Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll

Overview

General Information

Sample name:492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
Analysis ID:1579708
MD5:fad86474cd9720226aa41f9117fa1c32
SHA1:89c995faef96b2eec50bbfff2d1749379de829d4
SHA256:492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69a0f7b0e6cfa8e6aced1
Tags:dllValleyRATuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query network adapater information
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

  • System is w10x64
  • loaddll32.exe (PID: 4732 cmdline: loaddll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)
    • conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6780 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • rundll32.exe (PID: 6688 cmdline: rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7092 cmdline: rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@H@@YAHABVValue@Json@@AAH@Z MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 1452 cmdline: rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@YAHABVValue@Json@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 2924 cmdline: rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@Vjsonb_LPVOID@@@@YAHABVValue@Json@@AAVjsonb_LPVOID@@@Z MD5: 889B99C52A60DD49227C5E485A016679)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Submited SampleIntegrated Neural Analysis Model: Matched 93.4% probability
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D016642 CryptReleaseContext,2_2_6D016642
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D016688 CryptReleaseContext,2_2_6D016688
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0160AA __EH_prolog3_GS,CryptAcquireContextW,GetLastError,2_2_6D0160AA
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A7C31 ?VerifyCertInfo@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z,__EH_prolog3_GS,memset,memset,lstrcpyW,CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringA,LocalAlloc,CertGetNameStringW,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,CertFreeCertificateContext,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CertCloseStore,CryptMsgClose,2_2_6D0A7C31
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D01381C ?SymEnCrypt@CSymmetryString@ieg_common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z,?qq_symmetry_encrypt3_len@@YAHH@Z,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,2_2_6D01381C
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D04F4BF __EH_prolog3,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,2_2_6D04F4BF
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0137A4 ?GetEnCryptLength@CSymmetryString@ieg_common@@SAHH@Z,2_2_6D0137A4
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0137AD ?SymDeCrypt@CSymmetryString@ieg_common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,2_2_6D0137AD
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D04F184 __EH_prolog3_GS,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,2_2_6D04F184
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0173AA __EH_prolog3_GS,CryptGenRandom,GetLastError,?get_ret@Application@common@ierd_tgp@@QBEHXZ,2_2_6D0173AA
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D04F3CA __EH_prolog3_GS,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,2_2_6D04F3CA
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D04F2B2 __EH_prolog3,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,2_2_6D04F2B2
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0C8BEE __EH_prolog3,strlen,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,2_2_6D0C8BEE
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A8183 ?VerifyCertInfoByName@Sys_wrapper@common@ierd_tgp@@SA_NPB_W0PAV?$vector@U_FILETIME@@V?$allocator@U_FILETIME@@@std@@@std@@@Z,__EH_prolog3_GS,memset,memset,lstrcpyW,CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringA,LocalAlloc,CertGetNameStringW,?get_log_instance@base@@YAPAVILogger@1@XZ,StrCmpW,?GetTimeStampSignerInfo@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAPAU4@PAU_FILETIME@@@Z,FileTimeToLocalFileTime,FileTimeToSystemTime,?get_log_instance@base@@YAPAVILogger@1@XZ,LocalFree,lstrcmpA,CryptMsgOpenToDecode,CryptMsgUpdate,CryptMsgGetParam,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalAlloc,CryptMsgClose,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptMsgGetParam,CryptMsgClose,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CertOpenStore,?GetTimeStampSignerInfo@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAPAU4@PAU_FILETIME@@@Z,FileTimeToLocalFileTime,FileTimeToSystemTime,?get_log_instance@base@@YAPAVILogger@1@XZ,LocalFree,LocalFree,CertCloseStore,CryptMsgClose,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,CertFreeCertificateContext,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CertCloseStore,CryptMsgClose,2_2_6D0A8183
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0C8366 __EH_prolog3_GS,CreateFileW,GetFileSize,CloseHandle,memset,memset,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,2_2_6D0C8366
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D04C38C ?DESEncrypt@@YA_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4EPadType@@W4EDESMode@@@Z,2_2_6D04C38C
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D04C20A ?DESDecrypt@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV12@PBDW4EPadType@@W4EDESMode@@@Z,2_2_6D04C20A
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07DD03 ?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,rand,rand,rand,rand,2_2_6D07DD03
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07DF3F ?qq_symmetry_encrypt3_len@@YAHH@Z,2_2_6D07DF3F
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A1E45 ?GetTimeStampSignerInfo@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAPAU4@PAU_FILETIME@@@Z,__EH_prolog3_GS,lstrcmpA,lstrcmpA,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,LocalAlloc,LocalAlloc,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,lstrcmpA,CryptQueryObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CryptMsgGetParam,CryptMsgGetParam,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalAlloc,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptMsgGetParam,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?GetDateOfTimeStamp@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAU_FILETIME@@@Z,LocalFree,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalAlloc,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?GetDateOfTimeStamp@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAU_FILETIME@@@Z,CertCloseStore,CryptMsgClose,2_2_6D0A1E45
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D031AB4 ?GetCertificateSubjectName@common@ierd_tgp@@YAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAK1@Z,__EH_prolog3_GS,memset,memset,lstrcpyW,CryptQueryObject,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,LocalAlloc,CertGetNameStringW,LocalFree,GetLastError,GetLastError,GetLastError,LocalFree,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CertCloseStore,CryptMsgClose,2_2_6D031AB4
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07DAC4 ?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,2_2_6D07DAC4
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A10F9 ?GetDateOfTimeStamp@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAU_FILETIME@@@Z,__EH_prolog3_GS,lstrcmpA,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,FileTimeToLocalFileTime,FileTimeToSystemTime,2_2_6D0A10F9
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D265260 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,2_2_6D265260
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D016642 CryptReleaseContext,5_2_6D016642
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D016688 CryptReleaseContext,5_2_6D016688
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0160AA __EH_prolog3_GS,CryptAcquireContextW,GetLastError,5_2_6D0160AA
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A7C31 ?VerifyCertInfo@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z,__EH_prolog3_GS,memset,memset,lstrcpyW,CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringA,LocalAlloc,CertGetNameStringW,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,CertFreeCertificateContext,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CertCloseStore,CryptMsgClose,5_2_6D0A7C31
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D01381C ?SymEnCrypt@CSymmetryString@ieg_common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z,?qq_symmetry_encrypt3_len@@YAHH@Z,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,5_2_6D01381C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D04F4BF __EH_prolog3,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,5_2_6D04F4BF
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0137A4 ?GetEnCryptLength@CSymmetryString@ieg_common@@SAHH@Z,5_2_6D0137A4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0137AD ?SymDeCrypt@CSymmetryString@ieg_common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,5_2_6D0137AD
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D04F184 __EH_prolog3_GS,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,5_2_6D04F184
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0173AA __EH_prolog3_GS,CryptGenRandom,GetLastError,?get_ret@Application@common@ierd_tgp@@QBEHXZ,5_2_6D0173AA
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D04F3CA __EH_prolog3_GS,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,5_2_6D04F3CA
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D04F2B2 __EH_prolog3,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,5_2_6D04F2B2
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0C8BEE __EH_prolog3,strlen,?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,5_2_6D0C8BEE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A8183 ?VerifyCertInfoByName@Sys_wrapper@common@ierd_tgp@@SA_NPB_W0PAV?$vector@U_FILETIME@@V?$allocator@U_FILETIME@@@std@@@std@@@Z,__EH_prolog3_GS,memset,memset,lstrcpyW,CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringA,LocalAlloc,CertGetNameStringW,?get_log_instance@base@@YAPAVILogger@1@XZ,StrCmpW,?GetTimeStampSignerInfo@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAPAU4@PAU_FILETIME@@@Z,FileTimeToLocalFileTime,FileTimeToSystemTime,?get_log_instance@base@@YAPAVILogger@1@XZ,LocalFree,lstrcmpA,CryptMsgOpenToDecode,CryptMsgUpdate,CryptMsgGetParam,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalAlloc,CryptMsgClose,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptMsgGetParam,CryptMsgClose,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CertOpenStore,?GetTimeStampSignerInfo@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAPAU4@PAU_FILETIME@@@Z,FileTimeToLocalFileTime,FileTimeToSystemTime,?get_log_instance@base@@YAPAVILogger@1@XZ,LocalFree,LocalFree,CertCloseStore,CryptMsgClose,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,CertFreeCertificateContext,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CertCloseStore,CryptMsgClose,5_2_6D0A8183
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0C8366 __EH_prolog3_GS,CreateFileW,GetFileSize,CloseHandle,memset,memset,?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,5_2_6D0C8366
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D04C38C ?DESEncrypt@@YA_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4EPadType@@W4EDESMode@@@Z,5_2_6D04C38C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D04C20A ?DESDecrypt@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV12@PBDW4EPadType@@W4EDESMode@@@Z,5_2_6D04C20A
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07DD03 ?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z,rand,rand,rand,rand,5_2_6D07DD03
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07DF3F ?qq_symmetry_encrypt3_len@@YAHH@Z,5_2_6D07DF3F
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A1E45 ?GetTimeStampSignerInfo@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAPAU4@PAU_FILETIME@@@Z,__EH_prolog3_GS,lstrcmpA,lstrcmpA,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,LocalAlloc,LocalAlloc,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalFree,lstrcmpA,CryptQueryObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CryptMsgGetParam,CryptMsgGetParam,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalAlloc,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptMsgGetParam,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?GetDateOfTimeStamp@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAU_FILETIME@@@Z,LocalFree,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,LocalAlloc,?get_log_instance@base@@YAPAVILogger@1@XZ,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?GetDateOfTimeStamp@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAU_FILETIME@@@Z,CertCloseStore,CryptMsgClose,5_2_6D0A1E45
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D031AB4 ?GetCertificateSubjectName@common@ierd_tgp@@YAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAK1@Z,__EH_prolog3_GS,memset,memset,lstrcpyW,CryptQueryObject,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,LocalAlloc,CertGetNameStringW,LocalFree,GetLastError,GetLastError,GetLastError,LocalFree,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CertCloseStore,CryptMsgClose,5_2_6D031AB4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07DAC4 ?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z,5_2_6D07DAC4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A10F9 ?GetDateOfTimeStamp@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAU_FILETIME@@@Z,__EH_prolog3_GS,lstrcmpA,CryptDecodeObject,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,FileTimeToLocalFileTime,FileTimeToSystemTime,5_2_6D0A10F9
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D265260 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,5_2_6D265260
Source: loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_f8928c2e-f
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
Source: Binary string: keyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
Source: Binary string: D:\ci_dev\wegame_client\build\lib\Release\common.pdb source: loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
Source: Binary string: mkeyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07F642 ?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindClose,2_2_6D07F642
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07F273 ?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,FindClose,2_2_6D07F273
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A4CF6 ?ReSetIconForShortcutLnk@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00@Z,__EH_prolog3_GS,FindFirstFileW,_wcsicmp,_wcsicmp,CoInitializeEx,CoCreateInstance,_wcsicmp,_wcsicmp,FindNextFileW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CoUninitialize,FindClose,2_2_6D0A4CF6
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A0730 ?FindFirstFileW_fixed_remote@Sys_wrapper@common@ierd_tgp@@SAPAXPB_WPAU_WIN32_FIND_DATAW@@@Z,__EH_prolog3_GS,?disk_is_fixed_remote@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,FindFirstFileW,2_2_6D0A0730
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A07B4 ?FindLatestFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@HK@Z,?GetSecFromFileTime@Sys_wrapper@common@ierd_tgp@@SA_KKK@Z,FindFirstFileW,FindClose,FindNextFileW,FindClose,2_2_6D0A07B4
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A06D9 ?FindFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,FindFirstFileW,FindClose,FindClose,2_2_6D0A06D9
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0C4265 ?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindNextFileW,FindClose,2_2_6D0C4265
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D051C49 __EH_prolog3_GS,?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ,FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,2_2_6D051C49
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0C1172 ?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,?AddPathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,memset,FindFirstFileW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6D0C1172
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07F642 ?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindClose,5_2_6D07F642
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07F273 ?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,FindClose,5_2_6D07F273
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A4CF6 ?ReSetIconForShortcutLnk@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00@Z,__EH_prolog3_GS,FindFirstFileW,_wcsicmp,_wcsicmp,CoInitializeEx,CoCreateInstance,_wcsicmp,_wcsicmp,FindNextFileW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CoUninitialize,FindClose,5_2_6D0A4CF6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A0730 ?FindFirstFileW_fixed_remote@Sys_wrapper@common@ierd_tgp@@SAPAXPB_WPAU_WIN32_FIND_DATAW@@@Z,__EH_prolog3_GS,?disk_is_fixed_remote@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,FindFirstFileW,5_2_6D0A0730
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A07B4 ?FindLatestFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@HK@Z,?GetSecFromFileTime@Sys_wrapper@common@ierd_tgp@@SA_KKK@Z,FindFirstFileW,FindClose,FindNextFileW,FindClose,5_2_6D0A07B4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A06D9 ?FindFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,FindFirstFileW,FindClose,FindClose,5_2_6D0A06D9
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0C4265 ?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindNextFileW,FindClose,5_2_6D0C4265
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D051C49 __EH_prolog3_GS,?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ,FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,5_2_6D051C49
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0C1172 ?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,?AddPathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,memset,FindFirstFileW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,5_2_6D0C1172
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D09FF29 memset,GetLogicalDriveStringsW,QueryDosDeviceW,wcslen,_wcsnicmp,swprintf,2_2_6D09FF29
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4x nop then lea eax, dword ptr [ebp-18h]5_2_1000CC10

Networking

barindex
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 134.122.134.93 18852Jump to behavior
Source: global trafficTCP traffic: 192.168.2.7:49702 -> 134.122.134.93:8852
Source: Joe Sandbox ViewASN Name: BCPL-SGBGPNETGlobalASNSG BCPL-SGBGPNETGlobalASNSG
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: unknownTCP traffic detected without corresponding DNS query: 134.122.134.93
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D083F3F VirtualAlloc,WSAStartup,socket,connect,recv,2_2_6D083F3F
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://ocsp.digicert.com0
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://ocsp.digicert.com0A
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://ocsp.digicert.com0C
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://ocsp.digicert.com0X
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: http://www.digicert.com/CPS0
Source: loaddll32.exe, loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: loaddll32.exe, rundll32.exeString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D053E77: CreateFileW,GetLastError,??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z,CloseHandle,DeviceIoControl,GetLastError,??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z,CloseHandle,2_2_6D053E77
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6CFF6D102_2_6CFF6D10
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0B677A2_2_6D0B677A
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D017E9A2_2_6D017E9A
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D10BB502_2_6D10BB50
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D153B502_2_6D153B50
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D097B872_2_6D097B87
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0975342_2_6D097534
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6CFFB5B02_2_6CFFB5B0
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6CFF76B02_2_6CFF76B0
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D12CC102_2_6D12CC10
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D008CA82_2_6D008CA8
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D078F672_2_6D078F67
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0985DC2_2_6D0985DC
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D09841F2_2_6D09841F
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D04C7882_2_6D04C788
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D2606F02_2_6D2606F0
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A81832_2_6D0A8183
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0103332_2_6D010333
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0AC3752_2_6D0AC375
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07DD032_2_6D07DD03
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D025DC72_2_6D025DC7
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D091B432_2_6D091B43
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6CFFDA202_2_6CFFDA20
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D261A002_2_6D261A00
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07DAC42_2_6D07DAC4
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D025AFB2_2_6D025AFB
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0255F92_2_6D0255F9
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D00941F2_2_6D00941F
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0B977D2_2_6D0B977D
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0091622_2_6D009162
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0253BE2_2_6D0253BE
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_028324B02_2_028324B0
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_02840CDE2_2_02840CDE
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_02842D912_2_02842D91
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_0284122F2_2_0284122F
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_0283B66A2_2_0283B66A
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_028417802_2_02841780
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6CFF6D105_2_6CFF6D10
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0B677A5_2_6D0B677A
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D017E9A5_2_6D017E9A
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D10BB505_2_6D10BB50
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D153B505_2_6D153B50
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D097B875_2_6D097B87
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0975345_2_6D097534
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6CFFB5B05_2_6CFFB5B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6CFF76B05_2_6CFF76B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D12CC105_2_6D12CC10
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D008CA85_2_6D008CA8
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D078F675_2_6D078F67
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0985DC5_2_6D0985DC
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D09841F5_2_6D09841F
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D04C7885_2_6D04C788
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D2606F05_2_6D2606F0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A81835_2_6D0A8183
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0103335_2_6D010333
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0AC3755_2_6D0AC375
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07DD035_2_6D07DD03
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D025DC75_2_6D025DC7
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D091B435_2_6D091B43
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6CFFDA205_2_6CFFDA20
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D261A005_2_6D261A00
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07DAC45_2_6D07DAC4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D025AFB5_2_6D025AFB
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0255F95_2_6D0255F9
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D00941F5_2_6D00941F
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0B977D5_2_6D0B977D
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0091625_2_6D009162
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0253BE5_2_6D0253BE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DB24B05_2_04DB24B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DC0CDE5_2_04DC0CDE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DC2D915_2_04DC2D91
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DBB66A5_2_04DBB66A
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DC17805_2_04DC1780
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DC122F5_2_04DC122F
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DC1E5C5_2_04DC1E5C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000D9E45_2_1000D9E4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CD00325_2_04CD0032
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6CFF9B40 appears 50 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D112BF0 appears 31 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D112F1B appears 913 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D112FBD appears 56 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D262FE0 appears 34 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6CFFA8F0 appears 51 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D029AA6 appears 33 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6CFFA430 appears 32 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D00E945 appears 356 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D112F4F appears 606 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D13C3E0 appears 44 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D01A6AA appears 50 times
Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6D112F86 appears 207 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6CFF9B40 appears 50 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D112BF0 appears 31 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D112F1B appears 913 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D112FBD appears 56 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D262FE0 appears 34 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6CFFA8F0 appears 51 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D029AA6 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6CFFA430 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D00E945 appears 356 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D112F4F appears 606 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D13C3E0 appears 44 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D01A6AA appears 50 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6D112F86 appears 207 times
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: invalid certificate
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllBinary string: [Sys_wrapper]WritePrivateProfile fail, session:{}, key:{}, file:{}NtSuspendProcessntdllNtResumeProcess[Sys_wrapper]GetStrValueFromReg, open reg key failed, key:{}, error:{}[Sys_wrapper]GetStrValueFromReg, get reg value failed, key:{}, value_name:{}, error:{}[Sys_wrapper]GetStrValueFromReg, invalid size[Sys_wrapper]SetRegValue, open reg path failed, path:{}, error:{}[Sys_wrapper]SetRegValue, set reg value failed, path:{}, value_name:{}, value:{}, error:{}[Sys_wrapper]ACLineStatus:{},BatteryFlag:{}kernel32\Device\HarddiskVolume\\.\PhysicalDrive%dA:\%SystemDrive%\ :TENINSTIPGlobal\%s_%X_%dd:\ci_dev\wegame_client\dependences\tpf_for_tgp_sdk\include\teniobase\template\processhelp_t.h[ProcessHelp][RetrieveGameImagePathByProcessId]MapViewOfFile fail, hListMap:%p, err:%d[ProcessHelp][RetrieveGameImagePathByProcessId]OpenFileMappingA fail, iamge path:%s, err:%dH:3
Source: classification engineClassification label: mal60.evad.winDLL@12/0@0/1
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A0068 ?EnableDebugPriv@Sys_wrapper@common@ierd_tgp@@SAHXZ,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,CloseHandle,2_2_6D0A0068
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A0068 ?EnableDebugPriv@Sys_wrapper@common@ierd_tgp@@SAHXZ,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,CloseHandle,5_2_6D0A0068
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0AB6D3 ?get_free_space@Sys_wrapper@common@ierd_tgp@@SA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_N@Z,__EH_prolog3_GS,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?_Init@locale@std@@CAPAV_Locimp@12@_N@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,memset,wcsncpy,GetDiskFreeSpaceExW,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,2_2_6D0AB6D3
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A2CBF ?IsProcessRunning@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@5@@Z,__EH_prolog3_GS,?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,CreateToolhelp32Snapshot,memset,Process32FirstW,?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z,_wcsicmp,?get_log_instance@base@@YAPAVILogger@1@XZ,memset,OpenProcess,GetModuleFileNameExW,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,CloseHandle,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CreateToolhelp32Snapshot,memset,Module32FirstW,CloseHandle,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,Process32NextW,CloseHandle,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,2_2_6D0A2CBF
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A6FE1 ?TaskBarPin@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z,__EH_prolog3_GS,?IsWin10_OS@Sys_wrapper@common@ierd_tgp@@SA_NXZ,ShellExecuteW,GetCurrentProcess,?ChangeProcessImageName@Sys_wrapper@common@ierd_tgp@@SA_NPAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,CoInitialize,memset,LoadLibraryW,LoadStringW,CoCreateInstance,memset,wcscpy_s,PathRemoveFileSpecW,wcscpy_s,PathStripPathW,SysFreeString,VariantClear,VarBstrCmp,SysFreeString,SysFreeString,SysFreeString,VariantClear,CoUninitialize,FreeLibrary,2_2_6D0A6FE1
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_03
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@H@@YAHABVValue@Json@@AAH@Z
Source: loaddll32.exeString found in binary or memory: -launcher
Source: rundll32.exeString found in binary or memory: -launcher
Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll"
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@H@@YAHABVValue@Json@@AAH@Z
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@YAHABVValue@Json@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@Vjsonb_LPVOID@@@@YAHABVValue@Json@@AAVjsonb_LPVOID@@@Z
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@H@@YAHABVValue@Json@@AAH@ZJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@YAHABVValue@Json@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@ZJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@Vjsonb_LPVOID@@@@YAHABVValue@Json@@AAVjsonb_LPVOID@@@ZJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: winmm.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: More than 1064 > 100 exports found
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic file information: File size 3925088 > 1048576
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x29be00
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
Source: Binary string: keyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
Source: Binary string: D:\ci_dev\wegame_client\build\lib\Release\common.pdb source: loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
Source: Binary string: mkeyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D012D24 ?Create@CSimpleIPC@@QAEHHPBD@Z,__EH_prolog3_GS,?Create@CShareMem@@QAEHPBDH@Z,IsWindow,LoadLibraryA,GetProcAddress,FreeLibrary,?shutdown@Application@common@ierd_tgp@@EAEXXZ,?WriteIPCInfo@CSimpleIPC@@AAEXXZ,?Notify@CSimpleIPC@@QAEHKPAXH@Z,?Destroy@CShareMem@@QAEXXZ,2_2_6D012D24
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: real checksum: 0x3bfec6 should be: 0x3c4694
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllStatic PE information: section name: .QMGuid
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D112EE4 push ecx; ret 2_2_6D112EF7
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D1141CA push ecx; ret 2_2_6D1141ED
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_0284FE9A push ecx; ret 2_2_0284FEBF
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D112EE4 push ecx; ret 5_2_6D112EF7
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D1141CA push ecx; ret 5_2_6D1141ED
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DB9DF5 push ecx; ret 5_2_04DB9E08
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DCFE9A push ecx; ret 5_2_04DCFEBF

Persistence and Installation Behavior

barindex
Source: C:\Windows\System32\loaddll32.exeCode function: ?IsSSDDrive@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,memset,GetVolumePathNameW,memset,GetVolumeNameForVolumeMountPointW,wcslen,CreateFileW,DeviceIoControl,CreateFileW,DeviceIoControl,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, \\.\PhysicalDrive%d2_2_6D0A3325
Source: C:\Windows\System32\loaddll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,malloc,DeviceIoControl,free,CloseHandle, \\.\PhysicalDrive%d2_2_6D074EF6
Source: C:\Windows\System32\loaddll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,memset,memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d2_2_6D0750F5
Source: C:\Windows\System32\loaddll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,memset,DeviceIoControl,memset,memset,memset,isalnum,isalnum,GetLastError,CloseHandle, \\.\PhysicalDrive%d2_2_6D075371
Source: C:\Windows\SysWOW64\rundll32.exeCode function: ?IsSSDDrive@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,memset,GetVolumePathNameW,memset,GetVolumeNameForVolumeMountPointW,wcslen,CreateFileW,DeviceIoControl,CreateFileW,DeviceIoControl,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, \\.\PhysicalDrive%d5_2_6D0A3325
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,malloc,DeviceIoControl,free,CloseHandle, \\.\PhysicalDrive%d5_2_6D074EF6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,memset,memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d5_2_6D0750F5
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,memset,DeviceIoControl,memset,memset,memset,isalnum,isalnum,GetLastError,CloseHandle, \\.\PhysicalDrive%d5_2_6D075371
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0C0AE3 ?GetUpdatedFilePathv2@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W00AAK@Z,__EH_prolog3_GS,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?get_version@silence_update@common@ierd_tgp@@KA?AUversion_t@@PB_W@Z,memset,memset,GetLongPathNameW,memset,wcscpy,wcscpy,PathAppendW,PathAppendW,PathAppendW,wcscpy,PathRemoveFileSpecW,memset,GetPrivateProfileStringW,PathAppendW,_wtoi,PathAppendW,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,__Init_thread_footer,2_2_6D0C0AE3
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0C0AE3 ?GetUpdatedFilePathv2@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W00AAK@Z,__EH_prolog3_GS,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?get_version@silence_update@common@ierd_tgp@@KA?AUversion_t@@PB_W@Z,memset,memset,GetLongPathNameW,memset,wcscpy,wcscpy,PathAppendW,PathAppendW,PathAppendW,wcscpy,PathRemoveFileSpecW,memset,GetPrivateProfileStringW,PathAppendW,_wtoi,PathAppendW,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,__Init_thread_footer,5_2_6D0C0AE3

Boot Survival

barindex
Source: C:\Windows\System32\loaddll32.exeCode function: ?IsSSDDrive@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,memset,GetVolumePathNameW,memset,GetVolumeNameForVolumeMountPointW,wcslen,CreateFileW,DeviceIoControl,CreateFileW,DeviceIoControl,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, \\.\PhysicalDrive%d2_2_6D0A3325
Source: C:\Windows\System32\loaddll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,malloc,DeviceIoControl,free,CloseHandle, \\.\PhysicalDrive%d2_2_6D074EF6
Source: C:\Windows\System32\loaddll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,memset,memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d2_2_6D0750F5
Source: C:\Windows\System32\loaddll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,memset,DeviceIoControl,memset,memset,memset,isalnum,isalnum,GetLastError,CloseHandle, \\.\PhysicalDrive%d2_2_6D075371
Source: C:\Windows\SysWOW64\rundll32.exeCode function: ?IsSSDDrive@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,memset,GetVolumePathNameW,memset,GetVolumeNameForVolumeMountPointW,wcslen,CreateFileW,DeviceIoControl,CreateFileW,DeviceIoControl,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, \\.\PhysicalDrive%d5_2_6D0A3325
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,malloc,DeviceIoControl,free,CloseHandle, \\.\PhysicalDrive%d5_2_6D074EF6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,memset,memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d5_2_6D0750F5
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,memset,DeviceIoControl,memset,memset,memset,isalnum,isalnum,GetLastError,CloseHandle, \\.\PhysicalDrive%d5_2_6D075371
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D08043A rdtsc 2_2_6D08043A
Source: C:\Windows\System32\loaddll32.exeCode function: ?get_first_mac2@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,__EH_prolog3_catch_GS,GetAdaptersInfo,GetAdaptersInfo,?get_log_instance@base@@YAPAVILogger@1@XZ,__Init_thread_footer,2_2_6D077C98
Source: C:\Windows\System32\loaddll32.exeCode function: ?get_first_mac@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,__EH_prolog3_catch_GS,GetAdaptersInfo,GetAdaptersInfo,2_2_6D078095
Source: C:\Windows\SysWOW64\rundll32.exeCode function: ?get_first_mac2@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,__EH_prolog3_catch_GS,GetAdaptersInfo,GetAdaptersInfo,?get_log_instance@base@@YAPAVILogger@1@XZ,__Init_thread_footer,5_2_6D077C98
Source: C:\Windows\SysWOW64\rundll32.exeCode function: ?get_first_mac@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,__EH_prolog3_catch_GS,GetAdaptersInfo,GetAdaptersInfo,5_2_6D078095
Source: C:\Windows\System32\loaddll32.exeAPI coverage: 0.7 %
Source: C:\Windows\SysWOW64\rundll32.exeAPI coverage: 0.9 %
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07F642 ?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindClose,2_2_6D07F642
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D07F273 ?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,FindClose,2_2_6D07F273
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A4CF6 ?ReSetIconForShortcutLnk@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00@Z,__EH_prolog3_GS,FindFirstFileW,_wcsicmp,_wcsicmp,CoInitializeEx,CoCreateInstance,_wcsicmp,_wcsicmp,FindNextFileW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CoUninitialize,FindClose,2_2_6D0A4CF6
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A0730 ?FindFirstFileW_fixed_remote@Sys_wrapper@common@ierd_tgp@@SAPAXPB_WPAU_WIN32_FIND_DATAW@@@Z,__EH_prolog3_GS,?disk_is_fixed_remote@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,FindFirstFileW,2_2_6D0A0730
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A07B4 ?FindLatestFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@HK@Z,?GetSecFromFileTime@Sys_wrapper@common@ierd_tgp@@SA_KKK@Z,FindFirstFileW,FindClose,FindNextFileW,FindClose,2_2_6D0A07B4
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A06D9 ?FindFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,FindFirstFileW,FindClose,FindClose,2_2_6D0A06D9
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0C4265 ?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindNextFileW,FindClose,2_2_6D0C4265
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D051C49 __EH_prolog3_GS,?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ,FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,2_2_6D051C49
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0C1172 ?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,?AddPathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,memset,FindFirstFileW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6D0C1172
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07F642 ?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindClose,5_2_6D07F642
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D07F273 ?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,__EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z,FindClose,5_2_6D07F273
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A4CF6 ?ReSetIconForShortcutLnk@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00@Z,__EH_prolog3_GS,FindFirstFileW,_wcsicmp,_wcsicmp,CoInitializeEx,CoCreateInstance,_wcsicmp,_wcsicmp,FindNextFileW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,CoUninitialize,FindClose,5_2_6D0A4CF6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A0730 ?FindFirstFileW_fixed_remote@Sys_wrapper@common@ierd_tgp@@SAPAXPB_WPAU_WIN32_FIND_DATAW@@@Z,__EH_prolog3_GS,?disk_is_fixed_remote@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,FindFirstFileW,5_2_6D0A0730
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A07B4 ?FindLatestFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@HK@Z,?GetSecFromFileTime@Sys_wrapper@common@ierd_tgp@@SA_KKK@Z,FindFirstFileW,FindClose,FindNextFileW,FindClose,5_2_6D0A07B4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0A06D9 ?FindFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,FindFirstFileW,FindClose,FindClose,5_2_6D0A06D9
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0C4265 ?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,FindFirstFileW,FindNextFileW,wcscmp,wcscmp,?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,CreateFileW,GetFileSizeEx,CloseHandle,FindNextFileW,FindClose,5_2_6D0C4265
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D051C49 __EH_prolog3_GS,?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ,FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,5_2_6D051C49
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0C1172 ?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,?AddPathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,memset,FindFirstFileW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,5_2_6D0C1172
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D09FF29 memset,GetLogicalDriveStringsW,QueryDosDeviceW,wcslen,_wcsnicmp,swprintf,2_2_6D09FF29
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6CFF2DCB GetSystemInfo,2_2_6CFF2DCB
Source: 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllBinary or memory string: WQLSELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=TRUEroot\cimv2Win32_NetworkAdapterConfigurationSetDNSServerSearchOrderDNSServerSearchOrderIndexCaptionvmwarevirtualWin32_NetworkAdapterConfiguration.Index=%d[repair_dns] success.
Source: rundll32.exeBinary or memory string: vmware
Source: rundll32.exe, 00000009.00000002.3769590361.0000000002F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: loaddll32.exe, 00000002.00000002.3769711323.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3769504019.0000000003338000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3770340764.00000000028E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3769834987.0000000002965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D08043A rdtsc 2_2_6D08043A
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D112DEC IsDebuggerPresent,OutputDebugStringW,2_2_6D112DEC
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D027FCA __EH_prolog3_GS,GetLastError,OutputDebugStringA,FlushFileBuffers,GetSystemTime,SystemTimeToFileTime,SetFileTime,2_2_6D027FCA
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D012D24 ?Create@CSimpleIPC@@QAEHHPBD@Z,__EH_prolog3_GS,?Create@CShareMem@@QAEHPBDH@Z,IsWindow,LoadLibraryA,GetProcAddress,FreeLibrary,?shutdown@Application@common@ierd_tgp@@EAEXXZ,?WriteIPCInfo@CSimpleIPC@@AAEXXZ,?Notify@CSimpleIPC@@QAEHKPAXH@Z,?Destroy@CShareMem@@QAEXXZ,2_2_6D012D24
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D01E3D3 GetProcessHeap,HeapFree,2_2_6D01E3D3
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D11302D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_6D11302D
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D114920 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6D114920
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_02838587 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_02838587
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_02836815 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_02836815
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D11302D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_6D11302D
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D114920 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_6D114920
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DB8587 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_04DB8587
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04DB6815 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_04DB6815
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000D7F5 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_1000D7F5
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000DD2F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_1000DD2F

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 134.122.134.93 18852Jump to behavior
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_02835820 _memset,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,2_2_02835820
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe c:\users\user\desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@v?$basic_string@du?$char_traits@d@std@@v?$allocator@d@2@@std@@@@yahabvvalue@json@@aav?$basic_string@du?$char_traits@d@std@@v?$allocator@d@2@@std@@@z
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe c:\users\user\desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@v?$basic_string@du?$char_traits@d@std@@v?$allocator@d@2@@std@@@@yahabvvalue@json@@aav?$basic_string@du?$char_traits@d@std@@v?$allocator@d@2@@std@@@zJump to behavior
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6CFF2DEA InitializeSecurityDescriptor,SetSecurityDescriptorDacl,2_2_6CFF2DEA
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0764F6 cpuid 2_2_6D0764F6
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D03AA53 __EH_prolog3,InitializeCriticalSection,GetCurrentProcessId,GetCurrentThreadId,CreateNamedPipeA,CreateThread,CreateEventA,2_2_6D03AA53
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D09EF5F ??0Sys_wrapper@common@ierd_tgp@@QAE@XZ,__EH_prolog3_GS,GetSystemTimes,?get_log_instance@base@@YAPAVILogger@1@XZ,2_2_6D09EF5F
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A687C ?SetFileAuthority@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,__EH_prolog3_GS,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?EnableFileAccountPrivilege@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?EnableFileAccountPrivilege@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,GetUserNameW,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?EnableFileAccountPrivilege@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,2_2_6D0A687C
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0A2BD5 ?IsHighThanWin7@Sys_wrapper@common@ierd_tgp@@SA_NXZ,memset,GetVersionExW,2_2_6D0A2BD5
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D016D1E ?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z,2_2_6D016D1E
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D05AC3B __EH_prolog3_GS,_time32,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBEHXZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBE_KXZ,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,_wfopen,fwrite,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,_errno,fclose,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,_errno,2_2_6D05AC3B
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D016C9C ?from_json@jsonbind@@YAHPAXABVValue@Json@@@Z,2_2_6D016C9C
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D0865DE ?set_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAB_K@Z,2_2_6D0865DE
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D068C26 ?from_json@jsonbind@@YAHPAXABVValue@Json@@@Z,2_2_6D068C26
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D068CCE ?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z,2_2_6D068CCE
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D05C461 ?Init@InfoTraceSystem@trace_system@ierd_tgp@@QAE_N_NV?$weak_ptr@VIInfoTraceSystemListener@trace_system@ierd_tgp@@@std@@@Z,__EH_prolog3,2_2_6D05C461
Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6D085448 ?get_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBE_KXZ,2_2_6D085448
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D016D1E ?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z,5_2_6D016D1E
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D05AC3B __EH_prolog3_GS,_time32,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?instance@Application@common@ierd_tgp@@SAPAV123@XZ,?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBEHXZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBE_KXZ,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,_wfopen,fwrite,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,_errno,fclose,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,_errno,5_2_6D05AC3B
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D016C9C ?from_json@jsonbind@@YAHPAXABVValue@Json@@@Z,5_2_6D016C9C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D0865DE ?set_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAB_K@Z,5_2_6D0865DE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D068C26 ?from_json@jsonbind@@YAHPAXABVValue@Json@@@Z,5_2_6D068C26
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D068CCE ?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z,5_2_6D068CCE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D05C461 ?Init@InfoTraceSystem@trace_system@ierd_tgp@@QAE_N_NV?$weak_ptr@VIInfoTraceSystemListener@trace_system@ierd_tgp@@@std@@@Z,__EH_prolog3,5_2_6D05C461
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6D085448 ?get_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBE_KXZ,5_2_6D085448
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts12
Command and Scripting Interpreter
1
Bootkit
1
Access Token Manipulation
1
Access Token Manipulation
OS Credential Dumping1
System Time Discovery
Remote Services11
Archive Collected Data
2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API
1
DLL Side-Loading
212
Process Injection
212
Process Injection
LSASS Memory41
Security Software Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading
1
Deobfuscate/Decode Files or Information
Security Account Manager1
Process Discovery
SMB/Windows Admin SharesData from Network Shared Drive1
Ingress Tool Transfer
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information
NTDS1
Account Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Bootkit
LSA Secrets1
System Owner/User Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Rundll32
Cached Domain Credentials1
System Network Configuration Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading
DCSync2
File and Directory Discovery
Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem15
System Information Discovery
Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579708 Sample: 492c3445eddadc4b2c411a6eb79... Startdate: 23/12/2024 Architecture: WINDOWS Score: 60 24 AI detected suspicious sample 2->24 7 loaddll32.exe 1 2->7         started        process3 signatures4 26 Contains functionality to infect the boot sector 7->26 28 Contains functionality to inject code into remote processes 7->28 10 rundll32.exe 7->10         started        14 rundll32.exe 7->14         started        16 cmd.exe 1 7->16         started        18 2 other processes 7->18 process5 dnsIp6 22 134.122.134.93, 18852, 49702, 49703 BCPL-SGBGPNETGlobalASNSG United States 10->22 30 Contains functionality to infect the boot sector 10->30 32 System process connects to network (likely due to code injection or exploit) 14->32 20 rundll32.exe 16->20         started        signatures7 process8

