHash@@QEBA?AVQByteArray@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF81D
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF826
                                            • ?number@QByteArray@@SA?AV1@_JH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF839
                                            • ?left@QByteArray@@QEBA?AV1@H@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF84C
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF856
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF860
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF86A
                                            • ?at@QByteArray@@QEBADH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF877
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF887
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF893
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66AD5FE), ref: 00007FFDF66AF8BC
                                            • ?number@QString@@SA?AV1@IH@Z.QT5CORE ref: 00007FFDF66AF8D6
                                            • ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66AF8E6
                                            • ??0QString@@QEAA@HW4Initialization@Qt@@@Z.QT5CORE ref: 00007FFDF66AF8FB
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE ref: 00007FFDF66AF904
                                            • ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66AF910
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE ref: 00007FFDF66AF91F
                                            • memcpy.VCRUNTIME140 ref: 00007FFDF66AF92E
                                            • ??0QChar@@QEAA@UQLatin1Char@@@Z.QT5CORE ref: 00007FFDF66AF93E
                                            • ?appendLatin1To@QAbstractConcatenable@@KAXPEBDHPEAVQChar@@@Z.QT5CORE ref: 00007FFDF66AF968
                                            • ?appendLatin1To@QAbstractConcatenable@@KAXPEBDHPEAVQChar@@@Z.QT5CORE ref: 00007FFDF66AF985
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF66AF98F
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66AF999
                                            • ??1QCryptographicHash@@QEAA@XZ.QT5CORE ref: 00007FFDF66AF9A3
                                            • ??1QUrl@@QEAA@XZ.QT5CORE ref: 00007FFDF66AF9AD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Byte$Array@@$Char@@Data@Url@@$?const$?size@CryptographicHash@@$Char@@@Latin1$?append?number@?setAbstractConcatenable@@FormattingMode@1@@Parsing$?add?at@?left@?result@Algorithm@0@@Array@@@ComponentEncoded@Flags@Fragment@Initialization@Option@Option@2@@@@Password@Qt@@@V0@@V1@_memcpy
                                            • String ID: /
                                            • API String ID: 53486078-2043925204
                                            • Opcode ID: 21a94f0a73d3f20c978b328ebb531eee3d970b3de50ac8eb2947183529699348
                                            • Instruction ID: 2793080f12df022ff5a611a2a6a694876b0470d3f6db512bfdcf00d1e2f02ca7
                                            • Opcode Fuzzy Hash: 21a94f0a73d3f20c978b328ebb531eee3d970b3de50ac8eb2947183529699348
                                            • Instruction Fuzzy Hash: 57613B22B18A5696EB009F24E8749B83375FF54B89B404175E91E53EACFF3DD98AC340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60CFCCE40 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 260windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • srt_getsockstate.SRT ref: 00007FF60CFCCE7F
                                            • srt_recv.SRT ref: 00007FF60CFCCE9E
                                            • _Mtx_lock.MSVCP140(?), ref: 00007FF60CFCCEC4
                                            • _Mtx_unlock.MSVCP140(?), ref: 00007FF60CFCCEE4
                                              • Part of subcall function 00007FF60CFD0C10: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FF60CFCCF1E,?), ref: 00007FF60CFD0C8A
                                              • Part of subcall function 00007FF60CFD0C10: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE(?,?,?,?,?,?,?,?,00007FF60CFCCF1E,?), ref: 00007FF60CFD0C98
                                              • Part of subcall function 00007FF60CFD0C10: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FF60CFCCF1E,?), ref: 00007FF60CFD0CA9
                                              • Part of subcall function 00007FF60CFD0C10: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FF60CFCCF1E,?), ref: 00007FF60CFD0CB9
                                              • Part of subcall function 00007FF60CFD0C10: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FF60CFCCF1E,?), ref: 00007FF60CFD0CC9
                                              • Part of subcall function 00007FF60CFD0C10: ??6QDebug@@QEAAAEAV0@H@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FF60CFCCF1E,?), ref: 00007FF60CFD0CD7
                                              • Part of subcall function 00007FF60CFD0C10: ??1QDebug@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00007FF60CFCCF1E,?), ref: 00007FF60CFD0CE3
                                            • _Mtx_unlock.MSVCP140 ref: 00007FF60CFCCF24
                                            • srt_getsockstate.SRT ref: 00007FF60CFCCF2C
                                            • srt_getlasterror_str.SRT ref: 00007FF60CFCCF3C
                                            • ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60CFCCF5E
                                            • _Mtx_lock.MSVCP140 ref: 00007FF60CFCCF7D
                                            • _Mtx_unlock.MSVCP140 ref: 00007FF60CFCCF91
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCCF9C
                                            • ?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF60CFCCFD9
                                            • ?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF60CFCCFE1
                                            • srt_getsockstate.SRT ref: 00007FF60CFCD023
                                            • srt_recv.SRT ref: 00007FF60CFCD03F
                                            • _Mtx_lock.MSVCP140(?), ref: 00007FF60CFCD064
                                            • _Mtx_unlock.MSVCP140(?), ref: 00007FF60CFCD084
                                              • Part of subcall function 00007FF60CFCAE20: memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAE73
                                              • Part of subcall function 00007FF60CFCAE20: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAE8F
                                              • Part of subcall function 00007FF60CFCAE20: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAE9D
                                              • Part of subcall function 00007FF60CFCAE20: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAEAE
                                              • Part of subcall function 00007FF60CFCAE20: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAEBE
                                              • Part of subcall function 00007FF60CFCAE20: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAECE
                                              • Part of subcall function 00007FF60CFCAE20: ??6QDebug@@QEAAAEAV0@H@Z.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAEDC
                                              • Part of subcall function 00007FF60CFCAE20: ??1QDebug@@QEAA@XZ.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAEE8
                                              • Part of subcall function 00007FF60CFCAE20: _Mtx_lock.MSVCP140(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAEF2
                                              • Part of subcall function 00007FF60CFCAE20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAF11
                                              • Part of subcall function 00007FF60CFCAE20: memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAF24
                                              • Part of subcall function 00007FF60CFCAE20: memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAF37
                                              • Part of subcall function 00007FF60CFCAE20: _Mtx_unlock.MSVCP140(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAF47
                                              • Part of subcall function 00007FF60CFCAE20: _Mtx_lock.MSVCP140(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAF77
                                              • Part of subcall function 00007FF60CFCAE20: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAFA1
                                              • Part of subcall function 00007FF60CFCAE20: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAFAF
                                              • Part of subcall function 00007FF60CFCAE20: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,00000000,?,?,?,?,00007FF60CFCACDC), ref: 00007FF60CFCAFC6
                                            • _Mtx_unlock.MSVCP140 ref: 00007FF60CFCD0DF
                                            • srt_getsockstate.SRT ref: 00007FF60CFCD0E7
                                            • srt_getlasterror_str.SRT ref: 00007FF60CFCD0FA
                                            • ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60CFCD11E
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF60CFCD136
                                            • ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FF60CFCD144
                                            • ??6QDebug@@QEAAAEAV0@AEBVQString@@@Z.QT5CORE ref: 00007FF60CFCD153
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FF60CFCD163
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FF60CFCD173
                                            • ??6QDebug@@QEAAAEAV0@H@Z.QT5CORE ref: 00007FF60CFCD181
                                            • ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FF60CFCD18D
                                            • _Mtx_lock.MSVCP140 ref: 00007FF60CFCD197
                                            • _Mtx_unlock.MSVCP140 ref: 00007FF60CFCD1AB
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCD1B6
                                            • ?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF60CFCD1EB
                                            • ?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF60CFCD1F3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$Logger@@Message$Mtx_unlock$Mtx_lock$?debug@C_error@std@@String@@Throw_srt_getsockstate$memmove$?fromArrayAscii_helper@Data@Typedsrt_getlasterror_strsrt_recv$String@@@malloc
                                            • String ID: ..\srtminiserver\cafeedbackmanager.cpp
                                            • API String ID: 942850615-751187993
                                            • Opcode ID: 4fa32c3d309b164c96fc40ea77840c9f83794beeb1759eaafce885b6f365ca9c
                                            • Instruction ID: 0599fd629a58f591bcff2e8001e831794a3328eabd55d02e2233c9a86910d285
                                            • Opcode Fuzzy Hash: 4fa32c3d309b164c96fc40ea77840c9f83794beeb1759eaafce885b6f365ca9c
                                            • Instruction Fuzzy Hash: 46B18C32B08A4196EB54DF21E9805AD33A0FF84754F601635EA4FC3B95EF39E866CB44
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66B3490 Relevance: 56.2, APIs: 19, Strings: 13, Instructions: 192windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B351A
                                            • ?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B3532
                                            • ?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B35BF
                                            • ?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B35E0
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B366B
                                              • Part of subcall function 00007FFDF66B5610: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B3182), ref: 00007FFDF66B5641
                                              • Part of subcall function 00007FFDF66B5610: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B3182), ref: 00007FFDF66B564F
                                              • Part of subcall function 00007FFDF66B5610: ?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B3182), ref: 00007FFDF66B5673
                                              • Part of subcall function 00007FFDF66B5610: ?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B3182), ref: 00007FFDF66B5689
                                              • Part of subcall function 00007FFDF66B5610: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B5749
                                              • Part of subcall function 00007FFDF66B5610: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B5754
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FFDF66B368A
                                            • ?critical@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FFDF66B3698
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF66B36A8
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF66B36B4
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF66B36C4
                                            • ??1QDebug@@QEAA@XZ.QT5CORE ref: 00007FFDF66B36CF
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FFDF66B36E7
                                            • ?critical@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FFDF66B36F5
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF66B3705
                                            • ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FFDF66B3713
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B372F
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B374B
                                            • ?critical@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDF66B33E1), ref: 00007FFDF66B375B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$Debug@@Logger@@Message$?qstrcmp@@$?critical@$V0@@
                                            • String ID: :authority$:method$:path$:scheme$:status$cookie$invalid pseudo-header (:status) in a request$mandatory$mandatory :method pseudo-header not found$only one$only one :method pseudo-header is allowed$pseudo-header is allowed$pseudo-header not found
                                            • API String ID: 750759551-1120256471
                                            • Opcode ID: d04e347481f7c2d9f7006834e69026cf8f3a8f3414b7f4f47f52ccf10ab05dd4
                                            • Instruction ID: 33783531b5ab31fad2840b2c6200fbfe03b86983ab561e73f124ffc766b3c286
                                            • Opcode Fuzzy Hash: d04e347481f7c2d9f7006834e69026cf8f3a8f3414b7f4f47f52ccf10ab05dd4
                                            • Instruction Fuzzy Hash: E9819222B0C642D1FB509B15A974E7677A9EF45B84F445075DE2D12EDCEE3CE44ACB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6697820 Relevance: 52.7, APIs: 25, Strings: 5, Instructions: 220COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6696910: ??0QIODevicePrivate@@QEAA@XZ.QT5CORE ref: 00007FFDF6696932
                                              • Part of subcall function 00007FFDF6696910: ??0QBasicMutex@@QEAA@XZ.QT5CORE ref: 00007FFDF6696981
                                              • Part of subcall function 00007FFDF6696910: ??1QUrl@@QEAA@XZ.QT5CORE ref: 00007FFDF669699B
                                              • Part of subcall function 00007FFDF6696910: ??0QBasicMutex@@QEAA@XZ.QT5CORE ref: 00007FFDF66969A6
                                              • Part of subcall function 00007FFDF6696910: ??1QUrl@@QEAA@XZ.QT5CORE ref: 00007FFDF66969C0
                                              • Part of subcall function 00007FFDF6696910: ??0QBasicMutex@@QEAA@XZ.QT5CORE ref: 00007FFDF66969CD
                                              • Part of subcall function 00007FFDF6696910: ??0QVariant@@QEAA@_N@Z.QT5CORE ref: 00007FFDF6696A2A
                                              • Part of subcall function 00007FFDF6696910: ??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FFDF6696A58
                                              • Part of subcall function 00007FFDF6696910: ??0QIODevice@@IEAA@AEAVQIODevicePrivate@@PEAVQObject@@@Z.QT5CORE ref: 00007FFDF6696A67
                                              • Part of subcall function 00007FFDF6696840: ??0QUrl@@QEAA@AEBV0@@Z.QT5CORE(?,?,00000000,00007FFDF6685F0E), ref: 00007FFDF6696853
                                            • ??1QUrl@@QEAA@XZ.QT5CORE ref: 00007FFDF6697886
                                              • Part of subcall function 00007FFDF6688A60: ?normalizedType@QMetaObject@@SA?AVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,00007FFDF668330E), ref: 00007FFDF6688AA2
                                              • Part of subcall function 00007FFDF6688A60: ?registerNormalizedType@QMetaType@@SAHAEBVQByteArray@@P6AXPEAX@ZP6APEAX1PEBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PEBUQMetaObject@@@Z.QT5CORE ref: 00007FFDF6688ADD
                                              • Part of subcall function 00007FFDF6688A60: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF6688AEA
                                            • ?translate@QCoreApplication@@SA?AVQString@@PEBD00H@Z.QT5CORE ref: 00007FFDF66978C3
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66978F7
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF669790A
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697920
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697936
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF669794C
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697962
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF669797B
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697994
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66979AD
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF66979C6
                                            • ?invokeMethod@QMetaObject@@SA_NPEAVQObject@@PEBDW4ConnectionType@Qt@@VQGenericArgument@@333333333@Z.QT5CORE ref: 00007FFDF6697A3D
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697A4F
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697A68
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697A81
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697A9A
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697AB0
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697AC6
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697ADC
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697AF2
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697B08
                                            • ??0QGenericReturnArgument@@QEAA@PEBDPEAX@Z.QT5CORE ref: 00007FFDF6697B1E
                                            • ?invokeMethod@QMetaObject@@SA_NPEAVQObject@@PEBDW4ConnectionType@Qt@@VQGenericArgument@@333333333@Z.QT5CORE ref: 00007FFDF6697B90
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF6697B9B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Generic$Argument@@Return$Meta$Object@@$Type@Url@@$Array@@BasicByteMutex@@$?invokeArgument@@333333333@ConnectionDeviceMethod@Object@@@Private@@Qt@@String@@Variant@@$?normalized?register?translate@Application@@CoreDevice@@Flag@Flags@NormalizedTypeType@@Type@@@@V0@@
                                            • String ID: Network access is disabled.$QNetworkAccessManager$QNetworkReply::NetworkError$error$finished
                                            • API String ID: 252426309-3281323554
                                            • Opcode ID: 960c91c48fe8de7d6b3ae41de72b6e9978954ce882dca4805aca83cfb73f95e8
                                            • Instruction ID: f0b1384cb5299e81b18b0448c40684581aac67c52e99d9af2c3e7f0cb66cc35a
                                            • Opcode Fuzzy Hash: 960c91c48fe8de7d6b3ae41de72b6e9978954ce882dca4805aca83cfb73f95e8
                                            • Instruction Fuzzy Hash: BFB1C222A18F9595F7118F38D825AE973B5FF88748F849221DA4D12E68FF38D686C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66DB840 Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 190timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Generic$Argument@@Return$Object@@$Array@@ByteString@@$?invokeArgument@@333333333@ConnectionMetaMethod@Qt@@Type@V0@@$?begin@?resize@?size@DateTime@@V0@$$
                                            • String ID: deleteLater$quit
                                            • API String ID: 4087042418-3976603107
                                            • Opcode ID: 0f6c4388cfabc6fb0f63f91d7c23536014216eb25d84678676d9ecd81992c21e
                                            • Instruction ID: 2974897543d1ce68747aa24f9c0825f1dc3c8d86ceb03e4031c6de169f67ab03
                                            • Opcode Fuzzy Hash: 0f6c4388cfabc6fb0f63f91d7c23536014216eb25d84678676d9ecd81992c21e
                                            • Instruction Fuzzy Hash: C5A18322A18E95D5F7129F38D855BEA73B5FF88308F849221DA4D16E28FF38D685C704
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D01FE50 Relevance: 42.2, APIs: 15, Strings: 9, Instructions: 195COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: av_logavfilter_inout_free$__stdio_common_vsprintfavfilter_get_by_nameavfilter_graph_create_filteravfilter_inout_alloc
                                            • String ID: Cannot create buffer sink$Cannot create buffer source$Cannot set output pixel format$FILTER GRAPH:$buffer$buffersink$out$pix_fmts$video_size=%dx%d:pix_fmt=%d:time_base=%d/%d:pixel_aspect=%d/%d
                                            • API String ID: 2801208006-1812606733
                                            • Opcode ID: c525aec98e39951a68db6ffcf86ca5bbbb250aae882ebd8a533d59d1f820f9f3
                                            • Instruction ID: db942e6ea8bc520e6a180832dfc614ea66bac6a25c16b261fcfc416a2fda1208
                                            • Opcode Fuzzy Hash: c525aec98e39951a68db6ffcf86ca5bbbb250aae882ebd8a533d59d1f820f9f3
                                            • Instruction Fuzzy Hash: E191B272A09B4286E710DF25E8406A97764FB84794F600336DD5EC77A5EFBCD845CB08
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66CD6F0 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 336COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Data@@Empty@List$?errorDevice@@String@V0@@
                                            • String ID: _q_startNextRequest
                                            • API String ID: 214426747-1109240398
                                            • Opcode ID: f3f3bca9783a23f74355ca01e5d1f5225666d6a9a56f125579996aa6c4a48467
                                            • Instruction ID: c220b6155ee67a62643eccd1f4e25675876b981dd7e8a71b8ad5bf05673d5830
                                            • Opcode Fuzzy Hash: f3f3bca9783a23f74355ca01e5d1f5225666d6a9a56f125579996aa6c4a48467
                                            • Instruction Fuzzy Hash: 66F16F22708EC685EB619F25D860BF973A8FF88B49F444172DA2D57E98EF38D545CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66CD750 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 295COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Data@@Empty@List$?errorDevice@@String@V0@@
                                            • String ID: _q_startNextRequest
                                            • API String ID: 214426747-1109240398
                                            • Opcode ID: 245df5d88ef0060f89e49119ee65b60ca519a8d6390327c50b10415e51de5116
                                            • Instruction ID: 09d260c24682d08e8bbe10971a9ee4a4e3b163054b353e0b28a9b1137136114a
                                            • Opcode Fuzzy Hash: 245df5d88ef0060f89e49119ee65b60ca519a8d6390327c50b10415e51de5116
                                            • Instruction Fuzzy Hash: 11E16122708EC685EB619F25D460BF973A8FF88B49F444172DA2D57E98EF38D545C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66CD745 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 295COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Data@@Empty@List$?errorDevice@@String@V0@@
                                            • String ID: _q_startNextRequest
                                            • API String ID: 214426747-1109240398
                                            • Opcode ID: 3d76772eca1b2bbd084644d5290d4b88f1c3a46694c077c544d75899c90871f9
                                            • Instruction ID: 4e29d8afef4ddb2c2cd569dfc7a707c9f2e45a2ff8a3856eedaa7450ce0f379d
                                            • Opcode Fuzzy Hash: 3d76772eca1b2bbd084644d5290d4b88f1c3a46694c077c544d75899c90871f9
                                            • Instruction Fuzzy Hash: 08E16122708EC685EB619F25D860BF973A8FF88B49F444172DA2D57E98EF38D545CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66B9810 Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 253windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Logger@@Message$Category@@Logging$?warning@Enabled@H00@Warning$Init_thread_footer
                                            • String ID: INITIAL_WINDOW_SIZE must be in the range (0, 2^31-1]$MAX_CONCURRENT_STREAMS must be a positive number$MAX_FRAME_SIZE must be in the range [2^14, 2^24-1]$SETTINGS_ENABLE_PUSH can be only 0 or 1$Session receive window must be at least 65535 bytes
                                            • API String ID: 263034975-2894994997
                                            • Opcode ID: b07f98f49a022928d26bac5d496de667d13d09f51f66bfa574122003c06e7a4d
                                            • Instruction ID: e7912869ba0e745a51453422430a0ed69f66540ea69f0c41cf8fee8143ce6884
                                            • Opcode Fuzzy Hash: b07f98f49a022928d26bac5d496de667d13d09f51f66bfa574122003c06e7a4d
                                            • Instruction Fuzzy Hash: 5EA18461F09602C1EF589B55D474A3973A9EF96F80F0546B6C92D07FDAEE2CE881CA40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF671F7C0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 95windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            • QAbstractSocket: cannot bind to QHostAddress::Any (or an IPv6 address) and join an IPv4 multicast group; bind to QHostAddress::AnyIPv4 instead if you want to do this, xrefs: 00007FFDF671F8C3
                                            • QNativeSocketEngine::joinMulticastGroup() was called on an uninitialized socket device, xrefs: 00007FFDF671F7F9
                                            • QNativeSocketEngine::joinMulticastGroup() was called by a socket other than QAbstractSocket::UdpSocket, xrefs: 00007FFDF671F875
                                            • QNativeSocketEngine::joinMulticastGroup() was not called in QAbstractSocket::BoundState, xrefs: 00007FFDF671F837
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Logger@@Message$?warning@
                                            • String ID: QAbstractSocket: cannot bind to QHostAddress::Any (or an IPv6 address) and join an IPv4 multicast group; bind to QHostAddress::AnyIPv4 instead if you want to do this$QNativeSocketEngine::joinMulticastGroup() was called by a socket other than QAbstractSocket::UdpSocket$QNativeSocketEngine::joinMulticastGroup() was called on an uninitialized socket device$QNativeSocketEngine::joinMulticastGroup() was not called in QAbstractSocket::BoundState
                                            • API String ID: 3543197520-1723322543
                                            • Opcode ID: 3626d1cf69d141686f15e127af6750281c7068380bcd4c7d08d136ac1a276848