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll5%ReversingLabs
492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll4%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://curl.haxx.se/docs/http-cookies.htmlloaddll32.exe, loaddll32.exe, 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, rundll32.exe, 00000005.00000002.3771300959.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000006.00000002.3771401600.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.3771296282.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 0000000A.00000002.3771319981.000000006D28D000.00000002.00000001.01000000.00000004.sdmp, 492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dllfalse
    high
    https://curl.haxx.se/docs/http-cookies.html#loaddll32.exe, rundll32.exefalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      134.122.134.93
      unknownUnited States
      64050BCPL-SGBGPNETGlobalASNSGtrue
      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1579708
      Start date and time:2024-12-23 07:47:45 +01:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 9m 24s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:16
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
      Detection:MAL
      Classification:mal60.evad.winDLL@12/0@0/1
      EGA Information:
      • Successful, ratio: 100%
      HCA Information:
      • Successful, ratio: 89%
      • Number of executed functions: 11
      • Number of non-executed functions: 378
      Cookbook Comments:
      • Found application associated with file extension: .dll
      • Override analysis time to 240s for rundll32
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
      • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
      • Not all processes where analyzed, report is missing behavior information
      • Report creation exceeded maximum time and may have missing disassembly code information.
      • Report size exceeded maximum capacity and may have missing disassembly code.
      No simulations
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      134.122.134.93MicrosoftEdgeUpdateSetup.exeGet hashmaliciousUnknownBrowse
        No context
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        BCPL-SGBGPNETGlobalASNSGrQuotation.exeGet hashmaliciousFormBookBrowse
        • 202.95.11.110
        3.elfGet hashmaliciousUnknownBrowse
        • 137.220.247.57
        MicrosoftEdgeUpdateSetup.exeGet hashmaliciousUnknownBrowse
        • 134.122.134.93
        SWIFT COPY.exeGet hashmaliciousFormBookBrowse
        • 134.122.191.187
        http://93287.mobiGet hashmaliciousUnknownBrowse
        • 137.220.229.108
        T2dvU8f2xg.exeGet hashmaliciousUnknownBrowse
        • 118.107.29.172
        oiBxz37xUo.dllGet hashmaliciousUnknownBrowse
        • 118.107.29.172
        T2dvU8f2xg.exeGet hashmaliciousUnknownBrowse
        • 118.107.29.172
        oiBxz37xUo.dllGet hashmaliciousUnknownBrowse
        • 118.107.29.172
        7nJ9Jo78Vq.dllGet hashmaliciousUnknownBrowse
        • 118.107.29.172
        No context
        No context
        No created / dropped files found
        File type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
        Entropy (8bit):6.767280363456254
        TrID:
        • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
        • Generic Win/DOS Executable (2004/3) 0.20%
        • DOS Executable Generic (2002/1) 0.20%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll
        File size:3'925'088 bytes
        MD5:fad86474cd9720226aa41f9117fa1c32
        SHA1:89c995faef96b2eec50bbfff2d1749379de829d4
        SHA256:492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69a0f7b0e6cfa8e6aced1
        SHA512:3334a5f68cf6e60668b4bfa9599f5b054eb6166160cb87c8cb75b50c0810db472f3ea97076085be0338ed1c40704cc806bde56166d1a1796dc2a80bea3d49d8a
        SSDEEP:49152:TTcKPhmbTTBpHO0e9iNImYz88p4wi1ZxpEvHYyAadSPEssLT3hrxcMQyKJgW8i2P:TvGFpHM9iNITzLteZSHnpfssprx/Co
        TLSH:0406BE13BB828176D18E0271146E977F1979BE214B3481D3E3A07B2DAEB15C3623BB57
        File Content Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......A.G...)...)...)...-...).j.....).o.-...).o.,...)..v....).W.-...).W.*...).W.,.'.).W.(...).......)...,.Q.)...!...).....:.)...(.W.)
        Icon Hash:7ae282899bbab082
        Entrypoint:0x101245fa
        Entrypoint Section:.text
        Digitally signed:true
        Imagebase:0x10000000
        Subsystem:windows cui
        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
        Time Stamp:0x664EFDF6 [Thu May 23 08:27:34 2024 UTC]
        TLS Callbacks:0x101261f0
        CLR (.Net) Version:
        OS Version Major:5
        OS Version Minor:1
        File Version Major:5
        File Version Minor:1
        Subsystem Version Major:5
        Subsystem Version Minor:1
        Import Hash:152dda382128db1bd5cd89aa69412db8
        Signature Valid:false
        Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
        Signature Validation Error:The digital signature of the object did not verify
        Error Number:-2146869232
        Not Before, Not After
        • 18/10/2022 02:00:00 18/10/2025 01:59:59
        Subject Chain
        • CN=Tencent Technology (Shenzhen) Company Limited, O=Tencent Technology (Shenzhen) Company Limited, L=Shenzhen, S=Guangdong Province, C=CN
        Version:3
        Thumbprint MD5:6C4EBBDE79CF7DA261D1876664F7AC77
        Thumbprint SHA-1:617C4EDB4F205FCA0E5C07B9C52AA8D695FD122C
        Thumbprint SHA-256:7D1B7059F26749914F4CEDAD19FBD400692E63430C3AA927B9C6BAFF98C32BCF
        Serial:0DDAF2FE51F3B2E94CBB695A4A5174FC
        Instruction
        push ebp
        mov ebp, esp
        cmp dword ptr [ebp+0Ch], 01h
        jne 00007F955CDA5B87h
        call 00007F955CDA606Ch
        push dword ptr [ebp+10h]
        push dword ptr [ebp+0Ch]
        push dword ptr [ebp+08h]
        call 00007F955CDA5A38h
        add esp, 0Ch
        pop ebp
        retn 000Ch
        push ebp
        mov ebp, esp
        and dword ptr [1039AB6Ch], 00000000h
        sub esp, 24h
        push ebx
        xor ebx, ebx
        inc ebx
        or dword ptr [10383D00h], ebx
        push 0000000Ah
        call 00007F955CEF0EFCh
        test eax, eax
        je 00007F955CDA5CF2h
        and dword ptr [ebp-10h], 00000000h
        xor eax, eax
        or dword ptr [10383D00h], 02h
        xor ecx, ecx
        push esi
        push edi
        mov dword ptr [1039AB6Ch], ebx
        lea edi, dword ptr [ebp-24h]
        push ebx
        cpuid
        mov esi, ebx
        pop ebx
        mov dword ptr [edi], eax
        mov dword ptr [edi+04h], esi
        mov dword ptr [edi+08h], ecx
        xor ecx, ecx
        mov dword ptr [edi+0Ch], edx
        mov eax, dword ptr [ebp-24h]
        mov edi, dword ptr [ebp-20h]
        mov dword ptr [ebp-0Ch], eax
        xor edi, 756E6547h
        mov eax, dword ptr [ebp-18h]
        xor eax, 49656E69h
        mov dword ptr [ebp-08h], eax
        mov eax, dword ptr [ebp-1Ch]
        xor eax, 6C65746Eh
        mov dword ptr [ebp-04h], eax
        xor eax, eax
        inc eax
        push ebx
        cpuid
        mov esi, ebx
        pop ebx
        lea ebx, dword ptr [ebp-24h]
        mov dword ptr [ebx], eax
        mov eax, dword ptr [ebp-04h]
        or eax, dword ptr [ebp-08h]
        or eax, edi
        mov dword ptr [ebx+04h], esi
        mov dword ptr [ebx+08h], ecx
        mov dword ptr [ebx+0Ch], edx
        jne 00007F955CDA5BC5h
        mov eax, dword ptr [ebp-24h]
        and eax, 0FFF3FF0h
        cmp eax, 000106C0h
        Programming Language:
        • [ C ] VS2010 build 30319
        • [ C ] VS2008 SP1 build 30729
        • [IMP] VS2008 SP1 build 30729
        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x362e000x176d4.rdata
        IMAGE_DIRECTORY_ENTRY_IMPORT0x37a4d40x2a8.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x3a00000x1ad8.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
        IMAGE_DIRECTORY_ENTRY_SECURITY0x3bbc000x2860.reloc
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x3a20000x231cc.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x32eab00x54.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x32eba80x18.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x32eb080x40.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x29d0000xc90.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x29bccc0x29be001dd7b0d6af2be45214d4bc79ad04fb83unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0x29d0000xe32f40xe340079559ea6d653203548b03eb6dfbc4c50False0.3960761310506051data5.984320592641482IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x3810000x1de300x176007c13ba971eb17e967c7a7be1cbd7cdfaFalse0.22092245989304812data4.5617792855168116IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .QMGuid0x39f0000x140x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .rsrc0x3a00000x1ad80x1c007406988c6ed19bef4af84ee18e0b9e6dFalse0.28306361607142855data3.8672458651762835IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .reloc0x3a20000x231cc0x23200924ef0dd87ace2a16a9b55fadf219301False0.5951748776690391data6.63025130134918IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        NameRVASizeTypeLanguageCountryZLIB Complexity
        WEVT_TEMPLATE0x3a01400x1812dataEnglishUnited States0.2732878935410581
        RT_MESSAGETABLE0x3a01100x30Matlab v4 mat-file (little endian) I, text, rows 1342177284, columns 1342177284, imaginaryEnglishUnited States1.0416666666666667
        RT_MANIFEST0x3a19580x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727
        DLLImport
        VERSION.dllGetFileVersionInfoW, VerQueryValueA, GetFileVersionInfoSizeW
        PSAPI.DLLGetModuleFileNameExW, GetProcessImageFileNameW
        KERNEL32.dllSetEvent, CreateEventA, OpenEventA, GetCommandLineW, QueryPerformanceCounter, QueryPerformanceFrequency, GetSystemInfo, CreateThread, GetCurrentThreadId, TerminateThread, ResetEvent, WaitForSingleObjectEx, ReleaseSemaphore, FlushFileBuffers, SetFileTime, GetSystemTime, SystemTimeToFileTime, CreateSemaphoreW, OutputDebugStringW, CreateDirectoryW, GetFullPathNameW, GetOverlappedResult, WaitForMultipleObjects, ReadFile, ConnectNamedPipe, DisconnectNamedPipe, CreateEventW, CreateNamedPipeW, CancelIo, GetPrivateProfileStringW, WritePrivateProfileStringW, InterlockedDecrement, LocalAlloc, LocalFree, lstrcpyW, SwitchToThread, GetCurrentProcess, GetExitCodeProcess, DuplicateHandle, CreateProcessW, CreateNamedPipeA, LoadLibraryW, TerminateProcess, CreatePipe, FormatMessageA, GetSystemDirectoryW, CreateWaitableTimerA, SetWaitableTimer, GetFileInformationByHandle, DeviceIoControl, SetEndOfFile, FindClose, GetFileTime, SetCurrentDirectoryW, GetCurrentDirectoryW, GetDiskFreeSpaceExW, CreateDirectoryExW, RemoveDirectoryW, GetFileAttributesW, GetFileAttributesExW, DeleteFileW, FindFirstFileW, FindNextFileW, CopyFileW, MoveFileExW, GetProcessTimes, GetSystemWow64DirectoryW, GetVersionExA, GetSystemDirectoryA, InterlockedExchange, InterlockedCompareExchange, GetPrivateProfileIntA, GetPrivateProfileStringA, FindFirstFileA, CopyFileA, HeapAlloc, GetFileSizeEx, GetThreadId, CreateProcessA, CreateJobObjectA, AssignProcessToJobObject, SetInformationJobObject, OpenFileMappingW, MapViewOfFileEx, GetCurrentThread, SetThreadAffinityMask, GlobalMemoryStatusEx, VirtualAlloc, VirtualFree, OpenProcess, GetProcessHeap, FileTimeToLocalFileTime, FileTimeToSystemTime, lstrcmpA, GetLogicalDriveStringsA, GetLogicalDriveStringsW, GetStartupInfoA, ExpandEnvironmentStringsA, ExpandEnvironmentStringsW, GetDriveTypeA, GetDriveTypeW, QueryDosDeviceW, GetVersionExW, GetSystemPowerStatus, GetVolumeNameForVolumeMountPointW, GetVolumePathNameW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, Module32FirstW, OpenThread, GetExitCodeThread, Thread32First, Thread32Next, IsDebuggerPresent, LocalFileTimeToFileTime, GetPrivateProfileIntW, Process32First, Process32Next, lstrlenW, GetLocalTime, GetTickCount, ReleaseMutex, InitializeCriticalSectionAndSpinCount, SetLastError, Sleep, TryEnterCriticalSection, ResumeThread, SuspendThread, SetThreadPriority, GetModuleHandleA, LoadLibraryA, OpenFileMappingA, CreateFileMappingA, CreateMutexA, lstrcpyA, lstrcpynA, WaitForSingleObject, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, GetLastError, GetCurrentProcessId, FreeLibrary, CreateFileW, CreateFileMappingW, UnmapViewOfFile, MapViewOfFile, lstrlenA, ReadConsoleW, ReadConsoleA, SetConsoleMode, GetConsoleMode, GetEnvironmentVariableW, ConvertThreadToFiber, ConvertFiberToThread, HeapFree, FormatMessageW, VerifyVersionInfoA, VerSetConditionMask, PeekNamedPipe, CreateFiber, DeleteFiber, SwitchToFiber, GetFileType, GetStdHandle, SleepEx, GetModuleHandleExW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, WaitForMultipleObjectsEx, DisableThreadLibraryCalls, GetSystemTimeAsFileTime, InitializeSListHead, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetSystemTimes, WideCharToMultiByte, MultiByteToWideChar, GetModuleHandleW, GetModuleFileNameW, GetLongPathNameW, GetProcAddress, MoveFileExA, DeleteFileA, CreateFileA, CreateDirectoryA, OutputDebugStringA, GetModuleFileNameA, CloseHandle, SetFilePointer, WriteFile, GetFileSize, GlobalFree
        USER32.dllDispatchMessageW, PeekMessageA, PeekMessageW, SendMessageA, FindWindowA, SendMessageW, CallWindowProcW, SetWindowPos, SetWindowLongA, SetDlgItemTextW, GetSystemMetrics, GetWindowRect, GetWindowLongW, GetWindowLongA, UpdateWindow, RemovePropA, GetPropA, MessageBoxW, GetUserObjectInformationW, GetProcessWindowStation, SetWindowLongW, GetParent, LoadStringW, EnumDisplayDevicesA, CharLowerBuffA, GetDesktopWindow, TranslateMessage, SetPropA, ShowWindow, DestroyWindow, IsWindow, SendMessageTimeoutA, PostMessageA, DefWindowProcA, RegisterClassExA, CreateWindowExA, EndDialog
        GDI32.dllGetStockObject
        SHELL32.dllSHChangeNotify, SHGetDesktopFolder, SHGetSpecialFolderLocation, ShellExecuteW, SHBrowseForFolderW, SHGetFolderPathW, SHGetFolderPathA, SHGetSpecialFolderPathA, SHCreateDirectoryExW, SHGetPathFromIDListW, SHGetSpecialFolderPathW
        ole32.dllCoCreateGuid, StringFromCLSID, CoCreateInstance, CoSetProxyBlanket, CoInitializeSecurity, CoTaskMemFree, CoInitialize, CoInitializeEx, CoUninitialize, CoLoadLibrary, IIDFromString
        OLEAUT32.dllSysAllocString, SysFreeString, SafeArrayCreate, SafeArrayDestroy, SafeArrayAccessData, VarBstrCmp, VariantClear, VariantInit, SafeArrayUnaccessData
        COMDLG32.dllGetOpenFileNameW
        ADVAPI32.dllLookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken, RegOpenKeyExW, RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegCloseKey, CryptReleaseContext, CryptGenRandom, CryptAcquireContextW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, CryptAcquireContextA, BuildExplicitAccessWithNameW, SetNamedSecurityInfoW, GetNamedSecurityInfoW, SetEntriesInAclW, RegSetValueExW, RegQueryValueExW, RegOpenKeyW, RegCreateKeyW, GetUserNameW, DeregisterEventSource, RegisterEventSourceW, ReportEventW, CryptDestroyKey, CryptSetHashParam, CryptGetProvParam, CryptGetUserKey, CryptExportKey, CryptDecrypt, CryptCreateHash, CryptDestroyHash, CryptSignHashW, CryptEnumProvidersW
        MSVCP140.dll?uncaught_exception@std@@YA_NXZ, ?_Xlength_error@std@@YAXPBD@Z, ?_Xout_of_range@std@@YAXPBD@Z, ?good@ios_base@std@@QBE_NXZ, ?flags@ios_base@std@@QBEHXZ, ?width@ios_base@std@@QBE_JXZ, ?width@ios_base@std@@QAE_J_J@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z, ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ, ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ, ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z, ??0_Lockit@std@@QAE@H@Z, ??1_Lockit@std@@QAE@XZ, ?_Xbad_alloc@std@@YAXXZ, ??Bid@locale@std@@QAEIXZ, ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z, ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ, ?is@?$ctype@D@std@@QBE_NFD@Z, ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z, ?_Syserror_map@std@@YAPBDH@Z, ?_Winerror_map@std@@YAHH@Z, ?_Winerror_message@std@@YAKKPADK@Z, ??Bios_base@std@@QBE_NXZ, ?eof@ios_base@std@@QBE_NXZ, ?fail@ios_base@std@@QBE_NXZ, ?bad@ios_base@std@@QBE_NXZ, ?getloc@ios_base@std@@QBE?AVlocale@2@XZ, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ, ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ, ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z, ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ, ?id@?$ctype@D@std@@2V0locale@2@A, ?flags@ios_base@std@@QAEHH@Z, ?setf@ios_base@std@@QAEHHH@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ, ?widen@?$ctype@D@std@@QBEDD@Z, ?narrow@?$ctype@D@std@@QBEDDD@Z, ?exceptions@ios_base@std@@QAEXH@Z, ?precision@ios_base@std@@QAE_J_J@Z, ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z, ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z, ?_Xbad_function_call@std@@YAXXZ, _Mtx_init_in_situ, _Mtx_destroy_in_situ, _Mtx_lock, _Mtx_unlock, ?_Throw_C_error@std@@YAXH@Z, ?always_noconv@codecvt_base@std@@QBE_NXZ, ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, ?rdstate@ios_base@std@@QBEHXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ, ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ, ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ, ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ, ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z, ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ, ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z, ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ, ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z, ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ, ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z, ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ, ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z, _Xtime_get_ticks, _Query_perf_counter, _Query_perf_frequency, _Thrd_id, ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ, ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ, ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z, ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z, ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ, ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ, ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ, ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z, ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z, ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z, ?setf@ios_base@std@@QAEHH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z, ?_Xinvalid_argument@std@@YAXPBD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ?is@?$ctype@_W@std@@QBE_NF_W@Z, ?widen@?$ctype@_W@std@@QBE_WD@Z, ?narrow@?$ctype@_W@std@@QBED_WD@Z, ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z, ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z, ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z, ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z, ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z, ?id@?$ctype@_W@std@@2V0locale@2@A, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ, _Wcscoll, _Wcsxfrm, ??0_Locinfo@std@@QAE@PBD@Z, ??1_Locinfo@std@@QAE@XZ, ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ, ?c_str@?$_Yarn@D@std@@QBEPBDXZ, ??0facet@locale@std@@IAE@I@Z, ??1facet@locale@std@@MAE@XZ, ?tolower@?$ctype@_W@std@@QBE_W_W@Z, ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z, ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z, ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UAEXXZ, ?id@?$collate@_W@std@@2V0locale@2@A, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z, ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z, ?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z, ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z, ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ, ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z, _Strcoll, _Strxfrm, ?tolower@?$ctype@D@std@@QBEDD@Z, ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z, ?id@?$collate@D@std@@2V0locale@2@A, ??7ios_base@std@@QBE_NXZ, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z, _Mtx_trylock, ?unsetf@ios_base@std@@QAEXH@Z, ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z, ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, _Open_dir, _Read_dir, _Close_dir, _Stat, _File_size, _Last_write_time, ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A, ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
        SHLWAPI.dllPathRemoveFileSpecW, PathFileExistsW, StrNCatW, PathAppendW, PathStripPathW, StrCmpW, StrStrIA, PathAppendA, PathFileExistsA, PathQuoteSpacesW
        CRYPT32.dllCryptDecodeObject, CryptMsgUpdate, CertGetNameStringW, CertFreeCertificateContext, CertOpenStore, CryptQueryObject, CryptMsgOpenToDecode, CertGetNameStringA, CertFindCertificateInStore, CertCloseStore, CertEnumCertificatesInStore, CertDuplicateCertificateContext, CertGetCertificateContextProperty, CryptMsgGetParam, CryptMsgClose
        IPHLPAPI.DLLGetAdaptersInfo
        WININET.dllInternetSetCookieA, FindFirstUrlCacheEntryA, DeleteUrlCacheEntry, FindNextUrlCacheEntryA, FindCloseUrlCache
        NETAPI32.dllNetbios
        WINMM.dlltimeGetTime
        WS2_32.dllrecv, WSASetLastError, gethostbyname, bind, getpeername, WSACleanup, getsockname, getsockopt, WSAIoctl, connect, ntohl, htonl, WSAGetLastError, socket, sendto, select, WSAStartup, recvfrom, getaddrinfo, freeaddrinfo, accept, send, listen, getnameinfo, ntohs, inet_ntoa, inet_addr, __WSAFDIsSet, htons, setsockopt, ioctlsocket, gethostname, shutdown, closesocket
        WINHTTP.dllWinHttpCloseHandle, WinHttpGetProxyForUrl, WinHttpOpen, WinHttpGetIEProxyConfigForCurrentUser, WinHttpCrackUrl
        WLDAP32.dll
        VCRUNTIME140.dllmemchr, memcmp, _purecall, __std_type_info_name, __std_type_info_compare, __RTDynamicCast, longjmp, __CxxFrameHandler3, strchr, wcsrchr, strstr, wcsstr, __std_terminate, __std_type_info_destroy_list, _except_handler4_common, strrchr, _setjmp3, __std_exception_destroy, __std_exception_copy, memset, memmove, memcpy, _CxxThrowException
        api-ms-win-crt-runtime-l1-1-0.dll_exit, raise, __sys_nerr, _configure_narrow_argv, _invalid_parameter_noinfo, _errno, abort, _beginthreadex, _seh_filter_dll, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _getpid, _execute_onexit_table, _crt_atexit, _invalid_parameter_noinfo_noreturn, _cexit, signal, _initterm, _initterm_e, strerror, strerror_s, terminate
        api-ms-win-crt-heap-l1-1-0.dll_callnewh, free, malloc, realloc, calloc
        api-ms-win-crt-string-l1-1-0.dllstrcmp, strncmp, wcsncat_s, strlen, isprint, _stricmp, strcpy_s, isalnum, isspace, wcscpy_s, wcsncpy_s, towlower, strncpy_s, strnlen, tolower, strpbrk, _strnset_s, strspn, strcspn, strncat_s, strncpy, _strdup, wcscat_s, strcat, wcstok, wcscmp, _strnicmp, wcsncmp, wcslen, strcpy, _wcsicmp, isalpha, _wcsnicmp, wcsncpy, strncat, wcscpy
        api-ms-win-crt-math-l1-1-0.dll_except1, _dsign, _ldtest, _CIsqrt, floor, _dtest, _isnan, _libm_sse2_sqrt_precise
        api-ms-win-crt-stdio-l1-1-0.dll_open, _close, setbuf, ferror, fopen_s, clearerr, __stdio_common_vfprintf, ftell, fseek, fopen, _wfopen, __stdio_common_vswprintf_s, __acrt_iob_func, _write, __stdio_common_vfscanf, fwrite, _lseeki64, _read, _setmode, ungetc, setvbuf, _fseeki64, fsetpos, fread, fgetpos, fgetc, fflush, fclose, _get_stream_buffer_pointers, __stdio_common_vswprintf, _fileno, feof, __stdio_common_vsnwprintf_s, fputc, _wfopen_s, fgets, __stdio_common_vsscanf, fputs, __stdio_common_vsnprintf_s, __stdio_common_vsprintf_s, __stdio_common_vsprintf, _wtempnam
        api-ms-win-crt-locale-l1-1-0.dlllocaleconv
        api-ms-win-crt-utility-l1-1-0.dllabs, srand, rand, qsort
        api-ms-win-crt-filesystem-l1-1-0.dll_wsplitpath_s, _waccess, _splitpath_s, _stat64, _mkdir, _stat64i32, _fstat64i32, _fstat64, _unlock_file, _lock_file, _access
        api-ms-win-crt-time-l1-1-0.dll_mktime64, _localtime32_s, _localtime64_s, _gmtime64, _gmtime64_s, wcsftime, strftime, _time64, _time32, _localtime64
        api-ms-win-crt-convert-l1-1-0.dllstrtoll, _itoa_s, wcstol, strtoul, _wtoi, strtol, _strtoui64, _wtoi64, strtod, _atoi64, atoi
        api-ms-win-crt-multibyte-l1-1-0.dll_mbsrchr
        api-ms-win-crt-environment-l1-1-0.dllgetenv
        NameOrdinalAddress
        ??$json_value_to_obj@H@@YAHABVValue@Json@@AAH@Z10x10078744
        ??$json_value_to_obj@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@YAHABVValue@Json@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z20x1007879f
        ??$json_value_to_obj@Vjsonb_LPVOID@@@@YAHABVValue@Json@@AAVjsonb_LPVOID@@@Z30x1007886b
        ??$json_value_to_obj@Vjsonb_bool@@@@YAHABVValue@Json@@AAVjsonb_bool@@@Z40x100788be
        ??$json_value_to_obj@Vjsonb_double@@@@YAHABVValue@Json@@AAVjsonb_double@@@Z50x1007892c
        ??$json_value_to_obj@Vjsonb_int64@@@@YAHABVValue@Json@@AAVjsonb_int64@@@Z60x10078981
        ??$json_value_to_obj@Vjsonb_int@@@@YAHABVValue@Json@@AAVjsonb_int@@@Z70x10078744
        ??$json_value_to_obj@Vjsonb_uint64@@@@YAHABVValue@Json@@AAVjsonb_uint64@@@Z80x100789e2
        ??$json_value_to_obj@_K@@YAHABVValue@Json@@AA_K@Z90x100789e2
        ??$obj_to_json_value@H@@YAHAAVValue@Json@@AAH@Z100x10078a49
        ??$obj_to_json_value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@YAHAAVValue@Json@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z110x10078a86
        ??$obj_to_json_value@Vjsonb_LPVOID@@@@YAHAAVValue@Json@@AAVjsonb_LPVOID@@@Z120x10078ac1
        ??$obj_to_json_value@Vjsonb_bool@@@@YAHAAVValue@Json@@AAVjsonb_bool@@@Z130x10078b21
        ??$obj_to_json_value@Vjsonb_double@@@@YAHAAVValue@Json@@AAVjsonb_double@@@Z140x10078b60
        ??$obj_to_json_value@Vjsonb_int64@@@@YAHAAVValue@Json@@AAVjsonb_int64@@@Z150x10078ba6
        ??$obj_to_json_value@Vjsonb_int@@@@YAHAAVValue@Json@@AAVjsonb_int@@@Z160x10078a49
        ??$obj_to_json_value@Vjsonb_uint64@@@@YAHAAVValue@Json@@AAVjsonb_uint64@@@Z170x10078be6
        ??$obj_to_json_value@_K@@YAHAAVValue@Json@@AA_K@Z180x10078be6
        ??0Application@common@ierd_tgp@@QAE@HQAPAD_NKK1ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z190x10025515
        ??0Asy_udp@common@ierd_tgp@@QAE@XZ200x1002b8c5
        ??0BaseNamedPipe@base@@QAE@$$QAV01@@Z210x1003d005
        ??0BaseNamedPipe@base@@QAE@ABV01@@Z220x1003d005
        ??0BaseNamedPipe@base@@QAE@XZ230x1003d010
        ??0BaseTimer@base@@QAE@XZ240x1003fcc7
        ??0CLogTrace@@IAE@XZ250x10015782
        ??0CLogTrace@@QAE@ABV0@@Z260x1001589e
        ??0CPerfSample@@QAE@PBD@Z270x10090290
        ??0CShareMem@@QAE@ABV0@@Z280x10022742
        ??0CShareMem@@QAE@XZ290x1002278e
        ??0CSimpleIPC@@QAE@ABV0@@Z300x100227c3
        ??0CSimpleIPC@@QAE@XZ310x1002282e
        ??0CSymmetryString@ieg_common@@QAE@ABV01@@Z320x10023706
        ??0CSymmetryString@ieg_common@@QAE@XZ330x10023711
        ??0CThread@@QAE@ABV0@@Z340x10023889
        ??0CThread@@QAE@XZ350x100238c5
        ??0CThreadLock@@QAE@XZ360x10023b2d
        ??0ChildProcess@common@ierd_tgp@@QAE@PBD@Z370x1004aa10
        ??0Component_mgr@common@ierd_tgp@@AAE@XZ380x10056a06
        ??0Component_mgr@common@ierd_tgp@@QAE@$$QAV012@@Z390x10025745
        ??0Component_mgr@common@ierd_tgp@@QAE@ABV012@@Z400x10025745
        ??0CurlWrapper@curl_wrapper@ierd_tgp@@AAE@XZ410x1005a3ea
        ??0DumpManager@common@ierd_tgp@@AAE@XZ420x100c398f
        ??0ILogger@base@@QAE@ABV01@@Z430x10019e95
        ??0ILogger@base@@QAE@XZ440x10019ea0
        ??0InfoTraceSystem@trace_system@ierd_tgp@@QAE@XZ450x10068ff6
        ??0PerfScopeClass@common@ierd_tgp@@QAE@PBD_N0@Z460x100c6100
        ??0Qos@qos@adapt_for_imports@ierd_tgp@@QAE@XZ470x10092226
        ??0ShareMemory@Memory@ierd_tgp@@QAE@PB_WK@Z480x100a88b0
        ??0Shared_mem_obj@acce_common@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I0_N@Z490x10024229
        ??0Shared_mem_obj@common@ierd_tgp@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I0_N@Z500x100a977c
        ??0Syn_tcp@common@ierd_tgp@@QAE@XZ510x100ac0a6
        ??0Sys_wrapper@common@ierd_tgp@@QAE@XZ520x100aef5f
        ??0Tcp_port_detect@game_misc@ierd_tgp@@QAE@XZ530x100bed0d
        ??0WndMsg@common@ierd_tgp@@QAE@IIJ@Z540x10045142
        ??0WndMsgReceiver2@Tenio@@QAE@$$QAV01@@Z550x10023bb5
        ??0WndMsgReceiver2@Tenio@@QAE@ABV01@@Z560x10023bb5
        ??0WndMsgReceiver2@Tenio@@QAE@XZ570x10023c15
        ??0WndMsgReceiver@Tenio@@QAE@ABV01@@Z580x10023c4a
        ??0WndMsgReceiver@Tenio@@QAE@XZ590x10023c6e
        ??0directory_entry@filesystem@ierd_tgp@@QAE@ABV012@@Z600x1001a06b
        ??0directory_entry@filesystem@ierd_tgp@@QAE@ABVpath@12@@Z610x1001a0d1
        ??0directory_entry@filesystem@ierd_tgp@@QAE@XZ620x1001a12e
        ??0directory_iterator@filesystem@ierd_tgp@@QAE@ABV012@@Z630x1001a194
        ??0directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@@Z640x1001a1e2
        ??0directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@AAVerror_code@std@@@Z650x1001a256
        ??0directory_iterator@filesystem@ierd_tgp@@QAE@XZ660x1001a2e0
        ??0file_status@filesystem@ierd_tgp@@QAE@$$QAV012@@Z670x1001a3a0
        ??0file_status@filesystem@ierd_tgp@@QAE@ABV012@@Z680x1001a3a0
        ??0file_status@filesystem@ierd_tgp@@QAE@W4file_type@12@@Z690x1001a3b6
        ??0file_status@filesystem@ierd_tgp@@QAE@W4file_type@12@W4perms@12@@Z700x1001a3cb
        ??0file_status@filesystem@ierd_tgp@@QAE@XZ710x1001a3df
        ??0iterator@path@filesystem@ierd_tgp@@QAE@$$QAV0123@@Z720x1001a502
        ??0iterator@path@filesystem@ierd_tgp@@QAE@ABV0123@@Z730x1001a55c
        ??0iterator@path@filesystem@ierd_tgp@@QAE@XZ740x1001a594
        ??0md5@@QAE@XZ750x10056cd0
        ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z760x1001a6b9
        ??0path@filesystem@ierd_tgp@@QAE@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z770x1001a713
        ??0path@filesystem@ierd_tgp@@QAE@ABV012@@Z780x1001a713
        ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z790x1001a713
        ??0path@filesystem@ierd_tgp@@QAE@PA_W@Z800x1001a742
        ??0path@filesystem@ierd_tgp@@QAE@PB_W@Z810x1001a742
        ??0path@filesystem@ierd_tgp@@QAE@XZ820x1001a769
        ??0port_scan@game_misc@ierd_tgp@@QAE@XZ830x10090b7f
        ??0recursive_directory_iterator@filesystem@ierd_tgp@@QAE@$$QAV012@@Z840x1001a8ab
        ??0recursive_directory_iterator@filesystem@ierd_tgp@@QAE@ABV012@@Z850x1001a194
        ??0recursive_directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@@Z860x1001a901
        ??0recursive_directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@AAVerror_code@std@@@Z870x1001a9b2
        ??0recursive_directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@W4symlink_option@12@@Z880x1001aa8c
        ??0recursive_directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@W4symlink_option@12@AAVerror_code@std@@@Z890x1001ab40
        ??0recursive_directory_iterator@filesystem@ierd_tgp@@QAE@XZ900x1001a2e0
        ??0server_detect@game_misc@ierd_tgp@@QAE@XZ910x1009f45b
        ??1Application@common@ierd_tgp@@UAE@XZ920x1002640d
        ??1Asy_udp@common@ierd_tgp@@QAE@XZ930x1002c96e
        ??1BaseTimer@base@@QAE@XZ940x1003fe28
        ??1CLogTrace@@IAE@XZ950x10015a68
        ??1CPerfSample@@QAE@XZ960x1009043a
        ??1CShareMem@@QAE@XZ970x100229d4
        ??1CSimpleIPC@@QAE@XZ980x10022a20
        ??1CSymmetryString@ieg_common@@UAE@XZ990x1002371a
        ??1CThread@@UAE@XZ1000x100238e5
        ??1CThreadLock@@QAE@XZ1010x10023b3b
        ??1ChildProcess@common@ierd_tgp@@QAE@XZ1020x1004ab52
        ??1DumpManager@common@ierd_tgp@@QAE@XZ1030x100c3ac6
        ??1ILogger@base@@UAE@XZ1040x1001b491
        ??1InfoTraceSystem@trace_system@ierd_tgp@@QAE@XZ1050x10069b83
        ??1PerfScopeClass@common@ierd_tgp@@QAE@XZ1060x100c65e4
        ??1Qos@qos@adapt_for_imports@ierd_tgp@@QAE@XZ1070x100926b7
        ??1ShareMemory@Memory@ierd_tgp@@QAE@XZ1080x100a890b
        ??1Shared_mem_obj@acce_common@@QAE@XZ1090x1002431b
        ??1Shared_mem_obj@common@ierd_tgp@@QAE@XZ1100x100a9834
        ??1Syn_tcp@common@ierd_tgp@@QAE@XZ1110x100ac0b0
        ??1Tcp_port_detect@game_misc@ierd_tgp@@QAE@XZ1120x100befe8
        ??1WndMsgReceiver2@Tenio@@QAE@XZ1130x10023c82
        ??1WndMsgReceiver@Tenio@@QAE@XZ1140x10023cbe
        ??1directory_entry@filesystem@ierd_tgp@@QAE@XZ1150x1001b580
        ??1directory_iterator@filesystem@ierd_tgp@@QAE@XZ1160x1001b5c3
        ??1iterator@path@filesystem@ierd_tgp@@QAE@XZ1170x1001b580
        ??1path@filesystem@ierd_tgp@@QAE@XZ1180x1001b7a6
        ??1port_scan@game_misc@ierd_tgp@@QAE@XZ1190x10090c4c
        ??1recursive_directory_iterator@filesystem@ierd_tgp@@QAE@XZ1200x1001b5c3
        ??1server_detect@game_misc@ierd_tgp@@QAE@XZ1210x1009face
        ??4AS_communication_helper@common@ierd_tgp@@QAEAAV012@$$QAV012@@Z1220x1001babd
        ??4AS_communication_helper@common@ierd_tgp@@QAEAAV012@ABV012@@Z1230x1001babd
        ??4Asy_udp@common@ierd_tgp@@QAEAAV012@ABV012@@Z1240x1002433c
        ??4BaseNamedPipe@base@@QAEAAV01@$$QAV01@@Z1250x1001babd
        ??4BaseNamedPipe@base@@QAEAAV01@ABV01@@Z1260x1001babd
        ??4BaseTimer@base@@QAEAAV01@ABV01@@Z1270x1002433c
        ??4CLogTrace@@QAEAAV0@ABV0@@Z1280x10015b75
        ??4CPerfSample@@QAEAAU0@ABU0@@Z1290x1001babd
        ??4CShareMem@@QAEAAV0@ABV0@@Z1300x10022a9e
        ??4CSimpleIPC@@QAEAAV0@ABV0@@Z1310x10022ad0
        ??4CSymmetryString@ieg_common@@QAEAAV01@ABV01@@Z1320x1001babd
        ??4CThread@@QAEAAV0@ABV0@@Z1330x1002391f
        ??4CThreadLock@@QAEAAV0@ABV0@@Z1340x10015bc5
        ??4ChildProcess@common@ierd_tgp@@QAEAAV012@ABV012@@Z1350x1002433c
        ??4Component_mgr@common@ierd_tgp@@QAEAAV012@$$QAV012@@Z1360x1001babd
        ??4Component_mgr@common@ierd_tgp@@QAEAAV012@ABV012@@Z1370x1001babd
        ??4DumpManager@common@ierd_tgp@@QAEAAV012@ABV012@@Z1380x1002433c
        ??4File_info@common@ierd_tgp@@QAEAAU012@$$QAU012@@Z1390x1001babd
        ??4File_info@common@ierd_tgp@@QAEAAU012@ABU012@@Z1400x1001babd
        ??4ILogger@base@@QAEAAV01@ABV01@@Z1410x1001babd
        ??4InfoTraceSystem@trace_system@ierd_tgp@@QAEAAV012@ABV012@@Z1420x1002433c
        ??4PerfScopeClass@common@ierd_tgp@@QAEAAV012@ABV012@@Z1430x1002433c
        ??4Shared_mem_obj@acce_common@@QAEAAV01@ABV01@@Z1440x1002433c
        ??4Shared_mem_obj@common@ierd_tgp@@QAEAAV012@ABV012@@Z1450x1002433c
        ??4Syn_tcp@common@ierd_tgp@@QAEAAV012@ABV012@@Z1460x1001a3a0
        ??4Sys_wrapper@common@ierd_tgp@@QAEAAV012@$$QAV012@@Z1470x1001babd
        ??4Sys_wrapper@common@ierd_tgp@@QAEAAV012@ABV012@@Z1480x1001babd
        ??4Tcp_port_detect@game_misc@ierd_tgp@@QAEAAV012@ABV012@@Z1490x1002433c
        ??4WndMsg@common@ierd_tgp@@QAEAAU012@$$QAU012@@Z1500x10045a08
        ??4WndMsg@common@ierd_tgp@@QAEAAU012@ABU012@@Z1510x10045a24
        ??4WndMsgReceiver2@Tenio@@QAEAAV01@$$QAV01@@Z1520x10023cfe
        ??4WndMsgReceiver2@Tenio@@QAEAAV01@ABV01@@Z1530x10023cfe
        ??4WndMsgReceiver@Tenio@@QAEAAV01@ABV01@@Z1540x10023cfe
        ??4comp_mgr_instace@common@ierd_tgp@@QAEAAU012@$$QAU012@@Z1550x1001babd
        ??4comp_mgr_instace@common@ierd_tgp@@QAEAAU012@ABU012@@Z1560x1001babd
        ??4directory_entry@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z1570x1001bac2
        ??4directory_iterator@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z1580x1001baf2
        ??4file_status@filesystem@ierd_tgp@@QAEAAV012@$$QAV012@@Z1590x1001a3a0
        ??4file_status@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z1600x1001a3a0
        ??4iterator@path@filesystem@ierd_tgp@@QAEAAV0123@$$QAV0123@@Z1610x1001bb07
        ??4iterator@path@filesystem@ierd_tgp@@QAEAAV0123@ABV0123@@Z1620x1001bb2b
        ??4md5@@QAEAAV0@$$QAV0@@Z1630x10056fd8
        ??4md5@@QAEAAV0@ABV0@@Z1640x1005703b
        ??4path@filesystem@ierd_tgp@@QAEAAV012@$$QAV012@@Z1650x1001bb4f
        ??4path@filesystem@ierd_tgp@@QAEAAV012@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z1660x1001bb64
        ??4path@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z1670x1001bb64
        ??4path@filesystem@ierd_tgp@@QAEAAV012@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z1680x1001bb64
        ??4path@filesystem@ierd_tgp@@QAEAAV012@PA_W@Z1690x1001bb79
        ??4path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z1700x1001bb79
        ??4port_scan@game_misc@ierd_tgp@@QAEAAV012@ABV012@@Z1710x1002433c
        ??4qos_instace@qos@adapt_for_imports@ierd_tgp@@QAEAAU0123@$$QAU0123@@Z1720x1001babd
        ??4qos_instace@qos@adapt_for_imports@ierd_tgp@@QAEAAU0123@ABU0123@@Z1730x1001babd
        ??4recursive_directory_iterator@filesystem@ierd_tgp@@QAEAAV012@$$QAV012@@Z1740x1001bb8e
        ??4recursive_directory_iterator@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z1750x1001baf2
        ??4server_detect@game_misc@ierd_tgp@@QAEAAV012@ABV012@@Z1760x1002433c
        ??4silence_update@common@ierd_tgp@@QAEAAV012@$$QAV012@@Z1770x1001babd
        ??4silence_update@common@ierd_tgp@@QAEAAV012@ABV012@@Z1780x1001babd
        ??4version_t@common@ierd_tgp@@QAEAAU012@$$QAU012@@Z1790x100266c6
        ??4version_t@common@ierd_tgp@@QAEAAU012@ABU012@@Z1800x1001a3a0
        ??8directory_entry@filesystem@ierd_tgp@@QBE_NABV012@@Z1810x1001bba3
        ??8directory_iterator@filesystem@ierd_tgp@@QAE_NABV012@@Z1820x1001bbb8
        ??8file_status@filesystem@ierd_tgp@@QBE_NABV012@@Z1830x1001bbc1
        ??8recursive_directory_iterator@filesystem@ierd_tgp@@QAE_NABV012@@Z1840x1001bbdf
        ??9directory_entry@filesystem@ierd_tgp@@QBE_NABV012@@Z1850x1001bc0f
        ??9directory_iterator@filesystem@ierd_tgp@@QAE_NABV012@@Z1860x1001bc23
        ??9file_status@filesystem@ierd_tgp@@QBE_NABV012@@Z1870x1001bc34
        ??9recursive_directory_iterator@filesystem@ierd_tgp@@QAE_NABV012@@Z1880x1001bc45
        ??Bdirectory_entry@filesystem@ierd_tgp@@QBEABVpath@12@XZ1890x1001bd20
        ??Cdirectory_iterator@filesystem@ierd_tgp@@QBEPBVdirectory_entry@12@XZ1900x1001bd30
        ??Citerator@path@filesystem@ierd_tgp@@QBEPBV123@XZ1910x1001bd20
        ??Crecursive_directory_iterator@filesystem@ierd_tgp@@QBEPBVdirectory_entry@12@XZ1920x1001bd33
        ??Ddirectory_iterator@filesystem@ierd_tgp@@QBEABVdirectory_entry@12@XZ1930x1001bd30
        ??Diterator@path@filesystem@ierd_tgp@@QBEABV123@XZ1940x1001bd20
        ??Drecursive_directory_iterator@filesystem@ierd_tgp@@QBEABVdirectory_entry@12@XZ1950x1001bd33
        ??Edirectory_iterator@filesystem@ierd_tgp@@QAEAAV012@XZ1960x1001bd3c
        ??Eiterator@path@filesystem@ierd_tgp@@QAEAAV0123@XZ1970x1001bd61
        ??Erecursive_directory_iterator@filesystem@ierd_tgp@@QAEAAV012@XZ1980x1001bd6e
        ??Fiterator@path@filesystem@ierd_tgp@@QAEAAV0123@XZ1990x1001bd90
        ??Mversion_t@common@ierd_tgp@@QAE_NU012@@Z2000x10060292
        ??Oversion_t@common@ierd_tgp@@QAE_NU012@@Z2010x100602d1
        ??Ypath@filesystem@ierd_tgp@@QAEAAV012@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z2020x1001be4a
        ??Ypath@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z2030x1001be4a
        ??Ypath@filesystem@ierd_tgp@@QAEAAV012@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z2040x1001be4a
        ??Ypath@filesystem@ierd_tgp@@QAEAAV012@PA_W@Z2050x1001be5f
        ??Ypath@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z2060x1001be5f
        ??Ypath@filesystem@ierd_tgp@@QAEAAV012@_W@Z2070x1001be74
        ??_0path@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z2080x100607cd
        ??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z2090x10060881
        ??_7Application@common@ierd_tgp@@6B@2100x1029feb0
        ??_7BaseNamedPipe@base@@6B@2110x102a1730
        ??_7CSimpleIPC@@6B@2120x1029f908
        ??_7CSymmetryString@ieg_common@@6B@2130x1029fb88
        ??_7CThread@@6B@2140x1029fb90
        ??_7Component_mgr@common@ierd_tgp@@6B@2150x1029fec8
        ??_7ILogger@base@@6B@2160x1029e5b0
        ??_7WndMsgReceiver2@Tenio@@6B@2170x1029fba8
        ??_7WndMsgReceiver@Tenio@@6B@2180x1029fb9c
        ?AddFilesToZip@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$unordered_map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@4@@Z2190x100dd9ec
        ?AddFilesToZip@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z2200x100ddb05
        ?AddFilesToZip@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$unordered_map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$hash@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@U?$equal_to@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@_N@Z2210x100ddc50
        ?AddFilesToZip@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z2220x100ddc70
        ?AddPathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z2230x100cf842
        ?BeginTrace@CLogTrace@@QAEXPBD@Z2240x10015c92
        ?BeginTrace@PerfScopeClass@common@ierd_tgp@@QAEXXZ2250x100c6769
        ?CPEncode@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@I@Z2260x100aa451
        ?CPEncode@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@I@Z2270x100aa4df
        ?CanExit@Component_mgr@common@ierd_tgp@@UAE_NXZ2280x10057097
        ?ChangeProcessImageName@Sys_wrapper@common@ierd_tgp@@SA_NPAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z2290x100af296
        ?CheckIsNetworkValid@Sys_wrapper@common@ierd_tgp@@SA_NXZ2300x100af3af
        ?CheckLogFile@CLogTrace@@AAEXXZ2310x10015db3
        ?ClearIPCInfo@CSimpleIPC@@AAEXXZ2320x10022b48
        ?Close@ShareMemory@Memory@ierd_tgp@@QAEXXZ2330x100a8953
        ?CloseZipU@@YAKPAUHZIP__@@@Z2340x100c8432
        ?ConvertJsonStringToQos@qos@adapt_for_imports@ierd_tgp@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAUtagQOSRep@@@Z2350x1009867a
        ?ConvertNtPathToDrivePath@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V45@@Z2360x100af465
        ?ConvertQosToJsonString@qos@adapt_for_imports@ierd_tgp@@YAXABUtagQOSRep@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z2370x10098a01
        ?CopyDir@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@0@Z2380x100af646
        ?CovertToTPLangValue@overseas@ierd_tgp@@YAHH@Z2390x1008e2df
        ?CreatDesktopShortcut@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00000@Z2400x100af92f
        ?Create@CShareMem@@QAEHPBDH@Z2410x10022c4a
        ?Create@CSimpleIPC@@QAEHHPBD@Z2420x10022d24
        ?Create@ShareMemory@Memory@ierd_tgp@@QAEHH@Z2430x100a897e
        ?CreateDirectoryRecursively@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z2440x100afb87
        ?CreateNamePipe@BaseNamedPipe@base@@SA?AV?$shared_ptr@VBaseNamedPipe@base@@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@_NP6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@PBDI1@Z1@Z2450x1003d940
        ?CreateUserLogger@base@@YAPAVILogger@1@XZ2460x10037aad
        ?CreateWnd@WndMsgReceiver2@Tenio@@UAEPAUHWND__@@PBD@Z2470x10023d1c
        ?CreateWnd@WndMsgReceiver@Tenio@@EAEPAUHWND__@@PBD@Z2480x10023d30
        ?CreateWndImpl@WndMsgReceiver@Tenio@@IAEPAUHWND__@@PBDP6GJPAU3@IIJ@Z@Z2490x10023d44
        ?CreateXMLConfig@common@ierd_tgp@@YAPAVCTXMLConfig@12@XZ2500x100d7388
        ?CutStringByMaxCharacters@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z2510x100abbe1
        ?CutStringByMaxCharactersEx@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z2520x100abc6d
        ?DESDecrypt@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV12@PBDW4EPadType@@W4EDESMode@@@Z2530x1005c20a
        ?DESEncrypt@@YA_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4EPadType@@W4EDESMode@@@Z2540x1005c38c
        ?Decode16@common@ierd_tgp@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAXI@Z2550x100aa5a2
        ?Decode@md5@@AAEXPAIPAEI@Z2560x10088528
        ?DelOldSilenceUpdate@silence_update@common@ierd_tgp@@SAXPB_WABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@K_N@Z2570x100cf87a
        ?DeleteExpiredFiles@common@ierd_tgp@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00I_K@Z2580x100d3522
        ?DeleteFileA@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z2590x100afdeb
        ?Destroy@CShareMem@@QAEXXZ2600x10022e7a
        ?Destroy@CSimpleIPC@@QAEXXZ2610x10022eb0
        ?DestroyWnd@WndMsgReceiver@Tenio@@AAE_NPAUHWND__@@@Z2620x10023e40
        ?Digest@md5@@QAEPAEXZ2630x10057109
        ?DumpNow@DumpManager@common@ierd_tgp@@QAE_NW4EnumInfoLevel@123@_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@6@K@Z2640x100c3f24
        ?DynLoadStr@overseas@ierd_tgp@@YAPB_WV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z2650x1008e2fb
        ?EnableDebugPriv@Sys_wrapper@common@ierd_tgp@@SAHXZ2660x100b0068
        ?EnableDynamicPeekMessage@Application@common@ierd_tgp@@QAEX_N@Z2670x100269f9
        ?EnableFileAccountPrivilege@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z2680x100b00fe
        ?Encode16@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBXI@Z2690x100aa5f9
        ?Encode@md5@@AAEXPAEPAII@Z2700x10088573
        ?EndTrace@CLogTrace@@QAEXPBDH@Z2710x10015f9b
        ?EndTrace@PerfScopeClass@common@ierd_tgp@@QAEXXZ2720x100c6e13
        ?EndsWith@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z2730x100d3b93
        ?EndsWith@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z2740x100d3be0
        ?EnterLowPowerMode@Application@common@ierd_tgp@@QAEXXZ2750x10026a0b
        ?EnterNormalMode@Application@common@ierd_tgp@@QAEXXZ2760x10026a18
        ?Exists@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z2770x100b029b
        ?Exists@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z2780x100b03d9
        ?ExtractFilePathAndNameW@silence_update@common@ierd_tgp@@KAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1@Z2790x100cfd5a
        ?ExtractFromUrlProtocol@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV45@@Z2800x100b04c0
        ?ExtractFromUrlProtocol@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV45@@Z2810x100b05e5
        ?F@md5@@AAEIIII@Z2820x1005710d
        ?FF@md5@@AAEXAAIIIIIII@Z2830x10057123
        ?FileHasVMP@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAW4type@ImageArchitectureType@12@PAW45ShellType@12@@Z2840x10021d9b
        ?FileSeek@@YA_JPAX_JK@Z2850x100885b3
        ?Finalize@md5@@QAEXXZ2860x100885f9
        ?FindChildProcess@Sys_wrapper@common@ierd_tgp@@SAPAXK@Z2870x100b0631
        ?FindFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z2880x100b06d9
        ?FindFirstFileW_fixed_remote@Sys_wrapper@common@ierd_tgp@@SAPAXPB_WPAU_WIN32_FIND_DATAW@@@Z2890x100b0730
        ?FindLatestFile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@HK@Z2900x100b07b4
        ?FindZipItem@@YAKPAUHZIP__@@PB_W_NPAHPAUZIPENTRY@@@Z2910x100c8724
        ?FormatZipMessageU@@YAIKPA_WI@Z2920x100c875c
        ?FreeTrace@CLogTrace@@SAXXZ2930x10016120
        ?G@md5@@AAEIIII@Z2940x1005714f
        ?GG@md5@@AAEXAAIIIIIII@Z2950x10057166
        ?GeneralExptTrace@common@ierd_tgp@@YAXV_TGameID@12@IHIIIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1ABV?$vector@HV?$allocator@H@std@@@5@ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@ABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@5@@Z2960x100c6f83
        ?GenerateRandomData@common@ierd_tgp@@YA_NPAEI@Z2970x100d3c2f
        ?GenerateUniqueMemLog@common@ierd_tgp@@YA_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z2980x100c70e7
        ?GetAfterTimePairSecond@InfoTraceSystem@trace_system@ierd_tgp@@QAE?AU?$pair@II@std@@I@Z2990x1006bee3
        ?GetAllDriveInfo@Sys_wrapper@common@ierd_tgp@@SAXPAV?$vector@UDriveInfo@common@ierd_tgp@@V?$allocator@UDriveInfo@common@ierd_tgp@@@std@@@std@@@Z3000x100b0ae1
        ?GetAtQuitQosData@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NPAPAX@Z3010x100928ab
        ?GetAutoRunRegKeyW@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ3020x100b0d09
        ?GetBaseBoardByCmd@Sys_wrapper@common@ierd_tgp@@SAHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV45@@Z3030x100b0d61
        ?GetBuffer@ShareMemory@Memory@ierd_tgp@@QBEPAEXZ3040x100239e0
        ?GetCertificateSubjectName@common@ierd_tgp@@YAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAK1@Z3050x10041ab4
        ?GetCmdOutput@common@ierd_tgp@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z3060x100d3c89
        ?GetCpuNo@Sys_wrapper@common@ierd_tgp@@SAHXZ3070x100b10bd
        ?GetCrashInfo@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NPAUCrashInfo@234@@Z3080x100928e3
        ?GetCurrentStage@Qos@qos@adapt_for_imports@ierd_tgp@@QAE?AW4ProcessStage@234@XZ3090x100928f9
        ?GetDateOfTimeStamp@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAU_FILETIME@@@Z3100x100b10f9
        ?GetDoMainStr@overseas@ierd_tgp@@YAPBDV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z3110x1008e40d
        ?GetDownLoadAndSetupDefDirNameW@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ3120x100b121e
        ?GetDriveLetter@Sys_wrapper@common@ierd_tgp@@SA_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z3130x100b1276
        ?GetEnCryptLength@CSymmetryString@ieg_common@@SAHH@Z3140x100237a4
        ?GetErrorCode@InfoTraceSystem@trace_system@ierd_tgp@@QBE?AW4EnumTraceSystemErrorCode@23@XZ3150x1006c02d
        ?GetErrorInfo@common@ierd_tgp@@YAIIPA_WI@Z3160x100ddd4b
        ?GetExitCode@ChildProcess@common@ierd_tgp@@QAEKXZ3170x1004abf5
        ?GetFileBuffer@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z3180x100d4189
        ?GetFileCRC@common@ierd_tgp@@YAIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z3190x10059dda
        ?GetFileLength@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z3200x100d4223
        ?GetFileSha1@ZEN_LIB@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z3210x100a6c85
        ?GetFileSha1@ZEN_LIB@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z3220x100a6ce8
        ?GetFolderSize@common@ierd_tgp@@YA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z3230x100d4265
        ?GetGraphicCardSize@Sys_wrapper@common@ierd_tgp@@SAHXZ3240x100b1311
        ?GetGuidString@common@ierd_tgp@@YA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z3250x100654da
        ?GetHWnd@WndMsgReceiver@Tenio@@QAEPAUHWND__@@XZ3260x1001ece0
        ?GetHandle@CThread@@QAEPAXXZ3270x100239e0
        ?GetHandle@ChildProcess@common@ierd_tgp@@QBEPAXXZ3280x1003ff4d
        ?GetIEUserAgent@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3290x100b1720
        ?GetInstance@InfoTraceSystem@trace_system@ierd_tgp@@SAAAV123@XZ3300x1006c03a
        ?GetInterval@BaseTimer@base@@QAEIXZ3310x1003ff4d
        ?GetLastLoginedUin@common@ierd_tgp@@YA_KXZ3320x1001c484
        ?GetLastLoginedWegameId@common@ierd_tgp@@YAIXZ3330x1001c60b
        ?GetLastTickElapse@Application@common@ierd_tgp@@QAEIXZ3340x10026a31
        ?GetLastUnzipError@@YAKXZ3350x100c8ef1
        ?GetLastZipError@common@ierd_tgp@@YAIXZ3360x100ddd54
        ?GetLocalMmogVersion@util_version_cfg@ierd_tgp@@YAHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z3370x100d1d5e
        ?GetLocalVersion@util_version_cfg@ierd_tgp@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z3380x100d1dd1
        ?GetLogRelativePath@common@ierd_tgp@@YA_NW4EnumTgpLogType@12@PAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z3390x100c72c1
        ?GetLoggerLevel@common@ierd_tgp@@YAHXZ3400x100809bc
        ?GetLuaPluginPath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0@Z3410x100cfd7a
        ?GetMD5@common@ierd_tgp@@YAXPBD0@Z3420x10080ac2
        ?GetOutput@ChildProcess@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3430x1004ac2f
        ?GetPathList@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@ABV?$basic_regex@DV?$regex_traits@D@std@@@std@@PAV?$vector@Vpath@filesystem@ierd_tgp@@V?$allocator@Vpath@filesystem@ierd_tgp@@@std@@@7@_N3@Z3440x100b1763
        ?GetPrivateKey@common@ierd_tgp@@YA?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z3450x1005fb0f
        ?GetQQList@common@ierd_tgp@@YAHAAV?$vector@KV?$allocator@K@std@@@std@@@Z3460x1001c770
        ?GetQQLoginList@common@ierd_tgp@@YAXAAKPADH@Z3470x1001ca8b
        ?GetRefererFromUrl@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@_N@Z3480x100cc8d5
        ?GetRootPathToLua@common@ierd_tgp@@YAPBDXZ3490x10080c68
        ?GetSaltKey@common@ierd_tgp@@YA?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@I@Z3500x1005fcef
        ?GetSecFromFileTime@Sys_wrapper@common@ierd_tgp@@SA_KKK@Z3510x100b196a
        ?GetSha1@ZEN_LIB@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_istream@DU?$char_traits@D@std@@@3@@Z3520x100a6d5e
        ?GetSha1Parts@ZEN_LIB@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_istream@DU?$char_traits@D@std@@@3@IAAV?$map@_KUSha1Part@ZEN_LIB@@U?$less@_K@std@@V?$allocator@U?$pair@$$CB_KUSha1Part@ZEN_LIB@@@std@@@4@@3@V?$function@$$A6AX_K0@Z@3@@Z3530x100a6f83
        ?GetSha1Parts@ZEN_LIB@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@IAAV?$map@_KUSha1Part@ZEN_LIB@@U?$less@_K@std@@V?$allocator@U?$pair@$$CB_KUSha1Part@ZEN_LIB@@@std@@@4@@3@V?$function@$$A6AX_K0@Z@3@@Z3540x100a735c
        ?GetSize@ShareMemory@Memory@ierd_tgp@@QBEKXZ3550x100a89c0
        ?GetStatus@BaseTimer@base@@QAE?AW4TimerStatus@2@XZ3560x1003ff59
        ?GetStrValueFromReg@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAUHKEY__@@ABV45@1_N@Z3570x100b19d9
        ?GetStringCharacters@common@ierd_tgp@@YAIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z3580x100abc9c
        ?GetSystemAvgCpuUsage@Sys_wrapper@common@ierd_tgp@@SAHXZ3590x100b1ce9
        ?GetSystemResolution@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3600x100b1db3
        ?GetTenioDLPath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3610x100cfe33
        ?GetTgpId@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ3620x1006c03f
        ?GetTgpWorkState@common@ierd_tgp@@YA?AW4EnumTgpTaskState@12@XZ3630x100c75c3
        ?GetTimeStampSignerInfo@Sys_wrapper@common@ierd_tgp@@SAHPAU_CMSG_SIGNER_INFO@@PAPAU4@PAU_FILETIME@@@Z3640x100b1e45
        ?GetTodayDateStr@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3650x100b2417
        ?GetTpfUiVfsPath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3660x100d0005
        ?GetTrace@CLogTrace@@SAPAV1@XZ3670x10016145
        ?GetTraceIdByType@InfoTraceSystem@trace_system@ierd_tgp@@QAEII@Z3680x1006c08a
        ?GetTraceInstanceID@InfoTraceSystem@trace_system@ierd_tgp@@QAE_K_KII@Z3690x1006c20a
        ?GetUIN@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ3700x1006c22e
        ?GetUpdatedFilePath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0@Z3710x100d0259
        ?GetUpdatedFilePathEx@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0AAK@Z3720x100d0296
        ?GetUpdatedFilePathv2@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W00AAK@Z3730x100d0ae3
        ?GetUrlProtocolFromCMD@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV45@@Z3740x100b25a0
        ?GetUrlProtocolFromCMD@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ3750x100b270f
        ?GetWeGameADVirtualPathA@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3760x100b275d
        ?GetWeGameADVirtualPathW@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ3770x100b27ca
        ?GetWeGameAppDataPathW@Sys_wrapper@common@ierd_tgp@@SA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z3780x100b2824
        ?GetWeGameInstallRegPathA@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ3790x100b2a0c
        ?GetWeGameInstallRegPathW@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ3800x100b2a79
        ?GetWegameProcessCount@util_multi_instance@ierd_tgp@@YAHXZ3810x100cd7f1
        ?GetXMLDataInt@common@ierd_tgp@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBEI0H@Z3820x100d7d67
        ?GetXMLDataStr@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@PBEI0ABV34@@Z3830x100d7f2b
        ?GetXMLDataStr@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@PBEI00@Z3840x100d7fd5
        ?GetZipItem@@YAKPAUHZIP__@@HPAUZIPENTRY@@@Z3850x100c8ef7
        ?H@md5@@AAEIIII@Z3860x100571f8
        ?HH@md5@@AAEXAAIIIIIII@Z3870x10057208
        ?HasModalExist@Sys_wrapper@common@ierd_tgp@@SA_NXZ3880x100b2ad3
        ?I@md5@@AAEIIII@Z3890x1005722d
        ?II@md5@@AAEXAAIIIIIII@Z3900x1005723f
        ?Init@CurlWrapper@curl_wrapper@ierd_tgp@@QAEXXZ3910x1005a59d
        ?Init@DumpManager@common@ierd_tgp@@QAEXII@Z3920x100c49fd
        ?Init@InfoTraceSystem@trace_system@ierd_tgp@@QAE_N_NV?$weak_ptr@VIInfoTraceSystemListener@trace_system@ierd_tgp@@@std@@@Z3930x1006c461
        ?Init@WndMsgReceiver@Tenio@@QAE_NPBD@Z3940x10023e55
        ?Init@md5@@QAEXXZ3950x1008868e
        ?InitMainThreadWarningComponent@common@ierd_tgp@@YAX_NIIII0@Z3960x100c76fb
        ?Instance@CurlWrapper@curl_wrapper@ierd_tgp@@SAAAV123@XZ3970x1005a5b2
        ?Instance@DumpManager@common@ierd_tgp@@SAAAV123@XZ3980x100c4c72
        ?Is64BitProcess@Sys_wrapper@common@ierd_tgp@@SA_NPAX@Z3990x100b2b46
        ?Is64Bit_OS@Sys_wrapper@common@ierd_tgp@@SA_NXZ4000x100b2b89
        ?IsCJKChar@common@ierd_tgp@@YAH_W@Z4010x100abd10
        ?IsDirectoryExist@common@ierd_tgp@@YA_NPBD@Z4020x10080d3e
        ?IsHighThanWin7@Sys_wrapper@common@ierd_tgp@@SA_NXZ4030x100b2bd5
        ?IsInited@WndMsgReceiver@Tenio@@QAE_NXZ4040x10023e7a
        ?IsLaptop@Sys_wrapper@common@ierd_tgp@@SA_NXZ4050x100b2c34
        ?IsOpen@ShareMemory@Memory@ierd_tgp@@QBEHXZ4060x100a89c4
        ?IsOverseasVer@overseas@ierd_tgp@@YAHXZ4070x1008e600
        ?IsPathPure@common@ierd_tgp@@YA_NPBD@Z4080x1008ec64
        ?IsProcessRunning@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@5@@Z4090x100b2cbf
        ?IsSSDDrive@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4100x100b3325
        ?IsStartFromUrlProtocol@Sys_wrapper@common@ierd_tgp@@SA_NXZ4110x100b3541
        ?IsSubWegameProcess@util_multi_instance@ierd_tgp@@YA_NXZ4120x100cd865
        ?IsSuspend@CThread@@QAEHXZ4130x1000f670
        ?IsUrlIp@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z4140x100d4413
        ?IsWin10_OS@Sys_wrapper@common@ierd_tgp@@SA_NXZ4150x100b3669
        ?IsWin7@Sys_wrapper@common@ierd_tgp@@SA_NXZ4160x100b37a2
        ?IsWow64@Sys_wrapper@common@ierd_tgp@@SA_NXZ4170x100b3806
        ?IsXpOs@Sys_wrapper@common@ierd_tgp@@SA_NXZ4180x100b3843
        ?IsZipHandleU@@YA_NPAUHZIP__@@@Z4190x100c8f39
        ?JsonAddQosTask@qos@adapt_for_imports@ierd_tgp@@YAXABUtagQOSRep@@AB_N_N@Z4200x10099283
        ?KillAllProcess@Sys_wrapper@common@ierd_tgp@@SA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4210x100b38a7
        ?LoadIconForOversea@overseas@ierd_tgp@@YAPAUHICON__@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4220x1008e615
        ?LoadStr@overseas@ierd_tgp@@YAPB_WV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4230x1008e6bb
        ?Lock@CShareMem@@QAEPAXAAH@Z4240x10022ee1
        ?Lock@CThreadLock@@QAEHH@Z4250x10023b71
        ?LockUserMem@CSimpleIPC@@IAEPAXAAH@Z4260x10022f3a
        ?LogFilter@CLogTrace@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z4270x10016184
        ?LuaGetFileSize@common@ierd_tgp@@YA_JPBD@Z4280x10080de2
        ?LuaRemoveFile@common@ierd_tgp@@YA_NPBD@Z4290x10080ea8
        ?MD5BigFileSafe@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@PAV12@@Z4300x100886be
        ?MD5Buffer@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PADI@Z4310x10088944
        ?MD5File@@YAPADPB_W@Z4320x100889c1
        ?MD5FileChunk@@YAKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_J1AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z4330x10088a8b
        ?MD5FileSafe@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z4340x10088c19
        ?MD5String2Hex@@YAXPADPBDH@Z4350x10088d05
        ?MD5String@@YAPADPAD@Z4360x10088d6e
        ?MD5StringEx@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z4370x10088dc2
        ?MainThreadTaskUpdate@common@ierd_tgp@@YAXXZ4380x100313ed
        ?ModifyFileAccessTrustee@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z4390x100b3dd1
        ?MonitorDump@DumpManager@common@ierd_tgp@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4EnumInfoLevel@123@_NK@Z4400x100c4d9a
        ?MovDirToDir@common@ierd_tgp@@YAXPBD0H0@Z4410x10080fea
        ?Notify@CSimpleIPC@@QAEHKKPAXH@Z4420x10022f7a
        ?Notify@CSimpleIPC@@QAEHKPAXH@Z4430x10023022
        ?OnIPCNotify@CSimpleIPC@@MAEXKPAXH@Z4440x10023112
        ?OnIPCWndMsg@CSimpleIPC@@AAEJPAUHWND__@@IIJ@Z4450x10023115
        ?OnRecvMsg@WndMsgReceiver2@Tenio@@EAEXPAUHWND__@@IIJ@Z4460x10023e7e
        ?OnUserMsg@CSimpleIPC@@MAEXIIJ@Z4470x10023112
        ?Open@ShareMemory@Memory@ierd_tgp@@QAEHXZ4480x100a89cd
        ?OpenProcessIdByName@Sys_wrapper@common@ierd_tgp@@SAPAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z4490x100b3f97
        ?OpenRegKey@common@ierd_tgp@@YA_NHPBD_NPAULuaHelperRegKey@12@@Z4500x100815d4
        ?OpenZip@@YAPAUHZIP__@@PAXIPBD@Z4510x100c9008
        ?OpenZip@@YAPAUHZIP__@@PB_WPBD@Z4520x100c9020
        ?OpenZipHandle@@YAPAUHZIP__@@PAXPBD@Z4530x100c9037
        ?ParseTime@common@ierd_tgp@@YA_JABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z4540x100d44a8
        ?PostMainThreadTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@V?$shared_ptr@X@4@@Z4550x1003144c
        ?PostMainThreadTaskv2@common@ierd_tgp@@YA_NV?$function@$$A6AXXZ@std@@V?$shared_ptr@X@4@@Z4560x100314ae
        ?PrefetchImage@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4570x100b493a
        ?PrintMD5@@YAPADQAE@Z4580x10088e34
        ?PrintMD5Ex@@YAXQAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z4590x10088ec1
        ?ProcIPCMsg@CSimpleIPC@@AAEXPAUTCOPYDATA@1@@Z4600x10023249
        ?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z4610x10031543
        ?PushUniqueThreadAsyncTask@common@ierd_tgp@@YAIV?$function@$$A6AXXZ@std@@IK@Z4620x1003158b
        ?QosTraceSystemError@common@ierd_tgp@@YAXW4EnumTraceSystemError@12@K@Z4630x100c7a00
        ?QosTraceTaskFiles@common@ierd_tgp@@YAXV_TGameID@12@IABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1ABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@5@_N@Z4640x100c7a42
        ?ReSetIconForShortcutLnk@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z4650x100b49d0
        ?ReSetIconForShortcutLnk@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00@Z4660x100b4cf6
        ?ReSetIconForShortcutLnkByLinkPath@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z4670x100b5104
        ?ReSetIconForShortcutLnkByLinkPathImpl@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z4680x100b54d4
        ?ReadIPCInfo@CSimpleIPC@@AAEXXZ4690x10023295
        ?ReadPeerList@CSimpleIPC@@AAEXPAXH@Z4700x100232ce
        ?ReadPrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00AAV45@1@Z4710x100b563a
        ?ReadPrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAHAAV45@@Z4720x100b58d0
        ?RedirectIconLnk@Sys_wrapper@common@ierd_tgp@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z4730x100b599b
        ?RedirectIconLnk@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@000@Z4740x100b5dd1
        ?RegexSearch@common@ierd_tgp@@YA_NPBD0@Z4750x10081758
        ?ReleaseUserLogger@base@@YAXPAVILogger@1@@Z4760x10029007
        ?ReleaseXMLConfig@common@ierd_tgp@@YAXPAPAVCTXMLConfig@12@@Z4770x100d8488
        ?RemoveDir@common@ierd_tgp@@YAXPBD0@Z4780x100818d9
        ?RemoveDir@silence_update@common@ierd_tgp@@KAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4790x100d1172
        ?RemovePathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4800x100d1305
        ?ReplaceForbiddenChar@common@ierd_tgp@@YAXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4810x1008ed1b
        ?ReportFailedTask@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1@Z4820x100938e9
        ?ReportFailedTask@qos@adapt_for_imports@ierd_tgp@@YAXXZ4830x100996ad
        ?Resume@CThread@@QAEXXZ4840x100239e4
        ?ResumeProcess@Sys_wrapper@common@ierd_tgp@@SA_NI@Z4850x100b6023
        ?Run@ChildProcess@common@ierd_tgp@@QAE_NPBD_N@Z4860x1004ae66
        ?SaveFailedTask@qos@adapt_for_imports@ierd_tgp@@YAXXZ4870x10099860
        ?SaveOfflineReportData@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z4880x10093e59
        ?SendAsynMsg@CSimpleIPC@@IAEXIIJ@Z4890x10023374
        ?SetCrashInfo@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABUCrashInfo@234@@Z4900x10093ed1
        ?SetCurrentStage@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXW4ProcessStage@234@@Z4910x10093eeb
        ?SetDesktopWallpaper@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4EnumWallpaperStyle@23@@Z4920x100b61f1
        ?SetFileAccessTrustee@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z4930x100b6333
        ?SetFileAccessTrustee@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4940x100b6389
        ?SetFileAuthority@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z4950x100b67b7
        ?SetFileAuthority@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z4960x100b687c
        ?SetGamePromoteId@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z4970x10093efe
        ?SetInterval@BaseTimer@base@@QAEXI@Z4980x1003ffa5
        ?SetIsMultiInstance@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_N@Z4990x10093f23
        ?SetLastLoginedUin@common@ierd_tgp@@YAX_K@Z5000x1001cb36
        ?SetLastLoginedWegameId@common@ierd_tgp@@YAXI@Z5010x1001cc60
        ?SetLoginOK@InfoTraceSystem@trace_system@ierd_tgp@@QAEXI@Z5020x1006c662
        ?SetLoginTgpid@InfoTraceSystem@trace_system@ierd_tgp@@QAEXI@Z5030x1006c675
        ?SetLoginUin@InfoTraceSystem@trace_system@ierd_tgp@@QAEXI@Z5040x1006c68b
        ?SetMonitorInfo@DumpManager@common@ierd_tgp@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z5050x100c51e6
        ?SetOffline@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_N@Z5060x10094d8e
        ?SetPriority@CThread@@QAEHH@Z5070x10023a02
        ?SetRegValue@Sys_wrapper@common@ierd_tgp@@SAKPAUHKEY__@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@11@Z5080x100b6d2c
        ?SetStartForID@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_K@Z5090x10094f20
        ?SetTraceIdInfo@InfoTraceSystem@trace_system@ierd_tgp@@QAEX_K_NN@Z5100x1006c6a1
        ?SetUnzipBaseDir@@YAKPAUHZIP__@@PB_W@Z5110x100c90ca
        ?SetWallpaper@common@ierd_tgp@@YA_NPBDH@Z5120x10081c41
        ?SetXMLDataInt@common@ierd_tgp@@YAKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBEI0H@Z5130x100d84b0
        ?SetXMLDataStr@common@ierd_tgp@@YAKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBEI00@Z5140x100d87a5
        ?SetXMLDataStr@common@ierd_tgp@@YAKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBEI0ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z5150x100d8ac4
        ?Sha256@ZEN_LIB@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z5160x100a7490
        ?SimpleCreateProcess@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z5170x100b6e9e
        ?SomeFileMissing@Sys_wrapper@common@ierd_tgp@@SA_NABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z5180x100b6ef1
        ?SplitStringBySeperator@common@ierd_tgp@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z5190x100d453f
        ?SplitStringBySeperator@common@ierd_tgp@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0PAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z5200x100d460a
        ?StartInterval@BaseTimer@base@@QAE_NIV?$function@$$A6AXXZ@std@@I@Z5210x1003fffe
        ?StartThread@CThread@@QAEHPAXH@Z5220x10023a28
        ?StartTimeout@BaseTimer@base@@QAE_NIV?$function@$$A6AXXZ@std@@@Z5230x1004003c
        ?StartTimerTaskOnce@base@@YA_NIV?$function@$$A6AXXZ@std@@@Z5240x10040079
        ?StartWith@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z5250x100d46d5
        ?StartWith@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z5260x100d471d
        ?Stop@BaseTimer@base@@QAEX_N@Z5270x10040118
        ?StopAndJoinAsyncTaskMgr@common@ierd_tgp@@YAXXZ5280x100315da
        ?StopThread@CThread@@QAEXXZ5290x10023a7b
        ?String2Uint16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAG@Z5300x100aa69c
        ?SupportManifestETW@common@ierd_tgp@@YA_NXZ5310x100c7d1d
        ?Suspend@CThread@@QAEXXZ5320x10023aaa
        ?SuspendProcess@Sys_wrapper@common@ierd_tgp@@SA_NI@Z5330x100b6f9d
        ?SymDeCrypt@CSymmetryString@ieg_common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z5340x100237ad
        ?SymEnCrypt@CSymmetryString@ieg_common@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z5350x1002381c
        ?TaskBarPin@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z5360x100b6fe1
        ?Terminate@CThread@@QAEXXZ5370x10023acb
        ?TerminateProcess@Sys_wrapper@common@ierd_tgp@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z5380x100b74af
        ?ThreadFun@CThread@@QAEKPAX@Z5390x10023ad3
        ?ToHex@common@ierd_tgp@@YAEABE@Z5400x100aa736
        ?TraceInfo@InfoTraceSystem@trace_system@ierd_tgp@@QAE_N_KABUTraceInformation@23@@Z5410x1006c835
        ?Transform@md5@@AAEXPAE@Z5420x10088f67
        ?TransformQosStr@qos@adapt_for_imports@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z5430x10094f36
        ?UnInit@DumpManager@common@ierd_tgp@@QAEXXZ5440x100c520f
        ?UnInit@InfoTraceSystem@trace_system@ierd_tgp@@QAEXXZ5450x1006c9f4
        ?UnLock@CShareMem@@QAEXXZ5460x100233ef
        ?UnLock@CThreadLock@@QAEXXZ5470x10023bad
        ?UnLockUserMem@CSimpleIPC@@IAEXXZ5480x10023404
        ?UnZipToDir@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z5490x100de2b3
        ?UnZipToDir@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z5500x100de339
        ?UnZipToDirLua@common@ierd_tgp@@YAXPBD00@Z5510x10081ee6
        ?Uninit@CurlWrapper@curl_wrapper@ierd_tgp@@QAEXXZ5520x1005a612
        ?Uninit@WndMsgReceiver@Tenio@@QAE_NXZ5530x10023ecf
        ?UnlockByRename@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z5540x100b75ad
        ?UnzipItem@@YAKPAUHZIP__@@HPAXI@Z5550x100c950e
        ?UnzipItem@@YAKPAUHZIP__@@HPB_W@Z5560x100c9529
        ?UnzipItemHandle@@YAKPAUHZIP__@@HPAX@Z5570x100c9543
        ?Update@InfoTraceSystem@trace_system@ierd_tgp@@QAEXXZ5580x1006ca7f
        ?Update@md5@@QAEXPAEI@Z5590x10089641
        ?VerifyCertInfo@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z5600x100b7c31
        ?VerifyCertInfoByName@Sys_wrapper@common@ierd_tgp@@SA_NPB_W0PAV?$vector@U_FILETIME@@V?$allocator@U_FILETIME@@@std@@@std@@@Z5610x100b8183
        ?WaitFor@CThread@@QAEXXZ5620x10023b08
        ?WaitForStop@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NI@Z5630x10094f7e
        ?WriteHeaderCallback@CurlWrapper@curl_wrapper@ierd_tgp@@CAIPADIIPAX@Z5640x1005a624
        ?WriteIPCInfo@CSimpleIPC@@AAEXXZ5650x1002340c
        ?WritePeerList@CSimpleIPC@@AAEXPAXHH@Z5660x10023453
        ?WritePrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z5670x100b8c94
        ?WritePrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0H0@Z5680x100b8e11
        ?ZipFilesToFile@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@0@Z5690x100de367
        ?ZipFilesToFile@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@0@Z5700x100de499
        ?ZipFilesToFile@common@ierd_tgp@@YA_NABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z5710x100de5a1
        ?ZipFilesToFile@common@ierd_tgp@@YA_NABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z5720x100de68b
        ?_DoCreate@ShareMemory@Memory@ierd_tgp@@AAEHXZ5730x100a89f5
        ?_DoOpen@ShareMemory@Memory@ierd_tgp@@AAEHXZ5740x100a8a30
        ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z5750x10060948
        ?add_common_int@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABH@Z5760x1009537c
        ?add_common_string@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z5770x100953ce
        ?add_config@Component_mgr@common@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0H@Z5780x10057542
        ?add_or_update_switch@blink@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4blink_browser_type@12@@Z5790x10040ff5
        ?add_or_update_switch@blink@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4blink_browser_type@12@@Z5800x100411d7
        ?ajust_ie_security_protocol@game_misc@ierd_tgp@@YAXXZ5810x10065b6c
        ?appdata_project_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ5820x10045ee9
        ?append_separator_if_needed@path@filesystem@ierd_tgp@@AAEIXZ5830x10060c93
        ?assign@directory_entry@filesystem@ierd_tgp@@QAEXABVpath@23@Vfile_status@23@1@Z5840x1001d497
        ?backup_cfg_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ5850x100460b6
        ?base64_decode@AS_communication_helper@common@ierd_tgp@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@EV?$allocator@E@std@@@5@@Z5860x10027e9a
        ?base64_encode@AS_communication_helper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBEI@Z5870x10028071
        ?before_exit@Application@common@ierd_tgp@@EAEXXZ5880x1001fba0
        ?begin@path@filesystem@ierd_tgp@@QBE?AViterator@123@XZ5890x10060cdc
        ?bin_to_hexstr@common@ierd_tgp@@YA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAEI@Z5900x100aa74c
        ?c_str@path@filesystem@ierd_tgp@@QBEPB_WXZ5910x1001d4c2
        ?cal_crc@common@ierd_tgp@@YAIIPAEI@Z5920x1005a0a7
        ?calc_crc@common@ierd_tgp@@YAIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z5930x1005a0fd
        ?canonical@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z5940x10061452
        ?canonical@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0AAVerror_code@std@@@Z5950x10061497
        ?canonical@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@AAVerror_code@std@@@Z5960x100614cf
        ?cfg_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ5970x100460f5
        ?cfg_folder_appdata@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ5980x1004616f
        ?check_hosts@game_misc@ierd_tgp@@YA_NV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z5990x1005e360
        ?clear@path@filesystem@ierd_tgp@@QAEXXZ6000x1001d501
        ?clear_ie_cache@game_misc@ierd_tgp@@YAXAC_N@Z6010x10065e14
        ?close@Shared_mem_obj@acce_common@@QAEXXZ6020x10024390
        ?close@Shared_mem_obj@common@ierd_tgp@@QAEXXZ6030x100a9c37
        ?colon@path@filesystem@ierd_tgp@@2_WB6040x1029e0d8
        ?compare@path@filesystem@ierd_tgp@@QBEHABV123@@Z6050x10061522
        ?compare@path@filesystem@ierd_tgp@@QBEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z6060x1001d5e4
        ?compare@path@filesystem@ierd_tgp@@QBEHPB_W@Z6070x1001d630
        ?compare@version_t@common@ierd_tgp@@QAEHU123@@Z6080x10060310
        ?compare_ver@common@ierd_tgp@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z6090x100d5faf
        ?compare_ver@common@ierd_tgp@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z6100x100d5ffd
        ?compare_ver@common@ierd_tgp@@YAHAB_K0@Z6110x100d611f
        ?connect@Syn_tcp@common@ierd_tgp@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GI@Z6120x100ac0e4
        ?convert_ver@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AB_K@Z6130x100d6154
        ?convert_ver@common@ierd_tgp@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_K@Z6140x100d6194
        ?convert_ver@common@ierd_tgp@@YAHAB_KAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z6150x100d628b
        ?convert_ver@common@ierd_tgp@@YA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z6160x100d6336
        ?convert_ver_uint32@common@ierd_tgp@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAI@Z6170x100d6359
        ?convert_ver_uint32@common@ierd_tgp@@YAHIAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z6180x100d6434
        ?copy@filesystem@ierd_tgp@@YAXABVpath@12@0@Z6190x1006168c
        ?copy@filesystem@ierd_tgp@@YAXABVpath@12@0AAVerror_code@std@@@Z6200x100616b1
        ?copy_directory@filesystem@ierd_tgp@@YAXABVpath@12@0@Z6210x10061705
        ?copy_directory@filesystem@ierd_tgp@@YAXABVpath@12@0AAVerror_code@std@@@Z6220x1006172a
        ?copy_file@filesystem@ierd_tgp@@YAXABVpath@12@0@Z6230x10061784
        ?copy_file@filesystem@ierd_tgp@@YAXABVpath@12@0AAVerror_code@std@@@Z6240x100617ab
        ?copy_file@filesystem@ierd_tgp@@YAXABVpath@12@0W4copy_option@12@@Z6250x100617c3
        ?copy_file@filesystem@ierd_tgp@@YAXABVpath@12@0W4copy_option@12@AAVerror_code@std@@@Z6260x100617eb
        ?crack_url@net@ierd_tgp@@YA_NPBDPAUurl_components_t@12@I@Z6270x1008a67f
        ?create_directories@filesystem@ierd_tgp@@YA_NABVpath@12@@Z6280x100619ad
        ?create_directories@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z6290x100619ce
        ?create_directory@filesystem@ierd_tgp@@YA_NABVpath@12@@Z6300x10061aaa
        ?create_directory@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z6310x10061acb
        ?create_directory_ex@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z6320x100ba42e
        ?create_directory_ex@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z6330x100ba4ee
        ?create_directory_for_file@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z6340x100ba5fe
        ?create_directory_for_file@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z6350x100ba655
        ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@AAVerror_code@std@@@Z6360x10061b9a
        ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@XZ6370x10061bcb
        ?current_path@filesystem@ierd_tgp@@YAXABVpath@12@@Z6380x10061c09
        ?current_path@filesystem@ierd_tgp@@YAXABVpath@12@AAVerror_code@std@@@Z6390x10061c2a
        ?decode_qrcode@common@ierd_tgp@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z6400x1009bfa7
        ?decode_stream@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_istream@DU?$char_traits@D@std@@@4@AAV?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z6410x1005f60a
        ?decode_string@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z6420x1005f6ba
        ?decode_string@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z6430x1005f6d5
        ?decode_string_ex@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z6440x1005f6ee
        ?decode_url@common@ierd_tgp@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z6450x100cc9bd
        ?decode_vec@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$vector@EV?$allocator@E@std@@@std@@@std@@@std@@AAV?$vector@EV?$allocator@E@std@@@4@@Z6460x1005f72f
        ?decode_vec_ex@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$vector@EV?$allocator@E@std@@@std@@@std@@@std@@AAV?$vector@EV?$allocator@E@std@@@4@@Z6470x1005f74a
        ?depth@recursive_directory_iterator@filesystem@ierd_tgp@@QBEHXZ6480x1001d9d4
        ?dir_itr_close@detail@filesystem@ierd_tgp@@YAXAAPAX@Z6490x10061c2f
        ?dir_select_dialog@Sys_wrapper@common@ierd_tgp@@SA_NPAUHWND__@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV56@H@Z6500x100ba6d1
        ?directory_iterator_construct@detail@filesystem@ierd_tgp@@YAXAAVdirectory_iterator@23@ABVpath@23@PAVerror_code@std@@@Z6510x10061ec1
        ?directory_iterator_increment@detail@filesystem@ierd_tgp@@YAXAAVdirectory_iterator@23@PAVerror_code@std@@@Z6520x10062060
        ?disable_recursion_pending@recursive_directory_iterator@filesystem@ierd_tgp@@QAEX_N@Z6530x1001d9da
        ?disconnect@Syn_tcp@common@ierd_tgp@@QAEXXZ6540x100ac55d
        ?disk_is_fixed_remote@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z6550x100ba9d5
        ?dot@path@filesystem@ierd_tgp@@2_WB6560x1029e0d4
        ?dyn_comp_mgr_find_component@@YA?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@common@ierd_tgp@@@Z6570x10057618
        ?empty@path@filesystem@ierd_tgp@@QBE_NXZ6580x1001da2e
        ?enable_app_session_end@common@ierd_tgp@@YAX_N@Z6590x10046b24
        ?enable_offline_mode_on@common@ierd_tgp@@YAX_N@Z6600x10046b31
        ?enable_one_more_instance@common@ierd_tgp@@YAX_N@Z6610x10046b3e
        ?enable_profile_on@common@ierd_tgp@@YAX_N@Z6620x10046b4b
        ?enable_static_detail_log@common@ierd_tgp@@YAX_N@Z6630x10046b58
        ?encode_qrcode@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z6640x1009c698
        ?encode_stream@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_ofstream@DU?$char_traits@D@std@@@std@@@std@@@std@@AAV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@4@AAV?$basic_ofstream@DU?$char_traits@D@std@@@4@@Z6650x1005f788
        ?encode_string@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z6660x1005f7ef
        ?encode_string@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z6670x1005f80a
        ?encode_string_ex@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z6680x1005f823
        ?encode_url@common@ierd_tgp@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z6690x100ccaf5
        ?encode_vec@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$vector@EV?$allocator@E@std@@@std@@@std@@@std@@AAV?$vector@EV?$allocator@E@std@@@4@@Z6700x1005f864
        ?encode_vec_ex@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$vector@EV?$allocator@E@std@@@std@@@std@@@std@@AAV?$vector@EV?$allocator@E@std@@@4@@Z6710x1005f87f
        ?end@path@filesystem@ierd_tgp@@QBE?AViterator@123@XZ6720x1006232a
        ?equal@directory_iterator@filesystem@ierd_tgp@@QBE_NABV123@@Z6730x1001dabc
        ?equal@iterator@path@filesystem@ierd_tgp@@QBE_NABV1234@@Z6740x1001daec
        ?equal@recursive_directory_iterator@filesystem@ierd_tgp@@ABE_NABV123@@Z6750x1001db0c
        ?equivalent@filesystem@ierd_tgp@@YA_NABVpath@12@0@Z6760x1006258a
        ?equivalent@filesystem@ierd_tgp@@YA_NABVpath@12@0AAVerror_code@std@@@Z6770x100625af
        ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z6780x1006277a
        ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z6790x1006279b
        ?exit_app@Application@common@ierd_tgp@@QAEXH@Z6800x10026e88
        ?export_crt_file@util_curl_certificate@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z6810x100cd448
        ?extension@path@filesystem@ierd_tgp@@QBE?AV123@XZ6820x100627c4
        ?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z6830x1008edb4
        ?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z6840x1008eec7
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z6850x100baaba
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z6860x100babc5
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAI@Z6870x100baca3
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV45@@Z6880x100bad81
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_J@Z6890x100bae2f
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_K@Z6900x100baf10
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV45@@Z6910x100baff1
        ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@@Z6920x100bb125
        ?extract_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z6930x1008ef31
        ?extract_path@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z6940x1008f04b
        ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z6950x1008f0bb
        ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z6960x1008f111
        ?file_get_version@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAUversion_t@12@@Z6970x1006035a
        ?file_size@filesystem@ierd_tgp@@YA_KABVpath@12@@Z6980x10062991
        ?file_size@filesystem@ierd_tgp@@YA_KABVpath@12@AAVerror_code@std@@@Z6990x100629b2
        ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ7000x100629bb
        ?filename_is_dot@path@filesystem@ierd_tgp@@QBE_NXZ7010x10062ab0
        ?filename_is_dot_dot@path@filesystem@ierd_tgp@@QBE_NXZ7020x10062af8
        ?find_component@Component_mgr@common@ierd_tgp@@QAE?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@23@@Z7030x1005774d
        ?from_json@jsonbind@@YAHPAXABVValue@Json@@@Z7040x10078c26
        ?gen_id_by_name@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@0@Z7050x100655e0
        ?gen_relative_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@@Z7060x1008f132
        ?gen_seq_num@@YAGXZ7070x10052bf6
        ?genric_string@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7080x10062dcd
        ?genric_wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ7090x10062e57
        ?get_app_path_ex_m@Application@common@ierd_tgp@@QAE?AVpath@filesystem@3@XZ7100x100270f2
        ?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z7110x1002712b
        ?get_app_sub_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7120x10027199
        ?get_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBE_KXZ7130x10095448
        ?get_cert_pwd@util_curl_certificate@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7140x100cd5ab
        ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z7150x10046f4f
        ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N3@Z7160x10046f69
        ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z7170x10046fb1
        ?get_cfg_module_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ7180x10047246
        ?get_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBEHXZ7190x10095452
        ?get_client_id@util_client_info@ierd_tgp@@YAHXZ7200x100cce08
        ?get_client_type@overseas@ierd_tgp@@YAHXZ7210x1008e7cd
        ?get_client_version_type@overseas@ierd_tgp@@YAHXZ7220x1008e999
        ?get_coexist_name@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z7230x100cd8ee
        ?get_coexist_name_w@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z7240x100cd99f
        ?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ7250x10057882
        ?get_cpu_brand@common@ierd_tgp@@YA_NPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7260x10059b94
        ?get_cpu_id@common@ierd_tgp@@YA_NPA_K@Z7270x10059c0a
        ?get_cpu_info@common@ierd_tgp@@YA_NPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7280x10059c66
        ?get_cpu_name@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7290x100bb1d3
        ?get_cur_module_path@silence_update@common@ierd_tgp@@KA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ7300x100d16fd
        ?get_current_language@overseas@ierd_tgp@@YAHXZ7310x1008e9ae
        ?get_current_language_string@overseas@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7320x1008e9f2
        ?get_current_region@overseas@ierd_tgp@@YAHXZ7330x1008ea51
        ?get_debug_value@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W000@Z7340x1005bfa4
        ?get_debug_value@common@ierd_tgp@@YAHPB_W0H0@Z7350x1005c04a
        ?get_exe_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7360x100272b0
        ?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ7370x10027323
        ?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_K@Z7380x1008f20c
        ?get_file_count@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z7390x1008f273
        ?get_file_path_by_key@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z7400x100474d9
        ?get_file_size@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_K@Z7410x1008f4ec
        ?get_file_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z7420x1008f553
        ?get_first_cpu_id@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7430x10087ac9
        ?get_first_mac2@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7440x10087c98
        ?get_first_mac@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7450x10088095
        ?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_K@Z7460x1008f5db
        ?get_folder_size@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_K@Z7470x1008f642
        ?get_free_space@Sys_wrapper@common@ierd_tgp@@SA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_N@Z7480x100bb3a3
        ?get_free_space@Sys_wrapper@common@ierd_tgp@@SA_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_N@Z7490x100bb6d3
        ?get_game_launcher_flag@common@ierd_tgp@@YA_NXZ7500x10047b6a
        ?get_game_launcher_msg@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7510x10047b70
        ?get_game_path_by_tcls@util_version_cfg@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z7520x100d2006
        ?get_global_proxy_info@net@ierd_tgp@@YA_NPAUproxy_info_t@12@@Z7530x1008b444
        ?get_graphic_card_name@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7540x100bb9fc
        ?get_hdd_name@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7550x100bba98
        ?get_ie_version@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7560x100bbbb8
        ?get_largest_free_driver_hd@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7570x100bbc77
        ?get_largest_free_driver_hd_api@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV45@@Z7580x100bbea8
        ?get_largest_free_driver_hd_api@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$list@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@@Z7590x100bc03d
        ?get_largest_free_driver_hd_api@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7600x100bc1fb
        ?get_largest_free_driver_hd_wmi@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7610x100bc375
        ?get_last_result@Tcp_port_detect@game_misc@ierd_tgp@@QAEXAAU_Tcp_port_detect_result@23@@Z7620x100bf9cb
        ?get_last_result@port_scan@game_misc@ierd_tgp@@QAEXAAU_Scan_result@23@@Z7630x10090f1b
        ?get_last_result@server_detect@game_misc@ierd_tgp@@QAEXAAU_Detect_result@23@@Z7640x100a3d31
        ?get_local_drivers_hd@Sys_wrapper@common@ierd_tgp@@SAXAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z7650x100bcd9b
        ?get_log_instance@base@@YAPAVILogger@1@XZ7660x10039aa6
        ?get_mac_name@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7670x100bcee0
        ?get_machine_guid@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7680x10027350
        ?get_machine_guid@Qos@qos@adapt_for_imports@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7690x10095492
        ?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7700x1002737d
        ?get_memory_size@Sys_wrapper@common@ierd_tgp@@SAXAAK0@Z7710x100bcf32
        ?get_offline_login_account@common@ierd_tgp@@YA_KXZ7720x10047c08
        ?get_prefix@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7730x100cda21
        ?get_prefix_w@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ7740x100cdaf9
        ?get_process_count@util_multi_instance@ierd_tgp@@YAHPBD@Z7750x100cdb6d
        ?get_proxy_config@net@ierd_tgp@@YA_NPAUproxy_config_t@12@@Z7760x1008b4b5
        ?get_proxy_for_url@net@ierd_tgp@@YA_NPBDPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7770x1008b6b9
        ?get_proxy_for_url@net@ierd_tgp@@YA_NPB_WPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z7780x1008b7b0
        ?get_proxy_for_url_v2@net@ierd_tgp@@YA_NPBDPAUproxy_info_t@12@@Z7790x1008ba3b
        ?get_proxy_for_url_v2@net@ierd_tgp@@YA_NPB_WPAUproxy_info_t@12@@Z7800x1008bad6
        ?get_proxy_info@net@ierd_tgp@@YA_NPAUproxy_info_t@12@@Z7810x1008bcdd
        ?get_qm_report_guid@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7820x100849cc
        ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ7830x100954c3
        ?get_qq_skey_value@CurlWrapper@curl_wrapper@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV45@_N@Z7840x1005a6ca
        ?get_quick_login_uin@common@ierd_tgp@@YAKXZ7850x10047c14
        ?get_ret@Application@common@ierd_tgp@@QBEHXZ7860x10027410
        ?get_root_path@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7870x1008f939
        ?get_root_path_w@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ7880x1008f9b7
        ?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7890x1002741c
        ?get_sh_folder@Sys_wrapper@common@ierd_tgp@@SA?AVpath@filesystem@3@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z7900x100bcf81
        ?get_sys_drive@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7910x100bd248
        ?get_sys_driver_free_space@Sys_wrapper@common@ierd_tgp@@SA_KXZ7920x100bd346
        ?get_system_all_build_version@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7930x100bd3f6
        ?get_system_build_version@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7940x100bd535
        ?get_system_hardware@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7950x100bd659
        ?get_system_name@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ7960x100bd833
        ?get_tcls_path@util_version_cfg@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z7970x100d2224
        ?get_tcls_path@util_version_cfg@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z7980x100d22d5
        ?get_ver@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAAUversion_t@common@4@@Z7990x100954c8
        ?get_version@Application@common@ierd_tgp@@UAE?AUversion_t@23@XZ8000x10027519
        ?get_version@silence_update@common@ierd_tgp@@KA?AUversion_t@@PB_W@Z8010x100d179d
        ?get_workingdir_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ8020x1002755c
        ?get_workingdir_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ8030x100275c3
        ?guid_to_string@common@ierd_tgp@@YA_NABU_GUID@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8040x100aa7bb
        ?has_extension@path@filesystem@ierd_tgp@@QBE_NXZ8050x1001e541
        ?has_filename@path@filesystem@ierd_tgp@@QBE_NXZ8060x1001e575
        ?has_parent_path@path@filesystem@ierd_tgp@@QBE_NXZ8070x1001e57d
        ?has_root_directory@path@filesystem@ierd_tgp@@QBE_NXZ8080x1001e5b1
        ?has_root_name@path@filesystem@ierd_tgp@@QBE_NXZ8090x1001e5e5
        ?has_root_path@path@filesystem@ierd_tgp@@QBE_NXZ8100x1001e619
        ?has_stem@path@filesystem@ierd_tgp@@QBE_NXZ8110x1001e636
        ?hexstr_to_bin@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAPAEPAI@Z8120x100aa81e
        ?if_driver_valid@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV45@@Z8130x100bda73
        ?in_same_driver@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z8140x100bdb4d
        ?increment@recursive_directory_iterator@filesystem@ierd_tgp@@AAEXXZ8150x1001e778
        ?increment@recursive_directory_iterator@filesystem@ierd_tgp@@QAEAAV123@AAVerror_code@std@@@Z8160x1001e797
        ?init@Asy_udp@common@ierd_tgp@@QAE_NV?$function@$$A6AXPBDIV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@G@Z@std@@I@Z8170x1002e508
        ?init@Component_mgr@common@ierd_tgp@@QAE_NXZ8180x1005795e
        ?init_comm_center@@YAXXZ8190x10052c7d
        ?init_comm_center_event_hook@@YAXPAXP6AX0PBD@Z@Z8200x10052cd7
        ?init_remote_sender@@YAXHP6AXHPBDH@Z@Z8210x10052cec
        ?inited@Component_mgr@common@ierd_tgp@@QAEXXZ8220x1001fba0
        ?initial_path@filesystem@ierd_tgp@@YA?AVpath@12@AAVerror_code@std@@@Z8230x10062fdf
        ?initial_path@filesystem@ierd_tgp@@YA?AVpath@12@XZ8240x10063010
        ?instance@Application@common@ierd_tgp@@SAPAV123@XZ8250x100275f5
        ?instance@comp_mgr_instace@common@ierd_tgp@@SAAAVComponent_mgr@23@XZ8260x100275fb
        ?instance@qos_instace@qos@adapt_for_imports@ierd_tgp@@SAAAVQos@234@XZ8270x10057a7d
        ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ8280x1001e91a
        ?is_app_session_end@common@ierd_tgp@@YA_NXZ8290x10047d95
        ?is_certificate_open@util_curl_certificate@ierd_tgp@@YA_NXZ8300x100cd770
        ?is_connected@Syn_tcp@common@ierd_tgp@@QAE_NXZ8310x100ac62a
        ?is_directory@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8320x1008fa1c
        ?is_directory@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z8330x1008fa72
        ?is_directory@filesystem@ierd_tgp@@YA_NABVpath@12@@Z8340x1006304e
        ?is_directory@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z8350x1006306f
        ?is_empty@filesystem@ierd_tgp@@YA_NABVpath@12@@Z8360x1006315d
        ?is_empty@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z8370x1006317e
        ?is_ie_cache_exist@game_misc@ierd_tgp@@YA_NAC_N@Z8380x10065e25
        ?is_ie_security_protocol_abnormal@game_misc@ierd_tgp@@YA_NXZ8390x10065e3b
        ?is_number@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8400x100aa8fd
        ?is_offline_mode_on@common@ierd_tgp@@YA_NXZ8410x10047d9b
        ?is_one_more_instance@common@ierd_tgp@@YA_NXZ8420x10047da1
        ?is_other@filesystem@ierd_tgp@@YA_NABVpath@12@@Z8430x1006324e
        ?is_other@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z8440x1006326f
        ?is_profile_on@common@ierd_tgp@@YA_NXZ8450x10047da7
        ?is_reference_to_same_file@common@ierd_tgp@@YA_NPB_W0@Z8460x1008faca
        ?is_regular_file@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8470x1008fd53
        ?is_regular_file@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z8480x1008fda9
        ?is_regular_file@filesystem@ierd_tgp@@YA_NABVpath@12@@Z8490x100632b4
        ?is_regular_file@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z8500x100632d5
        ?is_relative@path@filesystem@ierd_tgp@@QBE_NXZ8510x1001e939
        ?is_relative_path@common@ierd_tgp@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8520x1008fe01
        ?is_relative_path@common@ierd_tgp@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z8530x1008fe65
        ?is_restart_after_update@common@ierd_tgp@@YA_NXZ8540x10047dad
        ?is_shared_mem_exist@acce_common@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8550x10023fe4
        ?is_shared_mem_exist@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8560x100a90b2
        ?is_shared_mem_version_match@acce_common@@YA_NPBXI@Z8570x10024026
        ?is_shared_mem_version_match@common@ierd_tgp@@YA_NPBXK@Z8580x100a90f4
        ?is_start_from_host@common@ierd_tgp@@YA_NXZ8590x10047db3
        ?is_static_detail_log@common@ierd_tgp@@YA_NXZ8600x10047db9
        ?is_symlink@filesystem@ierd_tgp@@YA_NABVpath@12@@Z8610x10063475
        ?is_symlink@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z8620x10063496
        ?join_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z8630x1008feb9
        ?js_escape@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z8640x100aa92b
        ?last_write_time@filesystem@ierd_tgp@@YAXABVpath@12@_J@Z8650x10063675
        ?last_write_time@filesystem@ierd_tgp@@YAXABVpath@12@_JAAVerror_code@std@@@Z8660x1006369d
        ?last_write_time@filesystem@ierd_tgp@@YA_JABVpath@12@@Z8670x100636b6
        ?last_write_time@filesystem@ierd_tgp@@YA_JABVpath@12@AAVerror_code@std@@@Z8680x100636d7
        ?level@recursive_directory_iterator@filesystem@ierd_tgp@@QBEHXZ8690x1001d9d4
        ?load_config@Component_mgr@common@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8700x10057a82
        ?load_proxy_param@common_helper@net@ierd_tgp@@YAXPBDPAUProxy_info@game_loader@3@@Z8710x1008c4ba
        ?load_proxy_param@common_helper@net@ierd_tgp@@YAXPBDPAX@Z8720x1008c596
        ?load_proxy_param@tclt_helper@net@ierd_tgp@@YAXPBDPAU_TCLT_PROXY_PARAM@@@Z8730x1008c6dd
        ?load_proxy_param@wgl_helper@net@ierd_tgp@@YAXPBDPAUstWeGameLoginProxyInfo@wgl@@@Z8740x1008c83d
        ?load_proxy_settings@client_helper@net@ierd_tgp@@YAXPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8750x1008c984
        ?loc_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z8760x100abfb7
        ?loc_to_u16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z8770x100aab61
        ?loc_to_u8@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z8780x100aabfa
        ?m_get_status@directory_entry@filesystem@ierd_tgp@@ABE?AVfile_status@23@PAVerror_code@std@@@Z8790x100637dd
        ?m_get_symlink_status@directory_entry@filesystem@ierd_tgp@@ABE?AVfile_status@23@PAVerror_code@std@@@Z8800x1006386e
        ?make_dir_exist@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z8810x1008ff87
        ?md5@ZEN_LIB@@YAPAEPBEIQAE@Z8820x100a784c
        ?name@Shared_mem_obj@acce_common@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ8830x1002439b
        ?name@Shared_mem_obj@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ8840x100a9c42
        ?native@path@filesystem@ierd_tgp@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ8850x1001bd20
        ?new_win_shared_mem@acce_common@@YAPAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAA_N_N@Z8860x10024047
        ?new_win_shared_mem@common@ierd_tgp@@YAPAVwindows_shared_memory@interprocess@boost@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KAA_N_N@Z8870x100a9138
        ?no_push@recursive_directory_iterator@filesystem@ierd_tgp@@QAEX_N@Z8880x1001d9da
        ?no_push_pending@recursive_directory_iterator@filesystem@ierd_tgp@@QBE_NXZ8890x1001eb6e
        ?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z8900x1008dac4
        ?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z8910x1008dd03
        ?oi_symmetry_encrypt2_len@@YAHH@Z8920x1008df3f
        ?open@Shared_mem_obj@acce_common@@QAEPAXW4SharedMemOpenMode@2@_N@Z8930x10024596
        ?open@Shared_mem_obj@common@ierd_tgp@@QAEPAXW4mode_t@interprocess@boost@@_N@Z8940x100aa125
        ?open_browsefolder_dialog@Sys_wrapper@common@ierd_tgp@@SA_NPAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV45@2@Z8950x100bdbf3
        ?open_file_mgr@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8960x100be127
        ?open_openfile_dialog@Sys_wrapper@common@ierd_tgp@@SA_NPAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8970x100be2a6
        ?open_web@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z8980x100be421
        ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ8990x100639ce
        ?parent_path_end@path@filesystem@ierd_tgp@@ABEIXZ9000x10063a5c
        ?path@directory_entry@filesystem@ierd_tgp@@QBE?BV023@XZ9010x1001ec98
        ?path_iterator_decrement@iterator@path@filesystem@ierd_tgp@@AAEXAAV1234@@Z9020x10063af1
        ?path_iterator_increment@iterator@path@filesystem@ierd_tgp@@AAEXAAV1234@@Z9030x10063be4
        ?path_to_str@common@ierd_tgp@@YA_NABVpath@filesystem@2@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9040x10090002
        ?permissions@file_status@filesystem@ierd_tgp@@QAEXW4perms@23@@Z9050x1001ecc7
        ?permissions@file_status@filesystem@ierd_tgp@@QBE?AW4perms@23@XZ9060x1001ece0
        ?pop@recursive_directory_iterator@filesystem@ierd_tgp@@QAEXXZ9070x1001ed72
        ?post_msg@@YAXHV?$shared_ptr@Umsg_base@@@std@@@Z9080x10052d4b
        ?post_msg@@YAXPBD0_N@Z9090x1005309d
        ?post_msg@@YAXPBDV?$shared_ptr@Umsg_base@@@std@@_N@Z9100x10053471
        ?post_msg_local_only@@YAXPBD0@Z9110x100542e3
        ?preferred_separator@path@filesystem@ierd_tgp@@2_WB9120x1029e0d0
        ?process@Application@common@ierd_tgp@@QAEXXZ9130x10027600
        ?process_curl_task@CurlWrapper@curl_wrapper@ierd_tgp@@QAEXHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAH11AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@ABUCurlReq@curl_adapter@3@ABV45@4@Z9140x1005ac03
        ?process_remote_pack@@YAXHPBDI@Z9150x10054881
        ?process_system_event@Application@common@ierd_tgp@@QAEXXZ9160x10027888
        ?qq_symmetry_encrypt3_len@@YAHH@Z9170x1008df3f
        ?read@Syn_tcp@common@ierd_tgp@@QAEHPADII@Z9180x100ac62e
        ?real_report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@@Z9190x10095553
        ?recursion_pending@recursive_directory_iterator@filesystem@ierd_tgp@@QBE_NXZ9200x1001eb6e
        ?reg_act@Application@common@ierd_tgp@@QAE_NABUEvent@23@ABV?$function@$$A6AXXZ@std@@@Z9210x100279d8
        ?reg_luaservice@@YAXPBD0@Z9220x100549a8
        ?reg_msg_handler@@YAXHV?$function@$$A6AXV?$shared_ptr@Umsg_base@@@std@@@Z@std@@PAX@Z9230x10054a1a
        ?reg_msg_handler@@YAXPBDV?$function@$$A6AXPBD@Z@std@@PAX@Z9240x10054a9a
        ?reg_msg_handler@@YAXPBDV?$function@$$A6AXV?$shared_ptr@Umsg_base@@@std@@@Z@std@@PAX@Z9250x10054b55
        ?reg_msg_luahandler@@YAXHPBD@Z9260x10054d18
        ?reg_msg_luahandler@@YAXPBD0@Z9270x10054d8a
        ?reg_msg_remotehandler@@YAXHPBD@Z9280x10054e48
        ?reg_service@@YAXPBDV?$function@$$A6AXPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z@std@@PAX@Z9290x10054f96
        ?reg_service@@YAXPBDV?$function@$$A6AXV?$shared_ptr@Umsg_base@@@std@@@Z@std@@PAX@Z9300x10055050
        ?regex_search@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z9310x100abd3c
        ?regex_search@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV34@@Z9320x100abd7c
        ?regex_search@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAV?$match_results@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@V?$allocator@V?$sub_match@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@std@@@2@@4@@Z9330x100abe1c
        ?relative_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ9340x1006407a
        ?remove@filesystem@ierd_tgp@@YA_NABVpath@12@@Z9350x10064179
        ?remove@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z9360x1006419a
        ?remove_all@filesystem@ierd_tgp@@YA_KABVpath@12@@Z9370x10064214
        ?remove_all@filesystem@ierd_tgp@@YA_KABVpath@12@AAVerror_code@std@@@Z9380x10064235
        ?remove_filename@path@filesystem@ierd_tgp@@QAEAAV123@XZ9390x100644a6
        ?remove_qos_invalid_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9400x100aac59
        ?remove_switch@blink@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4blink_browser_type@12@@Z9410x100418f6
        ?remove_trailing_separator@path@filesystem@ierd_tgp@@QAEAAV123@XZ9420x100644ba
        ?rename@filesystem@ierd_tgp@@YAXABVpath@12@0@Z9430x1006453d
        ?rename@filesystem@ierd_tgp@@YAXABVpath@12@0AAVerror_code@std@@@Z9440x10064562
        ?repair_dns@game_misc@ierd_tgp@@YA_NPB_W@Z9450x1005e6ea
        ?repair_hosts@game_misc@ierd_tgp@@YA_NV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z9460x1005e70e
        ?replace_extension@path@filesystem@ierd_tgp@@QAEAAV123@ABV123@@Z9470x10064567
        ?replace_filename@directory_entry@filesystem@ierd_tgp@@QAEXABVpath@23@Vfile_status@23@1@Z9480x1001f117
        ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@1@Z9490x100ab318
        ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z9500x100ab3ec
        ?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z9510x10095f6a
        ?report_beacon@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@H@Z9520x10096206
        ?root_directory@path@filesystem@ierd_tgp@@QBE?AV123@XZ9530x100645d3
        ?root_full_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ9540x100487e1
        ?root_name@path@filesystem@ierd_tgp@@QBE?AV123@XZ9550x100647e9
        ?root_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ9560x1006491c
        ?rotate_left@md5@@AAEIII@Z9570x10058ec3
        ?s_pLogTrace@CLogTrace@@0PAV1@A9580x10398520
        ?save_proxy_settings@client_helper@net@ierd_tgp@@YAXPBD@Z9590x1008cd04
        ?scale_path2absolute_path@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z9600x1009004b
        ?scale_path2absolute_path@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z9610x10090119
        ?send_msg@@YAXPBD0AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9620x10055400
        ?send_msg@@YAXPBDV?$shared_ptr@Umsg_base@@@std@@@Z9630x1005565b
        ?separator@path@filesystem@ierd_tgp@@2_WB9640x1029e0cc
        ?set_account_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9650x100965a5
        ?set_account_type@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXH@Z9660x100965c6
        ?set_app_path@Application@common@ierd_tgp@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9670x10027a83
        ?set_app_path@Application@common@ierd_tgp@@QAE_NABVpath@filesystem@3@@Z9680x10027b26
        ?set_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAB_K@Z9690x100965de
        ?set_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@ABV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z9700x10048a50
        ?set_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z9710x10048f60
        ?set_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABH@Z9720x100965fb
        ?set_client_version_type@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXH@Z9730x10096612
        ?set_dpi_flag@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXH@Z9740x1009662a
        ?set_game_launcher_flag@common@ierd_tgp@@YAX_N@Z9750x1004950e
        ?set_game_launcher_msg@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9760x1004951b
        ?set_global_proxy_info@net@ierd_tgp@@YA_NPBD@Z9770x1008cda2
        ?set_ie_cookie@game_misc@ierd_tgp@@YA_NPBD00@Z9780x10066105
        ?set_inbar@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABH@Z9790x10096646
        ?set_language@overseas@ierd_tgp@@YA_NH@Z9800x1008eb00
        ?set_launcher_info@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z9810x10097d47
        ?set_login_show@Component_mgr@common@ierd_tgp@@QAEX_N@Z9820x10058ed2
        ?set_machine_guid_async@Application@common@ierd_tgp@@SAXXZ9830x10027bf8
        ?set_machine_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9840x10097d5f
        ?set_mode@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABW4kind_t@Qos_mode@234@@Z9850x10097d7d
        ?set_offline_login_account@common@ierd_tgp@@YAX_K@Z9860x1004952d
        ?set_qm_report_guid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9870x10097f03
        ?set_qm_report_guid_async@common@ierd_tgp@@YAXXZ9880x10084b1d
        ?set_qos_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXK@Z9890x10097f21
        ?set_quick_login_uin@common@ierd_tgp@@YAXK@Z9900x10049542
        ?set_restart_after_update@common@ierd_tgp@@YAX_N@Z9910x1004954f
        ?set_ret@Application@common@ierd_tgp@@QAEXH@Z9920x10027bfd
        ?set_same_client_type_multi_instance@util_multi_instance@ierd_tgp@@YAX_N@Z9930x100cdc24
        ?set_session_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9940x10097f34
        ?set_shared_mem_version@acce_common@@YAXPAXI@Z9950x10024094
        ?set_shared_mem_version@common@ierd_tgp@@YAXPAXK@Z9960x100a9378
        ?set_start_from_host@common@ierd_tgp@@YAX_N@Z9970x1004955c
        ?set_uid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9980x10097fb9
        ?set_user_region@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z9990x10097fc5
        ?set_ver@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABUversion_t@common@4@@Z10000x10098032
        ?sha1@ZEN_LIB@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBEI@Z10010x100a78ee
        ?sha1@ZEN_LIB@@YAPAEPBEIQAE@Z10020x100a79b8
        ?should_hiden@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z10030x100be546
        ?shutdown@Application@common@ierd_tgp@@EAEXXZ10040x1001fba0
        ?size@Shared_mem_obj@acce_common@@QAEIXZ10050x100245ab
        ?size@Shared_mem_obj@common@ierd_tgp@@QAEIXZ10060x100aa13a
        ?size@path@filesystem@ierd_tgp@@QBEIXZ10070x1000f670
        ?split_int@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@DPAV?$vector@HV?$allocator@H@std@@@4@@Z10080x100abe91
        ?split_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@1@Z10090x100495a2
        ?split_str@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@DPAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z10100x100abf0f
        ?stamp_init@@YAXXZ10110x100aa1e7
        ?stamp_point@@YAXPBD@Z10120x100aa212
        ?stamp_uninit@@YAXXZ10130x100aa288
        ?start@Tcp_port_detect@game_misc@ierd_tgp@@QAE_NIABV?$vector@U_Tcp_port_detect_address@game_misc@ierd_tgp@@V?$allocator@U_Tcp_port_detect_address@game_misc@ierd_tgp@@@std@@@std@@@Z10140x100c066d
        ?start@port_scan@game_misc@ierd_tgp@@QAE_NIABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@GG@Z10150x10091a0d
        ?start@server_detect@game_misc@ierd_tgp@@QAE_NIABV?$vector@U_Domain_address@game_misc@ierd_tgp@@V?$allocator@U_Domain_address@game_misc@ierd_tgp@@@std@@@std@@@Z10160x100a51c0
        ?start@server_detect@game_misc@ierd_tgp@@QAE_NIIABV?$vector@U_Domain_address@game_misc@ierd_tgp@@V?$allocator@U_Domain_address@game_misc@ierd_tgp@@@std@@@std@@@Z10170x100a51d5
        ?status@directory_entry@filesystem@ierd_tgp@@QBE?AVfile_status@23@AAVerror_code@std@@@Z10180x1001f340
        ?status@directory_entry@filesystem@ierd_tgp@@QBE?AVfile_status@23@XZ10190x1001f37f
        ?status@filesystem@ierd_tgp@@YA?AVfile_status@12@ABVpath@12@@Z10200x10064ac0
        ?status@filesystem@ierd_tgp@@YA?AVfile_status@12@ABVpath@12@AAVerror_code@std@@@Z10210x10064ae8
        ?status@recursive_directory_iterator@filesystem@ierd_tgp@@QBE?AVfile_status@23@XZ10220x1001f3d3
        ?stem@path@filesystem@ierd_tgp@@QBE?AV123@XZ10230x10064b1b
        ?stop@Tcp_port_detect@game_misc@ierd_tgp@@QAEXXZ10240x100c073a
        ?stop@port_scan@game_misc@ierd_tgp@@QAEXXZ10250x10091b03
        ?stop@server_detect@game_misc@ierd_tgp@@QAEXXZ10260x100a5c4d
        ?str_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z10270x100901ea
        ?string8@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ10280x10064c20
        ?string@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ10290x10064c8b
        ?string_to_guid@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAU_GUID@@@Z10300x100ab470
        ?swap@path@filesystem@ierd_tgp@@QAEXAAV123@@Z10310x1001f48f
        ?symlink_status@directory_entry@filesystem@ierd_tgp@@QBE?AVfile_status@23@AAVerror_code@std@@@Z10320x1001f4d0
        ?symlink_status@directory_entry@filesystem@ierd_tgp@@QBE?AVfile_status@23@XZ10330x1001f50f
        ?symlink_status@filesystem@ierd_tgp@@YA?AVfile_status@12@ABVpath@12@@Z10340x10064da6
        ?symlink_status@filesystem@ierd_tgp@@YA?AVfile_status@12@ABVpath@12@AAVerror_code@std@@@Z10350x10064dce
        ?sync_proxy_settings@client_helper@net@ierd_tgp@@YAXXZ10360x1008d2bb
        ?tgp_fd_set@Syn_tcp@common@ierd_tgp@@AAEXIPAUfd_set@@@Z10370x1002f7c2
        ?tick@Component_mgr@common@ierd_tgp@@QAEXN@Z10380x10058f33
        ?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z10390x10078cce
        ?to_string@version_t@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ10400x1006045d
        ?to_uint32@version_t@common@ierd_tgp@@QAEIXZ10410x100604e9
        ?type@file_status@filesystem@ierd_tgp@@QAEXW4file_type@23@@Z10420x1001f592
        ?type@file_status@filesystem@ierd_tgp@@QBE?AW4file_type@23@XZ10430x1001bd30
        ?u16_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z10440x100ab4d6
        ?u16_to_path@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVpath@filesystem@2@@Z10450x100ac016
        ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z10460x100ab57e
        ?u8_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z10470x100ab759
        ?u8_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z10480x100ac047
        ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z10490x100ab7b8
        ?uninitialize@Component_mgr@common@ierd_tgp@@QAEXXZ10500x10059118
        ?unreg_all_msg_handler@@YAXPAX@Z10510x10055c92
        ?unreg_all_service@@YAXPAX@Z10520x10055e47
        ?update@Tcp_port_detect@game_misc@ierd_tgp@@QAEXI@Z10530x100c0780
        ?update@port_scan@game_misc@ierd_tgp@@QAEXI@Z10540x10091b60
        ?update@server_detect@game_misc@ierd_tgp@@QAEXI@Z10550x100a63c0
        ?url_components_to_proxy_info@net@ierd_tgp@@YA_NPAUurl_components_t@12@PAUproxy_info_t@12@@Z10560x1008d8aa
        ?utf8_to_full_path@File_info@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@3@@Z10570x100496e5
        ?waccess_fixed_remote@Sys_wrapper@common@ierd_tgp@@SAHPB_WH@Z10580x100be858
        ?write@Asy_udp@common@ierd_tgp@@QAEHPBDIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@G@Z10590x1002fe4a
        ?write@Syn_tcp@common@ierd_tgp@@QAEHPBDI@Z10600x100acc67
        ?write_data@CurlWrapper@curl_wrapper@ierd_tgp@@CAIPADIIPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z10610x1005bef2
        ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ10620x1001facf
        base64Decode10630x10031f33
        base64DecodeSafely10640x10032023
        base64Encode10650x1003211d
        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States
        TimestampSource PortDest PortSource IPDest IP
        Dec 23, 2024 07:48:45.223006010 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:45.224109888 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:45.342822075 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:45.342958927 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:45.343509912 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:45.343564987 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.654131889 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654206038 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654217958 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654345036 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.654419899 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654432058 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654443979 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654457092 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654474974 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.654503107 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.654886961 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654900074 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.654958963 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.655771971 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.659789085 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.662312031 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.662384987 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.662398100 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.662470102 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.662666082 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.662678957 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.662691116 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.662707090 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.662725925 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.662741899 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.663121939 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.663136005 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.663158894 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.664705992 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.667897940 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.773825884 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.773915052 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.773956060 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.778429031 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.781990051 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.782053947 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.782116890 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.786133051 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.832099915 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.832918882 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.864214897 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.864341021 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.864383936 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.868472099 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.868580103 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.868623972 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.876657963 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.876756907 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.876811981 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.876874924 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.876887083 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.876924992 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.880856991 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.880953074 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.880997896 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.885196924 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.885298014 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.885334969 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.889249086 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.889400959 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.889461994 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.893496037 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.893579960 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.893646955 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.897670984 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.897783041 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.897825003 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.901854038 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.902092934 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.902138948 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.906006098 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.906153917 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.906209946 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.910244942 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.910345078 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.910397053 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.914367914 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.914496899 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.914562941 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.918602943 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.918709040 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.918749094 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.922919035 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.922930956 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.922981977 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.926968098 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.927232981 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.927273989 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.931139946 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.931332111 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.931379080 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.935322046 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.935446024 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.935493946 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.939508915 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.939615965 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.939685106 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.947943926 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.947958946 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.948016882 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.951550961 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.951803923 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.951858044 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.956269026 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.956367970 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.956402063 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.983839989 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.983926058 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.983989000 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:46.996448040 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.996530056 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:46.996606112 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.074080944 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.074153900 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.074218988 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.076715946 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.077749968 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.077790022 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.077816010 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.083153009 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.083219051 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.083245993 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.088494062 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.088557959 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.088583946 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.090802908 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.090866089 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.090920925 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.092408895 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.092524052 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.092571020 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.093854904 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.093905926 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.093939066 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.097868919 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.098123074 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.098176003 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.099251986 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.099309921 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.099349022 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.103250980 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.103348970 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.103396893 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.104628086 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.104743004 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.105092049 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.108659029 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.108741045 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.108795881 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.110022068 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.110076904 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.110132933 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.114109039 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.114262104 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.114312887 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.115407944 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.115453005 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.115463018 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.119479895 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.119594097 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.119645119 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.124952078 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.124994993 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.125051022 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.130336046 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.130436897 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.130494118 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.134126902 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.134238005 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.134279966 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.137937069 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.138003111 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.138050079 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.141751051 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.141871929 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.141921997 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.145538092 CET885249702134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.145627022 CET497028852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.160244942 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.167623997 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.287159920 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.287264109 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.290683031 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.290764093 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.290808916 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.292551041 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.292634010 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.292676926 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.296318054 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.297724009 CET885249703134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.297770023 CET497038852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.316440105 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:47.436114073 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:47.436315060 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.093717098 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.213347912 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.213433027 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.614888906 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.614970922 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.614981890 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.615015030 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.615192890 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.615253925 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.615257025 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.615269899 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.615282059 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.615324974 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.615730047 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.615742922 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.615772963 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.616475105 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.616511106 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.734481096 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.734555006 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.734606028 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.738681078 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747050047 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747158051 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747169971 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747219086 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.747376919 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747432947 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747445107 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747457027 