                                            • Instruction ID: b8542705f56250271f9a9539f4482a611344802e6dba4cc5610a9a2ed17b6895
                                            • Opcode Fuzzy Hash: 3626d1cf69d141686f15e127af6750281c7068380bcd4c7d08d136ac1a276848
                                            • Instruction Fuzzy Hash: D131BF66B0868182EB109B26F470A6A7365FF9ABC4F844171DF5D07F9CEE2CD54ACB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D6D400 Relevance: 16.8, APIs: 13, Instructions: 541COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memcpy$memset
                                            • String ID:
                                            • API String ID: 438689982-0
                                            • Opcode ID: 198831e604cbbc03f004634e1c13eb14f333fd01fa66e7b42a4fc3cb9e4cd9b9
                                            • Instruction ID: 02ad3adee2e0a947504b6cda6c464246804233d32c9a18e5eaf73d62700df379
                                            • Opcode Fuzzy Hash: 198831e604cbbc03f004634e1c13eb14f333fd01fa66e7b42a4fc3cb9e4cd9b9
                                            • Instruction Fuzzy Hash: A7222E27E19FC641F3168739A8527B96710AFE77D4F01D327FE9872A96EB28D2419300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D6DD30 Relevance: 16.8, APIs: 13, Instructions: 538COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memcpy$memset
                                            • String ID:
                                            • API String ID: 438689982-0
                                            • Opcode ID: 1e020c2bfe5b584dc2d7bb2ed75164fc78c81c13858f334fe70c39ab5110ab33
                                            • Instruction ID: ca2a54ff538e602a5182bfd7250851f01d1c77bd20deab093593dd4e037a5e94
                                            • Opcode Fuzzy Hash: 1e020c2bfe5b584dc2d7bb2ed75164fc78c81c13858f334fe70c39ab5110ab33
                                            • Instruction Fuzzy Hash: 8E221B23E14FD641F3168738A8526B9A714AFE77D4F01D327FE9972A96EB28D3419300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D6F7F0 Relevance: 16.8, APIs: 13, Instructions: 535COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memcpy$memset
                                            • String ID:
                                            • API String ID: 438689982-0
                                            • Opcode ID: 8635fe6f830d58557a60b945d8bcf1f87ec1b6ef0a04d64e0ec8446c82dd0193
                                            • Instruction ID: acdaeb948fe345218aa79ac387d9dc16fce949e5671cab056010ace6698b15df
                                            • Opcode Fuzzy Hash: 8635fe6f830d58557a60b945d8bcf1f87ec1b6ef0a04d64e0ec8446c82dd0193
                                            • Instruction Fuzzy Hash: 69221F27E18FC641F3168739A8527B9A714AFE77D4F01D327FE9472A96EB28D2419300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6721710 Relevance: 16.7, APIs: 11, Instructions: 169networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@htons$ErrorLastbindhtonl$Data@@Sharedsetsockopt
                                            • String ID:
                                            • API String ID: 3825734897-0
                                            • Opcode ID: 732953664e9af77f634efa61945c1554cea57fedc6a7ea943af0dce4a2d7820f
                                            • Instruction ID: 62159772eed2828564b781887e05af8b599ad55734ce6609b01d4857ce779044
                                            • Opcode Fuzzy Hash: 732953664e9af77f634efa61945c1554cea57fedc6a7ea943af0dce4a2d7820f
                                            • Instruction Fuzzy Hash: B5712822F0865299FB509BB4D870ABC3379BB40318F540236DE6D97EDDEE38A9458B40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60CFFDE60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 320COMMON
                                            Download Yara Rule
                                            APIs
                                            • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF60CFFE11E
                                            • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF60CFFE28B
                                            • ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF60CFFE2E2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo_noreturn$Init@locale@std@@Locimp@12@_
                                            • String ID: bytes=(\d*-\d*(?:,\s*\d*-\d*)*)
                                            • API String ID: 23434050-4191776997
                                            • Opcode ID: c2f909bc7363895c76d7e2fe2f0250f65245d0ecd325f805df0625069a6c0906
                                            • Instruction ID: 4b566c4ca416bac6b5453bb08045f585d9a16f3867052ff777feae204a05f000
                                            • Opcode Fuzzy Hash: c2f909bc7363895c76d7e2fe2f0250f65245d0ecd325f805df0625069a6c0906
                                            • Instruction Fuzzy Hash: 48E1A372E14B8289EB10CF65D8442AD2761EF957A4F204336EA9D97AD9DF7CE181C340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D8D2E0 Relevance: 2.8, APIs: 2, Instructions: 319COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memset
                                            • String ID:
                                            • API String ID: 2221118986-0
                                            • Opcode ID: c174cb0284ea2954889247d25a374f4b060926c6d1d824f463143b0538244698
                                            • Instruction ID: 58a58e8df1aec181aff16296ed64eaa88e35ab9dc655fba8cd99c8f84c69be02
                                            • Opcode Fuzzy Hash: c174cb0284ea2954889247d25a374f4b060926c6d1d824f463143b0538244698
                                            • Instruction Fuzzy Hash: FDD1D333B156948EE710CFA5E8406AE7BB1F788B88F148129EF4A53F98DB78D515CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D8B6E0 Relevance: 1.6, APIs: 1, Instructions: 326COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memcpy
                                            • String ID:
                                            • API String ID: 3510742995-0
                                            • Opcode ID: 8ec90958a33035b8c3a2333d01e3496d79ce93d839a37f01003fda73f41b24fb
                                            • Instruction ID: 15b05aa1a013f28fa5245db73404e9d6d94d017f121b51636150e280117d0177
                                            • Opcode Fuzzy Hash: 8ec90958a33035b8c3a2333d01e3496d79ce93d839a37f01003fda73f41b24fb
                                            • Instruction Fuzzy Hash: 56D1B232719A8A86E7348F15E850BBEB761FB84B85F188135DA9D43B8DDF3DE4408B40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D97210 Relevance: 1.4, APIs: 1, Instructions: 171COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memset
                                            • String ID:
                                            • API String ID: 2221118986-0
                                            • Opcode ID: bd74064e56dea1f1d7ef9470d5a3f1964448904587220ae4d0306f0437b775a9
                                            • Instruction ID: a6bfdda938e797bdaab38f744a6626d9d966c9dd5ec6bf7cc68d05d42bd3914b
                                            • Opcode Fuzzy Hash: bd74064e56dea1f1d7ef9470d5a3f1964448904587220ae4d0306f0437b775a9
                                            • Instruction Fuzzy Hash: 99613D32B2D68586D7258B39E8157D9B750EFD6788F048336EB9D63F94EB39E0418700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D7B830 Relevance: 1.4, APIs: 1, Instructions: 151COMMON
                                            Download Yara Rule
                                            APIs
                                            • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,?,00007FFDF5D7B060), ref: 00007FFDF5D7BA47
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: free
                                            • String ID:
                                            • API String ID: 1294909896-0
                                            • Opcode ID: 7f32ac18983dd8e3564947396fa59db4d44e3b44078201540149927801372f90
                                            • Instruction ID: 151c9e4d51a045b306623bc177aebb2cc887d0e4c28758db6dd91591390003b0
                                            • Opcode Fuzzy Hash: 7f32ac18983dd8e3564947396fa59db4d44e3b44078201540149927801372f90
                                            • Instruction Fuzzy Hash: 3D51D23372AA898BD720CF18F844A69B7A0F759B49F562125CA6D53749DB3DD402CF00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D910C0 Relevance: .7, Instructions: 661COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 0a99f0cfc22f3370cdea37e5f78af0848b403ac3476b1640608527408cb07702
                                            • Instruction ID: b915537788713c680790f36a55b6df54efd88e4998dafdbfda5f25e59e52c511
                                            • Opcode Fuzzy Hash: 0a99f0cfc22f3370cdea37e5f78af0848b403ac3476b1640608527408cb07702
                                            • Instruction Fuzzy Hash: 61528C73A15A4A86E7248F64D861B6833A5FB65F58F050131DA6E833DDEF3CD892C780
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D69340 Relevance: .5, Instructions: 524COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: d6fe96a16a7ce5ef83c53ee06c64ef818c4683e2d209910c084b2512d81f2572
                                            • Instruction ID: 2bce4191c66248f4c7f60c34bd5678e05b6e05e43ca08fc8e8bd31cf77ffba17
                                            • Opcode Fuzzy Hash: d6fe96a16a7ce5ef83c53ee06c64ef818c4683e2d209910c084b2512d81f2572
                                            • Instruction Fuzzy Hash: C0127BB3A1999A46E32D8A3CDC31B397900EB62716F0D433DEB6747BD9D61DE2018710
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D67090 Relevance: .5, Instructions: 524COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: def153f7c8edcefe08ab79682192c8670ac686ce948fef1fb8aae0bf3735752f
                                            • Instruction ID: df10da3546245089f8fcdd8016765cfc81b39de166f1d5f159ea38e779ad7925
                                            • Opcode Fuzzy Hash: def153f7c8edcefe08ab79682192c8670ac686ce948fef1fb8aae0bf3735752f
                                            • Instruction Fuzzy Hash: 35126AB3A1999E46E32D8A3CDC31B796A04EB61711F09433DEB6787FD9DA1CE2018710
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D577C0 Relevance: .5, Instructions: 459COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: c237c9e6a3863ea215359ce58544240fabacc9300a40c27e7ffc6fcce60c9609
                                            • Instruction ID: 956cb3504d863ac3a8438ddf95f6dcc35d440fe2b2dae8a17300dfaeeb2d482d
                                            • Opcode Fuzzy Hash: c237c9e6a3863ea215359ce58544240fabacc9300a40c27e7ffc6fcce60c9609
                                            • Instruction Fuzzy Hash: 182260E311D1E88EC312CB689455E9E7F7AE36264DF0E439ADBC187243D52AD239C721
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D533C0 Relevance: .4, Instructions: 379COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 0a6dfe6344e8504487b25704417e2a1798e6ba19cfb5c7696290d43f0ba20951
                                            • Instruction ID: ddf3755b1e171df9e03fd21e55b148de00b9dfadf268201781b2cdc776b80d06
                                            • Opcode Fuzzy Hash: 0a6dfe6344e8504487b25704417e2a1798e6ba19cfb5c7696290d43f0ba20951
                                            • Instruction Fuzzy Hash: E9F1F666E39F9645E3039A3990025A4AB64AFF77C0B42D317FE5432E57E726E3868304
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D834A0 Relevance: .4, Instructions: 378COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 60b2e5ed820d629f45fc6c260afb1c20eba209c835a15c6350902dbfac8bf639
                                            • Instruction ID: 134b1cef69e1a1381328ffdf003752e39d5cc087923f288054e5bc03f253d10a
                                            • Opcode Fuzzy Hash: 60b2e5ed820d629f45fc6c260afb1c20eba209c835a15c6350902dbfac8bf639
                                            • Instruction Fuzzy Hash: 2BF1A622E36F8988E313C63548215EAE3989FB7BC5B1DD373E91E366A5EF15A4D34100
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D77190 Relevance: .4, Instructions: 377COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: d8650f8caf90b363a18062986412e2212fb0d312d88800073c5a7c2cad70125e
                                            • Instruction ID: a68b87c08407182f6ee228763d4a8a9c6561557d4443a92a44aace9b81ac029d
                                            • Opcode Fuzzy Hash: d8650f8caf90b363a18062986412e2212fb0d312d88800073c5a7c2cad70125e
                                            • Instruction Fuzzy Hash: 1DF1CF2AE35BC740F343433DA813565A618AFB72C1F45D327FEA076957FB1AA3928214
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D79DE0 Relevance: .3, Instructions: 297COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 4a02cfd67172f175fd8c1b69b35b3f6983933762297fc90631752ab9be1bd3c9
                                            • Instruction ID: 9f5338296812389e5d17b99d651df8906f9d5fd52ab5a450b567dbccab505ce3
                                            • Opcode Fuzzy Hash: 4a02cfd67172f175fd8c1b69b35b3f6983933762297fc90631752ab9be1bd3c9
                                            • Instruction Fuzzy Hash: AEE1D92BE29BCA40F303477C6813675A714BFA76C1F059336FEA47695BFB1A62858300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D79800 Relevance: .3, Instructions: 294COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 95de573dc31c0a257e444cba30faa3cd72b45e5b1a28fe7149578d967faecb0d
                                            • Instruction ID: bb916f6dd4114fc7218b15ddc5074476e6ec84e134223a4c5d2c2a3c535cf07a
                                            • Opcode Fuzzy Hash: 95de573dc31c0a257e444cba30faa3cd72b45e5b1a28fe7149578d967faecb0d
                                            • Instruction Fuzzy Hash: A9E1962BE29BCA41F303477C6813675A714BFA76C1F059326FEA476557FB2A63828300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D751D0 Relevance: .3, Instructions: 288COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 771c496e040631eb5fb52144d2303884810ece4a69a631633d5406c313f1e6ed
                                            • Instruction ID: 254d7b3ea5040f3be5e7a4658ead34465466e27313932596985de390addaf099
                                            • Opcode Fuzzy Hash: 771c496e040631eb5fb52144d2303884810ece4a69a631633d5406c313f1e6ed
                                            • Instruction Fuzzy Hash: 9AC17A2BD35FD780F383563D64030A5E714AFFB5D1A54E327BEE075813BB5A62928228
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D7B0B0 Relevance: .2, Instructions: 246COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: c92dffa16166d381f9fc7ea7c4cf62e8abebfe9ae4b201fecacb47106d821f34
                                            • Instruction ID: 550b36c982a0a802dc354ef8e3e1a181e61e489ac7ce5b2b81a771dfb516cf4b
                                            • Opcode Fuzzy Hash: c92dffa16166d381f9fc7ea7c4cf62e8abebfe9ae4b201fecacb47106d821f34
                                            • Instruction Fuzzy Hash: 7CB1C63270A68686E724DB15F86076E73A1FB84B94F505135DA6E43BDAEF3CE446C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D8DE10 Relevance: .2, Instructions: 236COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 003b7e9d3a947673a8b4916ec09cfe7f2636f82eda65933d32d6b107754d9aa8
                                            • Instruction ID: 786525414d3f7f23d6dee29aa4c1828e86dbcf041ab298e37994e4aed20413ed
                                            • Opcode Fuzzy Hash: 003b7e9d3a947673a8b4916ec09cfe7f2636f82eda65933d32d6b107754d9aa8
                                            • Instruction Fuzzy Hash: 50A18362B16B9982EB50CB28D855B7D77A4FB98B48F069235DF5C47395EF38E1818300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D55800 Relevance: .2, Instructions: 230COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 13a231e4f623b5607e7be7b0529116ed453af7a32aba6d2fbf4618d76eb05776
                                            • Instruction ID: 59f29a0026d3195fb84471d59abc1d894959bbe91050ace768a3ef94faf64583
                                            • Opcode Fuzzy Hash: 13a231e4f623b5607e7be7b0529116ed453af7a32aba6d2fbf4618d76eb05776
                                            • Instruction Fuzzy Hash: D1A1B326D39BC740F2030B3D6513665EB246FF76C5B15E317BEA471A62FB2663D28204
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D79320 Relevance: .2, Instructions: 213COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: cf91b26fc0883c0cbb96fcbb7618f7770f7cadea2d5e59dd139fee4ae17142c9
                                            • Instruction ID: be6f949f69714c7c52b9325d16ecd79f5ec554a441e8d484688cb6925f42bea7
                                            • Opcode Fuzzy Hash: cf91b26fc0883c0cbb96fcbb7618f7770f7cadea2d5e59dd139fee4ae17142c9
                                            • Instruction Fuzzy Hash: 4EB17E2BD39BCA81F343573D6413575A324BFEB2C1F549326BEA471867BB2A63818204
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D5D5A0 Relevance: .1, Instructions: 80COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: c0b194e39cc6da081e013d6d9db2775be4cedf03b2f574f32b1ea0367903e561
                                            • Instruction ID: a4e61a07c536a9c310c4a29897838b69403b71706d21f1dc4d4dc4357da8c8f1
                                            • Opcode Fuzzy Hash: c0b194e39cc6da081e013d6d9db2775be4cedf03b2f574f32b1ea0367903e561
                                            • Instruction Fuzzy Hash: 8B11A3B1730572029F288F3EAE18D696DC2E6C9741389A739F695C3EC9C52CD801E7A0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D5D750 Relevance: .1, Instructions: 77COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 17e837ff84a994432eb76af5224bf2b941519170938f3887742bcb1a55670ad9
                                            • Instruction ID: 12e23ba01796de4c910fad0e2eb9d61e1af58c26f116d765c0390410d5d859e6
                                            • Opcode Fuzzy Hash: 17e837ff84a994432eb76af5224bf2b941519170938f3887742bcb1a55670ad9
                                            • Instruction Fuzzy Hash: 8111B2B333552707E3184D3CAD49B5D6A4283D4702BC86728F995CBBCACAACFA55C790
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D5D680 Relevance: .1, Instructions: 64COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 306b839035eb99f56001e18e8d9299db432a4a2f5dfbb8aa89e158be053b6984
                                            • Instruction ID: 5f70f61494b2fd63ed2f02dd7405740fa24d365edfc59bba270d73ed1202131a
                                            • Opcode Fuzzy Hash: 306b839035eb99f56001e18e8d9299db432a4a2f5dfbb8aa89e158be053b6984
                                            • Instruction Fuzzy Hash: 401184A573503907F71D452E9C58A381982D3D9742FC0923CF8CADBACAC87DD58597A0
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6681770 Relevance: 94.8, APIs: 53, Strings: 1, Instructions: 289memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$V0@@$Url@@$Array@@Byte$?setArrayFlags@FormattingMode@1@@Name@Option@Parsing$??8@ComponentData@@String@@0@User$?allocate@?from?lock@?shared?unlock@?userA@$$AllocationConcurrency::details::stl_critical_section_win7::stl_critical_section_win7Data@@@@@Empty@Encoded@Fragment@Latin1@Locker@@MutexMutex@@Null@Option@2@@@@U1@_Url@@@@@
                                            • String ID: auth:
                                            • API String ID: 2027866523-104923615
                                            • Opcode ID: c44e107942be7dcd736d753c68fa18cdfdbb766ea192bae722249f55be891922
                                            • Instruction ID: 332595c528e034d4ddd9bfb9a9faee7cc0e3559468c85f5cc22fc1cb93656d3f
                                            • Opcode Fuzzy Hash: c44e107942be7dcd736d753c68fa18cdfdbb766ea192bae722249f55be891922
                                            • Instruction Fuzzy Hash: BAE11B26B089479AEB10DB75D4749AC7339FF54748B804271C92E17EACEF78E94AC780
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66A3830 Relevance: 75.4, APIs: 27, Strings: 16, Instructions: 148COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$String@@$?connect@ConnectionQt@@@Type@$String@@@$ObjectV0@@$?setLatin1Name@$Private@@
                                            • String ID: 1connected()$1connectionClosed()$1dtpConnectState(int)$1error(QAbstractSocket::SocketError)$1hostFound()$1readyRead()$1setupSocket()$2connectState(int)$2connected()$2disconnected()$2error(QAbstractSocket::SocketError)$2hostFound()$2newConnection()$2readyRead()$QFtpDTP active state server$QFtpPI_socket
                                            • API String ID: 1287429056-2602667496
                                            • Opcode ID: f06bf243582f526bec42ffb9ec50d5808d4a861e13b29192c42f8b76b52ff29c
                                            • Instruction ID: 0ea7b93fb2302413eba5ff419d1a652e5071557176251c2f51bf06348710d9d2
                                            • Opcode Fuzzy Hash: f06bf243582f526bec42ffb9ec50d5808d4a861e13b29192c42f8b76b52ff29c
                                            • Instruction Fuzzy Hash: D8812372708B4696EB10CF65E8644E97378FB48748B400236DB9E52E78EF7CD68AC744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60CFF2E60 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 170threadwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Widget@@$Variant@@$?hide@$?from?setArrayAscii_helper@Data@Settings@@TypedValue@Variant@@@$?close@?current?tr@AbstractBox@@Button@@Checked@MessageMetaObject@@Running@StandardThread@@$?question@Box@@@@Button@Button@1@ComboDatabase@@Flags@Index@String@@1String@@@Text@W421@@
                                            • String ID: Are you sure?$Quit$autoconnect_proxy$selectedProxyServer$tab_index
                                            • API String ID: 2651110133-1171995914
                                            • Opcode ID: 48c760900252c9a2d18a90f3b55bdf4bcd8f96fd5b9ffe911a8ce629e7de49d1
                                            • Instruction ID: ead5cf36204d568edd1f15bebede96ee4f19844871bd3908ef6996e576a9bd0b
                                            • Opcode Fuzzy Hash: 48c760900252c9a2d18a90f3b55bdf4bcd8f96fd5b9ffe911a8ce629e7de49d1
                                            • Instruction Fuzzy Hash: 35814032A05A4296EB14DF21E8542FC2330FF85B59F611231DA9F936A4EF7CE559C344
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6687800 Relevance: 64.9, APIs: 27, Strings: 10, Instructions: 180windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6693F40: ??0QVariant@@QEAA@AEBV0@@Z.QT5CORE(?,?,00000000,00007FFDF6686364), ref: 00007FFDF6693FAA
                                            • ?isValid@QVariant@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF668783B
                                            • ??1QVariant@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687848
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF668786C
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF668787A
                                            • ?reserve@QByteArray@@QEAAXH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687887
                                            • ??YQByteArray@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687898
                                            • ??YQByteArray@@QEAAAEAV0@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF66878E1
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF66878F2
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687900
                                            • ?reserve@QByteArray@@QEAAXH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687911
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF668791B
                                            • ?begin@QByteArray@@QEAAPEADXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687928
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687950
                                            • ?cend@QByteArray@@QEBAPEBDXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF668795C
                                            • ?resize@QByteArray@@QEAAXH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF668799F
                                            • ??0QVariant@@QEAA@AEBVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF66879AD
                                            • ??1QVariant@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF66879C4
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF66879CE
                                            • ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF66879F0
                                            • ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687A1A
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687A33
                                            • ?isReadable@QIODevice@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687A47
                                            • ?isOpen@QIODevice@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687A59
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687A81
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687A9C
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687AAC
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF66875E4), ref: 00007FFDF6687AB6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Array@@$String@@$Variant@@$?size@$Logger@@Message$?reserve@Device@@$?begin@?cend@?const?resize@?warning@Array@@@Char@@Data@Open@Readable@V0@@Valid@
                                            • String ID: 1.0$; boundary="$MIME-Version$alternative$could not open device for reading$device is not readable$form-data$mixed$multipart/$related
                                            • API String ID: 2288370592-1383949304
                                            • Opcode ID: c62fdd8d719d8a98891568727c068f6179c777c8b1e49003ebe5d797a25005cb
                                            • Instruction ID: ba3595aaa05d26046b77fc0a8063749fe029e3ad486703393ecb86c8119e58c2
                                            • Opcode Fuzzy Hash: c62fdd8d719d8a98891568727c068f6179c777c8b1e49003ebe5d797a25005cb
                                            • Instruction Fuzzy Hash: 3F816222B08A4695EB10DF34D8749B83B64FF45B98B4452B1D92E43E9CEF3CD94AC740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66A7790 Relevance: 59.8, APIs: 30, Strings: 4, Instructions: 302COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@Byte$Data@@List$V0@@$?begin@Latin1$?append@Null@$?append?const?dispose@?size@AbstractChar@@Char@@@Concatenable@@Data@Data@1@@Qt@@@String@@@$?compare@?detach_grow@?end@CaseData@1@Initialization@Sensitivity@memcpy
                                            • String ID: PASS $USER $anonymous$anonymous@
                                            • API String ID: 38148645-4189793654
                                            • Opcode ID: 5b173e4a530d8b213f033df47d33988da5fdd27c021bc82ab8ce30158badd24a
                                            • Instruction ID: a28af2ac5fdae146fc6fc1d74c3be5df0b8601109c67d15ec183c22219701530
                                            • Opcode Fuzzy Hash: 5b173e4a530d8b213f033df47d33988da5fdd27c021bc82ab8ce30158badd24a
                                            • Instruction Fuzzy Hash: 35F15D36B08B8299EB20CF24E8606ED3768FB44758F504275DA5E4BED8EF38D549C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67277F0 Relevance: 56.2, APIs: 31, Strings: 1, Instructions: 195COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$String@@$?size@$?cend@?const?number@Char@@Data@$?at@?begin@?reserve@?resize@$Empty@
                                            • String ID: .