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747487068 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.747514963 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.747916937 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747929096 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.747962952 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.748694897 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.748737097 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.785339117 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.829094887 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.829204082 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.829324007 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.833349943 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.833430052 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.833478928 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.841680050 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.841784000 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.841829062 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.850063086 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.850174904 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.850352049 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.858434916 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.858566046 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.858613014 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.866641998 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.866779089 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.866837025 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.866877079 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.866889000 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.866975069 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.870839119 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.875185013 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.875340939 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.875394106 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.883541107 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.883671999 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.883723974 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.891987085 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.892107010 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.892174006 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.900377035 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.900466919 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.900516987 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.908684015 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.908829927 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.908899069 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.910265923 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.948978901 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.949079990 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.949225903 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.957607031 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.957712889 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.957775116 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.961786032 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.961884975 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.961931944 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.970182896 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.970343113 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.970388889 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.978609085 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.978646040 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.978713036 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.986963987 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.987122059 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.987204075 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:48.995374918 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.995485067 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:48.995598078 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.003822088 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.003858089 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.003935099 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.012233019 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.012409925 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.012497902 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.020755053 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.020808935 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.020878077 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.028963089 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.029068947 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.029143095 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.037322998 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.037455082 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.037520885 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.042510986 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.042619944 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.042711973 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.045289993 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.045536995 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.045650959 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.050649881 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.050745964 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.051062107 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.056067944 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.056179047 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.056274891 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.061489105 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.061543941 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.061652899 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.066870928 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.066993952 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.067199945 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.072246075 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.072366953 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.072460890 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.077256918 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.077311993 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.077389002 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.077682972 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.077805042 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.077888966 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.083111048 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.083209991 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.083301067 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.086944103 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.087075949 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.087213993 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.090708971 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.090830088 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.090890884 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.094588995 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.094666004 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.094718933 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.098320007 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.098407030 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.098453999 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.102174044 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.102241993 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.102282047 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.106004000 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.106127977 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.106178045 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.109781027 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.109890938 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.109942913 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.113856077 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.114006042 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.116295099 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.117410898 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.117635965 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.117953062 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.121280909 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.121445894 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.121500015 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.125092983 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.126888037 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.126961946 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.128885031 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.129007101 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.129709005 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.132683992 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.132786036 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.133727074 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.136682034 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.136814117 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.137706041 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.162334919 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.162367105 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.162475109 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.168030977 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.168121099 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.168174982 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.170675993 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.170722008 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.170778036 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.174747944 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.174846888 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.174958944 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.180111885 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.180192947 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.180267096 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.185256004 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.185331106 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.185374975 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.190545082 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.190644979 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.190726995 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.195817947 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.195914030 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.195985079 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.201160908 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.201292992 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.201339006 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.206445932 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.206543922 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.206593037 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.211709023 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.211823940 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.211971045 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.215521097 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.215636015 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.215692043 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.219369888 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.219453096 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.219496965 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.223150015 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.223248005 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.223298073 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.226969004 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.227029085 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.227065086 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.230781078 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.230854988 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.230926991 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.234590054 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.234666109 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.234716892 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.238358021 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.238475084 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.238521099 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.242289066 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.242356062 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.242393970 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.246037006 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.246143103 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.246190071 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.249933004 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.250165939 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.250217915 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.253654003 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.253726006 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.253777981 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.255975008 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.256063938 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.256189108 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.257431984 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.257518053 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.257529974 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.257559061 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.257973909 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.258095026 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.258137941 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.260946035 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.260999918 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.261068106 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.261244059 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.261346102 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.261384010 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.263854027 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.263897896 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.263923883 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.266760111 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.266846895 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.266856909 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.269603014 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.269685984 CET1885249704134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.269727945 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.269727945 CET4970418852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.287866116 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.287887096 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.287945986 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.378420115 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.378434896 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.378561974 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.379703999 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.379798889 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.379851103 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.382555962 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.382672071 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.383658886 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.385416985 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.385642052 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.386018038 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.388427973 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.388535976 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.388592958 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.391139984 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.391225100 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.391275883 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.393872976 CET1885249705134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.394164085 CET4970518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.525306940 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.525362968 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.525386095 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.525460958 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.525643110 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.525676966 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.525698900 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.525702953 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.525722027 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.525743008 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.526119947 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.526144981 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.526180029 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.526782036 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.526837111 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.645045042 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.645119905 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.645215034 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.649276972 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.691541910 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.735497952 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.735632896 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.735702991 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.739679098 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.739801884 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.739866018 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.748152971 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.748209953 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.748264074 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.756474018 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.756532907 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.756591082 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.764897108 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.764934063 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.765000105 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.774063110 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.774192095 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.774243116 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.781646013 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.781766891 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.781817913 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.790016890 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.790106058 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.790206909 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.798500061 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.798712969 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.798764944 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.806809902 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.807040930 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.807142973 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.815184116 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.815303087 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.815359116 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.855335951 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.855391979 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.855478048 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.946059942 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.946162939 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.946244001 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.948677063 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.948749065 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.948805094 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.954010010 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.954164982 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.954219103 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.959228992 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.959362030 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.959418058 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.964508057 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.964662075 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.964718103 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.969774008 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.969877958 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.969935894 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.975043058 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.975143909 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.975198984 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.980287075 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.980389118 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.980444908 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.985621929 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.985728979 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.985785961 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.990885019 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.991003036 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.991046906 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.994641066 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.994777918 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.994831085 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.998492956 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.998569965 CET885249706134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:49.998637915 CET497068852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:49.999659061 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:50.119137049 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:50.119224072 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.434453011 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.434542894 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.434555054 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.434590101 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.434753895 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.434789896 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.434808016 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.434820890 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.434833050 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.434850931 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.435295105 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.435306072 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.435332060 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.435945988 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.435983896 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.441015959 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.554090023 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.554145098 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.554255962 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.558268070 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.560447931 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.560549021 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.613621950 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.646816015 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.646914005 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.647006989 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.650993109 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.651102066 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.651145935 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.659353971 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.659452915 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.659507036 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.667730093 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.667896986 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.667943001 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.676090956 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.676212072 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.676279068 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.684468985 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.684592009 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.684645891 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.692838907 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.692991018 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.693043947 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.701190948 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.701325893 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.701420069 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.709562063 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.709690094 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.709736109 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.718039036 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.718054056 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.718091965 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.733062983 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.733179092 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.733289003 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.766433954 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.766509056 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.766587019 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.858990908 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.859011889 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.859082937 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.860589027 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.860790014 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.860846043 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.866055965 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.866107941 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.866164923 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.871503115 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.871601105 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.871653080 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.876980066 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.877058029 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.877108097 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.882661104 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.882762909 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.882821083 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.887916088 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.888008118 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.888051987 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.893349886 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.893451929 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.893493891 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.898827076 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.898969889 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.899012089 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.902595043 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.902734041 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.902770996 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.906415939 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.906599045 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.906656981 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.910207987 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.910300970 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.910346031 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.914036989 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.914138079 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.914179087 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.917850018 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.917916059 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.917969942 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.921632051 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.921730042 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.921772957 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.925443888 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.925534964 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.925578117 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.929281950 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.929368973 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.929421902 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.933068037 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.933162928 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.933204889 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.936872005 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.936990023 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.937027931 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.940696001 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.940788984 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.940834999 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.944461107 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.944578886 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.944617987 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.948347092 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.948457956 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.948493004 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.952094078 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.952198029 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.952239037 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.978730917 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.978868008 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:51.978936911 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:51.980564117 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.035402060 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.071499109 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.071567059 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.071635962 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.072952986 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.073045969 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.073091984 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.075850964 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.075953007 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.076006889 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.078737974 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.078855991 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.078922987 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.081584930 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.081695080 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.081757069 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.084423065 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.084639072 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.084698915 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.087146997 CET1885249708134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.087210894 CET4970818852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.878671885 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878688097 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878699064 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878791094 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.878885031 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878896952 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878906965 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878917933 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878930092 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.878947020 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.878997087 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.879398108 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.880212069 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.880255938 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:52.998493910 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.998513937 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:52.998627901 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.002758026 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.050909042 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.092133999 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.092289925 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.092360020 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.096337080 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.096388102 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.096438885 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.104628086 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.107639074 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.107703924 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.107779026 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.116230011 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.116282940 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.116296053 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.124361038 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.124490023 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.124526978 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.133152962 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.133166075 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.133229017 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.141143084 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.141207933 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.141283989 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.149538040 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.149597883 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.149621964 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.157851934 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.157919884 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.157929897 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.166193962 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.166268110 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.166359901 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.174565077 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.174618959 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.174753904 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.211791992 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.211922884 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.305455923 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.305598021 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.305675030 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.308176041 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.308633089 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.308676004 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.313688040 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.313911915 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.313956022 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.319185972 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.319200993 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.319252968 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.324696064 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.324709892 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.324769020 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.330212116 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.330224991 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.330284119 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.335618019 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.335694075 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.335742950 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.340990067 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.341106892 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.341161013 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.346462011 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.346790075 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.346839905 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.350436926 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.350449085 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.350492954 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.354111910 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.354398012 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.354449987 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.358076096 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.358092070 CET885249709134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.358163118 CET497098852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.359214067 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:53.478738070 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:53.478965044 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.383899927 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.503396034 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.503511906 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.801515102 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.801592112 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.801606894 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.801660061 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.801862001 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.801876068 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.801887989 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.801901102 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.801923037 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.801951885 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.802367926 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.802380085 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.802423000 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.802737951 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.802861929 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.921153069 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.921237946 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.921350002 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:54.925339937 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:54.972852945 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.016027927 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.016249895 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.016433954 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.020198107 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.020267010 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.020900965 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.026664019 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.026793957 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.027343035 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.035082102 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.035149097 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.035227060 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.043390989 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.043488979 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.043684959 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.051795006 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.051991940 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.052113056 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.060220957 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.060288906 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.060547113 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.068576097 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.068659067 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.068742990 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.076946020 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.077023983 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.077173948 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.085309982 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.085391998 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.085587978 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.093725920 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.093902111 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.094002962 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.135962963 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.136116982 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.136203051 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.140139103 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.191888094 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.231271982 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.231374025 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.231554985 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.233921051 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.234029055 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.234178066 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.239342928 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.239742994 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.239835024 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.245501995 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.245515108 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.245666981 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.250089884 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.250181913 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.250246048 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.255425930 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.255523920 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.255808115 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.260685921 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.260864019 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.260947943 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.266124010 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.266268969 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.267014980 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.271492958 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.271595955 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.271677971 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.275388002 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.275489092 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.275800943 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.279124975 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.279238939 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.279331923 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.282917023 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.283040047 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.283324003 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.286729097 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.286878109 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.286936998 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.290580034 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.291078091 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.291214943 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.294312000 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.294502020 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.294576883 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.298156023 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.298293114 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.298434019 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.301960945 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.302066088 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.302165985 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.305743933 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.305847883 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.305918932 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.309890985 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.309902906 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.310820103 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.315999031 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.316112041 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.316201925 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.318655968 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.318753958 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.318864107 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.321079016 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.321180105 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.321239948 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.324898005 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.325022936 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.325438976 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.328757048 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.328825951 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.328932047 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.446544886 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.446686029 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.446973085 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.447953939 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.448060989 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.448137999 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.450788021 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.450932980 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.451186895 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.453576088 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.453689098 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.453811884 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.456379890 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.456492901 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.456558943 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.459156990 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.459271908 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.459331989 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.461844921 CET1885249715134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.462038040 CET4971518852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.813661098 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.813745022 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.813757896 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.813930035 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.814033985 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.814044952 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.814058065 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.814070940 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.814112902 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.814167976 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.814502001 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.814512968 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.814548016 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.815200090 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.815247059 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.933526039 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.933545113 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.933604956 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:55.937613964 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:55.988615990 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.023195028 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.023288012 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.023360014 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.027353048 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.028858900 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.028937101 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.028960943 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.037262917 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.037350893 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.037391901 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.045661926 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.045758963 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.045768976 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.053972960 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.054080009 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.054102898 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.062342882 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.062397003 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.062424898 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.070763111 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.070843935 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.070852041 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.079173088 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.079271078 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.079282999 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.087518930 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.087558031 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.087621927 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.129093885 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.241812944 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.241998911 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.242079973 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.244697094 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.244822979 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.244874954 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.250291109 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.252403975 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.252480984 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.252489090 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.258085966 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.258156061 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.258172989 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.263730049 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.263808966 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.263825893 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.269505024 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.269531965 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.269587994 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.275130033 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.275218964 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.275326014 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.280822039 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.280896902 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.280936003 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.286463022 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.286514044 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.286540985 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.292232990 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.292325974 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.292355061 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.297813892 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.297883987 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.297919989 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.303462029 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.303525925 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.303569078 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.309146881 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.309227943 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.309253931 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.314810038 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.314865112 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.314891100 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.320487022 CET885249716134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.320609093 CET497168852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.321940899 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:56.441466093 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:56.441612959 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.773910999 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.773940086 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.773952007 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.774173975 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.774229050 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.774244070 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.774255991 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.774279118 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.774292946 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.774311066 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.774339914 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.774339914 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.774734020 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.775475979 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.775527954 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.893976927 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.894013882 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.894124031 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.898093939 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.941658020 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:57.996958971 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.997034073 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:57.997421980 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.001058102 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.001199961 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.001656055 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.009458065 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.009613037 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.009725094 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.017864943 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.017987967 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.018064976 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.026210070 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.026319981 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.026375055 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.034625053 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.034678936 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.034734964 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.042958975 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.043057919 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.043165922 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.051345110 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.051430941 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.051534891 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.059705019 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.059823990 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.059904099 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.068119049 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.068212032 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.068394899 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.076581001 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.076621056 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.076869011 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.117311954 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.117331028 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.117470026 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.216723919 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.216835022 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.216937065 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.219543934 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.219640017 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.219758034 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.225244045 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.225347042 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.225487947 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.230911970 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.230998039 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.231051922 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.236610889 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.236633062 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.236773968 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.242259979 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.242317915 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.242378950 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.248018980 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.248172045 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.248373985 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.253562927 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.253664970 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.253736973 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.257421970 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.257558107 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.257751942 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.261295080 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.261462927 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.261619091 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.265204906 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.265311003 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.265464067 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.268938065 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.269064903 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.269260883 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.272777081 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.272895098 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.272953033 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.276556969 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.276675940 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.276953936 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.280376911 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.280503035 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.280642033 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.284425020 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.284497023 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.284676075 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.288070917 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.288158894 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.288255930 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.291888952 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.292073011 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.292167902 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.295665979 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.295784950 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.295845985 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.299494028 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.299633980 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.299773932 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.303386927 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.303445101 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.303541899 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.307179928 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.307324886 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.307389021 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.311028957 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.311151981 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.311244965 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.336543083 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.336561918 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.336682081 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.437907934 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.437966108 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.438097954 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.439297915 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.439393044 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.439521074 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.442300081 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.442414045 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.442471981 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.445261002 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.445373058 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.445456982 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.448196888 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.448297024 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.448364019 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.451222897 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.451289892 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.451350927 CET4972218852192.168.2.7134.122.134.93
        Dec 23, 2024 07:48:58.454052925 CET1885249722134.122.134.93192.168.2.7
        Dec 23, 2024 07:48:58.454119921 CET4972218852192.168.2.7134.122.134.93