                                            • API String ID: 3525849219-248832578
                                            • Opcode ID: 94a8118facfa0cd032cb76fafd43ce0091dd01613cf08f42040975f000bfc8d1
                                            • Instruction ID: a380f4a92a8ce6d6bb290e402b97579a652aef92ea7c979f87aa7fd5abb4e418
                                            • Opcode Fuzzy Hash: 94a8118facfa0cd032cb76fafd43ce0091dd01613cf08f42040975f000bfc8d1
                                            • Instruction Fuzzy Hash: 97717F21B0C7868AEB049F25A83853977A5BB86BC5F444270CE5F03F98EF7CD94A8704
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66D56C0 Relevance: 50.9, APIs: 27, Strings: 2, Instructions: 175COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$String@@$?size@$?append@?clear@?read@?reserve@?startsDevice@@Empty@With@
                                            • String ID: HTTP/$HTTP/
                                            • API String ID: 378662063-1049685889
                                            • Opcode ID: b9a08e5c9eac85c8446db2f5a7ad2771d4ec4da3678440d996bb36ba7e239436
                                            • Instruction ID: 6f36fa08af97c2b4ece7356c836684eca8cfaf016975e85904970519c5a1a1d0
                                            • Opcode Fuzzy Hash: b9a08e5c9eac85c8446db2f5a7ad2771d4ec4da3678440d996bb36ba7e239436
                                            • Instruction Fuzzy Hash: 8461B722B0864286FB209F25E874B793365EF41BA5F545175CD6E06ED8EF3CE88AC700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6735700 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 130COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$Data@@List$?begin@$V0@@$?dispose@Data@1@@$?append@?detach_grow@?end@Data@1@
                                            • String ID: /etc/openssl/certs/$/etc/ssl/$/etc/ssl/certs/$/opt/openssl/certs/$/usr/lib/ssl/certs/$/usr/local/ssl/$/usr/local/ssl/certs/$/usr/share/ssl/$/var/ssl/certs/
                                            • API String ID: 343098008-1513479150
                                            • Opcode ID: 3c8d9e43ba82f16890952a124e7e40704255db64f5ef72055e51a91a95f569a6
                                            • Instruction ID: 692e8667de04b4e38e884b88aea204a00c8c9e980c04248ab649318c6497145e
                                            • Opcode Fuzzy Hash: 3c8d9e43ba82f16890952a124e7e40704255db64f5ef72055e51a91a95f569a6
                                            • Instruction Fuzzy Hash: A0510222B18A1695EB10EF65D8718F93325FF44B89B501135D91E07EACFF6CD98AC340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66A979E Relevance: 42.1, APIs: 13, Strings: 11, Instructions: 80COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FFDF66A97D0
                                            • ?setObjectName@QObject@@QEAAXAEBVQString@@@Z.QT5CORE ref: 00007FFDF66A97DE
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF66A97E8
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66A9812
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66A981C
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66A9844
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66A984E
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66A9876
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66A9880
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66A98A8
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66A98B2
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66A98DA
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66A98E4
                                              • Part of subcall function 00007FFDF6715820: ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF6715835
                                              • Part of subcall function 00007FFDF6715820: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF6715847
                                              • Part of subcall function 00007FFDF6715820: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF67158AD
                                              • Part of subcall function 00007FFDF6715820: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF67158CA
                                              • Part of subcall function 00007FFDF6715820: ?deleteLater@QObject@@QEAAXXZ.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF67158EC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$?connect@ConnectionQt@@@Type@$Data@@List$?dispose@Data@1@@String@@String@@@$?begin@?delete?end@?setLater@Latin1Name@Object
                                            • String ID: 1socketBytesWritten(qint64)$1socketConnected()$1socketConnectionClosed()$1socketError(QAbstractSocket::SocketError)$1socketReadyRead()$2bytesWritten(qint64)$2connected()$2disconnected()$2error(QAbstractSocket::SocketError)$2readyRead()$QFtpDTP Active state socket
                                            • API String ID: 913286721-2328112770
                                            • Opcode ID: ced64c1eeb317e209d335217329a4daa5e92d5650e10a7b6c821b52e00594725
                                            • Instruction ID: e7bec81176cc43aa8378a84fe08afb1cb50795ed20eba33217d14b34e7aac6af
                                            • Opcode Fuzzy Hash: ced64c1eeb317e209d335217329a4daa5e92d5650e10a7b6c821b52e00594725
                                            • Instruction Fuzzy Hash: CE41E072B08B16D6EB10CF65E9648AC3374FB48748B500176DA5E53EACEF38D69AC740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6717520 Relevance: 40.7, APIs: 27, Instructions: 213timeCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6714530: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FFDF671454F
                                              • Part of subcall function 00007FFDF6714530: ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF671455F
                                            • ??0QByteArray@@QEAA@HD@Z.QT5CORE ref: 00007FFDF67175AA
                                            • ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF67175B4
                                            • ?begin@QByteArray@@QEAAPEADXZ.QT5CORE ref: 00007FFDF67175C1
                                              • Part of subcall function 00007FFDF6714810: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FFDF6714841
                                              • Part of subcall function 00007FFDF6714810: ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF6714851
                                            • ??0QString@@QEAA@XZ.QT5CORE ref: 00007FFDF67175ED
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE ref: 00007FFDF6717618
                                            • ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF6717625
                                            • ??0QString@@QEAA@XZ.QT5CORE ref: 00007FFDF6717638
                                              • Part of subcall function 00007FFDF66F7970: ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00000000,00007FFDF67307A7,?,?,?,00007FFDF6746CBE,?,?,00000000,00007FFDF6730752), ref: 00007FFDF66F798D
                                              • Part of subcall function 00007FFDF66F7970: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00000000,00007FFDF67307A7,?,?,?,00007FFDF6746CBE,?,?,00000000,00007FFDF6730752), ref: 00007FFDF66F7997
                                              • Part of subcall function 00007FFDF671A170: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF6719F52), ref: 00007FFDF671A1A0
                                              • Part of subcall function 00007FFDF671A170: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF6719F52), ref: 00007FFDF671A1B6
                                              • Part of subcall function 00007FFDF671A170: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF6719F52), ref: 00007FFDF671A1D5
                                              • Part of subcall function 00007FFDF671A170: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00007FFDF6719F52), ref: 00007FFDF671A24C
                                            • ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF671768D
                                            • ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF67176A4
                                            • ??4QDateTime@@QEAAAEAV0@$$QEAV0@@Z.QT5CORE ref: 00007FFDF67176B1
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF67176BB
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF67176E9
                                            • ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z.QT5CORE ref: 00007FFDF67176FF
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF671770B
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF671771C
                                              • Part of subcall function 00007FFDF67199F0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF6719A37
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF671773E
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF671774A
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF6717776
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF67177CE
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                            • ?append@QListData@@QEAAPEAPEAXXZ.QT5CORE ref: 00007FFDF67177DE
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF67177FB
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF6717826
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF6717830
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF671783A
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF671789E
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF67178A8
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF67178B2
                                              • Part of subcall function 00007FFDF67147B0: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FFDF67147CF
                                              • Part of subcall function 00007FFDF67147B0: ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF67147DF
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$String@@$Data@@$List$?begin@?size@Logger@@Message$V0@@$?warning@$?constChar@@Data@$?append@?detach_grow@?end@Data@1@DateSharedTime@@V0@$$malloc
                                            • String ID:
                                            • API String ID: 3322277849-0
                                            • Opcode ID: c0e21c67cf75e3fe747dcf8ff38d2e88b10c5282d4ae763abdd20a76f918ed55
                                            • Instruction ID: ef8066f0e41586cb7729df301ae551463cea71c1942b594e2925035273b66274
                                            • Opcode Fuzzy Hash: c0e21c67cf75e3fe747dcf8ff38d2e88b10c5282d4ae763abdd20a76f918ed55
                                            • Instruction Fuzzy Hash: 7CA14C26B08A4296EB10DF25E4746BD7364FB84B88F404572DA6E43EE9EF38D54AC300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF668D840 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Url@@$FileInfo@@$?scheme@Dir@@Formatting$?exists@ComponentEmpty@Flags@Option@$?authority@?compare@?dir@?size@CaseFile@Latin1LocalOption@2@@@@Qt@@@Sensitivity@String@String@@@Url@@@@@V0@@
                                            • String ID: qrc
                                            • API String ID: 3580839574-1673588963
                                            • Opcode ID: 1de6d75ad68d28835c68548db97a6485371a92565bbd6b5c457c82351fa25ace
                                            • Instruction ID: 5b94535de96610024341dc38e67bfa6ffc5c3049f6fff34a2f6296ef91149167
                                            • Opcode Fuzzy Hash: 1de6d75ad68d28835c68548db97a6485371a92565bbd6b5c457c82351fa25ace
                                            • Instruction Fuzzy Hash: EB515C22B08A1295FB009F74D874AB83378EF44798F405675D92E52EECEF2CD98AC750
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6695660 Relevance: 37.7, APIs: 25, Instructions: 186COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@$Array@@Byte$V0@@$?end@$?dispose@Data@1@Data@1@@$?append@?detach@?detach_grow@?realloc@?size@
                                            • String ID:
                                            • API String ID: 1400189274-0
                                            • Opcode ID: e9ac4835167f14f2809d85a976cf1b8148f66709bfbe63671945405eae455789
                                            • Instruction ID: 6e8be50b5e310fde0b24725c7538d6e948b712919e52bb525e16e5dc2e45e68e
                                            • Opcode Fuzzy Hash: e9ac4835167f14f2809d85a976cf1b8148f66709bfbe63671945405eae455789
                                            • Instruction Fuzzy Hash: A2719D26F19A1686EB109F15A8649793368FB45F95B444271CE2E47FECEF3CE886C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66AD6D0 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 122COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$With@$Data@@List$?compare@?ends?startsCaseQt@@@Sensitivity@$?begin@?dispose@?end@Data@1@@LongLong@V0@@
                                            • String ID: application/$content-length$content-type$ecmascript$javascript$text/
                                            • API String ID: 3071422044-756080929
                                            • Opcode ID: 9c8a501be1b093545f216e3dfcc28588d1417148850f328270932dcaa4ab4f7c
                                            • Instruction ID: 7a59b3ee538010ed4ab0c0dac4e370a44ba0d64a6965da08631a20f2c47972da
                                            • Opcode Fuzzy Hash: 9c8a501be1b093545f216e3dfcc28588d1417148850f328270932dcaa4ab4f7c
                                            • Instruction Fuzzy Hash: 80518122B0894291EB10DF15E474AB97378EF85B94F941171DA6D07DE8EF2DE84AC700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66857A0 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 179COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QBasicMutex@@QEAA@XZ.QT5CORE ref: 00007FFDF66857CD
                                            • ?setHost@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z.QT5CORE ref: 00007FFDF66857E0
                                            • ?setPort@QUrl@@QEAAXH@Z.QT5CORE ref: 00007FFDF66857EC
                                            • ??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FFDF6685815
                                            • ?setScheme@QUrl@@QEAAXAEBVQString@@@Z.QT5CORE ref: 00007FFDF6685823
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF668582D
                                              • Part of subcall function 00007FFDF6692C20: ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF6696996), ref: 00007FFDF6692C45
                                              • Part of subcall function 00007FFDF6692C20: ??0QBasicMutex@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF6696996), ref: 00007FFDF6692C80
                                              • Part of subcall function 00007FFDF6692C20: ??4QUrl@@QEAAAEAV0@AEBV0@@Z.QT5CORE(?,?,00000000), ref: 00007FFDF6692CCE
                                            • ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF6685891
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66858F8
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE ref: 00007FFDF6685906
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF6685910
                                            • ??0QVariant@@QEAA@_N@Z.QT5CORE ref: 00007FFDF6685929
                                            • ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF6685958
                                              • Part of subcall function 00007FFDF6685A70: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685A8B
                                              • Part of subcall function 00007FFDF6685A70: ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685A97
                                              • Part of subcall function 00007FFDF6685A70: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685AB3
                                              • Part of subcall function 00007FFDF6685A70: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685ABE
                                              • Part of subcall function 00007FFDF6685A70: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685ACB
                                              • Part of subcall function 00007FFDF6685A70: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685AD7
                                              • Part of subcall function 00007FFDF6685A70: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685AE3
                                              • Part of subcall function 00007FFDF6685A70: memcmp.VCRUNTIME140(?,?,?,00007FFDF66858AF), ref: 00007FFDF6685AF2
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66859C7
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE ref: 00007FFDF66859D5
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66859DF
                                            • ??0QVariant@@QEAA@_N@Z.QT5CORE ref: 00007FFDF66859F0
                                            • ??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FFDF6685A0C
                                            • ??1QUrl@@QEAA@XZ.QT5CORE ref: 00007FFDF6685A44
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@Byte$Data@@Url@@$List$?set?size@Variant@@$?const?dispose@BasicChar@@Data@Data@1@@Mutex@@String@@@$?begin@?end@Host@Latin1Mode@1@@ParsingPort@Scheme@SharedV0@@memcmp
                                            • String ID: preconnect-https$spdy/3
                                            • API String ID: 2419606996-1821861327
                                            • Opcode ID: ce5eb206166f7991eaf31f39ad989bd0dda4e83f1fa2a1e98cdab017a5dd70e5
                                            • Instruction ID: 9ad56ad8e3bf150555f810c772cb77ee3b4997d11055e1254a349e0eac3d9de3
                                            • Opcode Fuzzy Hash: ce5eb206166f7991eaf31f39ad989bd0dda4e83f1fa2a1e98cdab017a5dd70e5
                                            • Instruction Fuzzy Hash: D8814B22B0894299EB50DF35E4A0AFD3365EF90758F844172DE1E13D9CEE38E90AC740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6727500 Relevance: 34.7, APIs: 23, Instructions: 210memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array$Data@@$?data@$Array@@Byte$V0@@$String@@U1@_$?allocate@?deallocate@?sharedAllocationData@@@@@Flags@Null@Option@memcpy
                                            • String ID:
                                            • API String ID: 3796595600-0
                                            • Opcode ID: 029e8bbf3a7c3cf4d02fc658622c3b2109aa8bc900f98d99ad34ee1e876812a7
                                            • Instruction ID: fb9e4af57a9b4ce9a0475805f9d88a60931d7ff0ce6c5a0b73fecb5a6da8084d
                                            • Opcode Fuzzy Hash: 029e8bbf3a7c3cf4d02fc658622c3b2109aa8bc900f98d99ad34ee1e876812a7
                                            • Instruction Fuzzy Hash: 69815062B0968286EB10DF15E6749B973A4FB45F95B094231CE2E47F98EF3CE846C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66BD7C0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 140COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@MetaVariant@@$?connect@?get?setConnectionCountData@ExternalObject@@@Pointer@@Property@Qt@@@Ref@SharedType@U12@Variant@@@$String@@
                                            • String ID: 1_q_replyDestroyed(QObject*)$1_q_uploadDataReadyRead()$2destroyed(QObject*)$2readyRead()$HTTP2StreamID
                                            • API String ID: 334285360-237629884
                                            • Opcode ID: 6a62c076009e8dd64c6f75dce9c84cb38b34fa5427d97740aa1b2be1f3c68640
                                            • Instruction ID: f865060d4d12ebd17090bc7ea9ab9b9710ccb1d99f2a0c733b2102aaf35e1d7d
                                            • Opcode Fuzzy Hash: 6a62c076009e8dd64c6f75dce9c84cb38b34fa5427d97740aa1b2be1f3c68640
                                            • Instruction Fuzzy Hash: E4618232718A8696D714DF21E860BAE7368FB84B54F444135DA6D47E9CEF3CD94ACB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF668F770 Relevance: 31.6, APIs: 21, Instructions: 104timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$String@@$V0@@$?size@$?index?mid@?trimmed@$?at@DateTime@@V0@$$
                                            • String ID:
                                            • API String ID: 2136887296-0
                                            • Opcode ID: 350fba93a85a3b3bd586205a24f5351de2b50aa0372b9882eb9cc7058acaaacc
                                            • Instruction ID: d3b71fb0f5898db9e87ac362ef38a2d6df73512f5694596f7bd2e7a09c01c14e
                                            • Opcode Fuzzy Hash: 350fba93a85a3b3bd586205a24f5351de2b50aa0372b9882eb9cc7058acaaacc
                                            • Instruction Fuzzy Hash: DB412D32718A4396EB10DF26E8748697774FF84B84B405171DA5E43EA8EF7CD94ACB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF668D6B0 Relevance: 30.2, APIs: 20, Instructions: 172timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?size@ByteString@@$Array@@$?const?dispose@Char@@Data@Data@1@@Device@@Variant@@$?append@?at@?begin@?write@Array@@@Buffer@@DateEmpty@Int@Open@RingTime@@V0@$$V0@@
                                            • String ID:
                                            • API String ID: 236719278-0
                                            • Opcode ID: f1497239347153833c791ae8080fc6c9f60b9718698e65bb3f8e13987b76f10a
                                            • Instruction ID: ce0b24b703495b85d2efa84bce46d614ad571b1b8c3e0d3cc493c6f30c4a9f9b
                                            • Opcode Fuzzy Hash: f1497239347153833c791ae8080fc6c9f60b9718698e65bb3f8e13987b76f10a
                                            • Instruction Fuzzy Hash: CA713032B09A5286E7109F21A464A7933A8FB44F89F494275DE2E43F9DDF3CE956C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6687660 Relevance: 29.8, APIs: 9, Strings: 8, Instructions: 76COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPEAU12@PEBVQObject@@@Z.QT5CORE ref: 00007FFDF6687684
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66876DD
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66876E8
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6687711
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF668771C
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6687745
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF6687750
                                            • ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6687779
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF6687784
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$?connect@ConnectionQt@@@Type@$?getCountData@ExternalObject@@@Pointer@@Ref@SharedU12@
                                            • String ID: 1_q_replyEncrypted()$1_q_replyFinished()$1_q_replyPreSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*)$1_q_replySslErrors(QList<QSslError>)$2encrypted()$2finished()$2preSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*)$2sslErrors(QList<QSslError>)
                                            • API String ID: 88705724-258905617
                                            • Opcode ID: 88f14113e6574b2db36c1229bf9c35dd5e1a4878f5f58fcdcc89dd9e9186a99c
                                            • Instruction ID: ff2abd32538b721e692f02565791155067623da3a93fd3cc6c45884076bd09ae
                                            • Opcode Fuzzy Hash: 88f14113e6574b2db36c1229bf9c35dd5e1a4878f5f58fcdcc89dd9e9186a99c
                                            • Instruction Fuzzy Hash: 0F317072709B4685EB509F25E9609B87768FB48B94F040271DE5D12EA8EF3CD98BC700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D99D54 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 93libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: AddressHandleProc__scrt_fastfail$Module$CloseCreateCriticalDeleteEventSection_onexit
                                            • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                            • API String ID: 1097833127-1714406822
                                            • Opcode ID: d02a69a7411d751e7995a2565a30ce3bf57883ae812f0cc932bd3746a903c3b9
                                            • Instruction ID: bb373a7969cbbba023b637242375ec7dbdfa04ba056e1e43b9ede83d3b5f6e8f
                                            • Opcode Fuzzy Hash: d02a69a7411d751e7995a2565a30ce3bf57883ae812f0cc932bd3746a903c3b9
                                            • Instruction Fuzzy Hash: EC414F60B0BA0E92FF14AB20EC75B752361AF46F58F944039C92E47AEDEF2DA445C300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6729820 Relevance: 27.3, APIs: 18, Instructions: 285COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6744FD0: ?globalInstanceGet@QMutexPool@@SAPEAVQMutex@@PEBX@Z.QT5CORE(?,?,?,?,?,00007FFDF6729859,?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6744FE7
                                              • Part of subcall function 00007FFDF6744FD0: ?lock@QMutex@@QEAAXXZ.QT5CORE(?,?,?,?,?,00007FFDF6729859,?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6744FFA
                                              • Part of subcall function 00007FFDF6744FD0: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6729859,?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6745109
                                              • Part of subcall function 00007FFDF6744FD0: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,?,00007FFDF6729859,?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6745117
                                              • Part of subcall function 00007FFDF6744FD0: ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,00007FFDF6729859,?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6745122
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF67298C5
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6729917
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6729925
                                            • ?isEmpty@QListData@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF672992F
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6729948
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF6728046), ref: 00007FFDF6729C15
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?dispose@Data@1@@$Array@@ByteMutex@@String@@$?global?lock@Empty@Get@InstanceMutexPool@@V0@@
                                            • String ID:
                                            • API String ID: 3050649312-0
                                            • Opcode ID: 110a1d17d103739b19caba1ecdf90705a5a52a839ab9ebf812840503f2738955
                                            • Instruction ID: a6b002267d00878349492e688cf18ccb6127a7336ea77e41c0fa20b71a698aad
                                            • Opcode Fuzzy Hash: 110a1d17d103739b19caba1ecdf90705a5a52a839ab9ebf812840503f2738955