        Click to jump to process

        Click to jump to process

        Click to dive into process behavior distribution

        Click to jump to process

        Target ID:2
        Start time:01:48:43
        Start date:23/12/2024
        Path:C:\Windows\System32\loaddll32.exe
        Wow64 process (32bit):true
        Commandline:loaddll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll"
        Imagebase:0x990000
        File size:126'464 bytes
        MD5 hash:51E6071F9CBA48E79F10C84515AAE618
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:false

        Target ID:3
        Start time:01:48:43
        Start date:23/12/2024
        Path:C:\Windows\System32\conhost.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Imagebase:0x7ff75da10000
        File size:862'208 bytes
        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:false

        Target ID:4
        Start time:01:48:43
        Start date:23/12/2024
        Path:C:\Windows\SysWOW64\cmd.exe
        Wow64 process (32bit):true
        Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1
        Imagebase:0x410000
        File size:236'544 bytes
        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:false

        Target ID:5
        Start time:01:48:43
        Start date:23/12/2024
        Path:C:\Windows\SysWOW64\rundll32.exe
        Wow64 process (32bit):true
        Commandline:rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@H@@YAHABVValue@Json@@AAH@Z
        Imagebase:0x4f0000
        File size:61'440 bytes
        MD5 hash:889B99C52A60DD49227C5E485A016679
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:false

        Target ID:6
        Start time:01:48:43
        Start date:23/12/2024
        Path:C:\Windows\SysWOW64\rundll32.exe
        Wow64 process (32bit):true
        Commandline:rundll32.exe "C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll",#1
        Imagebase:0x4f0000
        File size:61'440 bytes
        MD5 hash:889B99C52A60DD49227C5E485A016679
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:false

        Target ID:9
        Start time:01:48:47
        Start date:23/12/2024
        Path:C:\Windows\SysWOW64\rundll32.exe
        Wow64 process (32bit):true
        Commandline:rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@YAHABVValue@Json@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
        Imagebase:0x4f0000
        File size:61'440 bytes
        MD5 hash:889B99C52A60DD49227C5E485A016679
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:false

        Target ID:10
        Start time:01:48:50
        Start date:23/12/2024
        Path:C:\Windows\SysWOW64\rundll32.exe
        Wow64 process (32bit):true
        Commandline:rundll32.exe C:\Users\user\Desktop\492c3445eddadc4b2c411a6eb79813339a0b3fc6d2d69.dll,??$json_value_to_obj@Vjsonb_LPVOID@@@@YAHABVValue@Json@@AAVjsonb_LPVOID@@@Z
        Imagebase:0x4f0000
        File size:61'440 bytes
        MD5 hash:889B99C52A60DD49227C5E485A016679
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:false

        Reset < >

          Execution Graph

          Execution Coverage:1.1%
          Dynamic/Decrypted Code Coverage:19.9%
          Signature Coverage:1.5%
          Total number of Nodes:582
          Total number of Limit Nodes:24
          execution_graph 92643 2836013 92644 2836045 92643->92644 92645 2850003 92644->92645 92648 283608a 92644->92648 92651 2835e07 92644->92651 92649 28360a0 RegOpenKeyExW 92648->92649 92650 2833f35 92649->92650 92652 284f0f9 RegQueryValueExW 92651->92652 92653 2833f35 92652->92653 92654 2837813 92655 2837823 92654->92655 92656 283781e 92654->92656 92660 283771d 92655->92660 92668 283b54b GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 92656->92668 92659 2837831 92661 2837729 92660->92661 92665 28377c6 92661->92665 92666 2837776 92661->92666 92669 28375b9 92661->92669 92663 28377a6 92664 28375b9 __CRT_INIT@12 133 API calls 92663->92664 92663->92665 92664->92665 92665->92659 92666->92663 92666->92665 92667 28375b9 __CRT_INIT@12 133 API calls 92666->92667 92667->92663 92668->92655 92670 28375c5 92669->92670 92671 2837647 92670->92671 92672 28375cd 92670->92672 92674 28376a8 92671->92674 92675 283764d 92671->92675 92720 283803b HeapCreate 92672->92720 92676 2837706 92674->92676 92677 28376ad 92674->92677 92680 283766b 92675->92680 92697 28375d6 92675->92697 92773 2838306 57 API calls _doexit 92675->92773 92676->92697 92781 2839a58 64 API calls __freefls@4 92676->92781 92778 2839754 TlsGetValue DecodePointer TlsSetValue 92677->92778 92678 28375d2 92678->92697 92721 2839ac6 GetModuleHandleW 92678->92721 92681 283767f 92680->92681 92774 283b0e4 58 API calls _free 92680->92774 92777 2837692 61 API calls __mtterm 92681->92777 92683 28376b2 __calloc_crt 92688 28376ca DecodePointer 92683->92688 92683->92697 92692 28376df 92688->92692 92689 28375e6 92767 2838059 HeapDestroy 92689->92767 92690 28375e2 __RTC_Initialize 92690->92689 92699 28375f2 GetCommandLineA 92690->92699 92691 2837675 92775 28397a5 61 API calls _free 92691->92775 92695 28376e3 92692->92695 92696 28376fa 92692->92696 92779 28397e2 57 API calls 2 library calls 92695->92779 92780 2836e49 57 API calls 2 library calls 92696->92780 92697->92666 92698 283767a 92776 2838059 HeapDestroy 92698->92776 92744 283b468 GetEnvironmentStringsW 92699->92744 92704 28376ea GetCurrentThreadId 92704->92697 92708 2837610 92768 28397a5 61 API calls _free 92708->92768 92709 2837617 92769 283b3ad 65 API calls _parse_cmdline 92709->92769 92712 283761c 92713 2837630 92712->92713 92770 283b137 63 API calls 2 library calls 92712->92770 92719 2837635 92713->92719 92772 283b0e4 58 API calls _free 92713->92772 92716 2837625 92716->92713 92771 2838119 70 API calls 4 library calls 92716->92771 92717 2837645 92717->92708 92719->92697 92720->92678 92722 2839ae3 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 92721->92722 92723 2839ada 92721->92723 92725 2839b2d TlsAlloc 92722->92725 92782 28397a5 61 API calls _free 92723->92782 92728 2839b7b TlsSetValue 92725->92728 92730 2839c3c 92725->92730 92727 2839adf 92727->92690 92729 2839b8c 92728->92729 92728->92730 92783 28380c2 EncodePointer EncodePointer __init_pointers __initp_misc_winsig FindHandlerForForeignException 92729->92783 92730->92690 92732 2839b91 EncodePointer EncodePointer EncodePointer EncodePointer 92733 2839bd0 92732->92733 92734 2839c37 92733->92734 92735 2839bd4 DecodePointer 92733->92735 92785 28397a5 61 API calls _free 92734->92785 92737 2839be9 92735->92737 92737->92734 92738 2839bf3 __calloc_crt 92737->92738 92738->92734 92739 2839c07 DecodePointer 92738->92739 92740 2839c18 92739->92740 92740->92734 92741 2839c1c 92740->92741 92784 28397e2 57 API calls 2 library calls 92741->92784 92743 2839c24 GetCurrentThreadId 92743->92730 92745 2837602 92744->92745 92746 283b484 WideCharToMultiByte 92744->92746 92755 283ae9f GetStartupInfoW __calloc_crt 92745->92755 92748 283b4f1 FreeEnvironmentStringsW 92746->92748 92749 283b4b9 __malloc_crt 92746->92749 92748->92745 92749->92748 92750 283b4c7 WideCharToMultiByte 92749->92750 92751 283b4e5 FreeEnvironmentStringsW 92750->92751 92752 283b4d9 92750->92752 92751->92745 92786 2836e49 57 API calls 2 library calls 92752->92786 92754 283b4e1 92754->92751 92756 283760c 92755->92756 92760 283aecd 92755->92760 92756->92708 92756->92709 92757 283afb2 92762 283b032 92757->92762 92764 283afe9 InitializeCriticalSectionAndSpinCount 92757->92764 92765 283afde GetFileType 92757->92765 92758 283af54 __calloc_crt 92758->92757 92758->92760 92759 283b068 GetStdHandle 92759->92762 92760->92757 92760->92758 92760->92762 92761 283b0cc SetHandleCount 92761->92756 92762->92759 92762->92761 92763 283b07a GetFileType 92762->92763 92766 283b0a0 InitializeCriticalSectionAndSpinCount 92762->92766 92763->92762 92764->92756 92764->92757 92765->92757 92765->92764 92766->92756 92766->92762 92767->92697 92768->92689 92769->92712 92770->92716 92771->92713 92772->92717 92773->92680 92774->92691 92775->92698 92776->92681 92777->92697 92778->92683 92779->92704 92780->92697 92781->92697 92782->92727 92783->92732 92784->92743 92785->92730 92786->92754 92787 6cff3b8d 92792 6d114266 92787->92792 92793 6d114272 ___scrt_is_nonwritable_in_current_image 92792->92793 92794 6d114282 ?shutdown@Application@common@ierd_tgp@ 92793->92794 92795 6d11429d 92793->92795 92794->92793 92801 6d1142c6 ?shutdown@Application@common@ierd_tgp@ Concurrency::details::platform::__RegisterWaitForSingleObject 92795->92801 92797 6cff3ba5 92798 6d113aa0 92797->92798 92802 6d113a65 _crt_atexit _register_onexit_function 92798->92802 92800 6cff3baf 92801->92797 92802->92800 92803 6cff2dcb GetSystemInfo 92804 2834274 92805 284f814 CreateThread 92804->92805 92807 2836110 92805->92807 92807->92807 92808 6d1144c9 92810 6d1144d5 ___scrt_is_nonwritable_in_current_image 92808->92810 92809 6d1144e4 92810->92809 92811 6d1144fe dllmain_raw 92810->92811 92812 6d1144f9 92810->92812 92811->92809 92813 6d114518 dllmain_crt_dispatch 92811->92813 92821 6d114b3a DisableThreadLibraryCalls 92812->92821 92813->92809 92813->92812 92815 6d114539 92816 6d114565 92815->92816 92822 6d114b3a DisableThreadLibraryCalls 92815->92822 92816->92809 92817 6d11456e dllmain_crt_dispatch 92816->92817 92817->92809 92818 6d114581 dllmain_raw 92817->92818 92818->92809 92820 6d114551 dllmain_crt_dispatch dllmain_raw 92820->92816 92821->92815 92822->92820 92823 6d1142da 92824 6d1142e5 92823->92824 92825 6d114318 dllmain_crt_process_detach 92823->92825 92826 6d11430a dllmain_crt_process_attach 92824->92826 92827 6d1142ea 92824->92827 92825->92827 92826->92827 92828 6d1145fa 92829 6d114603 92828->92829 92830 6d114608 dllmain_dispatch 92828->92830 92832 6d114aef GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___get_entropy 92829->92832 92832->92830 92833 6d11432d 92834 6d114339 ___scrt_is_nonwritable_in_current_image 92833->92834 92855 6d1138ae 92834->92855 92836 6d114340 92837 6d11436a 92836->92837 92838 6d11442f 92836->92838 92848 6d114345 92836->92848 92859 6d113810 92837->92859 92876 6d114920 6 API calls ___scrt_fastfail 92838->92876 92841 6d114436 92845 6d1143ca ___scrt_is_nonwritable_in_current_image 92845->92848 92853 6d1143f5 ?shutdown@Application@common@ierd_tgp@ 92845->92853 92847 6d114387 ___scrt_initialize_default_local_stdio_options 92849 6d11438c _initterm_e 92847->92849 92849->92845 92850 6d1143a1 92849->92850 92867 6d1137e5 92850->92867 92852 6d1143a6 92852->92845 92854 6d1143aa _initterm 92852->92854 92853->92848 92854->92845 92856 6d1138b7 92855->92856 92877 6d11461d IsProcessorFeaturePresent 92856->92877 92858 6d1138c3 ___scrt_uninitialize_crt 92858->92836 92878 6d1138e7 92859->92878 92861 6d113817 92861->92845 92862 6d114b7f 92861->92862 92863 6d114b8f 92862->92863 92865 6d114382 92862->92865 92864 6d114b96 ?shutdown@Application@common@ierd_tgp@ 92863->92864 92863->92865 92864->92863 92866 6d11341f InitializeSListHead 92865->92866 92866->92847 92868 6d1137ea ___scrt_release_startup_lock 92867->92868 92869 6d1137f5 92868->92869 92870 6d1137ee 92868->92870 92873 6d1137fa _configure_narrow_argv 92869->92873 92889 6d11461d IsProcessorFeaturePresent 92870->92889 92872 6d1137f3 92872->92852 92874 6d113805 92873->92874 92875 6d113808 _initialize_narrow_environment 92873->92875 92874->92852 92875->92872 92876->92841 92877->92858 92879 6d1138f6 92878->92879 92880 6d1138fa 92878->92880 92879->92861 92881 6d113984 92880->92881 92884 6d113907 ___scrt_release_startup_lock 92880->92884 92888 6d114920 6 API calls ___scrt_fastfail 92881->92888 92883 6d11398b 92885 6d113914 _initialize_onexit_table 92884->92885 92887 6d113932 92884->92887 92886 6d113923 _initialize_onexit_table 92885->92886 92885->92887 92886->92887 92887->92861 92888->92883 92889->92872 92890 6d082226 92891 6d082232 __EH_prolog3 92890->92891 92896 6d112e95 92891->92896 92894 6d082254 throw_exception 92897 6d112ea7 malloc 92896->92897 92898 6d082242 92897->92898 92899 6d112e9a _callnewh 92897->92899 92898->92894 92904 6d0820b3 92898->92904 92899->92897 92900 6d112eb6 std::_Facet_Register 92899->92900 92901 6d114903 std::_Facet_Register 92900->92901 92903 6d1148f4 _CxxThrowException 92900->92903 92902 6d114911 _CxxThrowException 92901->92902 92903->92901 92905 6d0820bf __EH_prolog3 92904->92905 92927 6d081f36 92905->92927 92907 6d08211e 92931 6d050076 92907->92931 92909 6d08212d 92910 6d050076 9 API calls 92909->92910 92911 6d08213c 92910->92911 92912 6d050076 9 API calls 92911->92912 92913 6d08214b 92912->92913 92914 6d050076 9 API calls 92913->92914 92915 6d08215a 92914->92915 92935 6d08a08a 92915->92935 92917 6d082169 92918 6d082178 _Mtx_init_in_situ memset 92917->92918 92944 6d0867c9 92918->92944 92922 6d0821f6 93224 6d083f3f 92922->93224 92924 6d0821fd 92925 6d082204 GetCurrentThreadId 92924->92925 92926 6d082225 throw_exception 92925->92926 92926->92894 92928 6d081f42 __EH_prolog3 92927->92928 93231 6d084fcd 92928->93231 92930 6d081f55 throw_exception 92930->92907 92932 6d050082 __EH_prolog3 92931->92932 93250 6d040f01 92932->93250 92934 6d050093 throw_exception 92934->92909 93254 6d112f1b 92935->93254 92937 6d08a096 _Mtx_init_in_situ _Mtx_init_in_situ _Mtx_init_in_situ 93255 6d089eea 92937->93255 92939 6d08a0fd 92940 6d089eea 9 API calls 92939->92940 92941 6d08a10f 92940->92941 93259 6d089ebd 92941->93259 92943 6d08a121 throw_exception 92943->92917 93271 6d041fcf 92944->93271 92948 6d0867f8 92949 6d046006 9 API calls 92948->92949 92950 6d086824 92949->92950 92951 6d046006 9 API calls 92950->92951 92952 6d08684e 92951->92952 92953 6d046006 9 API calls 92952->92953 92954 6d086878 92953->92954 92955 6d046006 9 API calls 92954->92955 92956 6d0868a2 92955->92956 92957 6d046006 9 API calls 92956->92957 92958 6d0868cc 92957->92958 92959 6d046006 9 API calls 92958->92959 92960 6d0868f6 92959->92960 92961 6d046006 9 API calls 92960->92961 92962 6d086920 92961->92962 92963 6d046006 9 API calls 92962->92963 92964 6d08694a 92963->92964 92965 6d046006 9 API calls 92964->92965 92966 6d086974 92965->92966 92967 6d046006 9 API calls 92966->92967 92968 6d08699e 92967->92968 92969 6d046006 9 API calls 92968->92969 92970 6d0869c8 92969->92970 92971 6d046006 9 API calls 92970->92971 92972 6d0869f2 92971->92972 92973 6d046006 9 API calls 92972->92973 92974 6d086a1c 92973->92974 92975 6d046006 9 API calls 92974->92975 92976 6d086a46 92975->92976 92977 6d046006 9 API calls 92976->92977 92978 6d086a70 92977->92978 92979 6d046006 9 API calls 92978->92979 92980 6d086a9a 92979->92980 92981 6d046006 9 API calls 92980->92981 92982 6d086ac4 92981->92982 92983 6d046006 9 API calls 92982->92983 92984 6d086aee 92983->92984 92985 6d046006 9 API calls 92984->92985 92986 6d086b18 92985->92986 92987 6d046006 9 API calls 92986->92987 92988 6d086b42 92987->92988 92989 6d046006 9 API calls 92988->92989 92990 6d086b6c 92989->92990 92991 6d046006 9 API calls 92990->92991 92992 6d086b96 92991->92992 92993 6d046006 9 API calls 92992->92993 92994 6d086bc0 92993->92994 92995 6d046006 9 API calls 92994->92995 92996 6d086bea 92995->92996 92997 6d046006 9 API calls 92996->92997 92998 6d086c14 92997->92998 92999 6d046006 9 API calls 92998->92999 93000 6d086c3e 92999->93000 93001 6d046006 9 API calls 93000->93001 93002 6d086c68 93001->93002 93003 6d046006 9 API calls 93002->93003 93004 6d086c92 93003->93004 93005 6d046006 9 API calls 93004->93005 93006 6d086cbc 93005->93006 93007 6d046006 9 API calls 93006->93007 93008 6d086ce6 93007->93008 93009 6d046006 9 API calls 93008->93009 93010 6d086d10 93009->93010 93011 6d046006 9 API calls 93010->93011 93012 6d086d3a 93011->93012 93013 6d046006 9 API calls 93012->93013 93014 6d086d64 93013->93014 93015 6d046006 9 API calls 93014->93015 93016 6d086d8e 93015->93016 93017 6d046006 9 API calls 93016->93017 93018 6d086db8 93017->93018 93019 6d046006 9 API calls 93018->93019 93020 6d086de2 93019->93020 93021 6d046006 9 API calls 93020->93021 93022 6d086e0c 93021->93022 93023 6d046006 9 API calls 93022->93023 93024 6d086e37 93023->93024 93025 6d046006 9 API calls 93024->93025 93026 6d086e5a 93025->93026 93027 6d046006 9 API calls 93026->93027 93028 6d086e86 93027->93028 93029 6d046006 9 API calls 93028->93029 93030 6d086eb0 93029->93030 93031 6d046006 9 API calls 93030->93031 93032 6d086eda 93031->93032 93033 6d046006 9 API calls 93032->93033 93034 6d086f04 93033->93034 93035 6d046006 9 API calls 93034->93035 93036 6d086f2e 93035->93036 93037 6d046006 9 API calls 93036->93037 93038 6d086f58 93037->93038 93039 6d046006 9 API calls 93038->93039 93040 6d086f82 93039->93040 93041 6d046006 9 API calls 93040->93041 93042 6d086fac 93041->93042 93043 6d046006 9 API calls 93042->93043 93044 6d086fd6 93043->93044 93045 6d046006 9 API calls 93044->93045 93046 6d087000 93045->93046 93047 6d046006 9 API calls 93046->93047 93048 6d08702a 93047->93048 93049 6d046006 9 API calls 93048->93049 93050 6d087054 93049->93050 93051 6d046006 9 API calls 93050->93051 93052 6d08707e 93051->93052 93053 6d046006 9 API calls 93052->93053 93054 6d0870a8 93053->93054 93055 6d046006 9 API calls 93054->93055 93056 6d0870d2 93055->93056 93057 6d046006 9 API calls 93056->93057 93058 6d0870fc 93057->93058 93059 6d046006 9 API calls 93058->93059 93060 6d087126 93059->93060 93061 6d046006 9 API calls 93060->93061 93062 6d087150 93061->93062 93063 6d046006 9 API calls 93062->93063 93064 6d08717a 93063->93064 93065 6d046006 9 API calls 93064->93065 93066 6d0871a4 93065->93066 93067 6d046006 9 API calls 93066->93067 93068 6d0871ce 93067->93068 93069 6d046006 9 API calls 93068->93069 93070 6d0871f8 93069->93070 93071 6d046006 9 API calls 93070->93071 93072 6d087222 93071->93072 93073 6d046006 9 API calls 93072->93073 93074 6d08724c 93073->93074 93075 6d046006 9 API calls 93074->93075 93076 6d087276 93075->93076 93077 6d046006 9 API calls 93076->93077 93078 6d0872a0 93077->93078 93079 6d046006 9 API calls 93078->93079 93080 6d0872ca 93079->93080 93081 6d046006 9 API calls 93080->93081 93082 6d0872f4 93081->93082 93083 6d046006 9 API calls 93082->93083 93084 6d08731e 93083->93084 93085 6d046006 9 API calls 93084->93085 93086 6d087348 93085->93086 93087 6d046006 9 API calls 93086->93087 93088 6d087372 93087->93088 93089 6d046006 9 API calls 93088->93089 93090 6d08739c 93089->93090 93091 6d046006 9 API calls 93090->93091 93092 6d0873c6 93091->93092 93093 6d046006 9 API calls 93092->93093 93094 6d0873f0 93093->93094 93095 6d046006 9 API calls 93094->93095 93096 6d08741a 93095->93096 93097 6d046006 9 API calls 93096->93097 93098 6d087444 93097->93098 93099 6d046006 9 API calls 93098->93099 93100 6d08746e 93099->93100 93101 6d046006 9 API calls 93100->93101 93102 6d087498 93101->93102 93103 6d046006 9 API calls 93102->93103 93104 6d0874c2 93103->93104 93105 6d046006 9 API calls 93104->93105 93106 6d0874ec 93105->93106 93107 6d046006 9 API calls 93106->93107 93108 6d087516 93107->93108 93109 6d046006 9 API calls 93108->93109 93110 6d087540 93109->93110 93111 6d046006 9 API calls 93110->93111 93112 6d08756a 93111->93112 93113 6d046006 9 API calls 93112->93113 93114 6d087594 93113->93114 93115 6d046006 9 API calls 93114->93115 93116 6d0875be 93115->93116 93117 6d046006 9 API calls 93116->93117 93118 6d0875e8 93117->93118 93119 6d046006 9 API calls 93118->93119 93120 6d087612 93119->93120 93121 6d046006 9 API calls 93120->93121 93122 6d08763c 93121->93122 93123 6d046006 9 API calls 93122->93123 93124 6d087666 93123->93124 93125 6d046006 9 API calls 93124->93125 93126 6d087690 93125->93126 93127 6d046006 9 API calls 93126->93127 93128 6d0876ba 93127->93128 93129 6d046006 9 API calls 93128->93129 93130 6d0876e1 93129->93130 93131 6d046006 9 API calls 93130->93131 93132 6d08770b 93131->93132 93133 6d046006 9 API calls 93132->93133 93134 6d087735 93133->93134 93135 6d046006 9 API calls 93134->93135 93136 6d08775f 93135->93136 93137 6d046006 9 API calls 93136->93137 93138 6d087789 93137->93138 93139 6d046006 9 API calls 93138->93139 93140 6d0877b3 93139->93140 93141 6d046006 9 API calls 93140->93141 93142 6d0877dd 93141->93142 93143 6d046006 9 API calls 93142->93143 93144 6d087807 93143->93144 93145 6d046006 9 API calls 93144->93145 93146 6d087831 93145->93146 93147 6d046006 9 API calls 93146->93147 93148 6d08785b 93147->93148 93149 6d046006 9 API calls 93148->93149 93150 6d087886 93149->93150 93151 6d046006 9 API calls 93150->93151 93152 6d0878ac 93151->93152 93153 6d046006 9 API calls 93152->93153 93154 6d0878d2 93153->93154 93155 6d046006 9 API calls 93154->93155 93156 6d0878fc 93155->93156 93157 6d046006 9 API calls 93156->93157 93158 6d087926 93157->93158 93159 6d046006 9 API calls 93158->93159 93160 6d087950 93159->93160 93161 6d046006 9 API calls 93160->93161 93162 6d08797a 93161->93162 93163 6d046006 9 API calls 93162->93163 93164 6d0879a4 93163->93164 93165 6d046006 9 API calls 93164->93165 93166 6d0879ce 93165->93166 93167 6d046006 9 API calls 93166->93167 93168 6d0879f8 93167->93168 93169 6d046006 9 API calls 93168->93169 93170 6d087a22 93169->93170 93171 6d046006 9 API calls 93170->93171 93172 6d087a4c 93171->93172 93173 6d046006 9 API calls 93172->93173 93174 6d087a76 93173->93174 93175 6d046006 9 API calls 93174->93175 93176 6d087aa0 93175->93176 93177 6d046006 9 API calls 93176->93177 93178 6d087aca 93177->93178 93179 6d046006 9 API calls 93178->93179 93180 6d087af4 93179->93180 93181 6d046006 9 API calls 93180->93181 93182 6d087b1e 93181->93182 93183 6d046006 9 API calls 93182->93183 93184 6d087b48 93183->93184 93185 6d046006 9 API calls 93184->93185 93186 6d087b72 93185->93186 93187 6d046006 9 API calls 93186->93187 93188 6d087b9c 93187->93188 93189 6d046006 9 API calls 93188->93189 93190 6d087bc6 93189->93190 93278 6d081d0f 93190->93278 93192 6d087bf4 93193 6d081d0f 9 API calls 93192->93193 93194 6d087c11 93193->93194 93195 6d081d0f 9 API calls 93194->93195 93196 6d087c2e 93195->93196 93197 6d081d0f 9 API calls 93196->93197 93198 6d087c4b 93197->93198 93199 6d081d0f 9 API calls 93198->93199 93200 6d087c68 93199->93200 93201 6d081d0f 9 API calls 93200->93201 93202 6d087c85 93201->93202 93203 6d081d0f 9 API calls 93202->93203 93204 6d0821ef 93203->93204 93205 6d08665e 93204->93205 93206 6d041fcf _invalid_parameter_noinfo_noreturn 93205->93206 93207 6d086673 93206->93207 93208 6d046006 9 API calls 93207->93208 93209 6d08668c 93208->93209 93210 6d046006 9 API calls 93209->93210 93211 6d0866b8 93210->93211 93212 6d046006 9 API calls 93211->93212 93213 6d0866e2 93212->93213 93214 6d046006 9 API calls 93213->93214 93215 6d08670c 93214->93215 93216 6d046006 9 API calls 93215->93216 93217 6d086736 93216->93217 93218 6d046006 9 API calls 93217->93218 93219 6d086760 93218->93219 93220 6d046006 9 API calls 93219->93220 93221 6d08678a 93220->93221 93222 6d046006 9 API calls 93221->93222 93223 6d0867b4 93222->93223 93223->92922 93291 6d08401f 93224->93291 93226 6d083f51 VirtualAlloc WSAStartup socket 93227 6d083fa9 connect 93226->93227 93228 6d083fcb 93227->93228 93229 6d083fd4 recv 93228->93229 93230 6d083ffd 93228->93230 93229->93228 93229->93230 93230->92924 93232 6d084fd9 __EH_prolog3_catch 93231->93232 93235 6cffb2e0 93232->93235 93234 6d084fe3 throw_exception 93234->92930 93236 6cffb2ee 93235->93236 93237 6cffb319 93235->93237 93238 6d112e95 std::_Facet_Register 4 API calls 93236->93238 93239 6cffb326 93237->93239 93241 6d112ea7 malloc 93237->93241 93240 6cffb2ff 93238->93240 93239->93234 93242 6cffb308 93240->93242 93243 6cffb313 _invalid_parameter_noinfo_noreturn 93240->93243 93244 6d112eb4 93241->93244 93245 6d112e9a _callnewh 93241->93245 93242->93234 93243->93237 93244->93234 93245->93241 93248 6d112eb6 std::_Facet_Register 93245->93248 93246 6d114903 std::_Facet_Register 93247 6d114911 _CxxThrowException 93246->93247 93248->93246 93249 6d1148f4 _CxxThrowException 93248->93249 93249->93246 93251 6d040f0d __EH_prolog3_catch 93250->93251 93252 6cffb2e0 Concurrency::details::platform::__RegisterWaitForSingleObject 9 API calls 93251->93252 93253 6d040f17 throw_exception 93252->93253 93253->92934 93254->92937 93256 6d089ef6 __EH_prolog3 93255->93256 93263 6d08b9a2 93256->93263 93258 6d089f09 throw_exception 93258->92939 93260 6d089ec9 __EH_prolog3 93259->93260 93267 6d08b94c 93260->93267 93262 6d089edc throw_exception 93262->92943 93264 6d08b9ae __EH_prolog3_catch 93263->93264 93265 6cffb2e0 Concurrency::details::platform::__RegisterWaitForSingleObject 9 API calls 93264->93265 93266 6d08b9bb throw_exception 93265->93266 93266->93258 93268 6d08b958 __EH_prolog3_catch 93267->93268 93269 6cffb2e0 Concurrency::details::platform::__RegisterWaitForSingleObject 9 API calls 93268->93269 93270 6d08b962 throw_exception 93269->93270 93270->93262 93281 6d0418fe 93271->93281 93274 6d046006 93275 6d046012 __EH_prolog3_catch 93274->93275 93287 6d041035 93275->93287 93277 6d04601a throw_exception 93277->92948 93279 6d046006 9 API calls 93278->93279 93280 6d081d1d 93279->93280 93280->93192 93282 6d04192f 93281->93282 93285 6d041911 93281->93285 93282->93274 93283 6d0418fe _invalid_parameter_noinfo_noreturn 93283->93285 93285->93282 93285->93283 93286 6cffb330 _invalid_parameter_noinfo_noreturn 93285->93286 93288 6d041041 __EH_prolog3_catch 93287->93288 93289 6cffb2e0 Concurrency::details::platform::__RegisterWaitForSingleObject 9 API calls 93288->93289 93290 6d04104d throw_exception 93289->93290 93290->93277 93292 6d08426a 93291->93292 93292->93226 93293 6d0854e6 93294 6d0854f2 __EH_prolog3 93293->93294 93296 6d085513 throw_exception 93294->93296 93302 6d11367b EnterCriticalSection 93294->93302 93297 6d085526 93297->93296 93298 6d085530 ??0Qos@qos@adapt_for_imports@ierd_tgp@@QAE 93297->93298 93299 6d113aa0 Concurrency::details::platform::__RegisterWaitForSingleObject 2 API calls 93298->93299 93300 6d085545 93299->93300 93307 6d113631 EnterCriticalSection LeaveCriticalSection ?shutdown@Application@common@ierd_tgp@ SetEvent ResetEvent 93300->93307 93303 6d11368f 93302->93303 93304 6d113694 LeaveCriticalSection 93303->93304 93308 6d11370f ?shutdown@Application@common@ierd_tgp@ LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 93303->93308 93304->93297 93307->93296 93308->93303 93309 283474c lstrlenW 93310 284fff8 93309->93310

          Control-flow Graph

          APIs
          • VirtualAlloc.KERNEL32(00000000,0001E000,00003000,00000040), ref: 6D083F62
          • WSAStartup.WS2_32(00000202,?), ref: 6D083F89
          • socket.WS2_32(00000002,00000001,00000000), ref: 6D083F92
          • connect.WS2_32(?,?,00000010), ref: 6D083FC7
          • recv.WS2_32(?,00000000,00001000,00000000), ref: 6D083FE6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AllocStartupVirtualconnectrecvsocket
          • String ID: ]$z
          • API String ID: 386822499-3659341173
          • Opcode ID: 2742a577c9b3370c7356fbe8b85e27bac68a0b4d21b25f9116afe7e27bb80fc7
          • Instruction ID: 24732720a9532926185860b2d76f19fc7793b542237e9c071f7fc5b20cfe7689
          • Opcode Fuzzy Hash: 2742a577c9b3370c7356fbe8b85e27bac68a0b4d21b25f9116afe7e27bb80fc7
          • Instruction Fuzzy Hash: 57214870D4424DEBEF10CBE4C809BDEBBB9AF49305F108159E214BA282D7B49A85CB65

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 121 6cff2dcb-6cff2de4 GetSystemInfo
          APIs
          • GetSystemInfo.KERNEL32(?), ref: 6CFF2DD5
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: InfoSystem
          • String ID:
          • API String ID: 31276548-0
          • Opcode ID: ff0e6022945e30959fa61ecadb1475c923a8d6115586d2335c4617b0f96bbfea
          • Instruction ID: 3d48c143f042e81af0b46bb911904764c9e9d9c824775d23358edf8e8e9b3e7b
          • Opcode Fuzzy Hash: ff0e6022945e30959fa61ecadb1475c923a8d6115586d2335c4617b0f96bbfea
          • Instruction Fuzzy Hash: 45C04CB59042089BCF00EBA5D58998B77FCBA4A206B400561D912E3240E770ED4CCBA1

          Control-flow Graph

          APIs
          • __EH_prolog3.LIBCMT ref: 6D0820BA
            • Part of subcall function 6D081FE2: __EH_prolog3.LIBCMT ref: 6D081FE9
            • Part of subcall function 6D082055: __EH_prolog3.LIBCMT ref: 6D08205C
            • Part of subcall function 6D081F36: __EH_prolog3.LIBCMT ref: 6D081F3D
            • Part of subcall function 6D050076: __EH_prolog3.LIBCMT ref: 6D05007D
            • Part of subcall function 6D08A08A: __EH_prolog3.LIBCMT ref: 6D08A091
            • Part of subcall function 6D08A08A: _Mtx_init_in_situ.MSVCP140(?,00000002,00000008,6D082169,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08A0BF
            • Part of subcall function 6D08A08A: _Mtx_init_in_situ.MSVCP140(?,00000002,?,00000002,00000008,6D082169,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08A0D1
            • Part of subcall function 6D08A08A: _Mtx_init_in_situ.MSVCP140(?,00000002,?,00000002,?,00000002,00000008,6D082169,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08A0E3
            • Part of subcall function 6D081FA1: __EH_prolog3.LIBCMT ref: 6D081FA8
          • _Mtx_init_in_situ.MSVCP140(?,00000002,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D082188
          • memset.VCRUNTIME140(?,00000000,00004EAC,?,00000002,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08219F
            • Part of subcall function 6D083F3F: VirtualAlloc.KERNEL32(00000000,0001E000,00003000,00000040), ref: 6D083F62
            • Part of subcall function 6D083F3F: WSAStartup.WS2_32(00000202,?), ref: 6D083F89
            • Part of subcall function 6D083F3F: socket.WS2_32(00000002,00000001,00000000), ref: 6D083F92
            • Part of subcall function 6D083F3F: connect.WS2_32(?,?,00000010), ref: 6D083FC7
            • Part of subcall function 6D083F3F: recv.WS2_32(?,00000000,00001000,00000000), ref: 6D083FE6
          • GetCurrentThreadId.KERNEL32 ref: 6D08220E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$Mtx_init_in_situ$AllocCurrentStartupThreadVirtualconnectmemsetrecvsocket
          • String ID:
          • API String ID: 763000222-0
          • Opcode ID: 5f9d6aff9e0e4924acafb1fdadd8266210196eb56e23b7348191a89d27f6e860
          • Instruction ID: 7bbac8e53ea3931270f0ff47dd360b70d55ec5fea93232efa6dc0728a83c1395
          • Opcode Fuzzy Hash: 5f9d6aff9e0e4924acafb1fdadd8266210196eb56e23b7348191a89d27f6e860
          • Instruction Fuzzy Hash: 134172B0809B45CEDB20DF74C5547DFBBE0AF15308F51496DC2AA972D1DB782A08CB96

          Control-flow Graph

          APIs
          • _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D00621D,0000002C,0000000C,6D005702,00000004,6D0057B1,00000214), ref: 6D112E9D
          • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D00621D,0000002C,0000000C,6D005702,00000004,6D0057B1,00000214), ref: 6D112EAA
          • _CxxThrowException.VCRUNTIME140(?,6D35275C), ref: 6D1148FD
          • _CxxThrowException.VCRUNTIME140(?,6D352778), ref: 6D11491A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ExceptionThrow$_callnewhmalloc
          • String ID:
          • API String ID: 4113974480-0
          • Opcode ID: c831d761a885688e4dacfa7d17c5e90dfc1c9646f0a50f7e610c4905b2074da6
          • Instruction ID: 81d6587ec943b33e0337f355d95e269be8e3758424259a99f7c2d123b7ae74fa
          • Opcode Fuzzy Hash: c831d761a885688e4dacfa7d17c5e90dfc1c9646f0a50f7e610c4905b2074da6
          • Instruction Fuzzy Hash: A8F05439C8C20EB6CB24EBE4EC09EAF776C6A05258F514175EA2491095EFB0E666C5D0

          Control-flow Graph

          APIs
          • __EH_prolog3.LIBCMT ref: 6D0854ED
          • ??0Qos@qos@adapt_for_imports@ierd_tgp@@QAE@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,6D04AB44), ref: 6D085536
          • __Init_thread_footer.LIBCMT ref: 6D08554A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3Init_thread_footerQos@qos@adapt_for_imports@ierd_tgp@@
          • String ID:
          • API String ID: 3158337806-0
          • Opcode ID: 93d1d0c779ef3c4f5763706f467b918bc739ed3a6ea3a322168acc40fe905a27
          • Instruction ID: 6389a06602b358f6aa98d1a25c969deb1db16b45e0b3c84d7454e130b024759e
          • Opcode Fuzzy Hash: 93d1d0c779ef3c4f5763706f467b918bc739ed3a6ea3a322168acc40fe905a27
          • Instruction Fuzzy Hash: 11F0B43554C901DBDF25DB24C994F2C3371AB47336FA20268E1124B3C9CBB89D038745

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 73 283474c-284fff8 lstrlenW 75 2850003-285000b 73->75 76 284fffe 73->76 76->75 77 284fffe call 2833260 76->77 77->75
          APIs
          • lstrlenW.KERNEL32(|p1:134.122.134.93|o1:9090|t1:1|p2:134.122.134.93|o2:9091|t2:1|p3:134.122.134.93|o3:9092|t3:1|dd:1|cl:1|fz:), ref: 02834755
            • Part of subcall function 02833260: __wcsrev.LIBCMT ref: 02850655
          Strings
          • |p1:134.122.134.93|o1:9090|t1:1|p2:134.122.134.93|o2:9091|t2:1|p3:134.122.134.93|o3:9092|t3:1|dd:1|cl:1|fz:, xrefs: 02834750
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __wcsrevlstrlen
          • String ID: |p1:134.122.134.93|o1:9090|t1:1|p2:134.122.134.93|o2:9091|t2:1|p3:134.122.134.93|o3:9092|t3:1|dd:1|cl:1|fz:
          • API String ID: 4062721203-58920605
          • Opcode ID: bfff8c35e55522e162e4758a5f2298c681b316372949b8f3fc3ca7c7f02c4518
          • Instruction ID: 23a453e5da52e2351f36ee99585bcb1bd9b487a17932d0ad341aeb5e453ab61f
          • Opcode Fuzzy Hash: bfff8c35e55522e162e4758a5f2298c681b316372949b8f3fc3ca7c7f02c4518
          • Instruction Fuzzy Hash: 42C08C7E28821CCFF60163D8901872C73A4EB32B1AFA04426EA01C9941EE998C10C7F2

          Control-flow Graph

          APIs
          • ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(6D3526E0,00000010,6CFF9278,00000004,00000004,00000003,6CFF8EC0,6CFF8ED0,?,?), ref: 6D114285
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?shutdown@Application@common@ierd_tgp@@
          • String ID:
          • API String ID: 3896587232-0
          • Opcode ID: a3cee8fc3a3eca378519098cb9d61b1575ee06f571edd102ba1dfcce623060ba
          • Instruction ID: 711fe1ee8afacd819486c823055f39ddedf5b669752962c42c1ee5cb459974c6
          • Opcode Fuzzy Hash: a3cee8fc3a3eca378519098cb9d61b1575ee06f571edd102ba1dfcce623060ba
          • Instruction Fuzzy Hash: 99F06736A08349DFCB00CFE8D9806DEBB70FB5921DF00413AD92667281C7B06951DB64

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 87 283608a-28360ae RegOpenKeyExW 89 28360b4-28360ce 87->89 90 284f0fb-284f0ff 87->90 89->90 92 284f778 89->92 91 284fc9d 90->91 93 2833f35-284f89b 91->93 94 284fca3 91->94 92->91 93->91 96 284fca8 94->96 96->96
          APIs
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Open
          • String ID:
          • API String ID: 71445658-0
          • Opcode ID: f7c4d477c2a802bbd87cbd4072e32c3507fa5fa076c290ef27b68b24f9045fb4
          • Instruction ID: b522498ad3ecb8dd2fc01599b999ce1eeaca315388cbc0104e9ad34d48e9206a
          • Opcode Fuzzy Hash: f7c4d477c2a802bbd87cbd4072e32c3507fa5fa076c290ef27b68b24f9045fb4
          • Instruction Fuzzy Hash: 24E06D7C90821DEBCB15CA40E584BBDB3B56B70708F604049D106A6884EB783A04CAD5

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 97 6d082226-6d08224b call 6d112f1b call 6d112e95 102 6d08224d-6d08224f call 6d0820b3 97->102 103 6d082256-6d082264 call 6d112ee4 97->103 106 6d082254 102->106 106->103
          APIs
          • __EH_prolog3.LIBCMT ref: 6D08222D
            • Part of subcall function 6D112E95: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D00621D,0000002C,0000000C,6D005702,00000004,6D0057B1,00000214), ref: 6D112EAA
            • Part of subcall function 6D0820B3: __EH_prolog3.LIBCMT ref: 6D0820BA
            • Part of subcall function 6D0820B3: _Mtx_init_in_situ.MSVCP140(?,00000002,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D082188
            • Part of subcall function 6D0820B3: memset.VCRUNTIME140(?,00000000,00004EAC,?,00000002,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08219F
            • Part of subcall function 6D0820B3: GetCurrentThreadId.KERNEL32 ref: 6D08220E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$CurrentMtx_init_in_situThreadmallocmemset
          • String ID:
          • API String ID: 3113669236-0
          • Opcode ID: f788a24224a6219bffb47f83f36cd675ef7cd0ebe27b2a5fb4d359f5c1c38a13
          • Instruction ID: 5c7175d485b50c3ca4c525ac23fc15e5970e7265d5fe84b3b4ca0d82ddc05f0d
          • Opcode Fuzzy Hash: f788a24224a6219bffb47f83f36cd675ef7cd0ebe27b2a5fb4d359f5c1c38a13
          • Instruction Fuzzy Hash: 20E0DF30B4D706DBDB349FB80D4121E65E06B05220B51413E92208B2C1DBB08C008740

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 108 2835e07-284f0f9 RegQueryValueExW 110 284f0fb-284f0ff 108->110 111 284fc9d 110->111 112 2833f35-284f89b 111->112 113 284fca3 111->113 112->111 115 284fca8 113->115 115->115
          APIs
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: QueryValue
          • String ID:
          • API String ID: 3660427363-0
          • Opcode ID: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
          • Instruction ID: 08ddeb0c13d1480ad02ce9242c2606872543a91a55d21112d40b69a8812f0413
          • Opcode Fuzzy Hash: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
          • Instruction Fuzzy Hash: E6C08C2CC5C76CE3C42259501C09979B2E0477462DF1004BFAA0BF5C80ADA42580C6EA