                                            • Instruction Fuzzy Hash: 77C15B32B15A4286EB248F26D8B05B93364FB51B95B5D4235CE6E13EDDDF2DE842CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67134E0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 277timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ElapsedTimer@@$?elapsed@Variant@@$?property@?qt_subtract_from_timeout@@?start@Object@@
                                            • String ID: Socket operation timed out$_q_networksession
                                            • API String ID: 2506561869-1174360909
                                            • Opcode ID: fd903e0b572153d2b81339b0b1c725914bd444621ef3ef56afb4a5bbe2a4c517
                                            • Instruction ID: 5a0fe6ec301a4c1461ceb53e73a546bb93ebb6a419a44e353866eb88bdef1f0e
                                            • Opcode Fuzzy Hash: fd903e0b572153d2b81339b0b1c725914bd444621ef3ef56afb4a5bbe2a4c517
                                            • Instruction Fuzzy Hash: EBD15B32B08A82AAEB50DB64D470BFD3369BB40758F444176DA2D57ED9EF38E54AC340
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66C3830 Relevance: 24.1, APIs: 16, Instructions: 82COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QBasicMutex@@QEAA@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C3845
                                            • ?scheme@QUrl@@QEBA?AVQString@@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C3861
                                            • ?setScheme@QUrl@@QEAAXAEBVQString@@@Z.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C386D
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C3878
                                            • ??1QUrl@@QEAA@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C3883
                                            • ?authority@QUrl@@QEBA?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C38A5
                                            • ?setAuthority@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C38B4
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C38BF
                                            • ??1QUrl@@QEAA@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C38CA
                                              • Part of subcall function 00007FFDF66D73C0: ??0QUrl@@QEAA@AEBV0@@Z.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D73FB
                                              • Part of subcall function 00007FFDF66D73C0: ?path@QUrl@@QEBA?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D7411
                                              • Part of subcall function 00007FFDF66D73C0: ?isEmpty@QString@@QEBA_NXZ.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D741A
                                              • Part of subcall function 00007FFDF66D73C0: ??1QString@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D7428
                                              • Part of subcall function 00007FFDF66D73C0: ?setPath@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D7456
                                              • Part of subcall function 00007FFDF66D73C0: ??1QString@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D7461
                                              • Part of subcall function 00007FFDF66D73C0: ?toEncoded@QUrl@@QEBA?AVQByteArray@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D7478
                                              • Part of subcall function 00007FFDF66D73C0: ??1QUrl@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF66BCED6), ref: 00007FFDF66D7483
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C38E6
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C38F1
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C391A
                                            • ??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C393A
                                            • ?setPath@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C394E
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C3959
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,00000000,00007FFDF66C29EB), ref: 00007FFDF66C3964
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Url@@$?setFormatting$ComponentFlags@Mode@1@@Option@Parsing$?constArray@@ByteChar@@Data@Path@String@@@Url@@@@@$?authority@?path@?scheme@?size@Authority@BasicEmpty@Encoded@Latin1Mutex@@Option@2@@@@Scheme@V0@@
                                            • String ID:
                                            • API String ID: 2195264724-0
                                            • Opcode ID: 0cd64a59c2f0f74f5c35b6d1dc0dbb9947f2c86dd78968ead128553242ba7e7c
                                            • Instruction ID: 9da419f9b13c09c124187f427275164ba08a8c86c517e099572b46038c27037f
                                            • Opcode Fuzzy Hash: 0cd64a59c2f0f74f5c35b6d1dc0dbb9947f2c86dd78968ead128553242ba7e7c
                                            • Instruction Fuzzy Hash: 96318F25B0CA4282EB109B15E47442D7375FF89B81B404275DA9E03FA8EF2DD94ACB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66C781A Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 62timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Char@@@V0@@$?arg@?translate@Application@@CoreDateTime@@V0@$$$Array@@ByteChar@@Empty@Latin1
                                            • String ID: Host %1 not found$QHttp
                                            • API String ID: 2795233775-221119264
                                            • Opcode ID: 45eaf6dbf5d154ed008c5bb623107ea4957b4c1aa8957dd0cacf6d80c5c54b45
                                            • Instruction ID: 32cf0c5d2bb318588feb13a54069c8a08f05906fedda6da54d75611377909883
                                            • Opcode Fuzzy Hash: 45eaf6dbf5d154ed008c5bb623107ea4957b4c1aa8957dd0cacf6d80c5c54b45
                                            • Instruction Fuzzy Hash: D5214622B08A1295EB108F65E8749B83774FF44B99B401272DA2D13EE8FF3CD64AC744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6693460 Relevance: 21.1, APIs: 14, Instructions: 128COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF66934A4
                                            • ?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z.QT5CORE ref: 00007FFDF66934BB
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF66934C7
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF66934D9
                                              • Part of subcall function 00007FFDF6687480: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF668324E,?,?,00000100,00007FFDF66939B7,?,?,?,00007FFDF6692CC4,?,?,00000000), ref: 00007FFDF66874C7
                                              • Part of subcall function 00007FFDF6687480: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF668324E,?,?,00000100,00007FFDF66939B7,?,?,?,00007FFDF6692CC4,?,?,00000000), ref: 00007FFDF66874D5
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF66934FC
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF6693508
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF669353A
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF6693548
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE ref: 00007FFDF6693594
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66935B6
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66935C4
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                            • ?append@QListData@@QEAAPEAPEAXXZ.QT5CORE(?,?,?,?,?,00000000,00007FFDF669663A,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66935E5
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF6694428
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF6694436
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteData@@ListV0@@$?begin@$?append@?detach_grow@?end@Data@1@malloc
                                            • String ID:
                                            • API String ID: 724226085-0
                                            • Opcode ID: 78a164494fe4bcb87a644bdd67d487684fed99e45ff826bb727d26a8ec08ff0c
                                            • Instruction ID: b6e0dc490ba5fc9394ee58486d5344dd12aed2d79ee5e101783a1f2430cbe12f
                                            • Opcode Fuzzy Hash: 78a164494fe4bcb87a644bdd67d487684fed99e45ff826bb727d26a8ec08ff0c
                                            • Instruction Fuzzy Hash: 34516D32708A8682DB009B12E86456AB368FB84FD4F444576DE6D47FACDF7CD596CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D41630 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 64windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Array@@$Device@@Handler@@ImageLogger@@MessageWith@$?device@?ends?peek@?set?starts?warning@Array@@@Array@@_Format@
                                            • String ID: QWebpHandler::canRead() called with no device$RIFF$WEBP
                                            • API String ID: 4149987770-97849969
                                            • Opcode ID: 82b2134fd389eb788f26b41c6ab4919cfe8b9d93f688e279e544d08e78a84ba0
                                            • Instruction ID: f75d1111278f5da6e1faf47a237d457fee5d4ebba46f2518f882b1cf6cb35726
                                            • Opcode Fuzzy Hash: 82b2134fd389eb788f26b41c6ab4919cfe8b9d93f688e279e544d08e78a84ba0
                                            • Instruction Fuzzy Hash: 18214162B0B64A92EF109F64ED24B7963A1FB51F58F440131C56D076ECEF6CD54ACB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF668D6C0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 56windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$?connect@ConnectionLogger@@MessageQt@@@Type@$?critical@Device@@Open@
                                            • String ID: 1_q_copyReadChannelFinished()$1_q_copyReadyRead()$2readChannelFinished()$2readyRead()$QNetworkReplyImpl: copy from QIODevice already in progress -- backend probly needs to be fixed
                                            • API String ID: 460977959-2229069138
                                            • Opcode ID: bf819eea966a306043aba308b9c2a8e483b768d43e69c59bf8b0effabbc5a477
                                            • Instruction ID: a75b932156ade61fb95a830d8e39847c597b17b422922c85677dc5c0cd2728a2
                                            • Opcode Fuzzy Hash: bf819eea966a306043aba308b9c2a8e483b768d43e69c59bf8b0effabbc5a477
                                            • Instruction Fuzzy Hash: 80211E76B18B4681EB50CF15F460AA97369FB88B84F440275DA5D07EACDF3CE54ACB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66F9760 Relevance: 19.6, APIs: 13, Instructions: 69COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F9770
                                            • ?toString@QIPAddressUtils@@YAXAEAVQString@@QEAE@Z.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F9796
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F97A3
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F97C5
                                            • ??0QString@@QEAA@HW4Initialization@Qt@@@Z.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F97D6
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F97E1
                                            • ??0QChar@@QEAA@UQLatin1Char@@@Z.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F97F1
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F9802
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F9811
                                            • memcpy.VCRUNTIME140(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F9821
                                            • ?append@QString@@QEAAAEAV1@AEBV1@@Z.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F982E
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F9839
                                            • ?toString@QIPAddressUtils@@YAXAEAVQString@@I@Z.QT5CORE(?,?,?,?,00007FFDF66AAD64), ref: 00007FFDF66F9859
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Char@@$?const?size@AddressData@String@Utils@@$?append@Char@@@Empty@Initialization@Latin1Qt@@@V1@@memcpy
                                            • String ID:
                                            • API String ID: 2572024655-0
                                            • Opcode ID: 99a09543e94087cd81ea9d41cd69a14d52a7d09120ad25f3a411daec02ec8075
                                            • Instruction ID: 79d978aa0d52bf412b96aa0f3d3dd8c1f24576ec5e33b588fedff5a3b4e50352
                                            • Opcode Fuzzy Hash: 99a09543e94087cd81ea9d41cd69a14d52a7d09120ad25f3a411daec02ec8075
                                            • Instruction Fuzzy Hash: 60214F22B0865686DB009F15E8749787375FF89BD5B444171CE5E03F98FE3CD98A8700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66B5820 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 116windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B584E
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B585F
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B586D
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B587B
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B5F45
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B5F5B
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B5F6D
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B5F7F
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B5F8A
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B5F95
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B5FAB
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B5FC1
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B5FD3
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B5FE5
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B5FF0
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B5FFB
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B6011
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B6027
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B6039
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B604B
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B6056
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B6061
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B6077
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B608D
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B609F
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B60B1
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B60BC
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B60C7
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B60DD
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B60F3
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B6105
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66B6117
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B6122
                                              • Part of subcall function 00007FFDF66B5EA0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66B612D
                                              • Part of subcall function 00007FFDF66B5EA0: ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE ref: 00007FFDF66B6142
                                            • ?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B589F
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B5929
                                            • ?critical@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B5939
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B5947
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00000000,?,00007FFDF66B31B3), ref: 00007FFDF66B5952
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B418B
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B4196
                                              • Part of subcall function 00007FFDF66B4120: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE ref: 00007FFDF66B41AB
                                              • Part of subcall function 00007FFDF66B4120: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE ref: 00007FFDF66B41B7
                                              • Part of subcall function 00007FFDF66B4120: memcmp.VCRUNTIME140 ref: 00007FFDF66B41C6
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B41D4
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B41DF
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B41FC
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B4208
                                              • Part of subcall function 00007FFDF66B4120: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE ref: 00007FFDF66B421D
                                              • Part of subcall function 00007FFDF66B4120: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE ref: 00007FFDF66B422A
                                              • Part of subcall function 00007FFDF66B4120: memcmp.VCRUNTIME140 ref: 00007FFDF66B4239
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B4248
                                              • Part of subcall function 00007FFDF66B4120: ?size@QString@@QEBAHXZ.QT5CORE ref: 00007FFDF66B4253
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$String@@$V0@@$?size@$?constChar@@Data@$Logger@@Messagememcmp$?critical@?qstrcmp@@
                                            • String ID: accept$lookup in dynamic table requires search index enabled
                                            • API String ID: 767616139-4055155769
                                            • Opcode ID: 81010d0f849b4e747ee17f9bc22b76f8c85209bdedb56ba6fc563d2811948fc8
                                            • Instruction ID: 9eeab016878e0feca7c6156150a1cf722d31c3445659d03756a22aeb1ed327e5
                                            • Opcode Fuzzy Hash: 81010d0f849b4e747ee17f9bc22b76f8c85209bdedb56ba6fc563d2811948fc8
                                            • Instruction Fuzzy Hash: 2C517362B08A82D2EB60DF21E4609E973A5FB44794F444171DBAD43E9DDF3CD555CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6699690 Relevance: 18.1, APIs: 12, Instructions: 104timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Variant@@$ElapsedLongLong@Timer@@V0@@$?elapsed@?ready?restart@Device@@Null@Read@V0@$$
                                            • String ID:
                                            • API String ID: 486414557-0
                                            • Opcode ID: ccf8897b887699e56f6b68fe2fb8467f6e612a5e07618a6444b4b4f41319178c
                                            • Instruction ID: 3cfdca9844662d1453bb41a7c890f279b48c50e71b14a2de356e065380cfb35c
                                            • Opcode Fuzzy Hash: ccf8897b887699e56f6b68fe2fb8467f6e612a5e07618a6444b4b4f41319178c
                                            • Instruction Fuzzy Hash: 0F416E32B18A8282EB54CB15D474AB93365FB84B98F484275D92E07EEDEE3CE945C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66E96D0 Relevance: 18.1, APIs: 12, Instructions: 76timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E96E1
                                            • ?isEmpty@QListData@@QEBA_NXZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E96F2
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E9735
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E9745
                                            • ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E9752
                                            • ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E9764
                                            • ??4QDateTime@@QEAAAEAV0@$$QEAV0@@Z.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E9770
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E977B
                                              • Part of subcall function 00007FFDF6699A30: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF66E4757), ref: 00007FFDF6699A4F
                                              • Part of subcall function 00007FFDF6699A30: ?detach@QListData@@QEAAPEAUData@1@H@Z.QT5CORE(?,?,?,00007FFDF66E4757), ref: 00007FFDF6699A5D
                                              • Part of subcall function 00007FFDF6699A30: ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF66E4757), ref: 00007FFDF6699A69
                                              • Part of subcall function 00007FFDF6699A30: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF66E4757), ref: 00007FFDF6699A75
                                              • Part of subcall function 00007FFDF6699A30: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF66E4757), ref: 00007FFDF6699A97
                                              • Part of subcall function 00007FFDF6699A30: ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF66E4757), ref: 00007FFDF6699AE7
                                              • Part of subcall function 00007FFDF6699A30: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,00007FFDF66E4757), ref: 00007FFDF6699AF5
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E97B6
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E97C6
                                            • ?prepend@QListData@@QEAAPEAPEAXXZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E97CF
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,00007FFDF66E84E1), ref: 00007FFDF66E97E0
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$Array@@Byte$String@@V0@@$?begin@$?size@Empty@$?const?detach@?dispose@?end@?prepend@Char@@Data@Data@1@Data@1@@DateTime@@V0@$$
                                            • String ID:
                                            • API String ID: 2846168812-0
                                            • Opcode ID: f2a2759653aa60ef6e179a35ce14904f6edc979a524d1efb4cec01342d3177ad
                                            • Instruction ID: 05f584a76973b7d114b399b3430ade11f3651f2c3435be5b72b3c0d950b30b46
                                            • Opcode Fuzzy Hash: f2a2759653aa60ef6e179a35ce14904f6edc979a524d1efb4cec01342d3177ad
                                            • Instruction Fuzzy Hash: F7311A26B08A4286EB04DF12E474A697369FF89F80F444275CE5E03F98EF7CE8468704
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60CFCFE50 Relevance: 18.1, APIs: 12, Instructions: 68COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FF60CFCE310: ??0QByteArray@@QEAA@XZ.QT5CORE ref: 00007FF60CFCE339
                                              • Part of subcall function 00007FF60CFCE310: ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60CFCE352
                                              • Part of subcall function 00007FF60CFCE310: ?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z.QT5CORE ref: 00007FF60CFCE392
                                              • Part of subcall function 00007FF60CFCE310: ??0QChar@@QEAA@UQLatin1Char@@@Z.QT5CORE ref: 00007FF60CFCE3A2
                                              • Part of subcall function 00007FF60CFCE310: ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z.QT5CORE ref: 00007FF60CFCE3C6
                                              • Part of subcall function 00007FF60CFCE310: ??0QChar@@QEAA@UQLatin1Char@@@Z.QT5CORE ref: 00007FF60CFCE3D5
                                              • Part of subcall function 00007FF60CFCE310: ?arg@QString@@QEBA?AV1@HHHVQChar@@@Z.QT5CORE ref: 00007FF60CFCE3F8
                                              • Part of subcall function 00007FF60CFCE310: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FF60CFCE409
                                              • Part of subcall function 00007FF60CFCE310: ?append@QString@@QEAAAEAV1@AEBV1@@Z.QT5CORE ref: 00007FF60CFCE41E
                                              • Part of subcall function 00007FF60CFCE310: ?append@QString@@QEAAAEAV1@AEBV1@@Z.QT5CORE ref: 00007FF60CFCE42B
                                              • Part of subcall function 00007FF60CFCE310: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCE43D
                                              • Part of subcall function 00007FF60CFCE310: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCE448
                                              • Part of subcall function 00007FF60CFCE310: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCE453
                                              • Part of subcall function 00007FF60CFCE310: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCE45E
                                              • Part of subcall function 00007FF60CFCE310: ??4QString@@QEAAAEAV0@D@Z.QT5CORE ref: 00007FF60CFCE46A
                                              • Part of subcall function 00007FF60CFCE310: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF60CFCE487
                                              • Part of subcall function 00007FF60CFCE310: ?debug@QMessageLogger@@QEBA?AVQDebug@@XZ.QT5CORE ref: 00007FF60CFCE494
                                              • Part of subcall function 00007FF60CFCE310: ??6QDebug@@QEAAAEAV0@PEBD@Z.QT5CORE ref: 00007FF60CFCE4A5
                                            • ?count@QComboBox@@QEBAHXZ.QT5WIDGETS ref: 00007FF60CFCFE75
                                            • ?itemData@QComboBox@@QEBA?AVQVariant@@HH@Z.QT5WIDGETS ref: 00007FF60CFCFE96
                                            • ?toString@QVariant@@QEBA?AVQString@@XZ.QT5CORE ref: 00007FF60CFCFEA5
                                            • ??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF60CFCFEB1
                                            • ??8@YA_NAEBVQString@@0@Z.QT5CORE ref: 00007FF60CFCFEC1
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCFED0
                                            • ?count@QComboBox@@QEBAHXZ.QT5WIDGETS ref: 00007FF60CFCFEE0
                                            • ?currentIndex@QComboBox@@QEBAHXZ.QT5WIDGETS ref: 00007FF60CFCFEF2
                                            • ?setCurrentIndex@QComboBox@@QEAAXH@Z.QT5WIDGETS ref: 00007FF60CFCFF10
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCFF1C
                                            • ?setCurrentIndex@QComboBox@@QEAAXH@Z.QT5WIDGETS ref: 00007FF60CFCFF3B
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF60CFCFF4A
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Box@@Combo$Char@@@$Data@Index@Variant@@$?append@?arg@?count@?from?setArrayArray@@Ascii_helper@ByteChar@@CurrentDebug@@Latin1Logger@@MessageTypedV1@@$??8@?current?debug@?itemString@String@@0@V0@@
                                            • String ID:
                                            • API String ID: 2205253895-0
                                            • Opcode ID: 18002b4e69e142db51e53f58c36ed4a07987c2148beb647c35cbdc273d42dd6b
                                            • Instruction ID: 9f75c1f09d91843b0cd7b8621f2d1cd01f0df9fc392cfaa7304426687812fc9a
                                            • Opcode Fuzzy Hash: 18002b4e69e142db51e53f58c36ed4a07987c2148beb647c35cbdc273d42dd6b
                                            • Instruction Fuzzy Hash: 25315C22B18A4192EB04DF25E99016D6321FFC5B84FB45131CB8FC3A64EFADE85AC705
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66C77C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 59timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$V0@@$?translate@Application@@CoreDateTime@@V0@$$
                                            • String ID: Data corrupted$Host requires authentication$Proxy requires authentication$QHttp$Unknown protocol specified
                                            • API String ID: 259000012-610499893
                                            • Opcode ID: fb468a569c41d31fc4fa4723047463644df9c5b607374e03756cb296cedc6f1c
                                            • Instruction ID: a0616109440cb7027cde8230af8aede664192b1b232187a82040636924343269
                                            • Opcode Fuzzy Hash: fb468a569c41d31fc4fa4723047463644df9c5b607374e03756cb296cedc6f1c
                                            • Instruction Fuzzy Hash: 64218061B0CA52D5E7249B25E8748B83B28FF46B95F444272DA2D02EECDF3CE946C744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF672B790 Relevance: 16.6, APIs: 11, Instructions: 113COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE ref: 00007FFDF672B7E7
                                            • ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE ref: 00007FFDF672B80F
                                            • ??0QVariant@@QEAA@XZ.QT5CORE ref: 00007FFDF672B834
                                            • ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE ref: 00007FFDF672B86A
                                            • ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE ref: 00007FFDF672B898
                                            • ??4QVariant@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF672B8A9
                                            • ?createNode@QMapDataBase@@QEAAPEAUQMapNodeBase@@HHPEAU2@_N@Z.QT5CORE ref: 00007FFDF672B8C6
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF672B8D6
                                            • ??0QVariant@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF672B8E3
                                              • Part of subcall function 00007FFDF672AF50: ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF672B5C3,00000000,?,?,00007FFDF66CD147), ref: 00007FFDF672AF78
                                              • Part of subcall function 00007FFDF672AF50: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF672B5C3,00000000,?,?,00007FFDF66CD147), ref: 00007FFDF672B034
                                              • Part of subcall function 00007FFDF672AF50: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF672B5C3,00000000,?,?,00007FFDF66CD147), ref: 00007FFDF672B067
                                              • Part of subcall function 00007FFDF672AF50: ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF672B5C3,00000000,?,?,00007FFDF66CD147), ref: 00007FFDF672B08E
                                            • ??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FFDF672B8EE
                                            • ??4QVariant@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF672B90D
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$V0@@$Variant@@$?qstrcmp@@Array@@Array@@0@$Base@@$?createDataData@@NodeNode@SharedU2@_
                                            • String ID:
                                            • API String ID: 1989383768-0
                                            • Opcode ID: 69c36f0a6d4988efcc5e4ee65f5875e79ce4f9416a11dc8f8413990f262d5730
                                            • Instruction ID: 07bf2ebd418983ebdce21d68a3836d3bad54cd749050f32756b8c992f0fcbdf1
                                            • Opcode Fuzzy Hash: 69c36f0a6d4988efcc5e4ee65f5875e79ce4f9416a11dc8f8413990f262d5730
                                            • Instruction Fuzzy Hash: F5415166B08A4682EB049F22D474A697368FB59F88F494031CF6D47F98EF3CE456CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67156E0 Relevance: 16.6, APIs: 11, Instructions: 85COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@$memcpy$?append@?detach_grow@?dispose@?end@Data@1@Data@1@@
                                            • String ID:
                                            • API String ID: 966379029-0
                                            • Opcode ID: 264cc267f2103d9f1a9ab639b41686b7f5ff285a9dea238f236c2a04e645529f
                                            • Instruction ID: 210b133322879b7c749196bce36451440a009045dcd8191cb4652fb6a3ab8704
                                            • Opcode Fuzzy Hash: 264cc267f2103d9f1a9ab639b41686b7f5ff285a9dea238f236c2a04e645529f
                                            • Instruction Fuzzy Hash: 24314C26B19A4692DB148B15A8746787369FB85BA1F544232CE6D43FE8DF3CD846C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D41590 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 37windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FFDF5D410C6), ref: 00007FFDF5D415A6
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,00007FFDF5D410C6), ref: 00007FFDF5D415B6
                                            • ?peek@QIODevice@@QEAA?AVQByteArray@@_J@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FFDF5D410C6), ref: 00007FFDF5D415D3
                                            • ?startsWith@QByteArray@@QEBA_NPEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FFDF5D410C6), ref: 00007FFDF5D415E5
                                            • ?endsWith@QByteArray@@QEBA_NPEBD@Z.QT5CORE(?,?,?,?,?,?,?,?,00007FFDF5D410C6), ref: 00007FFDF5D415FB
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00007FFDF5D410C6), ref: 00007FFDF5D41610
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Array@@$Logger@@MessageWith@$?ends?peek@?starts?warning@Array@@_Device@@
                                            • String ID: QWebpHandler::canRead() called with no device$RIFF$WEBP
                                            • API String ID: 1375363764-97849969
                                            • Opcode ID: 12a5c691402833975b1edc10e62f66381e7739370b61e5c65c232bbea82d361f
                                            • Instruction ID: ee26d87992d731675ff349713818979360aeb8a2c98764e54e286579c863cb47
                                            • Opcode Fuzzy Hash: 12a5c691402833975b1edc10e62f66381e7739370b61e5c65c232bbea82d361f
                                            • Instruction Fuzzy Hash: 81012D61B1AA4A92EF10EF64ED60BA96361BF92F49F841032D66D075ACDE6CD50DC700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66C5850 Relevance: 15.2, APIs: 10, Instructions: 152timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$V0@@$ObjectObject@@Private@@$Array@@BasicByteMutex@@Object@@@Timer@@Url@@malloc
                                            • String ID:
                                            • API String ID: 4192777407-0
                                            • Opcode ID: 4d8b203b589bb4c0ad0223d2e8e644eeec5b8a5a6494be324fb5bb74e6ad99b7
                                            • Instruction ID: 1a5ad818dd0217b583df3aea6ea1d719bb47874bbed84dccfb1f2d25b6723dbc
                                            • Opcode Fuzzy Hash: 4d8b203b589bb4c0ad0223d2e8e644eeec5b8a5a6494be324fb5bb74e6ad99b7
                                            • Instruction Fuzzy Hash: 4961B232709B9286DB50DF11E864BA973A8FB84B90F4A4135DA6E83B99FF3CD445C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF670F6D0 Relevance: 15.1, APIs: 10, Instructions: 144COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@$?end@$?append@?detach@?dispose@?size@Data@1@Data@1@@Empty@U1@@
                                            • String ID:
                                            • API String ID: 1538834070-0
                                            • Opcode ID: b8681489521fa6df2db8ff3b2fe58d358c0346b4f98507e0ac9cf7cbddc0b224
                                            • Instruction ID: d0df15e12020e791f1f4008870809ef1775089b352d0fac010f8f94796c60719
                                            • Opcode Fuzzy Hash: b8681489521fa6df2db8ff3b2fe58d358c0346b4f98507e0ac9cf7cbddc0b224
                                            • Instruction Fuzzy Hash: 9A518D22B09A8682EB14DB16A4706B97368FB85FD1F584136DE6D07FD8DF3CD8828710
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF668B4A0 Relevance: 15.1, APIs: 10, Instructions: 94COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$?size@$?constArray@@ByteChar@@Data@Data@@Hash$?free?hasHash@@Node@Shrunk@memcmp
                                            • String ID:
                                            • API String ID: 3581844596-0
                                            • Opcode ID: 8f1d0ed32103232e9d9e7f28a6743fc338506fcf37204322fa95100e4bff45c1
                                            • Instruction ID: 35a45555227d53ee69f982d15100c0b86b71257a4353c3a4d147931b93d21730
                                            • Opcode Fuzzy Hash: 8f1d0ed32103232e9d9e7f28a6743fc338506fcf37204322fa95100e4bff45c1
                                            • Instruction Fuzzy Hash: FC414832718A4686DB10DF21E92452D7769FB89F89B844171DE5E43F98EF3CD845CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66F74D0 Relevance: 15.1, APIs: 10, Instructions: 57timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$DateTime@@V0@$$V0@@$?clear@?index?left@?mid@CaseLatin1Qt@@@Sensitivity@
                                            • String ID:
                                            • API String ID: 2484421654-0
                                            • Opcode ID: b33861567d216a0799704be6887fed03b6de56fea2d02512575d33c3944972f3
                                            • Instruction ID: b6ae794eb2b4c302b74dcd5a5039c5679d028e2927ebadf72654b0b5407352c1
                                            • Opcode Fuzzy Hash: b33861567d216a0799704be6887fed03b6de56fea2d02512575d33c3944972f3
                                            • Instruction Fuzzy Hash: 35217176708A42C2DB109F24E8345697374FB85B58F540331CA6E02EA8EF3CD98AC744
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66856B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QBasicMutex@@QEAA@XZ.QT5CORE ref: 00007FFDF66856CE
                                            • ?setHost@QUrl@@QEAAXAEBVQString@@W4ParsingMode@1@@Z.QT5CORE ref: 00007FFDF66856E2
                                            • ?setPort@QUrl@@QEAAXH@Z.QT5CORE ref: 00007FFDF66856EF
                                            • ??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FFDF668571E
                                            • ?setScheme@QUrl@@QEAAXAEBVQString@@@Z.QT5CORE ref: 00007FFDF668572E
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF6685739
                                              • Part of subcall function 00007FFDF6692C20: ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF6696996), ref: 00007FFDF6692C45
                                              • Part of subcall function 00007FFDF6692C20: ??0QBasicMutex@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF6696996), ref: 00007FFDF6692C80
                                              • Part of subcall function 00007FFDF6692C20: ??4QUrl@@QEAAAEAV0@AEBV0@@Z.QT5CORE(?,?,00000000), ref: 00007FFDF6692CCE
                                              • Part of subcall function 00007FFDF6687660: ?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPEAU12@PEBVQObject@@@Z.QT5CORE ref: 00007FFDF6687684
                                              • Part of subcall function 00007FFDF6687660: ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66876DD
                                              • Part of subcall function 00007FFDF6687660: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66876E8
                                              • Part of subcall function 00007FFDF6687660: ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6687711
                                              • Part of subcall function 00007FFDF6687660: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF668771C
                                              • Part of subcall function 00007FFDF6687660: ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6687745
                                              • Part of subcall function 00007FFDF6687660: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF6687750
                                              • Part of subcall function 00007FFDF6687660: ?connect@QObject@@QEBA?AVConnection@QMetaObject@@PEBV1@PEBD1W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF6687779
                                              • Part of subcall function 00007FFDF6687660: ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF6687784
                                            • ??1QUrl@@QEAA@XZ.QT5CORE ref: 00007FFDF6685781
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$Url@@$?connect@ConnectionQt@@@Type@$?setString@@$BasicMutex@@SharedString@@@$?getCountData@Data@@ExternalHost@Latin1Mode@1@@Object@@@ParsingPointer@@Port@Ref@Scheme@U12@V0@@
                                            • String ID: preconnect-http
                                            • API String ID: 503967994-867629942
                                            • Opcode ID: 9358651ad1077d37ce3849a994ab2e5dae487c50de4870febe0fe844db220bc3
                                            • Instruction ID: fb52e0c123e92f4b1fc11b14400311ff19467fda8d745faf312a32d65697f14b
                                            • Opcode Fuzzy Hash: 9358651ad1077d37ce3849a994ab2e5dae487c50de4870febe0fe844db220bc3
                                            • Instruction Fuzzy Hash: 03216B7671CA8292DB00DB11F4608AAB325FB94794F405131EA9E43EACEF7CD54ACB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6723660 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State$?resetDebug@@@Format@
                                            • String ID: QLocalSocket::SocketError(
                                            • API String ID: 3506180795-2301656246
                                            • Opcode ID: 2334670426e07c6dcc8dfcf15347f911f8655201226ba44816f2a1d149dfa67c
                                            • Instruction ID: 1668484be5e2574a5d87a70303164d752c5173e8f1fae497a21d5af12fe84da8
                                            • Opcode Fuzzy Hash: 2334670426e07c6dcc8dfcf15347f911f8655201226ba44816f2a1d149dfa67c
                                            • Instruction Fuzzy Hash: E4111836B08A4282DB049F15E8646787379FB98B94F445075EA6E43FA8DF3CE846C701
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66BB7E0 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memcpy$Xbad_alloc@std@@memset$_invalid_parameter_noinfo_noreturnmalloc
                                            • String ID:
                                            • API String ID: 3194922333-0
                                            • Opcode ID: 089ba6a1dfcff68f2a5856aff94affe473b4f2ed83dc5fd2c6de4d887766ad83
                                            • Instruction ID: 36b8169f46e0f498ff8b5552d9569b71acacbd3f6769b292f175ed6cc20328aa
                                            • Opcode Fuzzy Hash: 089ba6a1dfcff68f2a5856aff94affe473b4f2ed83dc5fd2c6de4d887766ad83
                                            • Instruction Fuzzy Hash: DE51C121B09B8691EF10DB65E4746B96758FB4ABE4F540A35EA7D07FCAEE3CE0418300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66CF720 Relevance: 12.1, APIs: 8, Instructions: 105COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@$?append@?detach_grow@?end@Data@1@malloc
                                            • String ID:
                                            • API String ID: 1110224875-0
                                            • Opcode ID: 39d77016dc73c2b84ef014bbb9c937d97b9b916b4fb48b744bfddb81d2952cf9
                                            • Instruction ID: 6710e90a07ac943b56ae796517e6aac16ed0c94d76617c403a428a8d34b7d069
                                            • Opcode Fuzzy Hash: 39d77016dc73c2b84ef014bbb9c937d97b9b916b4fb48b744bfddb81d2952cf9
                                            • Instruction Fuzzy Hash: B2418C32B09A8582DB10DB12E86096AB3A8FB85FE5B444536EE6D47FD8DF3CD551CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66BB4A0 Relevance: 12.1, APIs: 8, Instructions: 84COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF66BE240: ?createData@QMapDataBase@@SAPEAU1@XZ.QT5CORE(?,?,?,00007FFDF66BB4B3), ref: 00007FFDF66BE258
                                              • Part of subcall function 00007FFDF66BE240: ?setParent@QMapNodeBase@@QEAAXPEAU1@@Z.QT5CORE(?,?,?,00007FFDF66BB4B3), ref: 00007FFDF66BE280
                                              • Part of subcall function 00007FFDF66BE240: ?recalcMostLeftNode@QMapDataBase@@QEAAXXZ.QT5CORE(?,?,?,00007FFDF66BB4B3), ref: 00007FFDF66BE2AE
                                              • Part of subcall function 00007FFDF66BE680: ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE(?,?,?,00007FFDF66BB4BE), ref: 00007FFDF66BE6A7
                                              • Part of subcall function 00007FFDF66BE680: ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE(?,?,?,00007FFDF66BB4BE), ref: 00007FFDF66BE6CF
                                            • ??0QString@@QEAA@XZ.QT5CORE ref: 00007FFDF66BB4E5
                                            • ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE ref: 00007FFDF66BB51A
                                            • ?qstrcmp@@YAHAEBVQByteArray@@0@Z.QT5CORE ref: 00007FFDF66BB548
                                            • ??4QByteArray@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF66BB559
                                            • ?createNode@QMapDataBase@@QEAAPEAUQMapNodeBase@@HHPEAU2@_N@Z.QT5CORE ref: 00007FFDF66BB575
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66BB585
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66BB592
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66BB59D
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Base@@$?qstrcmp@@Array@@Array@@0@$DataV0@@$?createNodeNode@$?recalc?setData@LeftMostParent@String@@U1@@U2@_
                                            • String ID:
                                            • API String ID: 2025822657-0
                                            • Opcode ID: c11763c4345d192984f9f22cee0216a3c58b906a557b4428ecf3945c5f500c4b
                                            • Instruction ID: 2b7a8c90eb181e350b32e7a7a5bcacd63f6ce52c8364f117eb1b62e85c6f52e7
                                            • Opcode Fuzzy Hash: c11763c4345d192984f9f22cee0216a3c58b906a557b4428ecf3945c5f500c4b
                                            • Instruction Fuzzy Hash: EC314F76708A42C6DB108F12E46496A7368FB49FC4B484572DE5E07F98EF3DE446CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF669F7E0 Relevance: 12.1, APIs: 8, Instructions: 78timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??8QUrl@@QEBA_NAEBV0@@Z.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F80C
                                            • ??8QDateTime@@QEBA_NAEBV0@@Z.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F822
                                            • ??8QDateTime@@QEBA_NAEBV0@@Z.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F838
                                            • ?size@QListData@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F858
                                            • ?size@QListData@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F864
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F872
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F87F
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF6683DE9), ref: 00007FFDF669F88C
                                              • Part of subcall function 00007FFDF668A570: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF6693192,?,?,?,00007FFDF6681409), ref: 00007FFDF668A585
                                              • Part of subcall function 00007FFDF668A570: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF6693192,?,?,?,00007FFDF6681409), ref: 00007FFDF668A590
                                              • Part of subcall function 00007FFDF668A570: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF6693192,?,?,?,00007FFDF6681409), ref: 00007FFDF668A5A2
                                              • Part of subcall function 00007FFDF668A570: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,00007FFDF6693192,?,?,?,00007FFDF6681409), ref: 00007FFDF668A5AE
                                              • Part of subcall function 00007FFDF668A570: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,00007FFDF6693192,?,?,?,00007FFDF6681409), ref: 00007FFDF668A5BA
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ?size@Data@@ListString@@$V0@@$?begin@?constChar@@Data@DateTime@@$?end@Url@@
                                            • String ID:
                                            • API String ID: 425079827-0
                                            • Opcode ID: 6f475e5890b56868c748e45513cd081239d2e9461bd8c8a32d8e842f9d644aab
                                            • Instruction ID: f64d9525441ee0087cf1ca43f6062b0fe9bf04160bc0959e78ceda5c69f7a42e
                                            • Opcode Fuzzy Hash: 6f475e5890b56868c748e45513cd081239d2e9461bd8c8a32d8e842f9d644aab
                                            • Instruction Fuzzy Hash: AE315E22B08A42A2EB50DF12E5648A823B9FF55B88B4500B6DE5D07EDCEF3CD44AC700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66E9800 Relevance: 12.1, APIs: 8, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?read@QIODevice@@QEAA_JPEAD_J@Z.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E984E
                                            • ??0QByteArray@@QEAA@PEBDH@Z.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E986D
                                            • ?isEmpty@QString@@QEBA_NXZ.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E9878
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E98A9
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E98BB
                                            • ?append@QListData@@QEAAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E98C5
                                            • ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E98D8
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF66E6E6E), ref: 00007FFDF66E98EA
                                              • Part of subcall function 00007FFDF66D4700: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D475B
                                              • Part of subcall function 00007FFDF66D4700: ?size@QString@@QEBAHXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D4767
                                              • Part of subcall function 00007FFDF66D4700: ?constData@QString@@QEBAPEBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D4791
                                              • Part of subcall function 00007FFDF66D4700: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D47A4
                                              • Part of subcall function 00007FFDF66D4700: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D47CB
                                              • Part of subcall function 00007FFDF66D4700: ??0QByteArray@@QEAA@$$QEAV0@@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D47D9
                                              • Part of subcall function 00007FFDF66D4700: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D47FA
                                              • Part of subcall function 00007FFDF66D4700: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D4812
                                              • Part of subcall function 00007FFDF66D4700: ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D483F
                                              • Part of subcall function 00007FFDF66D4700: ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D4856
                                              • Part of subcall function 00007FFDF66D4700: ?erase@QListData@@QEAAPEAPEAXPEAPEAX@Z.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D4862
                                              • Part of subcall function 00007FFDF66D4700: ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,00007FFDF66D46E8), ref: 00007FFDF66D486D
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteData@@List$?begin@$String@@$V0@@$?size@$?append@?const?erase@?read@A@$$Char@@Data@Device@@Empty@memcpy
                                            • String ID:
                                            • API String ID: 3158978291-0
                                            • Opcode ID: 4d1374ee13958e5d252ebadc586f1541367c0e45561da73cd4a31fb83a55b327
                                            • Instruction ID: bbaedb8bc8fa88adf2be034878a252b3f356a180b87f48d36ac054b26f5ac8c9
                                            • Opcode Fuzzy Hash: 4d1374ee13958e5d252ebadc586f1541367c0e45561da73cd4a31fb83a55b327
                                            • Instruction Fuzzy Hash: EE31A13270864292EB109F15E4604AAB325EF95BC4F540271CB6E07EE9EF6DED8AC700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66F17D0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?lock@QMutex@@QEAAXXZ.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F17E8
                                            • ?firstNode@QHashData@@QEAAPEAUNode@1@XZ.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F17FB
                                            • ?nextNode@QHashData@@SAPEAUNode@1@PEAU21@@Z.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F181F
                                            • ?firstNode@QHashData@@QEAAPEAUNode@1@XZ.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F183C
                                            • ?nextNode@QHashData@@SAPEAUNode@1@PEAU21@@Z.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F185F
                                            • ?firstNode@QHashData@@QEAAPEAUNode@1@XZ.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F1878
                                            • ?nextNode@QHashData@@SAPEAUNode@1@PEAU21@@Z.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F1892
                                            • ?unlock@QMutexLocker@@QEAAXXZ.QT5CORE(?,?,00000000,00007FFDF66F0AAE,?,?,?,?,?,?,?,00007FFDF66F1109), ref: 00007FFDF66F18A4
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@HashNode@Node@1@$?first?nextU21@@$?lock@?unlock@Locker@@MutexMutex@@
                                            • String ID:
                                            • API String ID: 35386720-0
                                            • Opcode ID: d6c6babba26e12488e21e24e9c917e9387ad7d5c3c3787479a72b8879b932b7a
                                            • Instruction ID: 72261255951ab5fa802a92994a378469a7b6c1254516b665dfbcd639341d4658
                                            • Opcode Fuzzy Hash: d6c6babba26e12488e21e24e9c917e9387ad7d5c3c3787479a72b8879b932b7a
                                            • Instruction Fuzzy Hash: E5211236F0968292EB549B61D57493863A5FF45BC0F581975CA3F02FD8EF2CE8C18A00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66FB7D0 Relevance: 10.6, APIs: 7, Instructions: 137COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF66FAFD0: ?detach_helper@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH@Z.QT5CORE ref: 00007FFDF66FB008
                                              • Part of subcall function 00007FFDF66FAFD0: ?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z@Z.QT5CORE ref: 00007FFDF66FB039