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 116 2834274-2850699 CreateThread
          APIs
          • CreateThread.KERNEL32(00000000,00000000,Function_00006110,00000000), ref: 02850693
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CreateThread
          • String ID:
          • API String ID: 2422867632-0
          • Opcode ID: 36044c989f28c936d05aeb4168baa5f0ade32ef6de4dd5a0c10f43242e38d6c3
          • Instruction ID: b9387998cf69a909e9550571926b8d7d35dc8fcacff60999887fd55957845261
          • Opcode Fuzzy Hash: 36044c989f28c936d05aeb4168baa5f0ade32ef6de4dd5a0c10f43242e38d6c3
          • Instruction Fuzzy Hash: FCC04C1C68C33CEBF52115442D06B291A403779F2DE604B163723ED8C259980440C593
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05AC45
            • Part of subcall function 6D04FD6C: __EH_prolog3.LIBCMT ref: 6D04FD73
            • Part of subcall function 6D04FA18: __EH_prolog3.LIBCMT ref: 6D04FA1F
            • Part of subcall function 6CFFA3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6D0062D8,00000000,6D006649,00000003,23C35E98,?,?,00000000,6D266604,000000FF,?,6D005B05,00000000), ref: 6CFFA3E5
          • _time32.API-MS-WIN-CRT-TIME-L1-1-0(00000000,game_id,?,?,?,uin,?,00000000,session_id,?,?,user_id,?,00000000,error_code,?), ref: 6D05AE76
          • ?instance@Application@common@ierd_tgp@@SAPAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,version,?,00000002,dump_time,?,00000000), ref: 6D05AF09
          • ?instance@Application@common@ierd_tgp@@SAPAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(ver1,?,?), ref: 6D05AF5E
          • ?instance@Application@common@ierd_tgp@@SAPAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(ver2,?,?), ref: 6D05AFB4
          • ?instance@Application@common@ierd_tgp@@SAPAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(ver3,?,?), ref: 6D05B00A
          • ?instance@Application@common@ierd_tgp@@SAPAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(ver4,?,?), ref: 6D05B060
          • ?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,ver4,?,?), ref: 6D05B069
            • Part of subcall function 6D01737D: __EH_prolog3.LIBCMT ref: 6D017384
            • Part of subcall function 6D01737D: ?get_first_mac@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000004), ref: 6D017390
          • ?instance@Application@common@ierd_tgp@@SAPAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(machine_id,?,00000000,ver4,?,?), ref: 6D05B0BC
          • ?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,machine_id,?,00000000,ver4,?,?), ref: 6D05B0C7
            • Part of subcall function 6D01741C: __EH_prolog3.LIBCMT ref: 6D017423
          • ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(session_id,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B115
          • ?get_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBEHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(session_id,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B11C
          • ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(channel_id,?,00000000,session_id,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B15E
          • ?get_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QBE_KXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(channel_id,?,00000000,session_id,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B165
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D05B673
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000000), ref: 6D05B680
          • _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,6D2969C0), ref: 6D05B7E5
            • Part of subcall function 6D057750: __EH_prolog3.LIBCMT ref: 6D057757
          • fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 6D05B816
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B82F
          • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp,000001A2,6D31E62F,?,?,?,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B86C
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B828
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,machine_id,?,00000000,ver4,?,?), ref: 6D05B8A0
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D05B8AE
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D05B8B5
          • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp,000001AA,6D31E62F), ref: 6D05B8F2
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Application@common@ierd_tgp@@$D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?instance@H_prolog3V123@$?u16to8@common@ierd_tgp@@D@2@@4@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@$D@2@@std@@$?get_log_instance@base@@?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@H_prolog3_Logger@1@Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@_errno$?get_bind_game_id@?get_channel_id@?get_first_mac@common@ierd_tgp@@?get_machine_id@?get_session_id@H_prolog3_catch__invalid_parameter_noinfo_noreturn_time32_wfopenfclosefwrite
          • String ID: !$[ExptFileProcesser] Dump_meta fopen path = %s, failed(%d)$[ExptFileProcesser] Dump_meta fwrite path = %s, failed(%d)$\meta.json$app_id$bind_game_id$channel_id$cur_name$d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp$data$data_files$desc$dump_time$error_code$expts$feedback_id$game_id$machine_id$orig_path$qos_common$self_int$self_str$session_id$sub_type$time_stamp$trace_id$type$uin$user_id$ver1$ver2$ver3$ver4$version
          • API String ID: 3408469005-634620883
          • Opcode ID: a731e73459e7bd67f3c7d734a2c3987a65696c5ac04bfe4836d9c57d5afce57e
          • Instruction ID: a69369fc1ad2047980d58ccc4d4d942a2bb47325f10af656ec2dc70c171712ad
          • Opcode Fuzzy Hash: a731e73459e7bd67f3c7d734a2c3987a65696c5ac04bfe4836d9c57d5afce57e
          • Instruction Fuzzy Hash: 8E825D30814258EAEB14DBA4CDA8BEDB7B8EF11308F5440D8D119A72A1DF745F49DFA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A7C3B
          • memset.VCRUNTIME140 ref: 6D0A7C58
          • memset.VCRUNTIME140(?,00000000,00000070), ref: 6D0A7C8F
          • lstrcpyW.KERNEL32(?,?), ref: 6D0A7C9F
          • CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6D0A7CDA
          • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 6D0A7CFF
          • LocalAlloc.KERNEL32(00000040,?), ref: 6D0A7D11
          • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 6D0A7D38
          • CertFindCertificateInStore.CRYPT32(?,00010001,00000000,000B0000,?,00000000), ref: 6D0A7D7F
          • CertGetNameStringA.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6D0A7D98
          • LocalAlloc.KERNEL32(00000040,00000000), ref: 6D0A7DAE
          • CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6D0A7DC7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7DD1
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7E38
          • GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000B95,6D31E62F), ref: 6D0A7E78
          • LocalFree.KERNEL32(00000000), ref: 6D0A7E9F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7EAA
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7F05
          • GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000B82,6D31E62F), ref: 6D0A7F4D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7F5E
          • GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000B75,6D31E62F), ref: 6D0A7FA6
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7FB4
          • GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000B64,6D31E62F), ref: 6D0A7FF4
          • LocalFree.KERNEL32(?), ref: 6D0A8020
          • CertFreeCertificateContext.CRYPT32(00000000), ref: 6D0A802F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A803A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A8095
          • GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000B50,6D31E62F), ref: 6D0A80DA
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A80E8
          • GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000B42,6D31E62F), ref: 6D0A8125
          • CertCloseStore.CRYPT32(00000000,00000000), ref: 6D0A815C
          • CryptMsgClose.CRYPT32(00000000), ref: 6D0A8171
          Strings
          • [Sys_wrapper::VerifyCertInfo] Get Signer Information failed: %d!, xrefs: 6D0A7FFB
          • [Sys_wrapper::VerifyCertInfo] Get signer information size failed: %d!, xrefs: 6D0A80E1
          • [Sys_wrapper::VerifyCertInfo] CryptQueryObject failed: %u!, xrefs: 6D0A812C
          • [Sys_wrapper::VerifyCertInfo]Subject Name: %s;, xrefs: 6D0A7E10
          • [Sys_wrapper::VerifyCertInfo] CertGetNameString failed: %d!, xrefs: 6D0A7E7F, 6D0A7F54
          • [Sys_wrapper::VerifyCertInfo] CertFindCertificateInStore failed: %d!, xrefs: 6D0A7FAD
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A7DF5, 6D0A7E5C, 6D0A7ED6, 6D0A7F31, 6D0A7F8A, 6D0A7FD8, 6D0A8066, 6D0A80C3, 6D0A810C
          • [Sys_wrapper::VerifyCertInfo]LocalAlloc szName is null, xrefs: 6D0A7EF0
          • [Sys_wrapper::VerifyCertInfo] LocalAlloc pSignerInfo failed!, xrefs: 6D0A8080
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$ErrorLast$Cert$CryptLocal$Free$AllocCertificateCloseNameParamStoreStringmemset$ContextFindH_prolog3H_prolog3_H_prolog3_catch_ObjectQuerylstrcpy
          • String ID: [Sys_wrapper::VerifyCertInfo] Get Signer Information failed: %d!$[Sys_wrapper::VerifyCertInfo] Get signer information size failed: %d!$[Sys_wrapper::VerifyCertInfo] CertFindCertificateInStore failed: %d!$[Sys_wrapper::VerifyCertInfo] CertGetNameString failed: %d!$[Sys_wrapper::VerifyCertInfo] CryptQueryObject failed: %u!$[Sys_wrapper::VerifyCertInfo] LocalAlloc pSignerInfo failed!$[Sys_wrapper::VerifyCertInfo]LocalAlloc szName is null$[Sys_wrapper::VerifyCertInfo]Subject Name: %s;$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 2020732910-2120264105
          • Opcode ID: 237224cd40e4a2ea2fc9ed45a1bea70f30a8e61ac51ebd409a740594f856f83f
          • Instruction ID: 2328d14960953fdf5142ab899d479478a1c2033cafc145a89230a56daa2a8a3f
          • Opcode Fuzzy Hash: 237224cd40e4a2ea2fc9ed45a1bea70f30a8e61ac51ebd409a740594f856f83f
          • Instruction Fuzzy Hash: 41D1A171944226AFFB20DBA4CC49FAA77B8AF45709F010194B609FB1C2DB72DE45CB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A2CC9
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0A2D41
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • GetLastError.KERNEL32 ref: 6D0A2D4C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A2D52
          • ?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0A2DAA
          • GetLastError.KERNEL32 ref: 6D0A2DB5
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A2DBB
          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6D0A2E20
          • memset.VCRUNTIME140(?,00000000,00000228,00000002,00000000), ref: 6D0A2E44
          • Process32FirstW.KERNEL32(00000000,0000022C), ref: 6D0A2E5E
          • ?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000000,0000022C), ref: 6D0A2ED5
          • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,0000022C), ref: 6D0A2F1F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A2F2F
          • memset.VCRUNTIME140(?,00000000,00000208), ref: 6D0A2FC5
          • GetModuleFileNameExW.PSAPI(00000000,00000000,?,00000104), ref: 6D0A2FF7
          • GetLastError.KERNEL32(00000000,00000000,?,00000104), ref: 6D0A305A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A3062
          • CloseHandle.KERNEL32(00000000), ref: 6D0A30CA
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A30DB
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,000005EC,6D31E62F), ref: 6D0A3118
          • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 6D0A3145
          • memset.VCRUNTIME140(?,00000000,00000424,00000008,?), ref: 6D0A3162
          • Module32FirstW.KERNEL32(00000000,0000022C), ref: 6D0A317C
          • CloseHandle.KERNEL32(00000000), ref: 6D0A31E2
          • Process32NextW.KERNEL32(00000000,0000022C), ref: 6D0A3286
          • GetLastError.KERNEL32(00000002,00000000), ref: 6D0A329C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A32A4
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • OpenProcess.KERNEL32(00000400,00000000,?), ref: 6D0A2FD9
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • CloseHandle.KERNEL32(00000000,00000000,0000022C), ref: 6D0A3294
          Strings
          • [Sys_wrapper][IsProcessRunning]GetModuleFileNameExW (len:%d), err:%x, xrefs: 6D0A30A1
          • [Sys_wrapper][IsProcessRunning]u8to16 fail, xrefs: 6D0A2D95
          • [Sys_wrapper][IsProcessRunning]Find Process:%s, pid:%u, xrefs: 6D0A2F81
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A2D7E, 6D0A2DDF, 6D0A2F53, 6D0A3086, 6D0A30FF, 6D0A320E, 6D0A32C8
          • [Sys_wrapper][IsProcessRunning]extract_name fail, xrefs: 6D0A2DF6
          • [Sys_wrapper][IsProcessRunning]Open Process Failed:%u, xrefs: 6D0A311F
          • [Sys_wrapper][IsProcessRunning]Open Module Failed:%u, xrefs: 6D0A322E
          • [Sys_wrapper][IsProcessRunning]CreateToolhelp32Snapshot fail, err:%d, xrefs: 6D0A32E0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$ErrorLast$CloseHandleU?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@memset$?extract_name@common@ierd_tgp@@CreateFirstH_prolog3_Process32SnapshotToolhelp32V34@@W@2@@std@@$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@FileH_prolog3H_prolog3_catch_ModuleModule32NameNextOpenProcessU?$char_traits@V?$allocator@V?$basic_string@W@2@@4@@_wcsicmp
          • String ID: [Sys_wrapper][IsProcessRunning]CreateToolhelp32Snapshot fail, err:%d$[Sys_wrapper][IsProcessRunning]Find Process:%s, pid:%u$[Sys_wrapper][IsProcessRunning]GetModuleFileNameExW (len:%d), err:%x$[Sys_wrapper][IsProcessRunning]Open Module Failed:%u$[Sys_wrapper][IsProcessRunning]Open Process Failed:%u$[Sys_wrapper][IsProcessRunning]extract_name fail$[Sys_wrapper][IsProcessRunning]u8to16 fail$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 711256695-191200958
          • Opcode ID: 45a39222ef686cc7e5ace7c29b0c4b2a37839aec0ba4061bf0c4fe8043657528
          • Instruction ID: 2806b6a68d8c8933011854944ea35bf4b82310e46fd711a9073a5fb982b78c4a
          • Opcode Fuzzy Hash: 45a39222ef686cc7e5ace7c29b0c4b2a37839aec0ba4061bf0c4fe8043657528
          • Instruction Fuzzy Hash: 1C02C270948229AFEB24DBA4CC58BEEB7B4AF59304F1501E9E508B7281DB749F84CF51
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0B6784
          • IsDebuggerPresent.KERNEL32(000001A8,6D0B6F5C,?,?,?,?,00000000,0000005C,6D0B6E10,?,?,?,?,?), ref: 6D0B678B
          • ?GetInstance@InfoTraceSystem@trace_system@ierd_tgp@@SAAAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,6D0B661D,23C35E98,?,?,?,6D266604,000000FF), ref: 6D0B6799
          • ?GetUIN@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,6D0B661D,23C35E98,?,?,?,6D266604,000000FF), ref: 6D0B67A6
          • GetTickCount.KERNEL32 ref: 6D0B67BD
          • _time32.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,6D0B661D,23C35E98,?,?,?,6D266604), ref: 6D0B6812
          • ?GetTgpWorkState@common@ierd_tgp@@YA?AW4EnumTgpTaskState@12@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0B6868
          • ?GetAfterTimePairSecond@InfoTraceSystem@trace_system@ierd_tgp@@QAE?AU?$pair@II@std@@I@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,system_event,main_thread_tick), ref: 6D0B68B2
          • ?GetUIN@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0B6979
          • ?GetTraceInstanceID@InfoTraceSystem@trace_system@ierd_tgp@@QAE_K_KII@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(000186A1,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0B6988
          • GetTickCount.KERNEL32 ref: 6D0B6DA4
            • Part of subcall function 6D0B63C1: __EH_prolog3.LIBCMT ref: 6D0B63C8
          • ?GetUIN@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0B69E0
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?GenerateUniqueMemLog@common@ierd_tgp@@YA_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,?,?,?,?,?,?,?,00000000,?,perf_type,?,00000000,after_login), ref: 6D0B6BC8
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,00000000,?,perf_type,?,00000000,after_login,?,?), ref: 6D0B6BF1
          • ?Instance@DumpManager@common@ierd_tgp@@SAAAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,00000000,?,perf_type,?,00000000,after_login,?,?), ref: 6D0B6C69
            • Part of subcall function 6D004080: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6D004167
          • ?DumpNow@DumpManager@common@ierd_tgp@@QAE_NW4EnumInfoLevel@123@_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@6@K@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000,?,perf_type), ref: 6D0B6C7D
            • Part of subcall function 6D0B3F24: __EH_prolog3_GS.LIBCMT ref: 6D0B3F43
            • Part of subcall function 6D0B3F24: GetTickCount.KERNEL32 ref: 6D0B3FA0
            • Part of subcall function 6D0B3F24: ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,DumpNow,00000007), ref: 6D0B4010
            • Part of subcall function 6D0B3F24: _time64.API-MS-WIN-CRT-TIME-L1-1-0(?,00000000,?,?,DumpNow,00000007), ref: 6D0B4071
            • Part of subcall function 6D0B3F24: memset.VCRUNTIME140(?,00000000,?,?,DumpNow,00000007), ref: 6D0B4093
            • Part of subcall function 6D0B3F24: _localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,00000000,?,?,DumpNow,00000007), ref: 6D0B40A6
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D2911A4,?,?,?,?,?,?,?,?,00000000,?,perf_type,?,00000000,after_login), ref: 6D0B6C97
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,00000000,?,perf_type,?,00000000,after_login,?,?), ref: 6D0B6CE5
          • ?TraceInfo@InfoTraceSystem@trace_system@ierd_tgp@@QAE_N_KABUTraceInformation@23@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,00000000,?,perf_type,?,00000000), ref: 6D0B6D64
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Trace$Info$System@trace_system@ierd_tgp@@$?get_log_instance@base@@Logger@1@$CountDumpTick$D@std@@EnumH_prolog3H_prolog3_Instance@Manager@common@ierd_tgp@@U?$char_traits@U?$char_traits@_V123@V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@$AfterD@2@@4@@D@2@@6@DebuggerGenerateI@std@@Info@Information@23@@InstanceLevel@123@_Log@common@ierd_tgp@@Now@PairPresentSecond@State@12@State@common@ierd_tgp@@TaskTimeU?$pair@UniqueWork_invalid_parameter_noinfo_noreturn_localtime64_s_time32_time64memmovememset
          • String ID: [TraceEvent] Main thread trace dump generated$[TraceEvent] Main thread trace dump got failed$[TraceEvent] Main thread trace will generate dump$after_login$after_start$d:\ci_dev\wegame_client\codes\common\src\trace_event.cpp$main_thread_tick$perf_type$system_event$tgp_tick_warning
          • API String ID: 2131266272-450692783
          • Opcode ID: 190daf83eb188bf24b00879b300c7affcfefe70d1be6ca4f4200de1c7b506950
          • Instruction ID: 889dee36ad550a193fe817f8e7bd93a74979bcab0543a87ce5b74fa84a421e08
          • Opcode Fuzzy Hash: 190daf83eb188bf24b00879b300c7affcfefe70d1be6ca4f4200de1c7b506950
          • Instruction Fuzzy Hash: B002B170D08209AEEB15DB74CC50BEEB7B8EF55304F50819DE15AAB181EF319B89CB61
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A6FEB
          • ?IsWin10_OS@Sys_wrapper@common@ierd_tgp@@SA_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(0000046C), ref: 6D0A7002
            • Part of subcall function 6D0A3669: memset.VCRUNTIME140(?,00000000,00000118), ref: 6D0A368A
            • Part of subcall function 6D0A3669: GetVersionExW.KERNEL32(0000011C), ref: 6D0A36A3
          • ShellExecuteW.SHELL32(00000000,?,?,00000000,00000000,00000000), ref: 6D0A705C
          • GetCurrentProcess.KERNEL32(?), ref: 6D0A70D1
          • ?ChangeProcessImageName@Sys_wrapper@common@ierd_tgp@@SA_NPAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D0A70D8
          • CoInitialize.OLE32(00000000), ref: 6D0A7107
          • memset.VCRUNTIME140(?,00000000,00000208), ref: 6D0A711A
          • LoadLibraryW.KERNEL32(Shell32.dll), ref: 6D0A7127
          • LoadStringW.USER32(00000000,?,?,00000104), ref: 6D0A7154
          • CoCreateInstance.OLE32(6D2AC5E0,00000000,00000015,6D2AC5D0,?), ref: 6D0A717C
          • memset.VCRUNTIME140(?,00000000,00000208), ref: 6D0A71AD
          • wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?), ref: 6D0A71C8
          • PathRemoveFileSpecW.SHLWAPI(?), ref: 6D0A71D8
          • wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?), ref: 6D0A7242
          • PathStripPathW.SHLWAPI(?), ref: 6D0A7252
          • SysFreeString.OLEAUT32(?), ref: 6D0A7291
          • VariantClear.OLEAUT32(?), ref: 6D0A7355
          • VarBstrCmp.OLEAUT32(?,?,00000400,00000000), ref: 6D0A7399
          • SysFreeString.OLEAUT32(?), ref: 6D0A73AD
          • SysFreeString.OLEAUT32(?), ref: 6D0A73FF
          • SysFreeString.OLEAUT32(?), ref: 6D0A7423
          • VariantClear.OLEAUT32(?), ref: 6D0A7448
          • CoUninitialize.OLE32 ref: 6D0A7478
          • FreeLibrary.KERNEL32(?), ref: 6D0A7489
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: FreeString$Pathmemset$ClearLibraryLoadProcessSys_wrapper@common@ierd_tgp@@Variantwcscpy_s$BstrChangeCreateCurrentExecuteFileH_prolog3_ImageInitializeInstanceName@RemoveShellSpecStripU?$char_traits@_UninitializeV?$allocator@_V?$basic_string@_VersionW@2@@std@@@W@std@@Win10_
          • String ID: Shell32.dll$explorer.exe$taskbarpin$taskbarunpin
          • API String ID: 2794181495-2015950778
          • Opcode ID: 5db24ff9d0b6cb2434877abef3b15d2cea4579925c4b9cfe7147264a9dfac968
          • Instruction ID: 689bbc81ddf83d765fb598edc2a0067d70405b8865a9cd99a48cd84124b3e0d1
          • Opcode Fuzzy Hash: 5db24ff9d0b6cb2434877abef3b15d2cea4579925c4b9cfe7147264a9dfac968
          • Instruction Fuzzy Hash: 22E14FB0D04258DFEB20CB64CC48B9EBBB8AF86305F5441D9E609A7241DB719F89CF65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A6886
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0A68BF
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • ?EnableFileAccountPrivilege@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,Administrators), ref: 6D0A6926
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,Administrators), ref: 6D0A6953
          • ?EnableFileAccountPrivilege@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,Users,?,Administrators), ref: 6D0A6A24
          • GetUserNameW.ADVAPI32(?,?), ref: 6D0A6AD9
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0A6B4E
          • ?EnableFileAccountPrivilege@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?), ref: 6D0A6BC5
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0A6BF6
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0A6C7C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,Users,?,Administrators), ref: 6D0A6A51
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [E][Sys_wrapper]SetFileAuthority, enable current user privilege failed: %s, %s, xrefs: 6D0A6C5D
          • [E][Sys_wrapper]SetFileAuthority, enable Administrators privilege failed: %s, xrefs: 6D0A69A5
          • [Sys_wrapper]SetFileAuthority, success: %d, current user: %s, path: %s, xrefs: 6D0A6CE7
          • Users, xrefs: 6D0A69D7
          • Administrators, xrefs: 6D0A68DA
          • [E][Sys_wrapper]SetFileAuthority, enable Users privilege failed: %s, xrefs: 6D0A6AA3
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A6977, 6D0A6A75, 6D0A6C1A, 6D0A6CA0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?get_log_instance@base@@Logger@1@$AccountEnableFilePrivilege@Sys_wrapper@common@ierd_tgp@@W@2@@std@@0@$?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@W@2@@std@@$H_prolog3H_prolog3_catch_NameUser
          • String ID: Administrators$Users$[E][Sys_wrapper]SetFileAuthority, enable Administrators privilege failed: %s$[E][Sys_wrapper]SetFileAuthority, enable Users privilege failed: %s$[E][Sys_wrapper]SetFileAuthority, enable current user privilege failed: %s, %s$[Sys_wrapper]SetFileAuthority, success: %d, current user: %s, path: %s$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 77728784-150800822
          • Opcode ID: 0e74ffa2a39d78b6000c1a38a2bfb2b980e24c309ba02345de5936d36e718b3c
          • Instruction ID: eb03876b9e7a76e39159223237844c9910446b2cfb5fb6551e7c6517fa54b629
          • Opcode Fuzzy Hash: 0e74ffa2a39d78b6000c1a38a2bfb2b980e24c309ba02345de5936d36e718b3c
          • Instruction Fuzzy Hash: 83D19070949259EEEB20DBA8CD58BDDB7B4AF24304F6440D9D108B7181EB719F88CFA1
          APIs
          • _memset.LIBCMT ref: 02835849
          • _memset.LIBCMT ref: 02835868
          • _memset.LIBCMT ref: 0283589D
          • GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 028358B1
            • Part of subcall function 028359E0: _vswprintf_s.LIBCMT ref: 028359F1
          • GetFileAttributesA.KERNEL32(?), ref: 028358E0
          • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 02835928
          • VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040,771B0630), ref: 0283594E
          • WriteProcessMemory.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000000,00003000,00000040,771B0630), ref: 02835968
          • GetThreadContext.KERNEL32(?,?,?,00000000,?,00000000,00000000,?,00000000,00000000,00003000,00000040,771B0630), ref: 02835987
          • SetThreadContext.KERNEL32(?,00010007,?,00000000,?,00000000,00000000,?,00000000,00000000,00003000,00000040,771B0630), ref: 028359A2
          • ResumeThread.KERNEL32(?,?,00000000,?,00000000,00000000,?,00000000,00000000,00003000,00000040,771B0630), ref: 028359C1
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
          • String ID: %s%s$D$Windows\SysWOW64\tracerpt.exe$Windows\System32\tracerpt.exe
          • API String ID: 2170139861-1986163084
          • Opcode ID: 9115d23ba626f49ced7f4c171a69da2cd0174b5509190992bf72caa9e73c794c
          • Instruction ID: a6eab2c3a9db3b30d8eb3705601e5a6d7ef543bb1fd031f97f0ff044bee6da67
          • Opcode Fuzzy Hash: 9115d23ba626f49ced7f4c171a69da2cd0174b5509190992bf72caa9e73c794c
          • Instruction Fuzzy Hash: 514186BCA40308ABD721CF64DC45FAE73B8AF58704F40459DB64DE6280DBB4AA84CF95
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D012D2B
          • ?Create@CShareMem@@QAEHPBDH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,000000FD,80000000,00000000,?,?,?,?,?,?,?,0000001C), ref: 6D012DBD
          • IsWindow.USER32(?), ref: 6D012DC9
          • LoadLibraryA.KERNEL32(user32.dll,?,?,?,?,?,0000001C), ref: 6D012DDB
          • GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 6D012DED
          • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,0000001C), ref: 6D012DFD
          • ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69([SimpleIPC]ERROR, Self window: %d.,?,?,?,?,?,?,0000001C), ref: 6D012E15
          • ?WriteIPCInfo@CSimpleIPC@@AAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,0000001C), ref: 6D012E1E
          • ?Notify@CSimpleIPC@@QAEHKPAXH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000001,00000000,00000000,?,?,?,?,?,0000001C), ref: 6D012E2A
          Strings
          • [SimpleIPC]ERROR, Self window: %d., xrefs: 6D012E10
          • ChangeWindowMessageFilter, xrefs: 6D012DE7
          • WeGameIPCShareMem10, xrefs: 6D012D73
          • [SimpleIPC]Self window: %d., xrefs: 6D012E06
          • user32.dll, xrefs: 6D012DD6
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: LibrarySimple$?shutdown@AddressApplication@common@ierd_tgp@@Create@FreeH_prolog3_Info@LoadMem@@Notify@ProcShareWindowWrite
          • String ID: ChangeWindowMessageFilter$WeGameIPCShareMem10$[SimpleIPC]ERROR, Self window: %d.$[SimpleIPC]Self window: %d.$user32.dll
          • API String ID: 1425942052-3095242511
          • Opcode ID: e3a1b1ac7d61f03646babdabf5f36140a16a8072d7d01f2a20b83e39cd0faee1
          • Instruction ID: 712898f235164eb06264e364c2940cb43c6c9e78dd6b9d67221f33b476d15905
          • Opcode Fuzzy Hash: e3a1b1ac7d61f03646babdabf5f36140a16a8072d7d01f2a20b83e39cd0faee1
          • Instruction Fuzzy Hash: D931BF316497069BEB259BF4CC45BAE77F4BF8A318F144028A112A7191DB70A50ACB61
          APIs
          • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D153E06
          • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D153E0D
          • strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 6D153E20
          • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?), ref: 6D153E2C
          • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?), ref: 6D153E37
          • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?), ref: 6D153E40
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: _errno$strtol
          • String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$+$<$GMT
          • API String ID: 3596500743-3646017816
          • Opcode ID: 5d5fa1e47f48d83e3b03c587b03fed78a9b0a3081c31e578b836f596c815c5a3
          • Instruction ID: 00bb4794dae11c24fda5e0f53f961ea6c29016226930fbc270316d2993b84aff
          • Opcode Fuzzy Hash: 5d5fa1e47f48d83e3b03c587b03fed78a9b0a3081c31e578b836f596c815c5a3
          • Instruction Fuzzy Hash: 4602F3B1A0C3058FC714CE2CC84066ABBF5ABD9324F444B2EF5B5C7294E7B5D9568B82
          APIs
          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,02200000,00000000,?,23C35E98,?,?,?,?,6D274914,000000FF), ref: 6D053F15
          • GetLastError.KERNEL32(?,?,6D274914,000000FF,?,6D0510CF,?,?,?), ref: 6D053F34
          • ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D053F5D
          • CloseHandle.KERNEL32(00000000,?), ref: 6D053F76
          • DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,?,00004008,?,00000000), ref: 6D053F9F
          • GetLastError.KERNEL32 ref: 6D053FA9
          • ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D054033
          • CloseHandle.KERNEL32(00000000,?), ref: 6D05404C
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ??0path@filesystem@ierd_tgp@@CloseE@$$ErrorHandleLastV012@@$ControlCreateDeviceFile
          • String ID: ierd_tgp::filesystem::read_symlink
          • API String ID: 3286561400-3686134802
          • Opcode ID: c52bdfa97a1bcde048f299308b077a972693bc7c61e5d3493052b3a9f5daff13
          • Instruction ID: 5cafef5ea7033172f9d8b0e3132535c495a3194cc42a4068401aa4545a745a5e
          • Opcode Fuzzy Hash: c52bdfa97a1bcde048f299308b077a972693bc7c61e5d3493052b3a9f5daff13
          • Instruction Fuzzy Hash: 865181B1914158EFEB10CFA8CD48BEEBBB8EF49319F00415AEA15B3180D7745A58CFA0
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D077CA2
          • __Init_thread_footer.LIBCMT ref: 6D07808A
            • Part of subcall function 6D050236: __EH_prolog3_catch.LIBCMT ref: 6D05023D
          • GetAdaptersInfo.IPHLPAPI(?,?), ref: 6D077D3F
          • GetAdaptersInfo.IPHLPAPI(?,?), ref: 6D077D6A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000288,?,0000015C), ref: 6D077D87
            • Part of subcall function 6D04F0A4: __EH_prolog3_catch.LIBCMT ref: 6D04F0AB
            • Part of subcall function 6D00443B: memmove.VCRUNTIME140(-00000030,00000001,00000001,-00000030,00000000,?,6D00461F,00000001,-00000030,-00000030,?,00000001,00000001,?,?), ref: 6D00444E
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\machine_id.cpp, xrefs: 6D077DA8
          • -%02x, xrefs: 6D077DFE
          • GetAdaptersInfo result is NULL!, xrefs: 6D077DBF
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AdaptersH_prolog3_catchInfo$?get_log_instance@base@@H_prolog3_catch_Init_thread_footerLogger@1@memmove
          • String ID: -%02x$GetAdaptersInfo result is NULL!$d:\ci_dev\wegame_client\codes\common\src\machine_id.cpp
          • API String ID: 1435465011-618869985
          • Opcode ID: cc6a2102d9a90da27f8456c9a816c9646f3260709c6d2e6371be6546194304b0
          • Instruction ID: 1c11f2cdacb5344ef619fc1f86cad37e69656ecb6c5b0477c780a5f2965677ae
          • Opcode Fuzzy Hash: cc6a2102d9a90da27f8456c9a816c9646f3260709c6d2e6371be6546194304b0
          • Instruction Fuzzy Hash: 8CA18E70D09658EFEB21CF64C954BEDBBB5AF46308F5040ADD109AB281DBB05E49CFA1
          APIs
          • memset.VCRUNTIME140(?,00000000,00000410,00000000,00000000,00000000), ref: 6D09FF73
          • GetLogicalDriveStringsW.KERNEL32(00000208,?,00000000,00000000,00000000), ref: 6D09FF87
          • QueryDosDeviceW.KERNEL32(00000000,?,00000208), ref: 6D09FFD3
          • wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D09FFE4
          • _wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6D0A0001
          • swprintf.LIBCMT ref: 6D0A0032
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: DeviceDriveLogicalQueryStrings_wcsnicmpmemsetswprintfwcslen
          • String ID: %s%s
          • API String ID: 2066086647-3252725368
          • Opcode ID: 4948cb2f564be49f8e78152219136d46e181966eb88c8cd9ff29bb65a0835d46
          • Instruction ID: 56cb734a7994242724d3228a4ead4437dc9e07965c1ea72335f10b8f92e72652
          • Opcode Fuzzy Hash: 4948cb2f564be49f8e78152219136d46e181966eb88c8cd9ff29bb65a0835d46
          • Instruction Fuzzy Hash: 7B31837590421DAAEB10CFA5CC84FAFB7F8BF45704F048066E915E7145EB319A48CF90
          APIs
          • isalnum.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D017EF1
            • Part of subcall function 6D017DDE: memchr.VCRUNTIME140(00000000,00000000,?,00000000,?,6D01800A,6D372FE8,00000000,?), ref: 6D017DFB
          • __EH_prolog3.LIBCMT ref: 6D018078
            • Part of subcall function 6D11314E: ___report_securityfailure.LIBCMT ref: 6D113153
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___report_securityfailureisalnummemchr
          • String ID: /7m$/7m$/7m$/7m
          • API String ID: 908437126-4214309186
          • Opcode ID: 51d00751d628f5b510e377f48fa6d6ef2287f9220e8269887e37db1764a4315f
          • Instruction ID: 2112f0a9af76ca291608596c86b5185031c0445ec7185dea128a4863874d7d57
          • Opcode Fuzzy Hash: 51d00751d628f5b510e377f48fa6d6ef2287f9220e8269887e37db1764a4315f
          • Instruction Fuzzy Hash: 1AB14976D0859AEFEB028FA9C8907EEBFB5EF5A310F1544ACD99057342C2358746CB90
          APIs
          • __EH_prolog3.LIBCMT ref: 6D03AA5A
          • InitializeCriticalSection.KERNEL32(?,?,00000004,6D03AA41,?,00000004), ref: 6D03AAAC
          • GetCurrentProcessId.KERNEL32 ref: 6D03AAB2
          • GetCurrentThreadId.KERNEL32 ref: 6D03AABA
          • CreateNamedPipeA.KERNEL32(?,00000003,00000000,00000001,00004000,00004000,00000000,00000000), ref: 6D03AAE7
          • CreateThread.KERNEL32(00000000,00000000,6D03AE0E,?,00000000,00000000), ref: 6D03AAFA
          • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 6D03AB07
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Create$CurrentThread$CriticalEventH_prolog3InitializeNamedPipeProcessSection
          • String ID:
          • API String ID: 2543911484-0
          • Opcode ID: 5476dea210758003ae9b9e69963233555624d79f175d4027792ec2b2bac471e1
          • Instruction ID: 16ae6fd1e8a43dbf235974ed61c1de8bf9193d900e21d2ab84915f6aa855ebc9
          • Opcode Fuzzy Hash: 5476dea210758003ae9b9e69963233555624d79f175d4027792ec2b2bac471e1
          • Instruction Fuzzy Hash: EB2133B1811360EFDF649F68C888B973EBCEF0A755F50419AF915DB286D3718944CBA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D027FD1
          • GetLastError.KERNEL32(?,?,?,?,0000003C), ref: 6D027FDE
            • Part of subcall function 6D023569: __EH_prolog3.LIBCMT ref: 6D023570
          • OutputDebugStringA.KERNEL32(00000000,?,?,?,?,?,0000003C), ref: 6D02800D
          • FlushFileBuffers.KERNEL32(000000FF,?,?,?,?,0000003C), ref: 6D028024
          • GetSystemTime.KERNEL32(?,?,?,?,?,0000003C), ref: 6D02803F
          • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,0000003C), ref: 6D02804D
          • SetFileTime.KERNEL32(000000FF,00000000,00000000,?,?,?,?,?,0000003C), ref: 6D02805E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Time$File$System$BuffersDebugErrorFlushH_prolog3H_prolog3_LastOutputString
          • String ID:
          • API String ID: 737605373-0
          • Opcode ID: d943f4b109cee47b30b4b2757edbf57a757443b7a35911b1327abee60d102c9b
          • Instruction ID: dc32cbfa8ea8452ce6f7b416391de0f38d08335bad931da64d120d53cf733a58
          • Opcode Fuzzy Hash: d943f4b109cee47b30b4b2757edbf57a757443b7a35911b1327abee60d102c9b
          • Instruction Fuzzy Hash: 1411F871810608EFEF11DFA4C849B9EB7B8BF8A316F500626E251A61A0D771AA49CF51
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0160B1
          • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040,00000034,6D017475,0000001C,6D0159BA,?,?,?,000000D4,6D014672,?,?), ref: 6D0160C6
          • GetLastError.KERNEL32(?,00000000,00000000,00000001,F0000040,00000034,6D017475,0000001C,6D0159BA,?,?,?,000000D4,6D014672,?,?), ref: 6D0160D8
          Strings
          • __thiscall boost::uuids::detail::random_provider_base::random_provider_base(void), xrefs: 6D016109
          • CryptAcquireContext, xrefs: 6D0160DE
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\uuid\detail\random_provider_wincrypt.ipp, xrefs: 6D016104
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AcquireContextCryptErrorH_prolog3_Last
          • String ID: CryptAcquireContext$__thiscall boost::uuids::detail::random_provider_base::random_provider_base(void)$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\uuid\detail\random_provider_wincrypt.ipp
          • API String ID: 2840587545-1991996185
          • Opcode ID: 0e13b6a5ed5a6d1439c13595482495bd4ffba9cdd4bab44851b0a403bc31dd49
          • Instruction ID: 630d9a837b041a76caac49ca9c480ad3b4a1c5d7f5269e8cfa9815f3e01dfaa6
          • Opcode Fuzzy Hash: 0e13b6a5ed5a6d1439c13595482495bd4ffba9cdd4bab44851b0a403bc31dd49
          • Instruction Fuzzy Hash: 53F02B31548248ABEB2197E08C0CFFF76B89F97304F840048B600BB1C1DBB44A09DB60
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D09EF66
          • GetSystemTimes.KERNEL32(6D38A3E4,6D38A3EC,6D38A3F4,00000050), ref: 6D09EF7C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(6D38A3E4,6D38A3EC,6D38A3F4,00000050), ref: 6D09EF85
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • error, xrefs: 6D09EFBD
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D09EFA9
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_H_prolog3_catch_Logger@1@SystemTimes
          • String ID: d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp$error
          • API String ID: 1984077098-3542477499
          • Opcode ID: 884fbbee6d806d86cd331be93cce807342afeed489b9091c10186ae18539abd2
          • Instruction ID: 52b6073c6dd3c9d58017455a20e3d6ed22c61c8595a88cecb9e32e05ed48e096
          • Opcode Fuzzy Hash: 884fbbee6d806d86cd331be93cce807342afeed489b9091c10186ae18539abd2
          • Instruction Fuzzy Hash: 2CF0F670A493066BFB3496E18C11F7D32615F40718F210125E611BF1CADBE6DD42A641
          APIs
          • IsDebuggerPresent.KERNEL32 ref: 0283793D
          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02837952
          • UnhandledExceptionFilter.KERNEL32(02845350), ref: 0283795D
          • GetCurrentProcess.KERNEL32(C0000409), ref: 02837979
          • TerminateProcess.KERNEL32(00000000), ref: 02837980
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
          • String ID:
          • API String ID: 2579439406-0
          • Opcode ID: d34614067c16e0d0f4d1cce2abdf1cbce15951e9e44b0916c692f2d314c5ec29
          • Instruction ID: a9081776e0e18f6ca76c972daa00e339045a4d6b5fb4b36326340e3967b0403f
          • Opcode Fuzzy Hash: d34614067c16e0d0f4d1cce2abdf1cbce15951e9e44b0916c692f2d314c5ec29
          • Instruction Fuzzy Hash: 8021E0BCCD4304DFE78ADF68E1696583BE9BB18349F401819E5089B3C0EBB856A0CF45
          APIs
          • memset.VCRUNTIME140(?,00000000,00000031,6D38F000,?,?), ref: 6D076527
          • memmove.VCRUNTIME140(?,?,00000004,6D38F000,?,?), ref: 6D07655A
          • memmove.VCRUNTIME140(?,?,00000004,?,?,00000004,6D38F000,?,?), ref: 6D076565
          • memmove.VCRUNTIME140(?,?,00000004,?,?,00000004,?,?,00000004,6D38F000,?,?), ref: 6D076573
          • memmove.VCRUNTIME140(?,?,00000004,?,?,00000004,?,?,00000004,?,?,00000004,6D38F000,?,?), ref: 6D076581
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$memset
          • String ID:
          • API String ID: 3790616698-0
          • Opcode ID: ca3e190a48bf6b2e878ffe18295f0ab7c22346b3f833ed4c1ae3e0e5caf63f39
          • Instruction ID: ac984886abfc72e32b4706b9bed44eb640203acef298ceeb8c157c7a76239960
          • Opcode Fuzzy Hash: ca3e190a48bf6b2e878ffe18295f0ab7c22346b3f833ed4c1ae3e0e5caf63f39
          • Instruction Fuzzy Hash: 8C3141B2D0060DAFDB15CFE8D880DEEB7FCFF09204F15052AE556A7240E770AA498B90
          APIs
            • Part of subcall function 6D112E3F: memset.VCRUNTIME140(6D38A7C4,00000000,00000018,?,6D38A7B0,6D112DF4,?,6CFF4DD3), ref: 6D112E4C
            • Part of subcall function 6D016A3F: InitializeCriticalSectionAndSpinCount.KERNEL32(6D38A7C4,00000000,23C35E98,6D38A7B0,6CFF0000,Function_00277428,000000FF,?,6D112E1B,?,?,?,6CFF4DD3), ref: 6D016A66
            • Part of subcall function 6D016A3F: GetLastError.KERNEL32(?,6D112E1B,?,?,?,6CFF4DD3), ref: 6D016A70
          • IsDebuggerPresent.KERNEL32(?,?,?,6CFF4DD3), ref: 6D112E1F
          • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6CFF4DD3), ref: 6D112E2E
          Strings
          • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6D112E29
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinStringmemset
          • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
          • API String ID: 1128651283-631824599
          • Opcode ID: 8614f259d9c8932bf95a2a2017c6d966a6eb3e6c4a93e552fc481659a258de0a
          • Instruction ID: b268fe67b839307a9ccc76f1cfdd76684540b00fa809ab588fde909319977253
          • Opcode Fuzzy Hash: 8614f259d9c8932bf95a2a2017c6d966a6eb3e6c4a93e552fc481659a258de0a
          • Instruction Fuzzy Hash: 58E06D701093418FD7309F24D908343BAF4AF4270AF01882DD496C2708EBB4D408CB91
          APIs
          • __EH_prolog3.LIBCMT ref: 6D04F4C6
          • ?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?), ref: 6D04F553
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?oi_symmetry_encrypt2@@H_prolog3
          • String ID:
          • API String ID: 3544494841-0
          • Opcode ID: 9c10df6921486c4097986912ad23f8f57fb22a7df9ed02a2ca249c8e280dbe2a
          • Instruction ID: 2b192f107e5629ecd704261e131ea8ff79fc0bb8a5edc4dc63bfcc9ff8137607
          • Opcode Fuzzy Hash: 9c10df6921486c4097986912ad23f8f57fb22a7df9ed02a2ca249c8e280dbe2a
          • Instruction Fuzzy Hash: 22312BB1C04209EFEB01CF98C880AEEFBB8FF49310F558169E515A7250D774AA44CB61
          APIs
          • ?qq_symmetry_encrypt3_len@@YAHH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D013833
          • ?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000000,00000000), ref: 6D01386E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?oi_symmetry_encrypt2@@?qq_symmetry_encrypt3_len@@
          • String ID:
          • API String ID: 2360126228-0
          • Opcode ID: 9637bee899427cc8a25badac20a81feaa85824450cac2a97d322f5df9810f3fd
          • Instruction ID: 29e394faa96957eaf2e92368be7a1e5d210ce9c2a59457a55637a2d402cbd993
          • Opcode Fuzzy Hash: 9637bee899427cc8a25badac20a81feaa85824450cac2a97d322f5df9810f3fd
          • Instruction Fuzzy Hash: 3F017872608305AFEB158F98CC40BAB73AEFF89B64B51091DE5255B350C7B1AC52CBE1
          APIs
          • InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 6D016025
          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 6D016034
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: DescriptorSecurity$DaclInitialize
          • String ID:
          • API String ID: 625223987-0
          • Opcode ID: 4b91756182c5f80f540e6cc0310699ce2fa3a7412c2006243cc36f7aa95d058d
          • Instruction ID: 67e5396990d30ad880a99901e9f62deac44e5c114e16d56d5af1c80a2c934a69
          • Opcode Fuzzy Hash: 4b91756182c5f80f540e6cc0310699ce2fa3a7412c2006243cc36f7aa95d058d
          • Instruction Fuzzy Hash: 8DE030712453429FF7224E694C84F67BBECEB87745F40851EE19596140D7A19805C661
          APIs
          • memset.VCRUNTIME140(?,00000000,00000118), ref: 6D0A2BF6
          • GetVersionExW.KERNEL32(0000011C), ref: 6D0A2C0F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Versionmemset
          • String ID:
          • API String ID: 3136939366-0
          • Opcode ID: cb18991fc3090332e80e7e5e06b5a7252419c8356567154de49cc4639c929b92
          • Instruction ID: 6dbcc8a79d703aba6c988a0fb762e058b27ab4f2f98117e8646c6789e56c3778
          • Opcode Fuzzy Hash: cb18991fc3090332e80e7e5e06b5a7252419c8356567154de49cc4639c929b92
          • Instruction Fuzzy Hash: DEF06570D4021CEBDF28DF64CD06BDEB3F8AB09308F4100B9D605A6181DB749B998F84
          APIs
          • GetProcessHeap.KERNEL32(00000000,?,?,6D0196E5,?), ref: 6D01E3DB
          • HeapFree.KERNEL32(00000000,?,6D0196E5,?), ref: 6D01E3E2
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Heap$FreeProcess
          • String ID:
          • API String ID: 3859560861-0
          • Opcode ID: 056c12996b8d11413fe5c1acd4373c55b3e5b156ce551e8524b9305442d41a4d
          • Instruction ID: f563593f00fdbc9580ba0c384ee493ce31b86720034698bf46fcd273627967d6
          • Opcode Fuzzy Hash: 056c12996b8d11413fe5c1acd4373c55b3e5b156ce551e8524b9305442d41a4d
          • Instruction Fuzzy Hash: 3AB04C35044208ABCF401AD1980DF967B3CB786656F000001F60945041C7659018DA51
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID:
          • String ID: [RO] %ld bytes
          • API String ID: 0-772938740
          • Opcode ID: c6706bffd41a062b52dc5ff63fd4b83f8d2f7a7fb5bb4b5a3e8573747a993bfd
          • Instruction ID: c29cebf2f96c7120901aae0e3682bf6f1f7f5979f4a49dce3448288870ca09c4
          • Opcode Fuzzy Hash: c6706bffd41a062b52dc5ff63fd4b83f8d2f7a7fb5bb4b5a3e8573747a993bfd
          • Instruction Fuzzy Hash: 082236B8A00B059FDB25CF69C580AAABBF1FF48304F148A6DD85AD7759D730E941CB90
          APIs
          • ?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,00000000), ref: 6D0137F8
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?oi_symmetry_decrypt2@@
          • String ID:
          • API String ID: 596376532-0
          • Opcode ID: 9b2d2172b230bfed5e01cc94368d11d4ae5f57c09279340ceb006f95281ba57b
          • Instruction ID: 1912289fddb3ddf6378d52e88ffcaadf3cc042589f2580d3c163998ecca4963f
          • Opcode Fuzzy Hash: 9b2d2172b230bfed5e01cc94368d11d4ae5f57c09279340ceb006f95281ba57b
          • Instruction Fuzzy Hash: A7015A75604319AFEB10DF98DC40AAB73AAFB89B24B004519E8214B341C771EC52CBE1
          APIs
          • CryptReleaseContext.ADVAPI32(00000000,00000000,23C35E98,00000000,00000000,6D268CE3,000000FF,?,6D0174A9,?,00000010,0000001C,6D0159BA,?,?,?), ref: 6D016675
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ContextCryptRelease
          • String ID:
          • API String ID: 829835001-0
          • Opcode ID: 52e1d48d71b6d6c6378f45246e0e1c0dc4430605a9cc04538ce76ca25e537ec8
          • Instruction ID: f5bb8bcf66ed2c898c385acbbe2bbe436743a8d489e490ff9513ea033b4eb2ec
          • Opcode Fuzzy Hash: 52e1d48d71b6d6c6378f45246e0e1c0dc4430605a9cc04538ce76ca25e537ec8
          • Instruction Fuzzy Hash: 33F03972905A88EFCB168F64CD00B6AB7B8F70A724F20076AA422A26E0CB756504CA54
          APIs
          • CryptReleaseContext.ADVAPI32(?,00000000,23C35E98,?,Function_002760CD,000000FF), ref: 6D0166B3
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ContextCryptRelease
          • String ID:
          • API String ID: 829835001-0
          • Opcode ID: 244ea8dd9dc6c0ae3fd3ed1407c1e7005dc19082af6251551c4c148eaa29b7f9
          • Instruction ID: e1384fe7424001515e1d111b04c1c6ccab0fb4951d17c57ed3039c067302fb2e
          • Opcode Fuzzy Hash: 244ea8dd9dc6c0ae3fd3ed1407c1e7005dc19082af6251551c4c148eaa29b7f9
          • Instruction Fuzzy Hash: A0E04F75644688EFC7028F54CC40F55B7F8F70AB14F10066AE42297AD0CB356408CA44
          APIs
          • ?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D016D25
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?to_json@jsonbind@@Json@@@Value@
          • String ID:
          • API String ID: 1197194930-0
          • Opcode ID: 6b4b75457bf38a675d386b2a21e1941492bcacc9d3599dabfcee34674c00fe44
          • Instruction ID: fda12bbc9c7982c7cf4572847a3c3172944f14575e36c2ed41c3dd982ea7a5ec
          • Opcode Fuzzy Hash: 6b4b75457bf38a675d386b2a21e1941492bcacc9d3599dabfcee34674c00fe44
          • Instruction Fuzzy Hash: 89B0127300C30C3A66081691F903C467B8CD612170610401BF708061816D33F06051BC
          APIs
          • ?from_json@jsonbind@@YAHPAXABVValue@Json@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D016CA3
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?from_json@jsonbind@@Json@@@Value@
          • String ID:
          • API String ID: 2593738861-0
          • Opcode ID: 699a2249a92d441694e35bea20fa06a2f7649fcbd3cb6b9dfcf7814da861a750
          • Instruction ID: beaac7f15298a799761701324fc6a11f5a5f9ad9f2544ecc9b057e1b6620336c
          • Opcode Fuzzy Hash: 699a2249a92d441694e35bea20fa06a2f7649fcbd3cb6b9dfcf7814da861a750
          • Instruction Fuzzy Hash: 68B012B300C30C3A65181691F802C46BB8CC611170610441BF704051C06D33F56052BC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 1f6cb0c5456358f352707325e622d12a23aecf0326ac4f5a7f625647ac789a1c
          • Instruction ID: ca303f72de2cc3c78fd3be21bfa6fb1d35d0baa0e7e50ff5171ea4144f4c2da3
          • Opcode Fuzzy Hash: 1f6cb0c5456358f352707325e622d12a23aecf0326ac4f5a7f625647ac789a1c
          • Instruction Fuzzy Hash: 24425173B505244BDB48CE7DCC922DEB2D3ABC826474E8638E819D3746E9BCDC538684
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: _invalid_parameter_noinfo_noreturnmalloc
          • String ID:
          • API String ID: 1104909994-0
          • Opcode ID: ab2157fb5fcfbed79064cbeeb4fc15411289bd3d2e8cded0562040e07088f255
          • Instruction ID: ca1043e3986d8339124ad29bf8e98a8de94a8a7136ddc9f130cdd3df9cc5114c
          • Opcode Fuzzy Hash: ab2157fb5fcfbed79064cbeeb4fc15411289bd3d2e8cded0562040e07088f255
          • Instruction Fuzzy Hash: 01028D70806716DFD720DF94CA0476AB7B4FF56B28F11860EE9655B2C8EBF1A841CB81