                                            • ?qHash@@YAIAEBVQString@@I@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF66FC503,?,?,?,00007FFDF66FB570), ref: 00007FFDF66FB809
                                              • Part of subcall function 00007FFDF66FCE70: ?qHash@@YAIAEBVQString@@I@Z.QT5CORE(?,?,?,?,?,?,00007FFDF66FB89B,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66FCF33
                                              • Part of subcall function 00007FFDF66FCE70: ??8@YA_NAEBVQString@@0@Z.QT5CORE(?,?,?,?,?,?,00007FFDF66FB89B,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66FCF68
                                              • Part of subcall function 00007FFDF66FCE70: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00007FFDF66FB89B,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66FCF81
                                              • Part of subcall function 00007FFDF66FCE70: ?freeNode@QHashData@@QEAAXPEAX@Z.QT5CORE(?,?,?,?,?,?,00007FFDF66FB89B,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66FCF8E
                                              • Part of subcall function 00007FFDF66FCE70: ?hasShrunk@QHashData@@QEAAXXZ.QT5CORE(?,?,?,?,?,?,00007FFDF66FB89B,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66FCFA7
                                              • Part of subcall function 00007FFDF66FCE70: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00007FFDF66FB89B,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66FCFBF
                                              • Part of subcall function 00007FFDF66FCE70: ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,00007FFDF66FB89B,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDF66FCFD2
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF66FC503,?,?,?,00007FFDF66FB570), ref: 00007FFDF66FB851
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,00007FFDF66FC503,?,?,?,00007FFDF66FB570), ref: 00007FFDF66FB864
                                            • ?qHash@@YAIAEBVQString@@I@Z.QT5CORE ref: 00007FFDF66FB8CA
                                              • Part of subcall function 00007FFDF66FB4B0: ??8@YA_NAEBVQString@@0@Z.QT5CORE(?,?,00000000,00007FFDF66F2A1C), ref: 00007FFDF66FB4FC
                                            • ?willGrow@QHashData@@QEAA_NXZ.QT5CORE ref: 00007FFDF66FB8F1
                                            • ?allocateNode@QHashData@@QEAAPEAXH@Z.QT5CORE ref: 00007FFDF66FB916
                                            • ??0QByteArray@@QEAA@AEBV0@@Z.QT5CORE ref: 00007FFDF66FB930
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Data@@Hash$Hash@@$??8@Node@String@@0@$?allocate?detach_helper@?free?free_helper@?has?willArray@@ByteGrow@Node@1@Node@1@@Shrunk@V0@@
                                            • String ID:
                                            • API String ID: 3770219487-0
                                            • Opcode ID: 732a7608d27d8c17a3cfd79b72840b427cbb593aeac87e19b105ccec2cc91236
                                            • Instruction ID: c7e0daa92f61fa16fd66f7f34475e35c3a95312c67f3dde423241478408f5f09
                                            • Opcode Fuzzy Hash: 732a7608d27d8c17a3cfd79b72840b427cbb593aeac87e19b105ccec2cc91236
                                            • Instruction Fuzzy Hash: B6519E62B08B8192EB00CF25D5606697374FB99B84F149635DF6D07B99EF38E4A1CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66D3780 Relevance: 10.6, APIs: 7, Instructions: 79COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteString@@Url@@$ObjectPrivate@@
                                            • String ID:
                                            • API String ID: 393494805-0
                                            • Opcode ID: 9efc34ceb8bc089478cb67f7a71f274947798da0cc79133dea2b6483276f663f
                                            • Instruction ID: 438130fb86b955ffe94d0408b0d4b1774e3ce9acd77df5d701f3ba1e34abef28
                                            • Opcode Fuzzy Hash: 9efc34ceb8bc089478cb67f7a71f274947798da0cc79133dea2b6483276f663f
                                            • Instruction Fuzzy Hash: F5315F31B09942A6EB48DB25D5706B8B328FF85750F448171D63E93EE9EF2CE856C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6707750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$?tr@DateEmpty@MetaObject@@Time@@V0@$$V0@@
                                            • String ID: Invalid domain name
                                            • API String ID: 1141942472-4090324451
                                            • Opcode ID: 2a8cc17a081109b85a3e070029c6dd49ea791e34f475fea44ef8067f035c493b
                                            • Instruction ID: 422c90e4fd10d8688aec915ef294d3ad383b5b26677f86df3c5bb74c2218233d
                                            • Opcode Fuzzy Hash: 2a8cc17a081109b85a3e070029c6dd49ea791e34f475fea44ef8067f035c493b
                                            • Instruction Fuzzy Hash: 74313C3261CA86A6DB50CF20E870BAAB768FB80744F444176E29D42EDDEF7CD549CB50
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF672F800 Relevance: 10.6, APIs: 7, Instructions: 62COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@ByteDebug@@$String@@@malloc
                                            • String ID:
                                            • API String ID: 2997392113-0
                                            • Opcode ID: 164f0cf8fa7555a2673a7bc0ef4e3ecb668fbd9cf874c37977684c17c607a163
                                            • Instruction ID: c8e265acd6abe22bc00d4403195296aab634c61075cd5a044be3db59e5502a77
                                            • Opcode Fuzzy Hash: 164f0cf8fa7555a2673a7bc0ef4e3ecb668fbd9cf874c37977684c17c607a163
                                            • Instruction Fuzzy Hash: 73211036718A5692EB00DF15E87496A7364FB85B80F804171DE9E07FA9EF3CD946CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66BD6E0 Relevance: 10.6, APIs: 7, Instructions: 57COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Base@@$Node$?set$Array@@ByteParent@U1@@V0@@$?color@?createColor@Color@1@Color@1@@DataNode@U2@_
                                            • String ID:
                                            • API String ID: 2305653893-0
                                            • Opcode ID: 7e9670c5f59bc8ac053378a6485b0c69fae05ba6992539312b7a63fc307d9eed
                                            • Instruction ID: 66532851a06f91918e97644780056d8f00aea888f1edc0aff90d2849c6f8c8a4
                                            • Opcode Fuzzy Hash: 7e9670c5f59bc8ac053378a6485b0c69fae05ba6992539312b7a63fc307d9eed
                                            • Instruction Fuzzy Hash: 19212826B08A4282EB049F22E9247697364FB88FC4F444175CA6D4BF98EF7CE856C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D614F0 Relevance: 10.5, APIs: 8, Instructions: 453COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memset$memcpy
                                            • String ID:
                                            • API String ID: 368790112-0
                                            • Opcode ID: a6d468db4333e8731d862714eeee9638e4860e649500defd43d993b0ae2314c0
                                            • Instruction ID: 9b6a87469f389e1ff6af6dfb773d5208cde474fd6c86b53bb8d4c28899b24cad
                                            • Opcode Fuzzy Hash: a6d468db4333e8731d862714eeee9638e4860e649500defd43d993b0ae2314c0
                                            • Instruction Fuzzy Hash: 4D42F816E19BC592E711CB3CC6197FC6760F7AAB48F19A325CB9C12157EF25A2DAC300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D4D1A0 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 272COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: VP8
                                            • API String ID: 0-2406432225
                                            • Opcode ID: 02ff9131429cd44c4b2c0120519d0a69040d7850b41cc6d310304563f932765e
                                            • Instruction ID: 6c3d6cf3df4000dd35596a714f5241444528706dec330c6c6b2ee66c6c149000
                                            • Opcode Fuzzy Hash: 02ff9131429cd44c4b2c0120519d0a69040d7850b41cc6d310304563f932765e
                                            • Instruction Fuzzy Hash: E6C1BD32B0AB8986E760DF25D950B6973A0FB49B54F144235DBAD87BC8DF38E561CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D055E50 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: _aligned_freefree
                                            • String ID:
                                            • API String ID: 426171744-0
                                            • Opcode ID: d268f71062386fd26cdd8fa367d8ea1d741fb92c2fa0268ba5ff27bd3d6672b7
                                            • Instruction ID: 3df9c5198bea597174609a5caf456996696730c2b59f6eb437166cf97561447c
                                            • Opcode Fuzzy Hash: d268f71062386fd26cdd8fa367d8ea1d741fb92c2fa0268ba5ff27bd3d6672b7
                                            • Instruction Fuzzy Hash: 9D4190B2B04B4594EB14DFA6D8446EE6761FB58BD4F604232EE0E93B99EF38C540C304
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66B9670 Relevance: 9.1, APIs: 6, Instructions: 108COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?nextNode@QMapNodeBase@@QEBAPEBU1@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B8F1F), ref: 00007FFDF66B9701
                                            • ?fromRawData@QByteArray@@SA?AV1@PEBDH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B8F1F), ref: 00007FFDF66B9789
                                            • ?toBase64@QByteArray@@QEBA?AV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B8F1F), ref: 00007FFDF66B979D
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,00007FFDF66B8F1F), ref: 00007FFDF66B97A8
                                            • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFDF66B8F1F), ref: 00007FFDF66B97FE
                                            • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFDF66B8F1F), ref: 00007FFDF66B9805
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$Array@@$_invalid_parameter_noinfo_noreturn$?from?nextArray@@@@@Base64Base64@Base@@Data@Flags@NodeNode@Option@
                                            • String ID:
                                            • API String ID: 553760676-0
                                            • Opcode ID: ea665cb8819a81fe10b6fe89c0d030240a9dc5e0b073ee20a5817829db39a4d7
                                            • Instruction ID: 8dabe1c2e85d12512e0c2609c986c6edf643ecebda33b85375f54c896d70b080
                                            • Opcode Fuzzy Hash: ea665cb8819a81fe10b6fe89c0d030240a9dc5e0b073ee20a5817829db39a4d7
                                            • Instruction Fuzzy Hash: 46418122B18686C2EF10DB25E0646B96364FB85B84F440271E65E47EEEEF6CE545CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6711700 Relevance: 9.1, APIs: 6, Instructions: 96COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ?setChannelCount@DeviceDevice@@Object@@Private@@$?activate@MetaReadReadable@String@@V0@@Writable@Write
                                            • String ID:
                                            • API String ID: 2187096659-0
                                            • Opcode ID: e798d5b906411e9c466e5ff7a8eae8ac8d3857c9607aae1f6a28a4d59f45bbc7
                                            • Instruction ID: 806435d61423005afcf379cda05a79d84f87de366fa027b74641b07e9559f136
                                            • Opcode Fuzzy Hash: e798d5b906411e9c466e5ff7a8eae8ac8d3857c9607aae1f6a28a4d59f45bbc7
                                            • Instruction Fuzzy Hash: BE415C36B08B8192DB089F21E1A07E973A5FB88B84F404032DB6D47BA8DF79E465C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66A54A0 Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Data@@List$?activate@Empty@Meta$?at@Array@@Byte
                                            • String ID:
                                            • API String ID: 2511475051-0
                                            • Opcode ID: 44a59b09a4e02b6fab43e7977d0d815f208fbc2fa137b05dc51a2bd26365cd10
                                            • Instruction ID: 4b3a43aea8fcade78a207bad3cfe25c9484f1a0e529eca4e54829a1146818c3b
                                            • Opcode Fuzzy Hash: 44a59b09a4e02b6fab43e7977d0d815f208fbc2fa137b05dc51a2bd26365cd10
                                            • Instruction Fuzzy Hash: F3413E3271CA8186EB50DF20E060BA977A5FB85748F440175EA9E0BEADDF3CD545CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66814A0 Relevance: 9.1, APIs: 6, Instructions: 71COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteString@@$?constChar@@Data@$?cend@?resize@?size@Initialization@Qt@@@
                                            • String ID:
                                            • API String ID: 1104785696-0
                                            • Opcode ID: fc0698119a3a7454dfa5408696d16732a0955c37eca1ee0bc8e378a696af5376
                                            • Instruction ID: 240ff03149ae45fcd9c6bec138bd1906178de9185ce560617ddbfc596cbaf81c
                                            • Opcode Fuzzy Hash: fc0698119a3a7454dfa5408696d16732a0955c37eca1ee0bc8e378a696af5376
                                            • Instruction Fuzzy Hash: 9F21F166B0D68289DB048F26A424439BBA5FF89FC0B48C571CE6E03F58EE3CD4468701
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6683710 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@ListString@@$FindObject@@$?begin@?dispose@?end@?qt_qChildChildren_helper@@Data@1@@Flags@List@MetaOption@Qt@@@@@
                                            • String ID:
                                            • API String ID: 2432269031-0
                                            • Opcode ID: 9da034710dd619ec85310c0bf86a9c8ab1b78c89a3281f08ad1b212a42916b5e
                                            • Instruction ID: 6099b99804e2dd0a8a88bb445e240a8d44fbd12e2d673a23521562fb6add1d14
                                            • Opcode Fuzzy Hash: 9da034710dd619ec85310c0bf86a9c8ab1b78c89a3281f08ad1b212a42916b5e
                                            • Instruction Fuzzy Hash: 19211C36709A4682EB008BA5E474569B364FF84BA4F144175DA5E43FE8DE7DE846C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6743850 Relevance: 9.1, APIs: 6, Instructions: 56COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Base@@$Node$?set$Parent@U1@@$?color@?createArray@@ByteColor@Color@1@Color@1@@DataNode@U2@_V0@@
                                            • String ID:
                                            • API String ID: 485551508-0
                                            • Opcode ID: 593bac8f3a809254947673f5464a731d19afef5fe296862d8bf8b511f12b8a27
                                            • Instruction ID: 26bfbe8756aaae6723724047ffc02d82e02a624ae76a6e4308dc7c33f06e3b48
                                            • Opcode Fuzzy Hash: 593bac8f3a809254947673f5464a731d19afef5fe296862d8bf8b511f12b8a27
                                            • Instruction Fuzzy Hash: FE213822B08A4182EB048F16E424729B3B8FB88FC4F484139CE6D47F98EF7DE5568740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF668F470 Relevance: 9.0, APIs: 6, Instructions: 27timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF668F0DB,?,?,?,00007FFDF66836EC), ref: 00007FFDF668F483
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF668F0DB,?,?,?,00007FFDF66836EC), ref: 00007FFDF668F48D
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF668F0DB,?,?,?,00007FFDF66836EC), ref: 00007FFDF668F497
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF668F0DB,?,?,?,00007FFDF66836EC), ref: 00007FFDF668F4A1
                                            • ??1QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF668F0DB,?,?,?,00007FFDF66836EC), ref: 00007FFDF668F4AB
                                            • ??1QDateTime@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF668F0DB,?,?,?,00007FFDF66836EC), ref: 00007FFDF668F4B5
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@Byte$DateTime@@
                                            • String ID:
                                            • API String ID: 664682113-0
                                            • Opcode ID: 21ed419e4c519055bcc3de7e691c68d1f7ec3d13e50004de8fa204095c59815a
                                            • Instruction ID: 835887c2dc242a814d974360c4fd941aec955c93d3fde77572f96bc6652fc9a5
                                            • Opcode Fuzzy Hash: 21ed419e4c519055bcc3de7e691c68d1f7ec3d13e50004de8fa204095c59815a
                                            • Instruction Fuzzy Hash: 68F03C21B0C806A2EB049B65EA749783335FF94740F444271C62E02DE9EF6CECEAC344
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66EB6C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,00000000,00007FFDF66EAACF), ref: 00007FFDF66EB703
                                            • ?registerNormalizedType@QMetaType@@SAHAEBVQByteArray@@P6AXPEAX@ZP6APEAX1PEBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PEBUQMetaObject@@@Z.QT5CORE ref: 00007FFDF66EB737
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF66EB744
                                            • _Init_thread_footer.LIBCMT ref: 00007FFDF66EB77A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Meta$Array@@Byte$Type@$?normalized?registerFlag@Flags@Init_thread_footerNormalizedObject@@Object@@@TypeType@@Type@@@@
                                            • String ID: QNetworkSession::SessionError
                                            • API String ID: 109532953-3125804625
                                            • Opcode ID: 66336642b8895b226e275e115d1f6d97a731b78d5c2154e9377d79bf72081221
                                            • Instruction ID: 5753e052fd1a99e25ab411f16a5b4a0ff0239d83254d295cd00a188b07e29a15
                                            • Opcode Fuzzy Hash: 66336642b8895b226e275e115d1f6d97a731b78d5c2154e9377d79bf72081221
                                            • Instruction Fuzzy Hash: 8A110071B18A4286E710CF25F8B09653768BF58741F800176D62D86EEDEF3CE949CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66954B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PEBD@Z.QT5CORE(?,?,?,?,00000000,00007FFDF6692CA1,?,?,00000000), ref: 00007FFDF66954F3
                                            • ?registerNormalizedType@QMetaType@@SAHAEBVQByteArray@@P6AXPEAX@ZP6APEAX1PEBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PEBUQMetaObject@@@Z.QT5CORE ref: 00007FFDF6695527
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF6695534
                                            • _Init_thread_footer.LIBCMT ref: 00007FFDF669556A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Meta$Array@@Byte$Type@$?normalized?registerFlag@Flags@Init_thread_footerNormalizedObject@@Object@@@TypeType@@Type@@@@
                                            • String ID: QNetworkRequest
                                            • API String ID: 109532953-2472831940
                                            • Opcode ID: 2533aed385cb9b56338f0f5201eff0a5ddde6d98870adab78307847782f5459c
                                            • Instruction ID: ef18499de2aac7b425f9edf46af22a1fea2829a2ac1930b671393fadbb63c5a4
                                            • Opcode Fuzzy Hash: 2533aed385cb9b56338f0f5201eff0a5ddde6d98870adab78307847782f5459c
                                            • Instruction Fuzzy Hash: 6E110A71F0864686E710CF15E8B096537A8BB64758F840176DA6D43EEDEF3CE95ACB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673D6E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF673D6F8
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673D71D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF673D734
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$X509_print
                                            • API String ID: 646154281-491108590
                                            • Opcode ID: b25c54454cec0c21b0613005ec07e1bca5aa58cd2aa8d1a84f48b016ef470672
                                            • Instruction ID: 1d38dbb93bdfa8c22d68a82cf52a1a99ed7bffa819745e38bef014743cd3519c
                                            • Opcode Fuzzy Hash: b25c54454cec0c21b0613005ec07e1bca5aa58cd2aa8d1a84f48b016ef470672
                                            • Instruction Fuzzy Hash: E9F05B15F1CA83C1EB51AB51E872EB53359BF81F44F404231D56D03F99EE3CD5968600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673B840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6749226,00000000,00000001,00000000,00007FFDF67510F7), ref: 00007FFDF673B858
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6749226,00000000,00000001,00000000,00007FFDF67510F7), ref: 00007FFDF673B87D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6749226,00000000,00000001,00000000,00007FFDF67510F7), ref: 00007FFDF673B894
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$SSL_free
                                            • API String ID: 646154281-4066756980
                                            • Opcode ID: f80fc64bd5da9d35e29530b1d14d9f5cb8aeb02956c119cf7200080ec3fe248c
                                            • Instruction ID: b3017e2db843a2c79ba6e27e6e4ef035b9ed6323a66a5fcb8b9fd66bab29a935
                                            • Opcode Fuzzy Hash: f80fc64bd5da9d35e29530b1d14d9f5cb8aeb02956c119cf7200080ec3fe248c
                                            • Instruction Fuzzy Hash: 7EF03614F1CA83C1EB51AB61D871DB53359AF81F44F504131C56D03FADEE2CA596C600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673B6F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF673B708
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673B72D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF673B744
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$SSL_clear
                                            • API String ID: 646154281-668550569
                                            • Opcode ID: c0f03b8d19fb203dc9429b45d8155a00bfefefa0f49fe20baf8efeab7483a84f
                                            • Instruction ID: 7a731faa5759135aa03323dbcc0aab4567d46ba8e57b11a3d4cebfa00c82753f
                                            • Opcode Fuzzy Hash: c0f03b8d19fb203dc9429b45d8155a00bfefefa0f49fe20baf8efeab7483a84f
                                            • Instruction Fuzzy Hash: 94F05424F1CA83C1EB51AB65E872DB53359AF91F10F504336D96D03FE8EE2CE9868600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6739700 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6746946,?,?,?,00007FFDF6748514), ref: 00007FFDF6739718
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6746946,?,?,?,00007FFDF6748514), ref: 00007FFDF673973D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6746946,?,?,?,00007FFDF6748514), ref: 00007FFDF6739754
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: EVP_PKEY_get1_RSA$QSslSocket: cannot call unresolved function %s
                                            • API String ID: 646154281-3901137079
                                            • Opcode ID: 16633d4edfc15fb0c6b79b6ac486c0364d364c99b618f4cccd359a5e4c3d64c2
                                            • Instruction ID: 5cc7b35aab44466d6960974fbfdb25c9119b5fe24c7ab191a16728d080a9aec2
                                            • Opcode Fuzzy Hash: 16633d4edfc15fb0c6b79b6ac486c0364d364c99b618f4cccd359a5e4c3d64c2
                                            • Instruction Fuzzy Hash: 33F03014F1CA8381EB51AF61E832DB53399AF85F00F404232C96D03FE9FE2C95868600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673D520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6745024), ref: 00007FFDF673D538
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6745024), ref: 00007FFDF673D55D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6745024), ref: 00007FFDF673D574
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$X509_get_subject_name
                                            • API String ID: 646154281-2939435048
                                            • Opcode ID: 3707b8a0728b006d4606af42e330697f06fb200f6c1327030db21a6dcea4fdac
                                            • Instruction ID: 1aa94084b67a1b9783d2fdc9b7f5408ea2afa236dd0a378097d621dd29e4f650
                                            • Opcode Fuzzy Hash: 3707b8a0728b006d4606af42e330697f06fb200f6c1327030db21a6dcea4fdac
                                            • Instruction Fuzzy Hash: B6F03054F1CA4381EB50AB61E871EB53399AF85F14F404236D96D42FA9EE2CA58A8700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673B530 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF673B548
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673B56D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF673B584
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$SSL_CTX_use_psk_identity_hint
                                            • API String ID: 646154281-1560254588
                                            • Opcode ID: 23484b62d594ebc46183416067ad120405337deffc687689bd688ad6af3f841d
                                            • Instruction ID: a2813477ff6f6a690021e5e36810596d24cc8e92457380909252d1da59850e70
                                            • Opcode Fuzzy Hash: 23484b62d594ebc46183416067ad120405337deffc687689bd688ad6af3f841d
                                            • Instruction Fuzzy Hash: 24F05414F1CA43C1EB11AB61E831EB93399BF85F40F404236C96D43FA9EE2CE5868700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6739540 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6746921,?,?,?,00007FFDF6748514), ref: 00007FFDF6739558
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6746921,?,?,?,00007FFDF6748514), ref: 00007FFDF673957D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6746921,?,?,?,00007FFDF6748514), ref: 00007FFDF6739594
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: EVP_PKEY_base_id$QSslSocket: cannot call unresolved function %s
                                            • API String ID: 646154281-3796295355
                                            • Opcode ID: cfd4f40f239d3b1e3c927571a9844a2cca8091e06d5796312dc0849fd5f8cdc7
                                            • Instruction ID: ebc0706b063d6ecf474d110260d9c197cf21db9636af8f614ca442eeaf5f7682
                                            • Opcode Fuzzy Hash: cfd4f40f239d3b1e3c927571a9844a2cca8091e06d5796312dc0849fd5f8cdc7
                                            • Instruction Fuzzy Hash: 5BF03014F1CA8381EB11AB61E832DB53399BF85F00F405236D96D03FEDEE2D95868700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673D750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF674BCD7), ref: 00007FFDF673D768
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF674BCD7), ref: 00007FFDF673D78D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF674BCD7), ref: 00007FFDF673D7A4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$X509_verify_cert
                                            • API String ID: 646154281-1197077324
                                            • Opcode ID: 42b1814fd74a89d5348741d4ec4c2ab270e63f7207aba4bf1ebe2173897a7a29
                                            • Instruction ID: 63b3e7f9e26ce3d043f81195771087ea97da8a77d29ec001ece9a8d5727705ab
                                            • Opcode Fuzzy Hash: 42b1814fd74a89d5348741d4ec4c2ab270e63f7207aba4bf1ebe2173897a7a29
                                            • Instruction Fuzzy Hash: 50F03024F1CA8381EB50AB61E872DB53359AF81F50F504336D96D02FECEE2CA5968700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673D670 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6742EC1,?,?,?,?,00007FFDF6744099), ref: 00007FFDF673D688
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6742EC1,?,?,?,?,00007FFDF6744099), ref: 00007FFDF673D6AD
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6742EC1,?,?,?,?,00007FFDF6744099), ref: 00007FFDF673D6C4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$X509_getm_notBefore
                                            • API String ID: 646154281-627992934
                                            • Opcode ID: 022f86617e0003062e67b371291654fae79fd6f702d44ccd087d959fd4e091a3
                                            • Instruction ID: 12f369face42e490c33bc9c7d804dc662ba04de29d6a445a47bac692f3d7eeb6
                                            • Opcode Fuzzy Hash: 022f86617e0003062e67b371291654fae79fd6f702d44ccd087d959fd4e091a3
                                            • Instruction Fuzzy Hash: 4FF03014F1CA83C1EB11AB61E831DB53399AF85F40F504236C96D03FA9EE2C959A8A00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673B680 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF673B698
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673B6BD
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF673B6D4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$SSL_accept
                                            • API String ID: 646154281-4119542777
                                            • Opcode ID: 7c8f21af64d07e17e70ac3ccfc44d309be4c141903c19184078ee8dad22bf854
                                            • Instruction ID: 44764fa6ba988fc6782ff06a211ed2f1763ed7fc585b37c4f40449368cd45b1d
                                            • Opcode Fuzzy Hash: 7c8f21af64d07e17e70ac3ccfc44d309be4c141903c19184078ee8dad22bf854
                                            • Instruction Fuzzy Hash: 71F09020F1CA83C1EB00AB61E832DB53359AF81F00F504236C97D03FE9EE2CA5868A00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6739690 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF67469A6,?,?,?,00007FFDF6748514), ref: 00007FFDF67396A8
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF67469A6,?,?,?,00007FFDF6748514), ref: 00007FFDF67396CD
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF67469A6,?,?,?,00007FFDF6748514), ref: 00007FFDF67396E4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: EVP_PKEY_get1_EC_KEY$QSslSocket: cannot call unresolved function %s
                                            • API String ID: 646154281-939091918
                                            • Opcode ID: 1a3577bb23dcf1fef093ae4b7412c5d8927ad29e8db5b32c3f246ea463fa64a7
                                            • Instruction ID: c980a425208237ac228696f917a856981ba29c50dfcc11622c88ad0dbb0bc664
                                            • Opcode Fuzzy Hash: 1a3577bb23dcf1fef093ae4b7412c5d8927ad29e8db5b32c3f246ea463fa64a7
                                            • Instruction Fuzzy Hash: B3F05B14F1DA43C1EB509B61D871EB53359AF45F40F405135D56D03F99FE2DD5868640
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67397E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF67397F8
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673981D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF6739834
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: EVP_PKEY_set1_DSA$QSslSocket: cannot call unresolved function %s
                                            • API String ID: 646154281-2907225549
                                            • Opcode ID: 40a50c02b8552015b7314c429d767b217330b5274a047452669cd851fc4acca0
                                            • Instruction ID: e4de554ce4c049f71a2a90b13ebd9557433467919c0da408fef417c7d76b18cd
                                            • Opcode Fuzzy Hash: 40a50c02b8552015b7314c429d767b217330b5274a047452669cd851fc4acca0
                                            • Instruction Fuzzy Hash: 53F03024F1CA8381EB11AB61E872EB5335ABF81F10F404236D96D03FE9FE2D95868604
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673D830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF67483CE), ref: 00007FFDF673D848
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF67483CE), ref: 00007FFDF673D86D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF67483CE), ref: 00007FFDF673D884
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$d2i_PKCS12_bio
                                            • API String ID: 646154281-1413310762
                                            • Opcode ID: 6417901f5582894965d79ff18773289ea55f9d2f7a13519bcd9641b801d24606
                                            • Instruction ID: 412938b008da9ff3aeda3adc27a2098f5aa0cb5facf9551f3f475709e3dd040e
                                            • Opcode Fuzzy Hash: 6417901f5582894965d79ff18773289ea55f9d2f7a13519bcd9641b801d24606
                                            • Instruction Fuzzy Hash: BCF03614F1CA43C1EB50AB61E871EB53399AF45F00F405231D55D02FE9EE2CA5868600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6739850 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF6739868
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673988D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF67398A4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: EVP_PKEY_set1_EC_KEY$QSslSocket: cannot call unresolved function %s
                                            • API String ID: 646154281-2965549941
                                            • Opcode ID: b49acd71400ac8357735982f13f4ab1f1f4bfe7f62d4585e0cabc50fe4bf551a
                                            • Instruction ID: aa98ff292bcf8c00046613539d4406920a8281af9d8be63265c9c8d28ff43322
                                            • Opcode Fuzzy Hash: b49acd71400ac8357735982f13f4ab1f1f4bfe7f62d4585e0cabc50fe4bf551a
                                            • Instruction Fuzzy Hash: D2F03024F1CA8381FB50AB61E872EB5335AAF85F10F544236D97D03FE9EE2D95868604
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673B760 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF673B778
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673B79D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF673B7B4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$SSL_connect
                                            • API String ID: 646154281-2438786244
                                            • Opcode ID: 3bd5499aaa58d41400f9e99fc93fb29d062ceac5f2e344cae1a4cc9e6a0bdb75
                                            • Instruction ID: c79cb2cc4bd38f21bb085c7dd4601237fd75cd77bff57cc2e7d3da1c76a3c6d0
                                            • Opcode Fuzzy Hash: 3bd5499aaa58d41400f9e99fc93fb29d062ceac5f2e344cae1a4cc9e6a0bdb75
                                            • Instruction Fuzzy Hash: D9F03024F1CA83C1EB50AB61E872EB53359AF91F10F504236D96D03FE8EE2CA5868600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6739770 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF6739788
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF67397AD
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF67397C4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: EVP_PKEY_new$QSslSocket: cannot call unresolved function %s
                                            • API String ID: 646154281-74362941
                                            • Opcode ID: ec9f0ef880cdbc16332845ac75119c43c122e592b42d49a838ebd94d027eefc8
                                            • Instruction ID: 222b4afd4478cd66cb64fdc6a1ec2a4ae9d30fcbe6404e725498e954fe13e045
                                            • Opcode Fuzzy Hash: ec9f0ef880cdbc16332845ac75119c43c122e592b42d49a838ebd94d027eefc8
                                            • Instruction Fuzzy Hash: 84F03014F1CA8381EB11AF61E831DB53399AF85F10F504232C96D07FE9FE2D95868600
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673D7C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6742231,?,?,?,00007FFDF672CAE6), ref: 00007FFDF673D7D8
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6742231,?,?,?,00007FFDF672CAE6), ref: 00007FFDF673D7FD
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF6742231,?,?,?,00007FFDF672CAE6), ref: 00007FFDF673D814
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$d2i_DHparams
                                            • API String ID: 646154281-3362144670
                                            • Opcode ID: 1a0d7d29c32929e0fc84aa9290b5012047e7eeef7d5a8cfab4be1567aa5960f0
                                            • Instruction ID: 43c77c4306137bf47f07e746e6495cd9ffab2f4b33771623bb1091e450df775a
                                            • Opcode Fuzzy Hash: 1a0d7d29c32929e0fc84aa9290b5012047e7eeef7d5a8cfab4be1567aa5960f0
                                            • Instruction Fuzzy Hash: 51F03014F1CA4381EB50AB61E871DB53399AF85F00F505232C96D02FA9EE2CE58A8A40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF673B7D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE ref: 00007FFDF673B7E8
                                              • Part of subcall function 00007FFDF6727C90: ??0QLoggingCategory@@QEAA@PEBD@Z.QT5CORE(?,?,?,00007FFDF673D0D5,?,?,?,?,?,?,?,?,?,?,00007FFDF67428DA), ref: 00007FFDF6727CEC
                                              • Part of subcall function 00007FFDF6727C90: _Init_thread_footer.LIBCMT ref: 00007FFDF6727D05
                                            • ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE ref: 00007FFDF673B80D
                                            • ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FFDF673B824
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                            • String ID: QSslSocket: cannot call unresolved function %s$SSL_ctrl
                                            • API String ID: 646154281-3177806278
                                            • Opcode ID: 5e9ebf072326d9fcb767376bb91d501f92028ec773628c35f26ab0ec5bf1624a
                                            • Instruction ID: d77c75bdf61d371168c23a4b61ad12d29c8350ea170572786931c8007d87a640
                                            • Opcode Fuzzy Hash: 5e9ebf072326d9fcb767376bb91d501f92028ec773628c35f26ab0ec5bf1624a
                                            • Instruction Fuzzy Hash: 54F09614F28A43C1EB409B21E831DB53359AF41F10F404231C56D03FE8EE2DD58A8640
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D95320 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 249COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memset$memcpy
                                            • String ID: RIFF$VP8L$WEBP
                                            • API String ID: 368790112-2152065085
                                            • Opcode ID: c98bb87acb19021eb130a0770900102a1ce0f68bed675091136fedb3a620d3e3
                                            • Instruction ID: 8f12eb9a7cfdafc524b7a8f3bcfd51971929e7056073e64c6493f3c25ff5955d
                                            • Opcode Fuzzy Hash: c98bb87acb19021eb130a0770900102a1ce0f68bed675091136fedb3a620d3e3
                                            • Instruction Fuzzy Hash: 47A18D72B0A6898AE714DF61D8607AD37A1EF46B88F444035DE1E97B8DDE38E905C780
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6715820 Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF6715835
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF6715847
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF67158AD
                                            • ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF67158CA
                                            • ?deleteLater@QObject@@QEAAXXZ.QT5CORE(?,?,?,00007FFDF67152E8,?,?,?,00007FFDF66A3D69), ref: 00007FFDF67158EC
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?dispose@Data@1@@$?begin@?delete?end@Later@Object@@
                                            • String ID:
                                            • API String ID: 3538899828-0
                                            • Opcode ID: 55a490ad505929420c2a155480f315e1727e8a8008690ca307e03405abe32e02
                                            • Instruction ID: 747d01d0bcae3d2bbab4d52ee57791445ee434133ed765537e70631cb41d5eac
                                            • Opcode Fuzzy Hash: 55a490ad505929420c2a155480f315e1727e8a8008690ca307e03405abe32e02
                                            • Instruction Fuzzy Hash: 71311032B05A4597FB658B69E86076973E4EB44B54F184136CB6E83FE4DF3CD8868700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6701780 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF67008C4,?,?,preconnect-https,00007FFDF66E23DA), ref: 00007FFDF67017C3
                                            • ??0QUrl@@QEAA@AEBV0@@Z.QT5CORE(?,?,?,00007FFDF67008C4,?,?,preconnect-https,00007FFDF66E23DA), ref: 00007FFDF67017D1
                                            • ??0QSharedData@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF67008C4,?,?,preconnect-https,00007FFDF66E23DA), ref: 00007FFDF67017FA
                                            • ??0QBasicMutex@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF67008C4,?,?,preconnect-https,00007FFDF66E23DA), ref: 00007FFDF6701804
                                            • ??1QUrl@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF67008C4,?,?,preconnect-https,00007FFDF66E23DA), ref: 00007FFDF670183C
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@SharedUrl@@$BasicMutex@@V0@@malloc
                                            • String ID:
                                            • API String ID: 494146124-0
                                            • Opcode ID: a9df2a07026b2a0657b2e06d6141e4eb58c9ff08d65b36ed02a9b04c3a248feb
                                            • Instruction ID: 77e3697671d8cef7a11df4b34136e3c4245b3d5e8b91cf185dac509727e71e11
                                            • Opcode Fuzzy Hash: a9df2a07026b2a0657b2e06d6141e4eb58c9ff08d65b36ed02a9b04c3a248feb
                                            • Instruction Fuzzy Hash: 4B316932B096428AEB14DF55E47066973A4EB44B94F088039DB6E43FD8EF3CE952C750
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67034B0 Relevance: 7.6, APIs: 5, Instructions: 65timeCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                              • Part of subcall function 00007FFDF6703760: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF6703769
                                              • Part of subcall function 00007FFDF6703760: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF670377A
                                              • Part of subcall function 00007FFDF6703760: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF6703784
                                              • Part of subcall function 00007FFDF6703760: ??0QDateTime@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF6703796
                                              • Part of subcall function 00007FFDF6703760: ??0QDateTime@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF67037A0
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF67034F7
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF670350F
                                            • ??4QString@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF6703522
                                            • ??4QDateTime@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF6703542
                                            • ??4QDateTime@@QEAAAEAV0@AEBV0@@Z.QT5CORE ref: 00007FFDF6703555
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$V0@@$DateTime@@$malloc
                                            • String ID:
                                            • API String ID: 3964370747-0
                                            • Opcode ID: 736984523568c381f090e0e289ed52e0ba5e6d715d16004edf59b37252454acd
                                            • Instruction ID: db8492bf85e2af193b35e8760f1e79209e15a14e8cfe8112a2e2b0c388a3404b
                                            • Opcode Fuzzy Hash: 736984523568c381f090e0e289ed52e0ba5e6d715d16004edf59b37252454acd
                                            • Instruction Fuzzy Hash: CD313C26708BE089DB40CB5AE4A4529BB78F799B94F168066DFDD43B5ACE38C092C710
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D4B0A0 Relevance: 7.6, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF5D4B4C0), ref: 00007FFDF5D4B0CB
                                            • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF5D4B4C0), ref: 00007FFDF5D4B0D4
                                              • Part of subcall function 00007FFDF5D97160: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000098,00007FFDF5D4B0EB,?,?,?,00007FFDF5D4B4C0), ref: 00007FFDF5D97170
                                            • memset.VCRUNTIME140(?,?,?,00007FFDF5D4B4C0), ref: 00007FFDF5D4B0FD
                                            • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF5D4B4C0), ref: 00007FFDF5D4B106
                                            • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF5D4B4C0), ref: 00007FFDF5D4B125
                                            • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDF5D4B4C0), ref: 00007FFDF5D4B14E
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: free$memset
                                            • String ID:
                                            • API String ID: 2717317152-0
                                            • Opcode ID: 361219c9071bef26e3eb2c497ef19fa60b0e6f648a5828a4905808d4e931e281
                                            • Instruction ID: 47294231388e6b48799b7cbcdc3c01f5a135b18d8af3619053a7e20e84e44cd5
                                            • Opcode Fuzzy Hash: 361219c9071bef26e3eb2c497ef19fa60b0e6f648a5828a4905808d4e931e281
                                            • Instruction Fuzzy Hash: B5218132B16A8996DB48DF22D9517ED7360FB85F48F480035DB6D0368ADF34E8A1C780
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6699830 Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?end@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00007FFDF66987D0,?,?,?,?,?,?,00000000,00007FFDF669A47C), ref: 00007FFDF6699858
                                            • ?begin@QListData@@QEBAPEAPEAXXZ.QT5CORE(?,?,00000000,00007FFDF66987D0,?,?,?,?,?,?,00000000,00007FFDF669A47C), ref: 00007FFDF6699864
                                            • ?size@QListData@@QEBAHXZ.QT5CORE(?,?,00000000,00007FFDF66987D0,?,?,?,?,?,?,00000000,00007FFDF669A47C), ref: 00007FFDF669988D
                                            • ??0QEvent@@QEAA@W4Type@0@@Z.QT5CORE(?,?,00000000,00007FFDF66987D0,?,?,?,?,?,?,00000000,00007FFDF669A47C), ref: 00007FFDF66998AB
                                            • ?postEvent@QCoreApplication@@SAXPEAVQObject@@PEAVQEvent@@H@Z.QT5CORE(?,?,00000000,00007FFDF66987D0,?,?,?,?,?,?,00000000,00007FFDF669A47C), ref: 00007FFDF66998C4
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$Event@@$?begin@?end@?post?size@Application@@CoreEvent@Object@@Type@0@@
                                            • String ID:
                                            • API String ID: 1072224609-0
                                            • Opcode ID: 769dd6c88e0b9c25c6dbbae4db539726ef5460109e312a6c91f1227082783e21
                                            • Instruction ID: a904bc37c78beb4804ac7dcbe07afae4ef147501939b37965fa6228a9c56267d
                                            • Opcode Fuzzy Hash: 769dd6c88e0b9c25c6dbbae4db539726ef5460109e312a6c91f1227082783e21
                                            • Instruction Fuzzy Hash: 06118F32B19A4296EB048B01E8645797368FB89FC4F480575EA5E03F9DDF3CD882CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6703830 Relevance: 7.5, APIs: 5, Instructions: 44timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??1QDateTime@@QEAA@XZ.QT5CORE ref: 00007FFDF670388C
                                            • ??1QDateTime@@QEAA@XZ.QT5CORE ref: 00007FFDF6703896
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF67038A0
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF67038AA
                                            • ??1QString@@QEAA@XZ.QT5CORE ref: 00007FFDF67038B3
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                              • Part of subcall function 00007FFDF6703760: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF6703769
                                              • Part of subcall function 00007FFDF6703760: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF670377A
                                              • Part of subcall function 00007FFDF6703760: ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF6703784
                                              • Part of subcall function 00007FFDF6703760: ??0QDateTime@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF6703796
                                              • Part of subcall function 00007FFDF6703760: ??0QDateTime@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6703473), ref: 00007FFDF67037A0
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$DateTime@@$malloc
                                            • String ID:
                                            • API String ID: 3822018753-0
                                            • Opcode ID: 0a9aeea5e2b5aa2aa0bf0411b2adad507fffa7a4d76f610647324bf13d9c30da
                                            • Instruction ID: 09560b8b563af46ec83b5b01aa1db0f7b606aa41f0427678004708148cfff4bb
                                            • Opcode Fuzzy Hash: 0a9aeea5e2b5aa2aa0bf0411b2adad507fffa7a4d76f610647324bf13d9c30da
                                            • Instruction Fuzzy Hash: 03112B22B08A4691EB04DB16E6B47287365FB44B94F084170DA2D47ED9DF3CE8D6C354
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D417D0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?device@QImageIOHandler@@QEBAPEAVQIODevice@@XZ.QT5GUI(?,?,00000000,00007FFDF5D419CD), ref: 00007FFDF5D417F2
                                            • ?readAll@QIODevice@@QEAA?AVQByteArray@@XZ.QT5CORE(?,?,00000000,00007FFDF5D419CD), ref: 00007FFDF5D41800
                                            • ??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z.QT5CORE(?,?,00000000,00007FFDF5D419CD), ref: 00007FFDF5D4180D
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,00000000,00007FFDF5D419CD), ref: 00007FFDF5D41818
                                            • ?constData@QByteArray@@QEBAPEBDXZ.QT5CORE(?,?,00000000,00007FFDF5D419CD), ref: 00007FFDF5D41822
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$Device@@$?const?device@?readAll@Data@Handler@@ImageV0@$$V0@@
                                            • String ID:
                                            • API String ID: 14243995-0
                                            • Opcode ID: 5b94255f5ac245ff9501521cf51722e8e3ed053d93535ef80b7488d019647efa
                                            • Instruction ID: 948a7f5a078cc807b891919711cc405b7d6145e674aec3a6407a104224e551d5
                                            • Opcode Fuzzy Hash: 5b94255f5ac245ff9501521cf51722e8e3ed053d93535ef80b7488d019647efa
                                            • Instruction Fuzzy Hash: F7016136B1AA4583DB10AB21F8507AEB3A0FB44B44F445031DB9E47BA8DF3CE586C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66FF7E0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$Array@@ByteV0@@$A@$$
                                            • String ID:
                                            • API String ID: 101242672-0
                                            • Opcode ID: 6a60991c38404d20dc76e4393af336ee2f79ee035afaebd938658c59fef5e0f3
                                            • Instruction ID: 6af4f1df38e37ed9a7807e3aeafb0936a352baf68d675af9cf80dea08fa17b8b
                                            • Opcode Fuzzy Hash: 6a60991c38404d20dc76e4393af336ee2f79ee035afaebd938658c59fef5e0f3
                                            • Instruction Fuzzy Hash: 13018B62B1C94196EB40CB15E874B2A6324BF84B80F584170E96E02AECEF7CD8858B00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66A96BF Relevance: 7.5, APIs: 5, Instructions: 29timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@Byte$Device@@$?clear@?readAll@DateOpen@Time@@V0@$$V0@@
                                            • String ID:
                                            • API String ID: 3340490329-0
                                            • Opcode ID: 227e25864e1b31cf92d735a1051a26fc8270dc2227c0a65d653a76de2dbbfc98
                                            • Instruction ID: d068b231bd047b87fccedfddc72abe45aa8c649094fd62adc61d1444dbe4a17e
                                            • Opcode Fuzzy Hash: 227e25864e1b31cf92d735a1051a26fc8270dc2227c0a65d653a76de2dbbfc98
                                            • Instruction Fuzzy Hash: 04014022B24A6297FB10CF21D864AAC3778FB00B44F500175DA1E47E99EF28E565C740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67037C0 Relevance: 7.5, APIs: 5, Instructions: 25timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$DateTime@@
                                            • String ID:
                                            • API String ID: 1669668222-0
                                            • Opcode ID: f466ca9cdad7fb8002baf08e77b92c2899f486ee04730045aeedca42c327fe69
                                            • Instruction ID: 7ca23cd3ecba56e189de9ca5b17dfcea15d79a2aa2809c3621ffca96554a9de1
                                            • Opcode Fuzzy Hash: f466ca9cdad7fb8002baf08e77b92c2899f486ee04730045aeedca42c327fe69
                                            • Instruction Fuzzy Hash: D1F01D62F08907D2EB04DF21E8745783328EF54B19B480170CA2E02AE8EF2CD9DBC394
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6703760 Relevance: 7.5, APIs: 5, Instructions: 20timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$DateTime@@
                                            • String ID:
                                            • API String ID: 1669668222-0
                                            • Opcode ID: 5faad8ac852ff5419c791b04024e571638a371d6cc9e22ff56938da3e4eb9ec8
                                            • Instruction ID: b369115504c1f1dc37cbaaa938744181b79332100ef35c594bfd26187a68416f
                                            • Opcode Fuzzy Hash: 5faad8ac852ff5419c791b04024e571638a371d6cc9e22ff56938da3e4eb9ec8
                                            • Instruction Fuzzy Hash: 25F0126261460A86DB449F60D4647683334FB58F0DF501164C91D42698EFB8D8CAC784
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D41310 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: ?invalidate@Array@@ByteColor@@Handler@@Image
                                            • String ID: K
                                            • API String ID: 468397674-856455061
                                            • Opcode ID: 18d9dc8137f5a710cff19be3bf150b2a9e7d63ba66e2a740790b6d8804f66728
                                            • Instruction ID: 7e08fb7445563e8b1895eff71f3bba57464d129b1fb567857be18fd83bc5f817
                                            • Opcode Fuzzy Hash: 18d9dc8137f5a710cff19be3bf150b2a9e7d63ba66e2a740790b6d8804f66728
                                            • Instruction Fuzzy Hash: 8D010032606F0586D7909F35E99076873E8FB49B48F504234CA9C833A8EF38D4A9C380
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67236DF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::ServerNotFoundError
                                            • API String ID: 1532547931-2843305452
                                            • Opcode ID: 3fe1b042094a68d710f156d7fe00184ad53ba7384a1d255f7187785d2a50f38b
                                            • Instruction ID: f4ea2412bcadbb042fa8238ac69fbf01d71b2f0f501aa1c5fa1c68652dd80333
                                            • Opcode Fuzzy Hash: 3fe1b042094a68d710f156d7fe00184ad53ba7384a1d255f7187785d2a50f38b
                                            • Instruction Fuzzy Hash: 80E0E536B08A4281DB049F16F9604283338FB88B95B041071DE6E03FA8EF3CE851CB04
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67236F4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::SocketAccessError
                                            • API String ID: 1532547931-2124978009
                                            • Opcode ID: cd526fb638bced1c9c679d991b2593d65835a7533fc0a0a380f78ccddc979093
                                            • Instruction ID: 249b92fa552f5d87223f5850b4772ee5ab834f216350342e1ae9b10947df9086
                                            • Opcode Fuzzy Hash: cd526fb638bced1c9c679d991b2593d65835a7533fc0a0a380f78ccddc979093
                                            • Instruction Fuzzy Hash: 4EE0ED36B09A4281DB045F15F9604283334FB48B95B041072DE5E03FA8DF3CE851C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6723709 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::SocketResourceError
                                            • API String ID: 1532547931-4227693670
                                            • Opcode ID: c35393e0936a6050e0144a0c40a678c433dd0a2a08fa58009982d4ab5469a229
                                            • Instruction ID: e508466e5e1229da8c87d86ab801bde8dc33a390e950d06fe34cb628edb766c8
                                            • Opcode Fuzzy Hash: c35393e0936a6050e0144a0c40a678c433dd0a2a08fa58009982d4ab5469a229
                                            • Instruction Fuzzy Hash: E3E0E536B19A4281DB049F16F9604283338FB88B95B441072DE6E03FA8EF3CE895CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF672371E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::SocketTimeoutError
                                            • API String ID: 1532547931-1768731006
                                            • Opcode ID: 881ca1811530087f429e2ac53fac4a1cfd9be2a79bb077d33e05d586b514f859
                                            • Instruction ID: 994677e70e37e365e67443019ec5b9bbcb3184ecad9e0fbd2e05a907a6872d01
                                            • Opcode Fuzzy Hash: 881ca1811530087f429e2ac53fac4a1cfd9be2a79bb077d33e05d586b514f859
                                            • Instruction Fuzzy Hash: 23E0E536B09A42C1DB049F16F9604283338FB88B95B041071DE6E03FA8EF3CE851CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6723730 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::DatagramTooLargeError
                                            • API String ID: 1532547931-904559475
                                            • Opcode ID: 554e396312bc00a8d2a066d3040096d8b589346c951b0aa7e8d7bc8c8eb3ebc9
                                            • Instruction ID: 553e4eca0874dde6a7d26b4b261caf0969358eaa318d2117c60fa2fa1b231e08
                                            • Opcode Fuzzy Hash: 554e396312bc00a8d2a066d3040096d8b589346c951b0aa7e8d7bc8c8eb3ebc9
                                            • Instruction Fuzzy Hash: 5DE0ED36B09A4281DB045F15F9604283334FB48B95B041071DE5E03FA8DF3CE851C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6723742 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::ConnectionError
                                            • API String ID: 1532547931-2889533582
                                            • Opcode ID: d0522511d657bfa92eddf7b77e0ada528f0f97815a90f9d432cacd20f8613f9c
                                            • Instruction ID: 136bb081fe22d824a5840b1f8a88a9ba8e24e42045417da97d633fb307f1a485
                                            • Opcode Fuzzy Hash: d0522511d657bfa92eddf7b77e0ada528f0f97815a90f9d432cacd20f8613f9c
                                            • Instruction Fuzzy Hash: CFE0E536B08A4282DB049F16F9604283338FB88B95B041071DE6E03FACEF3CE851CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6723754 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::UnsupportedSocketOperationError
                                            • API String ID: 1532547931-2568171267
                                            • Opcode ID: 800f3e671b680b7ba99e38336f92feb84ad519a16347489046a607e7a7a58c9d
                                            • Instruction ID: 72d13b646262aafd287981c450da6cd4bb9060e602e1f8a3d227f864110b417c
                                            • Opcode Fuzzy Hash: 800f3e671b680b7ba99e38336f92feb84ad519a16347489046a607e7a7a58c9d
                                            • Instruction Fuzzy Hash: 79E0E536B08A4281DB049F16F9604283338FB88B95B081071DE6E03FA8EF3CE851CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67236B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::ConnectionRefusedError
                                            • API String ID: 1532547931-1615569452
                                            • Opcode ID: 8e9d564d3b695891a33e6eb636042c68ed20f7d92a6071d5c8634eddf0e0bb3d
                                            • Instruction ID: c3bdf2ecc511640712f154e7603b0937172a51a4f8c2f9642b92cfe630d02851
                                            • Opcode Fuzzy Hash: 8e9d564d3b695891a33e6eb636042c68ed20f7d92a6071d5c8634eddf0e0bb3d
                                            • Instruction Fuzzy Hash: E3E0E536B08A4281DB049F16F9604283338FB88B95B041072DE6E03FA8DF3CE891CB01
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF67236CA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::PeerClosedError
                                            • API String ID: 1532547931-2632870787
                                            • Opcode ID: abe1c16a035c159362bd12a7f0b10eb257045c9e7db2f807b5399fbfa5678a2f
                                            • Instruction ID: 7060efee384a6dbc62f9b35ffdc9ef688501f35b25dbf57f45be68d8c9264cb9
                                            • Opcode Fuzzy Hash: abe1c16a035c159362bd12a7f0b10eb257045c9e7db2f807b5399fbfa5678a2f
                                            • Instruction Fuzzy Hash: 4EE0ED36B08A4281DB045F15F9605283338FB84B95B081071DE6E03FA8DF3CE851CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6723766 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Debug@@$DebugSaver@@State
                                            • String ID: QLocalSocket::UnknownSocketError
                                            • API String ID: 1532547931-1870636887
                                            • Opcode ID: ad141025673820426cf319ca15e6b9767988ccbaa331019b693112a74be34c14
                                            • Instruction ID: ac73ca9686e2693f7d74149d2d5f965202e4d6d089db3a9569b42bf1935614ef
                                            • Opcode Fuzzy Hash: ad141025673820426cf319ca15e6b9767988ccbaa331019b693112a74be34c14
                                            • Instruction Fuzzy Hash: 97E0E536B08A4281DB049F16F9704283378FB88B95B041071DE6E03FA8DF3CE851CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66AB830 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            • ?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z.QT5CORE ref: 00007FFDF66AB860
                                            • ??1Connection@QMetaObject@@QEAA@XZ.QT5CORE ref: 00007FFDF66AB86B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Object@@$Connection@Meta$?connect@ConnectionQt@@@Type@
                                            • String ID: 1deleteLater()$2done(bool)
                                            • API String ID: 1047475738-2265470634
                                            • Opcode ID: 0d55d5aa8d7452f886c91f3ac6dcb1cf1a80eea570fc60f814b615e37661c4ab
                                            • Instruction ID: 86469e01a9d1f51bba020635a8915aa0f8c369170ac8742a48812ebdf452c138
                                            • Opcode Fuzzy Hash: 0d55d5aa8d7452f886c91f3ac6dcb1cf1a80eea570fc60f814b615e37661c4ab
                                            • Instruction Fuzzy Hash: 4FE01265718A4691EB10CF10E8745F97378F758B48F940172DA6D43EA8EF3CD64AC740
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D956C0 Relevance: 6.6, APIs: 5, Instructions: 347COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: free$memcpy
                                            • String ID:
                                            • API String ID: 4107583993-0
                                            • Opcode ID: 2fcc2c4a9815474cc1288ae06698a78654ec5c1e1770f20be0a1f1bb5b523614
                                            • Instruction ID: 057205164d72845656eeb95f39b36e9f17b5cff47fb0b95c9e6549cbd8a2f983
                                            • Opcode Fuzzy Hash: 2fcc2c4a9815474cc1288ae06698a78654ec5c1e1770f20be0a1f1bb5b523614
                                            • Instruction Fuzzy Hash: 2902AD62B1AB8982E710CF28D9547AC33A0FB59B8CF049235DF9D5369AEF34E595C300
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D7D650 Relevance: 6.3, APIs: 5, Instructions: 54COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: free$memset
                                            • String ID:
                                            • API String ID: 2717317152-0
                                            • Opcode ID: b631ad133b217f50f1a8edd4504272af646ae85f8ec341c4be10219a48afd1ab
                                            • Instruction ID: 048f9420fbb24031db1e0424e0210abf8619f4549edc7537ae3af35904eb0342
                                            • Opcode Fuzzy Hash: b631ad133b217f50f1a8edd4504272af646ae85f8ec341c4be10219a48afd1ab
                                            • Instruction Fuzzy Hash: 39114F22B1B64A40EF48EB21E920BBD1261EF85F98F445135D96E17ACDCF38D4478354
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D433D0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 249COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: memcpy
                                            • String ID: Could not decode alpha data.
                                            • API String ID: 3510742995-3483007141
                                            • Opcode ID: 2ba7a767d766882508268c17835d19008bff8bef58bd53ff45eb77baaa3e2de5
                                            • Instruction ID: 407ec115d705e14252fc25fa82169bc57fdd100e399f9ffc01be3699e4c04e4f
                                            • Opcode Fuzzy Hash: 2ba7a767d766882508268c17835d19008bff8bef58bd53ff45eb77baaa3e2de5
                                            • Instruction Fuzzy Hash: 3EB1AC72715AC58ADB74CF29D891BAD77A5FB88B88F104025DE4D4BB89DF38D680CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66EF4B0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Mutex@@$?lock@?unlock@$Locker@@Mutex
                                            • String ID:
                                            • API String ID: 3061340097-0
                                            • Opcode ID: a56d5f302760f45f6953604bea418ed017b01396de31368c5c703d9306e617f8
                                            • Instruction ID: 6cad37fd02fa0eeb1305651a49da58eed4fe575fff88edf5c0ce9b92f89ef239
                                            • Opcode Fuzzy Hash: a56d5f302760f45f6953604bea418ed017b01396de31368c5c703d9306e617f8
                                            • Instruction Fuzzy Hash: 37319932B08A4587EF00DB29D4A077977A5EFA4B98F148471DA2E43ED9EF3DD8458B01
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66FB660 Relevance: 6.1, APIs: 4, Instructions: 82timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ?lock@QMutex@@QEAAXXZ.QT5CORE(00000000,?,?,00007FFDF66FBD01), ref: 00007FFDF66FB689
                                              • Part of subcall function 00007FFDF66F9FD0: ??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FFDF66FA01F
                                              • Part of subcall function 00007FFDF66F9FD0: ??0QString@@QEAA@XZ.QT5CORE ref: 00007FFDF66FA034
                                            • ?qHash@@YAIAEBVQString@@I@Z.QT5CORE(00000000,?,?,00007FFDF66FBD01), ref: 00007FFDF66FB6B5
                                            • ?elapsed@QElapsedTimer@@QEBA_JXZ.QT5CORE(00000000,?,?,00007FFDF66FBD01), ref: 00007FFDF66FB73A
                                            • ?unlock@QMutexLocker@@QEAAXXZ.QT5CORE(00000000,?,?,00007FFDF66FBD01), ref: 00007FFDF66FB76F
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: String@@$?elapsed@?lock@?unlock@ElapsedHash@@Latin1Locker@@MutexMutex@@String@@@Timer@@
                                            • String ID:
                                            • API String ID: 155392960-0
                                            • Opcode ID: 8a107e587f5fd681ae9d3184c528ac83be2bfb5e009a7f9314a33009c1378b62
                                            • Instruction ID: e642019651709ec1855f43c52a8ce0e83f32905d9e4da35e3b8afea1b166de51
                                            • Opcode Fuzzy Hash: 8a107e587f5fd681ae9d3184c528ac83be2bfb5e009a7f9314a33009c1378b62
                                            • Instruction Fuzzy Hash: 71317076708B8081EB14DF25E460A2873A8FB59F84F144175DA6C4BB99EF39D892CB80
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66FF6E0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Data@@List$?begin@$?detach@?end@Data@1@
                                            • String ID:
                                            • API String ID: 2291827984-0
                                            • Opcode ID: 873194aa351902bc65598cddfaa6585dd4721c7d9ab2f15747326d197b864ad3
                                            • Instruction ID: a951fbbacbefd3e27e5333a668efb65727a4a7f7b1a4882ee923f02fbe347d1d
                                            • Opcode Fuzzy Hash: 873194aa351902bc65598cddfaa6585dd4721c7d9ab2f15747326d197b864ad3
                                            • Instruction Fuzzy Hash: 0E117536B1864686DB109F25B454569B7A4FB45FD0F584171DA7D03FDCEE3CE8428B00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF6729770 Relevance: 6.0, APIs: 4, Instructions: 46timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ??1QDateTime@@QEAA@XZ.QT5CORE ref: 00007FFDF67297C4
                                            • ??1QDateTime@@QEAA@XZ.QT5CORE ref: 00007FFDF67297CE
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF67297EA
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FFDF67297F4
                                              • Part of subcall function 00007FFDF673D210: ?isWarningEnabled@QLoggingCategory@@QEBA_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF672876D,?,?,?,00007FFDF672A3DC), ref: 00007FFDF673D228
                                              • Part of subcall function 00007FFDF673D210: ??0QMessageLogger@@QEAA@PEBDH00@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF672876D,?,?,?,00007FFDF672A3DC), ref: 00007FFDF673D24D
                                              • Part of subcall function 00007FFDF673D210: ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00007FFDF672876D,?,?,?,00007FFDF672A3DC), ref: 00007FFDF673D264
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteDateLogger@@MessageTime@@$?warning@Category@@Enabled@H00@LoggingWarning
                                            • String ID:
                                            • API String ID: 1974625209-0
                                            • Opcode ID: 79acbd7d06209fd8e8642b3c3a106aca683d16b49e50c636771dee03c54fd5e6
                                            • Instruction ID: 10f21cb19792af161bdf49212f2100cb90b5bebd34e25df84b801f4e9bdcafa1
                                            • Opcode Fuzzy Hash: 79acbd7d06209fd8e8642b3c3a106aca683d16b49e50c636771dee03c54fd5e6
                                            • Instruction Fuzzy Hash: A8116322B1894292EB54DF21DA7497C7365FF50B54B480531DA2E43DD9DF2CE8A6C700
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF672F6A0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00007FFDF6759290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDF668328F), ref: 00007FFDF67592AA
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6747A85,?,?,?,00007FFDF674BE72), ref: 00007FFDF672F6BF
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6747A85,?,?,?,00007FFDF674BE72), ref: 00007FFDF672F6D9
                                            • ??0QString@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6747A85,?,?,?,00007FFDF674BE72), ref: 00007FFDF672F6F0
                                            • ??1QByteArray@@QEAA@XZ.QT5CORE(?,?,?,00007FFDF6747A85,?,?,?,00007FFDF674BE72), ref: 00007FFDF672F723
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Array@@ByteString@@$malloc
                                            • String ID:
                                            • API String ID: 2645771327-0
                                            • Opcode ID: 9b3b0cca0971da09879ea9678a2fbf8f940a53c8daadb6b6dcfbacdf83ab5dbc
                                            • Instruction ID: 3e012bae0e745594b6fdd5dc2a2804aecf1984dc260aff72e507d4adff54215e
                                            • Opcode Fuzzy Hash: 9b3b0cca0971da09879ea9678a2fbf8f940a53c8daadb6b6dcfbacdf83ab5dbc
                                            • Instruction Fuzzy Hash: 00015B36728A4181EB40DF25E0B49AA7324EF88B80F845031EA5E07F9DEF3CC884CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FF60D060E50 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088052427.00007FF60CFC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF60CFC0000, based on PE: true
                                            • Associated: 0000000F.00000002.3088035517.00007FF60CFC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088110305.00007FF60D086000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088157309.00007FF60D101000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088175807.00007FF60D104000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088193777.00007FF60D108000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088211068.00007FF60D10B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ff60cfc0000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
                                            • String ID:
                                            • API String ID: 2582267257-0
                                            • Opcode ID: b1ca0942c2911be35d6154a8b21df9a8af32e51ee33c823be6bd33c98ec84f3c
                                            • Instruction ID: 34d05a56d8d1ccd2ee3ca375c98de87d1f3cb5582b1aa802198cecc6fde11043
                                            • Opcode Fuzzy Hash: b1ca0942c2911be35d6154a8b21df9a8af32e51ee33c823be6bd33c98ec84f3c
                                            • Instruction Fuzzy Hash: D001A470F4AA13A1ED58EB60945937C12E0AF54BA4FA00B34D15F813D4FF6D60DA8219
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF672D6A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                            Download Yara Rule
                                            APIs
                                            • ??0QByteArray@@QEAA@UQByteArrayDataPtr@@@Z.QT5CORE(?,?,000000010000000E,00007FFDF672DBFA), ref: 00007FFDF672D6D6
                                            • _Init_thread_footer.LIBCMT ref: 00007FFDF672D766
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$ArrayArray@@DataInit_thread_footerPtr@@@
                                            • String ID: Y-----
                                            • API String ID: 4174580304-2754263011
                                            • Opcode ID: 68b37fdf30fc36a3f5e155693fcbbd277c96f3f36f1e265bb193d2bd29505ce3
                                            • Instruction ID: fb33328866885547867c7c37e89ecc9832c8ac2231c83b825499c89eb165e43a
                                            • Opcode Fuzzy Hash: 68b37fdf30fc36a3f5e155693fcbbd277c96f3f36f1e265bb193d2bd29505ce3
                                            • Instruction Fuzzy Hash: E911E765F1CA4789F7108F26B870A783368AB58751F485235D97D07EEDDF3CA9858B00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF672D830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$ArrayArray@@DataInit_thread_footerPtr@@@
                                            • String ID: -----
                                            • API String ID: 4174580304-4165711970
                                            • Opcode ID: 1c9ef6911fb7b8959b3349f9b246879a7f4943c098c523a04c8e389f7df192a1
                                            • Instruction ID: 04016792e79ec29d4c634e4b5d460683ae4f7dd71be8800081a4e5da35c5df6e
                                            • Opcode Fuzzy Hash: 1c9ef6911fb7b8959b3349f9b246879a7f4943c098c523a04c8e389f7df192a1
                                            • Instruction Fuzzy Hash: 7611E264F0CA8689FB008B26B874A743368AB58310F496235C93C07EEDDF3C7984CB00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF672D770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Byte$ArrayArray@@DataInit_thread_footerPtr@@@
                                            • String ID: .5.13
                                            • API String ID: 4174580304-880305061
                                            • Opcode ID: 0aa5c8ec51e34536f710a7f19ae0667605e8a5c470747c1de8499884bf89720f
                                            • Instruction ID: 02324c675e7a5670d97d19809a37c0c7f524e2943da6525c0bcb3eb3973b6a1a
                                            • Opcode Fuzzy Hash: 0aa5c8ec51e34536f710a7f19ae0667605e8a5c470747c1de8499884bf89720f
                                            • Instruction Fuzzy Hash: 351106A1F0EA4281FB05DF14E870AB43329AB98750F505236D92D46EEEEF3C78858B00
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66B94A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Latin1String@@String@@@
                                            • String ID: The connection established in response to a CONNECT request was reset or abnormally closed$Z
                                            • API String ID: 2468299162-706977911
                                            • Opcode ID: 90a97ea561bfd6c1275b09807063e89e7fd26526c00763a80d3e2d92f9278f4b
                                            • Instruction ID: 8131f457a1f2a03368683921518a406d39dd296ba6ad89367ee136b6e90c389b
                                            • Opcode Fuzzy Hash: 90a97ea561bfd6c1275b09807063e89e7fd26526c00763a80d3e2d92f9278f4b
                                            • Instruction Fuzzy Hash: 9EE039A2B08B8089E7018F74D8501AC7B74BB49798B084661CEAC12A59DB78D295C750
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF66B9495 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088902604.00007FFDF6681000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDF6680000, based on PE: true
                                            • Associated: 0000000F.00000002.3088882464.00007FFDF6680000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088973478.00007FFDF675C000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089015329.00007FFDF67AA000.00000004.00000001.01000000.00000017.sdmpDownload File
                                            • Associated: 0000000F.00000002.3089035220.00007FFDF67B7000.00000002.00000001.01000000.00000017.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf6680000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: Latin1String@@String@@@
                                            • String ID: N$Server is unable to maintain the header compression context for the connection
                                            • API String ID: 2468299162-1635745983
                                            • Opcode ID: f97e7ba58474f6741d747e1873e5601515e5e3be74bea702dbea34bf90a69c98
                                            • Instruction ID: 52434210571641618aecb973e5678c7063630d1bafa59da0f7631de98a0ff331
                                            • Opcode Fuzzy Hash: f97e7ba58474f6741d747e1873e5601515e5e3be74bea702dbea34bf90a69c98
                                            • Instruction Fuzzy Hash: 94E0E5B2F04B81C9E7018F65D8505BC7774BB48798F545925CE6C22A98DFB89294C790
                                            Uniqueness

                                            Uniqueness Score: -1.00%

                                            Function 00007FFDF5D936C0 Relevance: 5.2, APIs: 4, Instructions: 156COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.3088255443.00007FFDF5D41000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFDF5D40000, based on PE: true
                                            • Associated: 0000000F.00000002.3088239650.00007FFDF5D40000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088295831.00007FFDF5D9D000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088318141.00007FFDF5DB5000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DB8000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            • Associated: 0000000F.00000002.3088336034.00007FFDF5DBF000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_7ffdf5d40000_SRTMiniServer.jbxd
                                            Similarity
                                            • API ID: free$memset
                                            • String ID:
                                            • API String ID: 2717317152-0
                                            • Opcode ID: 1452f9abff354da8d645d3d8651b663263d6f5ecbd0c9ccec8b2074ffc631d5b
                                            • Instruction ID: ae8217d5d63b5d56f220e350791dc71d1b4f2a4b1cc73af5055e8e9dcf3b5e0a
                                            • Opcode Fuzzy Hash: 1452f9abff354da8d645d3d8651b663263d6f5ecbd0c9ccec8b2074ffc631d5b
                                            • Instruction Fuzzy Hash: 58519732B0978586D724DB15B860BAAB7D4FB89B88F444134EE9D43B99DF3CE445CB40
                                            Uniqueness

                                            Uniqueness Score: -1.00%