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 667c6d0033a0fe63cd8ec0002e622dd133bce5db3798ed931822dbe3e8751e50
          • Instruction ID: 98233d81ad78733cfee874991f21345f3b7a6c43cb19ea6d04a3b2b9d35777ea
          • Opcode Fuzzy Hash: 667c6d0033a0fe63cd8ec0002e622dd133bce5db3798ed931822dbe3e8751e50
          • Instruction Fuzzy Hash: A9D11B367082499FD715CF18C490BAAB7B2FF46718F188999E8658BB61D733E807C790
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: caf49820fa807b94d0f106b97b3a28fc126ac1404d47f7e6d138c94fc9639a5e
          • Instruction ID: a3388a7f192fd27ad0148480faa543b27475b4e4f3c9f0e3f81bd8ad1058e3f3
          • Opcode Fuzzy Hash: caf49820fa807b94d0f106b97b3a28fc126ac1404d47f7e6d138c94fc9639a5e
          • Instruction Fuzzy Hash: A0F16D756081118FC709CF18C4D48FAB7F1EF69310B1A82FEC8999B7A6D731A981CB51
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 65c71e96409ca6ac626d0a345f24a03d9159f306f6fdd86ed84647c1466fc9f3
          • Instruction ID: b9691753289335ea8b07a54998b5016276394962384f1336f8ad2dda8ae1681a
          • Opcode Fuzzy Hash: 65c71e96409ca6ac626d0a345f24a03d9159f306f6fdd86ed84647c1466fc9f3
          • Instruction Fuzzy Hash: 1661943122016A5FDB04CE1EDCE15367375E78F3817858629EA90CB789C739F526C7A1
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 4f6ac3d63d688f847966be16c287e23271fd97bcddae9c8a97ccee292380733d
          • Instruction ID: 28fc295945f7684fd7d1dfa6e975d20d2adc44180569248147e33872343a8471
          • Opcode Fuzzy Hash: 4f6ac3d63d688f847966be16c287e23271fd97bcddae9c8a97ccee292380733d
          • Instruction Fuzzy Hash: B7516B71E002298BDB58CF69C8946EDF7F1EB8C314F1581AAD81AF7340D678AA55CF90
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_
          • String ID:
          • API String ID: 2427045233-0
          • Opcode ID: 1225f191949c3cf6f3e1d5f44405819bde8913935478eb4969d3cecdd839e8d5
          • Instruction ID: 8ca2ef400c924390aeed6d0d00596e1d4caa9c13c9eed4b187a14863627da9f9
          • Opcode Fuzzy Hash: 1225f191949c3cf6f3e1d5f44405819bde8913935478eb4969d3cecdd839e8d5
          • Instruction Fuzzy Hash: 7AD0C9745002049FC710EF58C140905FBE4BB49244315C1A9DA088F302E732E882CAC0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 9942a3f4ace8ad93a368c8414c0e3873ec02e427dfe61c837a3dc747b2db4b2e
          • Instruction ID: ba469a00aa9513a07dfe7c05f26773dcf4d0576655731dc750abf58f81c73db7
          • Opcode Fuzzy Hash: 9942a3f4ace8ad93a368c8414c0e3873ec02e427dfe61c837a3dc747b2db4b2e
          • Instruction Fuzzy Hash:
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A75B7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(000006FC), ref: 6D0A75BF
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0A767A
          • memset.VCRUNTIME140(?,00000000,00000208,?,?), ref: 6D0A768D
          • _time64.API-MS-WIN-CRT-TIME-L1-1-0(?,?,00000000,00000208,?,?), ref: 6D0A7699
          • memset.VCRUNTIME140(?,00000000,00000208), ref: 6D0A76B5
          • _localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,00000000,00000208), ref: 6D0A76C8
          • wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,00000104,%Y%m%d_%H%M%S,?), ref: 6D0A76EE
          • wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,[get_local_time_failed]), ref: 6D0A7705
          • swprintf.LIBCMT ref: 6D0A7736
          • memset.VCRUNTIME140(?,00000000,00000208,?,00000104,%s%s,?,?), ref: 6D0A7748
          • swprintf.LIBCMT ref: 6D0A776F
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0A77E6
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0A77FC
          • CopyFileW.KERNEL32(?,?,00000000,?), ref: 6D0A787D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7887
          • MoveFileExW.KERNEL32(?,?,00000009), ref: 6D0A791D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7929
          • GetLastError.KERNEL32(00000000,00000003,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000781,6D31E62F), ref: 6D0A796C
          • CopyFileW.KERNEL32(?,?,00000000), ref: 6D0A79C7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A79D3
          • GetLastError.KERNEL32(00000000,00000003,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000789,6D31E62F), ref: 6D0A7A10
          • CopyFileW.KERNEL32(?,?,00000000), ref: 6D0A7A6B
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7A77
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,0000078D,6D31E62F), ref: 6D0A7AB4
          • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 6D0A7AFC
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7B08
          • GetLastError.KERNEL32(00000000,00000003,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000796,6D31E62F), ref: 6D0A7B45
          • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 6D0A7B80
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7B8C
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000779,6D31E62F), ref: 6D0A78CC
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • GetLastError.KERNEL32(00000000,00000003,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,0000079A,6D31E62F), ref: 6D0A7BC9
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$ErrorFileLast$CopyMovememset$D@std@@U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@std@@swprintf$?u16to8@common@ierd_tgp@@?u8to16@common@ierd_tgp@@D@2@@4@@D@2@@std@@H_prolog3H_prolog3_W@2@@4@@W@2@@std@@_localtime64_s_time64wcscpywcsftime
          • String ID: %Y%m%d_%H%M%S$%s%s$%s.tmp$Copy LSP from {} To Temp File : {}$Copy file to temp file failed : {}$UnlockByRename %s$[get_local_time_failed]$copy new file rs {} errorcode {}$copy new file try2 rs:{}, errorcode:{}$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp$delete old file rs {} errorcode {}$delete temp file rs {} errorcode {}$rename old file rs {} errorcode {}
          • API String ID: 2710479686-2762186532
          • Opcode ID: 5772b5dfca8940c8f0cf4641b8351ff2a835c99c4852216901b218b505e1118b
          • Instruction ID: 860828c2907708671ad73cf611fd02cc3d00d3265a90a5b3eb57574e55de9112
          • Opcode Fuzzy Hash: 5772b5dfca8940c8f0cf4641b8351ff2a835c99c4852216901b218b505e1118b
          • Instruction Fuzzy Hash: 7D028E71D44229AFEB20DBA4CC54FEDB3B9AF94204F0141EAD609A7181DB769F94CF90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04E78C
          • CoInitializeEx.OLE32(00000000,00000002,000001F4,6D04E701,?), ref: 6D04E7AD
          • CoInitializeEx.OLE32(00000000,00000000), ref: 6D04E7B5
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Initialize$H_prolog3_
          • String ID: Caption$DNSServerSearchOrder$Index$SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=TRUE$SetDNSServerSearchOrder$WQL$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=%d$[repair_dns] success.$d:\ci_dev\wegame_client\codes\common\src\dns_repair.cpp$root\cimv2$virtual$vmware
          • API String ID: 2604203524-2417071372
          • Opcode ID: a098dd541896b8c17160d2412621e2d6a8b56e1e3b858814c407047a0b2a34b0
          • Instruction ID: a2c75844d87605193413d08f03ebfeb54aa12f16239ed5468dc5b633cf213f49
          • Opcode Fuzzy Hash: a098dd541896b8c17160d2412621e2d6a8b56e1e3b858814c407047a0b2a34b0
          • Instruction Fuzzy Hash: 9E022A70A01219EFEB25CB64CC94FEAB7B9AF49715F0081E9E509AB250DB319E85CF50
          APIs
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(23C35E98,?,?,?,?,6D28310D,000000FF), ref: 6D0C3CC7
          • memset.VCRUNTIME140(?,00000000,00000044), ref: 6D0C3D56
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000044), ref: 6D0C3D66
          • CreatePipe.KERNEL32(?,?), ref: 6D0C3DC4
          • GetLastError.KERNEL32 ref: 6D0C3DCE
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C3DDA
          • memset.VCRUNTIME140(?,?,?,?,00000000,00000800), ref: 6D0C3E77
          • StrNCatW.SHLWAPI(?,?,000003FF), ref: 6D0C3E96
          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 6D0C3EBB
          • GetLastError.KERNEL32 ref: 6D0C3EC5
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C3ED1
          • CreateJobObjectA.KERNEL32(00000000,00000000), ref: 6D0C3F29
          • memset.VCRUNTIME140(?,00000000,00000070), ref: 6D0C3F46
          • SetInformationJobObject.KERNEL32(00000000,00000009,?,00000070), ref: 6D0C3F64
          • AssignProcessToJobObject.KERNEL32(00000000,?), ref: 6D0C3F71
          • GetLastError.KERNEL32 ref: 6D0C3F79
          • CloseHandle.KERNEL32(?), ref: 6D0C3F87
          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 6D0C4000
          • GetExitCodeProcess.KERNEL32(?,?), ref: 6D0C4013
          • GetLastError.KERNEL32 ref: 6D0C401D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C4025
          • ReadFile.KERNEL32(?,?,00000FFF,?,00000000), ref: 6D0C3FF2
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • CloseHandle.KERNEL32(00000000), ref: 6D0C4097
          • CloseHandle.KERNEL32(00000000), ref: 6D0C40AC
          • CloseHandle.KERNEL32(00000000), ref: 6D0C40C1
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C40C7
          Strings
          • [GetCmdOutput] Failed to create process. err_code={}, xrefs: 6D0C3F1B
          • [GetCmdOutput] cmdline={}, xrefs: 6D0C3D19
          • [GetCmdOutput] exitCode={} cmdline={}, xrefs: 6D0C411E
          • [GetCmdOutput] Failed to get exit code. err_code={}, xrefs: 6D0C4067
          • [GetCmdOutput] Failed to create pipe. err_code={}, xrefs: 6D0C3E24
          • d:\ci_dev\wegame_client\codes\common\src\utility.cpp, xrefs: 6D0C3CEB, 6D0C3E06, 6D0C3EFD, 6D0C4049, 6D0C40EB
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$CloseErrorHandleLastObjectmemset$CreateProcess$AssignCodeExitFileH_prolog3InformationPipeReadSingleWait
          • String ID: [GetCmdOutput] Failed to create pipe. err_code={}$[GetCmdOutput] Failed to create process. err_code={}$[GetCmdOutput] Failed to get exit code. err_code={}$[GetCmdOutput] cmdline={}$[GetCmdOutput] exitCode={} cmdline={}$d:\ci_dev\wegame_client\codes\common\src\utility.cpp
          • API String ID: 2953213574-3026063238
          • Opcode ID: ec7b7bce1951dca37a18df68906a02be071ca838393443980cd7f5270c9bffc2
          • Instruction ID: 65daf75cdf8741f505b44341d98ff5d87ed79834d892cc387bc386eb64087915
          • Opcode Fuzzy Hash: ec7b7bce1951dca37a18df68906a02be071ca838393443980cd7f5270c9bffc2
          • Instruction Fuzzy Hash: B4F1BE71944219AFEB21CB64CC44BEEB7F8FF49305F14819AE509A7180EB71AB89CF51
          APIs
          • RegOpenKeyExW.ADVAPI32(80000001,Console\0,00000000,00020019,?), ref: 02835507
          • RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 0283552E
          • _memset.LIBCMT ref: 02835548
          • RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 02835563
          • VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 02835586
          • RegCloseKey.ADVAPI32(?), ref: 028355B1
          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 02835605
          • _memset.LIBCMT ref: 02835669
          • _memset.LIBCMT ref: 0283568D
          • _memset.LIBCMT ref: 0283569F
          • VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 02835726
          • RegCreateKeyW.ADVAPI32(80000001,Console\0,?), ref: 02835799
          • RegDeleteValueW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4), ref: 028357AC
          • RegSetValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000065), ref: 028357C4
          • RegCloseKey.ADVAPI32(?), ref: 028357CE
          • Sleep.KERNEL32(00000BB8), ref: 028357FE
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Value_memset$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
          • String ID: !jWW$.$9e9e85e05ee16fc372a0c7df6549fbd4$Console\0$_$e$i$l${vU_
          • API String ID: 354323817-1574078108
          • Opcode ID: b27c0d8bc158fcda1816d59a5f2cf7e071bfddd0064a3af484a33731e07419d2
          • Instruction ID: d4e692c2b9a82ded48409b5eb108d39b4bdb9a83000e2a3a809c06d1fbf10c11
          • Opcode Fuzzy Hash: b27c0d8bc158fcda1816d59a5f2cf7e071bfddd0064a3af484a33731e07419d2
          • Instruction Fuzzy Hash: 0091A67DA40304BBE721DF64DC44FAA77BAEB88704F504559F909DB280D7B5AA40CF91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A38B1
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(0000074C), ref: 6D0A38C0
          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6D0A3957
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000002,00000000), ref: 6D0A3967
          • memset.VCRUNTIME140(?,00000000,00000410,00000002,00000000), ref: 6D0A39BC
          • Process32FirstW.KERNEL32(?,0000022C), ref: 6D0A39DB
          • OpenProcess.KERNEL32(00000411,00000000,?,?,0000022C), ref: 6D0A39F8
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D0A3AEE
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D0A3AF5
          • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D0A3B6E
          • GetModuleFileNameExW.PSAPI(00000000,00000000,?,00000104), ref: 6D0A3B9E
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0A3C87
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A3C8E
          • CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104), ref: 6D0A3D30
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • TerminateProcess.KERNEL32(00000000,00000000), ref: 6D0A3D07
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • Process32NextW.KERNEL32(?,0000022C), ref: 6D0A3D52
          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D0A3D62
          • CloseHandle.KERNEL32(00000000), ref: 6D0A3D80
          • CloseHandle.KERNEL32(?), ref: 6D0A3DBF
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@CloseHandleLogger@1@$Process$?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@H_prolog3_Process32TerminateU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@$CreateFileFirstH_prolog3H_prolog3_catch_ModuleNameNextOpenSnapshotToolhelp32memset
          • String ID: [Sys_wrapper][KillAllProcess]Kill all process, create snapshot fail.$[Sys_wrapper][KillAllProcess]kill proc=%s$[Sys_wrapper][KillAllProcess]path is empty.$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 3377103056-2637393427
          • Opcode ID: 1ac0aaaa4bbf1c73118e9c77597d088a1816c7062b401156f188f1618c45e034
          • Instruction ID: e42ac43a8f80cbc2cf3ac1ca853a7530bb876deb0921a801aabf9b136cd3c7b9
          • Opcode Fuzzy Hash: 1ac0aaaa4bbf1c73118e9c77597d088a1816c7062b401156f188f1618c45e034
          • Instruction Fuzzy Hash: B0D191B0D05219ABEB20CF94CC84BEEB7B4AF55309F5001D9E209A7181DB759F88CF65
          APIs
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D047C56
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • ?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D047C7C
            • Part of subcall function 6D017323: __EH_prolog3.LIBCMT ref: 6D01732A
          • ?extract_path@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D047CA5
            • Part of subcall function 6D07F04B: __EH_prolog3_GS.LIBCMT ref: 6D07F052
            • Part of subcall function 6D07F04B: ?has_parent_path@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000034), ref: 6D07F078
            • Part of subcall function 6D07F04B: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000034), ref: 6D07F088
            • Part of subcall function 6D00D3C4: memmove.VCRUNTIME140(00000008,?,00000008,?,?,?,?,6D00D33E,?,00000000,?,6D050877,?,0000001C,6D00F12C,?), ref: 6D00D3F6
          • GetTickCount.KERNEL32 ref: 6D047CE2
          • LoadLibraryW.KERNEL32(?), ref: 6D047CFA
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D047D13
          • LoadLibraryW.KERNEL32(?), ref: 6D047D8C
          • GetLastError.KERNEL32 ref: 6D047D9C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D047DAA
            • Part of subcall function 6D04729F: __EH_prolog3_GS.LIBCMT ref: 6D0472A9
            • Part of subcall function 6D04729F: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000008C), ref: 6D0472EA
            • Part of subcall function 6D04729F: ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000008C), ref: 6D047301
            • Part of subcall function 6D04729F: ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,0000008C), ref: 6D04736C
            • Part of subcall function 6D04729F: ?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000001,?,?,?,?,?,?,0000008C), ref: 6D04737C
          Strings
          • _QueryPluginInterface@12, xrefs: 6D047F4B
          • _QueryPluginInterface@8, xrefs: 6D047EF9
          • [Component_mgr]load_interface, Load library {} failed, error:%d, xrefs: 6D047E01
          • [Component_mgr]retry load library {}, xrefs: 6D047D65
          • [Component_mgr]load_interface, GetProcAddress _QueryPluginInterface failed, error:%d, xrefs: 6D047FEC
          • d:\ci_dev\wegame_client\codes\common\src\component_mgr.cpp, xrefs: 6D047D37, 6D047DCE, 6D047E84, 6D047FD4
          • [Component_mgr]load library elpase:{} , name:{}, xrefs: 6D047EDA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$H_prolog3_$?get_log_instance@base@@D@std@@LibraryLoadLogger@1@U?$char_traits@V?$allocator@V?$basic_string@W@2@@std@@$?extract_path@common@ierd_tgp@@?file_exists@common@ierd_tgp@@?get_exe_path_ex@?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?has_parent_path@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?report@?u16to8@common@ierd_tgp@@?u8to16@common@ierd_tgp@@Application@common@ierd_tgp@@CountD@2@@4@@D@2@@std@@ErrorH_prolog3LastQos@123@Qos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@Qos_occasion@234@@TickV123@V34@@Vpath@filesystem@3@W@2@@4@@W@2@@std@@@memmove
          • String ID: [Component_mgr]load library elpase:{} , name:{}$[Component_mgr]load_interface, GetProcAddress _QueryPluginInterface failed, error:%d$[Component_mgr]load_interface, Load library {} failed, error:%d$[Component_mgr]retry load library {}$_QueryPluginInterface@12$_QueryPluginInterface@8$d:\ci_dev\wegame_client\codes\common\src\component_mgr.cpp
          • API String ID: 3916375037-2184993025
          • Opcode ID: 0174199d7a529f1725bb47e57ed9a3a0e636b9601c335a7292af74b94a88d984
          • Instruction ID: d1f684f2018238a3ff6328e6b1fbb85f5e2859e6cabb06a193054a45e9f8ec63
          • Opcode Fuzzy Hash: 0174199d7a529f1725bb47e57ed9a3a0e636b9601c335a7292af74b94a88d984
          • Instruction Fuzzy Hash: 31D1B170C0425AEBEB24DFA4CC54FEEBBB4AF55304F5040ACD115B7281EB709A49CBA1
          APIs
          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839ACE
          • __mtterm.LIBCMT ref: 02839ADA
            • Part of subcall function 028397A5: DecodePointer.KERNEL32(00000009,028376A5,0283768B,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 028397B6
            • Part of subcall function 028397A5: TlsFree.KERNEL32(0000001C,028376A5,0283768B,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 028397D0
            • Part of subcall function 028397A5: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,028376A5,0283768B,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 0283C031
            • Part of subcall function 028397A5: _free.LIBCMT ref: 0283C034
            • Part of subcall function 028397A5: DeleteCriticalSection.KERNEL32(0000001C,?,?,028376A5,0283768B,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 0283C05B
          • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 02839AF0
          • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 02839AFD
          • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 02839B0A
          • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 02839B17
          • TlsAlloc.KERNEL32(?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839B67
          • TlsSetValue.KERNEL32(00000000,?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839B82
          • __init_pointers.LIBCMT ref: 02839B8C
          • EncodePointer.KERNEL32(?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839B9D
          • EncodePointer.KERNEL32(?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839BAA
          • EncodePointer.KERNEL32(?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839BB7
          • EncodePointer.KERNEL32(?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839BC4
          • DecodePointer.KERNEL32(Function_00009929,?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839BE5
          • __calloc_crt.LIBCMT ref: 02839BFA
          • DecodePointer.KERNEL32(00000000,?,?,028375E2,02847B60,00000008,02837776,?,?,?,02847B80,0000000C,02837831,?), ref: 02839C14
          • GetCurrentThreadId.KERNEL32 ref: 02839C26
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
          • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
          • API String ID: 3698121176-3819984048
          • Opcode ID: bde9e500965d544c67da98f821bc20cc20754c61096845a82a91799dce9386a1
          • Instruction ID: 6cb1c10736b38fc9d7a4263fb54ca7bffed8692c9b45fdd6d08f27c6b26d0113
          • Opcode Fuzzy Hash: bde9e500965d544c67da98f821bc20cc20754c61096845a82a91799dce9386a1
          • Instruction Fuzzy Hash: 7531503DDC02159BEB22AF78A94871ABBE5FB54778B550D16E408C32D0EBB8C461DF90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D03AE85
          • CreateFileA.KERNEL32(?,40000000,00000000,?,00000003,00000080,000000FF), ref: 6D03AED4
          • GetCurrentProcess.KERNEL32 ref: 6D03AEE9
          • GetCurrentProcess.KERNEL32 ref: 6D03AEF4
          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000002), ref: 6D03AF07
          • GetCurrentProcess.KERNEL32 ref: 6D03AF11
          • GetCurrentProcess.KERNEL32 ref: 6D03AF1C
          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000002), ref: 6D03AF2F
          • memset.VCRUNTIME140(?,00000000,00000044), ref: 6D03AF44
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000003,?,?,?,?,?,?,?,0000000F,?,00000000,00000044), ref: 6D03AFD9
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000003,?,?,?,?,?,?,?,0000000F,?,00000000,00000044), ref: 6D03AFE6
          Strings
          • [exception_track]ChildProcess CreateProcessW fail, exec:%s,args_:%s, error:%d, xrefs: 6D03B140
          • d:\ci_dev\wegame_client\codes\common\src\child_process.cpp, xrefs: 6D03B057, 6D03B119
          • [exception_track]ChildProcess CreateProcessW, exec:%s,args_:%s, xrefs: 6D03B07F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CurrentProcess$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@DuplicateHandleU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@4@@W@std@@$CreateFileH_prolog3_memset
          • String ID: [exception_track]ChildProcess CreateProcessW fail, exec:%s,args_:%s, error:%d$[exception_track]ChildProcess CreateProcessW, exec:%s,args_:%s$d:\ci_dev\wegame_client\codes\common\src\child_process.cpp
          • API String ID: 3476372949-726642795
          • Opcode ID: 9701b842412452f4db5cb486069dfb06155a8ad546f3bd15e821c2f7011271f1
          • Instruction ID: e66874ff48d6a236318d140eb88224a245bbdbf39bae6e2785698b86b098ef47
          • Opcode Fuzzy Hash: 9701b842412452f4db5cb486069dfb06155a8ad546f3bd15e821c2f7011271f1
          • Instruction Fuzzy Hash: 8CA17A70900219EFEF24DFA4CC48FEEBBB4AF49304F504199E519A7291EB709A49CF61
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0BF884
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000138), ref: 6D0BF899
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0BF936
          • ?ExtractFilePathAndNameW@silence_update@common@ierd_tgp@@KAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?), ref: 6D0BF99D
          • ?RemovePathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?), ref: 6D0BF9A9
          • ?ExtractFilePathAndNameW@silence_update@common@ierd_tgp@@KAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?), ref: 6D0BFA07
          • ?RemovePathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?), ref: 6D0BFA10
          • ?ExtractFilePathAndNameW@silence_update@common@ierd_tgp@@KAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0BFA67
          • ?RemovePathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0BFA70
          • ?ExtractFilePathAndNameW@silence_update@common@ierd_tgp@@KAHPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0BFAE1
          • ?RemovePathSlashW@silence_update@common@ierd_tgp@@KAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?), ref: 6D0BFAEA
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0BFC7C
          • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,client_ui,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0BFA95
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • ?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?), ref: 6D0BFD54
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$PathW@silence_update@common@ierd_tgp@@$ExtractFileNameRemoveSlashW@2@@std@@1@W@2@@std@@@$?get_log_instance@base@@Logger@1@$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@H_prolog3H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@W@2@@4@@Xbad_function_call@std@@_wcsicmp
          • String ID: client_ui$d:\ci_dev\wegame_client\codes\common\src\util_silence_update.cpp$silence_update del done:%s$silence_update del:%s$version.ini
          • API String ID: 2402599457-2681532218
          • Opcode ID: 35360dab43223520268f00b14e358f2b11188074cb3330ff556474e6112d669b
          • Instruction ID: 7975d84c33b3f85374bb9841af2d43fa846216a7bd6835c684b313eb1a560eab
          • Opcode Fuzzy Hash: 35360dab43223520268f00b14e358f2b11188074cb3330ff556474e6112d669b
          • Instruction Fuzzy Hash: 2FE126B0C08258DEEF24CFA9C844BDDFBB8AF65304F54419AD109B72A1DB715A89CF61
          APIs
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13B8E2
          • __allrem.LIBCMT ref: 6D13B919
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13B927
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13B937
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13B96F
          • __allrem.LIBCMT ref: 6D13B9A3
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13B9B1
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13B9C1
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13B9F8
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13BA2F
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13BA58
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem
          • String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
          • API String ID: 632788072-2102732564
          • Opcode ID: 29cc70e1b5a23eaca67661b94a7a2d4d2df401340ffd7e45c79e57003e3371bf
          • Instruction ID: dd5d8c8b22025881bb31225e144801a07dc62619b331b216fe66ed3edd36ea41
          • Opcode Fuzzy Hash: 29cc70e1b5a23eaca67661b94a7a2d4d2df401340ffd7e45c79e57003e3371bf
          • Instruction Fuzzy Hash: 0241B7A2B8DB7035E5226549BD01FAF211D9BC1F58F130469FB00B718DE7E56D4602FA
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07FAD4
          • ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,000004D0), ref: 6D07FB16
            • Part of subcall function 6D07F111: _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,?,6D07F0F8,?,?,?,?,?,?,?,?,0000001C), ref: 6D07F122
          • ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,000004D0), ref: 6D07FB43
          • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000020,00000000), ref: 6D07FBBE
          • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000020,00000000), ref: 6D07FBDD
          • memset.VCRUNTIME140(?,00000000,00000034), ref: 6D07FBF6
          • memset.VCRUNTIME140(?,00000000,00000034,?,00000000,00000034), ref: 6D07FC05
          • GetFileInformationByHandle.KERNEL32(?,?), ref: 6D07FC1A
          • GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6D07FC2D
          • CloseHandle.KERNEL32(00000000), ref: 6D07FC67
          • CloseHandle.KERNEL32(?), ref: 6D07FC6F
          • memset.VCRUNTIME140(?,00000000,00000208), ref: 6D07FC83
          • memset.VCRUNTIME140(?,00000000,00000208,?,00000000,00000208), ref: 6D07FC95
          • GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 6D07FCB1
          • GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 6D07FCC1
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D07FCC3
          • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D07FD38
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\path_op.cpp, xrefs: 6D07FCE7
          • [common]is_reference_same_file file not exist - {}, {}, xrefs: 6D07FD0F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: FileHandlememset$?file_exists@common@ierd_tgp@@CloseCreateFullInformationNamePathU?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@$?get_log_instance@base@@H_prolog3_Logger@1@_waccess_wcsicmp
          • String ID: [common]is_reference_same_file file not exist - {}, {}$d:\ci_dev\wegame_client\codes\common\src\path_op.cpp
          • API String ID: 3486947438-1714020974
          • Opcode ID: 72502f3a0bca97177b3a6ed921a8ca19cade6f5eeb373db82d4946f89b26ed80
          • Instruction ID: 4ca9b1cdc8dafcb70fca82a9ecd9a84bd10a99ccaab215ea6dc49e9cc2d954da
          • Opcode Fuzzy Hash: 72502f3a0bca97177b3a6ed921a8ca19cade6f5eeb373db82d4946f89b26ed80
          • Instruction Fuzzy Hash: A9614EB1944229AAEB20DB64CC94FEE77BCAB55314F5001DAE614BB180DB709E85CF68
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04A6D4
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04A701
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04A891
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04AA09
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04A9BF
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
            • Part of subcall function 6CFFA3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6D0062D8,00000000,6D006649,00000003,23C35E98,?,?,00000000,6D266604,000000FF,?,6D005B05,00000000), ref: 6CFFA3E5
          • ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04AB3F
          • ?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000001,?,?,?,?,?), ref: 6D04AB77
          • ?get_qq_skey_value@CurlWrapper@curl_wrapper@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV45@_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,00000000,00000001,?,?,?,?,?), ref: 6D04ABB0
          Strings
          • [curl_wrapper]get_qq_skey_value, init curl failed, xrefs: 6D04AAF3
          • [curl_wrapper]get_qq_skey_value., xrefs: 6D04A73C
          • d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp, xrefs: 6D04A722, 6D04A8B6, 6D04A9E8, 6D04AA32, 6D04AA7C, 6D04AADC
          • [curl_wrapper]get_qq_skey_value, curl perform failed:%d, xrefs: 6D04AA9A
          • [curl_wrapper]get_qq_skey_value, cookie is [%s], xrefs: 6D04A8D4
          • [curl_wrapper]get_qq_skey_value, cookie is empty, xrefs: 6D04A9FF
          • [curl_wrapper]get_qq_skey_value, get cookie info failed, xrefs: 6D04AA49
          • p_skey, xrefs: 6D04A93D
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?get_qq_skey_value@?report@CurlD@2@@std@@D@std@@H_prolog3H_prolog3_H_prolog3_catch_Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@Qos_occasion@234@@U?$char_traits@V45@_V?$allocator@V?$basic_string@Wrapper@curl_wrapper@ierd_tgp@@_invalid_parameter_noinfo_noreturn
          • String ID: [curl_wrapper]get_qq_skey_value, cookie is [%s]$[curl_wrapper]get_qq_skey_value, cookie is empty$[curl_wrapper]get_qq_skey_value, curl perform failed:%d$[curl_wrapper]get_qq_skey_value, get cookie info failed$[curl_wrapper]get_qq_skey_value, init curl failed$[curl_wrapper]get_qq_skey_value.$d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp$p_skey
          • API String ID: 4086295442-3566312541
          • Opcode ID: 41db287fc0885e41d8335e10ee647e411796319efb635525b718488d344ea194
          • Instruction ID: 665c6777da363d2b5c9a1efc4157b8e7a957ba17ce036805a77771dcb6aefda8
          • Opcode Fuzzy Hash: 41db287fc0885e41d8335e10ee647e411796319efb635525b718488d344ea194
          • Instruction Fuzzy Hash: 46E16270A45359EBFB11CBA4CC50FED77B5AF15308F1180B8E644BB282DBB19A45CB51
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A6393
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0A63CC
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • ?ModifyFileAccessTrustee@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000001,Administrators), ref: 6D0A6415
            • Part of subcall function 6D0A3DD1: __EH_prolog3_GS.LIBCMT ref: 6D0A3DDB
            • Part of subcall function 6D0A3DD1: GetNamedSecurityInfoW.ADVAPI32(?,00000001,00000004,00000000,00000000,?,00000000,?,?,?,?,?,?,00000080), ref: 6D0A3E11
            • Part of subcall function 6D0A3DD1: ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000080), ref: 6D0A3E1D
            • Part of subcall function 6D0A3DD1: LocalFree.KERNEL32(00000000), ref: 6D0A3F7F
            • Part of subcall function 6D0A3DD1: LocalFree.KERNEL32(00000000), ref: 6D0A3F8A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A6434
          • ?ModifyFileAccessTrustee@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D0A64E7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,Users), ref: 6D0A6506
          • GetUserNameW.ADVAPI32(?,?), ref: 6D0A658E
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0A6603
          • ?ModifyFileAccessTrustee@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,?,?), ref: 6D0A665E
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,Users), ref: 6D0A6681
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,Users), ref: 6D0A6707
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • Users, xrefs: 6D0A64B8
          • [E][Sys_wrapper]ModifyFileAccessTrustee, enable Users privilege failed: %s, xrefs: 6D0A6558
          • [E][Sys_wrapper]ModifyFileAccessTrustee, enable Administrators privilege failed: %s, xrefs: 6D0A6486
          • Administrators, xrefs: 6D0A63E7
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A6458, 6D0A652A, 6D0A66A5, 6D0A672B
          • [E][Sys_wrapper]ModifyFileAccessTrustee, enable current user privilege failed: %s, %s, xrefs: 6D0A66E8
          • [Sys_wrapper]SetFileAccessTrustee done, result: %d, current user: %s, path: %s, xrefs: 6D0A6772
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$AccessFileH_prolog3_ModifySys_wrapper@common@ierd_tgp@@Trustee@W@2@@std@@0_$?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@FreeLocalU?$char_traits@V?$allocator@V?$basic_string@W@2@@std@@$H_prolog3H_prolog3_catch_InfoNameNamedSecurityUser
          • String ID: Administrators$Users$[E][Sys_wrapper]ModifyFileAccessTrustee, enable Administrators privilege failed: %s$[E][Sys_wrapper]ModifyFileAccessTrustee, enable Users privilege failed: %s$[E][Sys_wrapper]ModifyFileAccessTrustee, enable current user privilege failed: %s, %s$[Sys_wrapper]SetFileAccessTrustee done, result: %d, current user: %s, path: %s$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 4202387323-622478044
          • Opcode ID: 43a370bcb7987136aac29e641e202212fc10e520dce2e6c62a7f517c909741d9
          • Instruction ID: e955d317b64185595ff8d18110043eea77528ca528d7754a0c455f72ee2e012e
          • Opcode Fuzzy Hash: 43a370bcb7987136aac29e641e202212fc10e520dce2e6c62a7f517c909741d9
          • Instruction Fuzzy Hash: EDB16D70D46229EEEB20DBA8CC98BEDB7B4AF14304F5540D9D508A7281EB719F84CF61
          APIs
          • ResetEvent.KERNEL32(?), ref: 02832D9B
          • InterlockedExchange.KERNEL32(?,00000000), ref: 02832DA7
          • timeGetTime.WINMM ref: 02832DAD
          • socket.WS2_32(00000002,00000001,00000006), ref: 02832DDA
          • lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02832E06
          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02832E12
          • lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 02832E31
          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02832E3D
          • gethostbyname.WS2_32(00000000), ref: 02832E4B
          • htons.WS2_32(?), ref: 02832E6D
          • connect.WS2_32(?,?,00000010), ref: 02832E8B
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
          • String ID: 0u
          • API String ID: 640718063-3203441087
          • Opcode ID: f1c8d94110b9a83cdefe05e6c43911afc887dfebcf177964a865a1c688d7017b
          • Instruction ID: a4e1c592b8948f00766ff05b00cdff3205bd206e85ec9c5f3c1828989275c902
          • Opcode Fuzzy Hash: f1c8d94110b9a83cdefe05e6c43911afc887dfebcf177964a865a1c688d7017b
          • Instruction Fuzzy Hash: E9614DB9A40304ABE720DFA4DC45FAEB7F9BF58710F104919F646E72C0D6B4A904CBA5
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D0C352C
          • _Xtime_get_ticks.MSVCP140(0000022C), ref: 6D0C354E
            • Part of subcall function 6D0C2564: __EH_prolog3_GS.LIBCMT ref: 6D0C256B
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,0000022C), ref: 6D0C3593
          • ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0C36A3
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D0C37F1
          • DeleteFileW.KERNEL32(?,?,?,61C46800,00000008,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6D0C3887
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C3891
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C3909
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000022C), ref: 6D0C3A7B
          • GetLastError.KERNEL32(00000000,00000003,d:\ci_dev\wegame_client\codes\common\src\utility.cpp,00000030,6D31E62F), ref: 6D0C38D3
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • DeleteFileW.KERNEL32(6D38A64C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0C3ADE
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\utility.cpp, xrefs: 6D0C35B4, 6D0C38BA, 6D0C392A, 6D0C3A9C
          • DeleteExpiredFiles delete log file[{}] failed:[{}], xrefs: 6D0C38EA
          • DeleteExpiredFiles DeleteFileW log file[{}], xrefs: 6D0C3AB7
          • DeleteExpiredFiles delete log file[{}] success, xrefs: 6D0C3945
          • DeleteExpiredFiles check folder:{}, xrefs: 6D0C35CC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$DeleteFile$??0path@filesystem@ierd_tgp@@ErrorH_prolog3H_prolog3_H_prolog3_catch_LastU?$char_traits@_Unothrow_t@std@@@V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@Xtime_get_ticks__ehfuncinfo$??2@
          • String ID: DeleteExpiredFiles DeleteFileW log file[{}]$DeleteExpiredFiles check folder:{}$DeleteExpiredFiles delete log file[{}] failed:[{}]$DeleteExpiredFiles delete log file[{}] success$d:\ci_dev\wegame_client\codes\common\src\utility.cpp
          • API String ID: 2732379511-1893911766
          • Opcode ID: eaae42f2c19f583893cce0c3bfba7c5f94b217260350071a586d0dc63e4bee74
          • Instruction ID: d9d46f9330e9a8bad9e38d249ba73795d76e2322cd8ce090a282c95f387f6252
          • Opcode Fuzzy Hash: eaae42f2c19f583893cce0c3bfba7c5f94b217260350071a586d0dc63e4bee74
          • Instruction Fuzzy Hash: CF027A71D04259EAEB25CFA8C894BEDB7B4AF59308F1081D9E505B7281DB706F88CF91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D08290D
          • memset.VCRUNTIME140(?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002), ref: 6D082923
          • memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?), ref: 6D082933
          • memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?), ref: 6D082941
          • memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9), ref: 6D08294F
          • memset.VCRUNTIME140(?,00000000,00000400,?,?), ref: 6D082A82
            • Part of subcall function 6D0004F0: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,?,?,6D00CB1C,?,?,%s,%lu,?,?,00000010), ref: 6D00050C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D082AEB
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D082B46
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$?get_log_instance@base@@Logger@1@$H_prolog3H_prolog3___stdio_common_vsprintf_s
          • String ID: [qos_t]InitQos failed, {}$[qos_t]InitQos success$d:\ci_dev\wegame_client\codes\common\src\qos_command.cpp$ied-tqos-tgp.qq.com$ied-tqos.qq.com$ied-tqos.wegamex.com.hk$ied-tqosweb.qq.com$ied-tqosweb.wegamex.com.hk$tqos.wegamex.com.hk
          • API String ID: 2915109889-1485585471
          • Opcode ID: 2cf887470e014207179b7d4b656105410bc69581c6fc06c06ba71ce3d85afb83
          • Instruction ID: 28bde85ce3f156a4c2e06cb825afd29ac270d34cd7773f407133229e566a7097
          • Opcode Fuzzy Hash: 2cf887470e014207179b7d4b656105410bc69581c6fc06c06ba71ce3d85afb83
          • Instruction Fuzzy Hash: 4061D8B194521A7FEF24DF60CC54FFA77ACAF04318F0141A4E605AB182DB359E46CBA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D082704
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(6D045F3F,===qos begin===,00000020,6D08625F,?,?,00000003,00000001,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?), ref: 6D08271C
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(6D045F3F), ref: 6D08272D
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(?), ref: 6D082745
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(6D045F3F), ref: 6D08274E
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(00000000,6D295354), ref: 6D082778
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(0000000F), ref: 6D08278D
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(6D045F3F), ref: 6D08279A
          • memmove.VCRUNTIME140(?,0000000F,00000080,00000080,00000000), ref: 6D0827FB
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(00000000,6D295354), ref: 6D082816
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(6D045F3F), ref: 6D08283E
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(6D045F3F), ref: 6D082878
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: V01@$D@std@@@std@@U?$char_traits@$??5?$basic_istream@V01@@$??6?$basic_ostream@$H_prolog3_memmove
          • String ID: ===qos begin===$===qos end===$Int$qos id = $str
          • API String ID: 3768889356-3919521203
          • Opcode ID: 85ee82e32ea051a1e63f837300ab0be372451d25dd3615d6755492f70bf7b87b
          • Instruction ID: 0beaede52e0dcc8e82840cc813b05a30ef859d657c5c40cea90971e3aa62f822
          • Opcode Fuzzy Hash: 85ee82e32ea051a1e63f837300ab0be372451d25dd3615d6755492f70bf7b87b
          • Instruction Fuzzy Hash: E941D371A04308EFEF18EBB5D85DEBE77B4EB49219F54101EE206A7281EB749804CB24
          APIs
          • memset.VCRUNTIME140(?,00000000,00000008,?,?,?,?,6D05E61B,00000000,?,?,6D064C3E,00000000,23C35E98,?,00000000), ref: 6D066C5D
          • memset.VCRUNTIME140(6D28DF0C,00000000,00000020,?,00000000,00000008,?,?,?,?,6D05E61B,00000000,?,?,6D064C3E,00000000), ref: 6D066C69
          • memset.VCRUNTIME140(?,00000000,00000020,6D28DF0C,00000000,00000020,?,00000000,00000008,?,?,?,?,6D05E61B,00000000,?), ref: 6D066C75
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000020,6D28DF0C,00000000,00000020,?,00000000,00000008,?,?,?), ref: 6D066C88
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000020,6D28DF0C,00000000,00000020,?,00000000,00000008), ref: 6D066CA2
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000020,6D28DF0C,00000000,00000020,?), ref: 6D066CB0
          • memset.VCRUNTIME140(?,00000000,00000010), ref: 6D066CC1
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010), ref: 6D066CCF
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000010), ref: 6D066CDD
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010), ref: 6D066CEB
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010), ref: 6D066CFF
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?), ref: 6D066D0D
          • memset.VCRUNTIME140(?,00000000,00000010), ref: 6D066D1E
          • memset.VCRUNTIME140(?,00000000,00000028,?,00000000,00000010), ref: 6D066D83
          • memset.VCRUNTIME140(?,00000000,00000020,?,00000000,00000028,?,00000000,00000010), ref: 6D066DB2
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000020,?,00000000,00000028,?,00000000,00000010), ref: 6D066DC0
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000020,?,00000000,00000028,?,00000000,00000010), ref: 6D066DCE
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000020,?,00000000,00000028,?), ref: 6D066DDD
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000020,?), ref: 6D066DF0
          • memset.VCRUNTIME140(?,00000000,-00000060,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?), ref: 6D066E21
          • memset.VCRUNTIME140(?,00000000,00002080,?,00000000,-00000060,?,00000000,00000010,?,00000000,00000010,?,00000000,00000010,?), ref: 6D066E2E
          • memset.VCRUNTIME140(?,00000000,-00000060,?,00000000,00002080,?,00000000,-00000060,?,00000000,00000010,?,00000000,00000010,?), ref: 6D066E3E
          • memset.VCRUNTIME140(?,00000000,00000010,?,00000000,-00000060,?,00000000,00002080,?,00000000,-00000060,?,00000000,00000010,?), ref: 6D066E73
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset
          • String ID:
          • API String ID: 2221118986-0
          • Opcode ID: ab998b5caee233824e733c929c49252771104639b8a94b61853bb235df34489d
          • Instruction ID: cc2be41b0a29d273c90be2ba09c7dd9faac2dcac49cb29f6e91c7b1973fabe22
          • Opcode Fuzzy Hash: ab998b5caee233824e733c929c49252771104639b8a94b61853bb235df34489d
          • Instruction Fuzzy Hash: A171FEB1A55A06BED369CF758C84FC7FBACBF09344F00462AA22CD6240D774B5258BE5
          APIs
          • __EH_prolog3.LIBCMT ref: 6D057F3E
            • Part of subcall function 6D058835: __EH_prolog3.LIBCMT ref: 6D05883C
            • Part of subcall function 6D058835: ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ.MSVCP140(00000008,6D057F54,00000009,00000001,000000DC,6D057650,6D0576F7,?,00000005,00000048,00000094,00000014,6D057719,?,6D0576F7,?), ref: 6D05885A
            • Part of subcall function 6D058835: ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,00000000,6D0576F7,00000008,6D057F54,00000009,00000001,000000DC,6D057650,6D0576F7,?,00000005,00000048,00000094), ref: 6D058887
          • ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(00000014,?,00000009,00000001,000000DC,6D057650,6D0576F7,?,00000005,00000048,00000094,00000014,6D057719,?,6D0576F7,?), ref: 6D057F6F
          • ?flags@ios_base@std@@QBEHXZ.MSVCP140(00000048,00000094,00000014,6D057719,?,6D0576F7,?,00000009,?,6D0576F7), ref: 6D057FB3
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140(?,6D0576F7), ref: 6D057FCC
          • ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,?,6D0576F7), ref: 6D058025
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05804E
          • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(0000002B), ref: 6D05806B
          • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(0000002D), ref: 6D058086
          • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(00000020), ref: 6D0580A1
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D0580B2
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05811D
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05813F
          • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(0000002B), ref: 6D05815B
          • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(0000002D), ref: 6D058176
          • ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000), ref: 6D058224
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05825B
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D058292
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(00000000,?,?,?,00000000,00000000), ref: 6D058377
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D058394
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$U?$char_traits@_$W@std@@@std@@$?pptr@?$basic_streambuf@$?widen@?$basic_ios@_$?width@ios_base@std@@$??1?$basic_ios@H_prolog3$??0?$basic_ios@_??0?$basic_ostream@_?flags@ios_base@std@@?imbue@?$basic_ios@V32@@V?$basic_streambuf@_Vlocale@2@W@std@@@1@_
          • String ID:
          • API String ID: 723872306-0
          • Opcode ID: 4c368b6fc400233aaa3e7b068379cc8889ef93ff56bd2c4de9effd2af7bc1bac
          • Instruction ID: 7756ef4143104e2d3fc250015b32e5e580f055daab3affe82c2c5a3fb32721d9
          • Opcode Fuzzy Hash: 4c368b6fc400233aaa3e7b068379cc8889ef93ff56bd2c4de9effd2af7bc1bac
          • Instruction Fuzzy Hash: B1F14D71A00219DFDF04CFA8C994BAD7BF5FF49318F148059E906A7290DB35E955CB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AFA23
          • select.WS2_32(00000000,00000000,?,?,?), ref: 6D0AFADD
          • GetTickCount.KERNEL32 ref: 6D0AFAEB
          • inet_ntoa.WS2_32(00000000), ref: 6D0AFB5F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,?,?,00000460,6D0B0752), ref: 6D0AFBA5
          • inet_ntoa.WS2_32(0000000F), ref: 6D0AFD69
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,00000001), ref: 6D0AFDBA
            • Part of subcall function 6D0B0106: __EH_prolog3_GS.LIBCMT ref: 6D0B0110
            • Part of subcall function 6D01F613: __EH_prolog3_GS.LIBCMT ref: 6D01F648
          • WSAGetLastError.WS2_32(?,?,?,00000460,6D0B0752), ref: 6D0AFECC
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000460,6D0B0752), ref: 6D0AFED8
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000460,6D0B0752), ref: 6D0AFFB4
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\tcp_port_detect.cpp, xrefs: 6D0AFBD4, 6D0AFDE6, 6D0AFF06, 6D0AFFE0
          • [Tcp_port_detect]internal_process all ip check over,port = %d, xrefs: 6D0B0000
          • [Tcp_port_detect]internal_process socket connect success(%s,%d), xrefs: 6D0AFE05
          • [Tcp_port_detect]internal_process select failed port=%d,err=%d, xrefs: 6D0AFF27
          • [Tcp_port_detect]internal_process socket connect timeout(%s,%d), xrefs: 6D0AFBFB
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$H_prolog3_$inet_ntoa$CountErrorLastTickselect
          • String ID: [Tcp_port_detect]internal_process all ip check over,port = %d$[Tcp_port_detect]internal_process select failed port=%d,err=%d$[Tcp_port_detect]internal_process socket connect success(%s,%d)$[Tcp_port_detect]internal_process socket connect timeout(%s,%d)$d:\ci_dev\wegame_client\codes\common\src\tcp_port_detect.cpp
          • API String ID: 3367625610-1722927508
          • Opcode ID: e98e0f88ca483f353bbb6d6a0a3b7239db9b5b93fa018016e2063d859438b4e7
          • Instruction ID: bd063a61a9379bcbd876edc97d278442057aafd8bc67c0edad2150b11077dce8
          • Opcode Fuzzy Hash: e98e0f88ca483f353bbb6d6a0a3b7239db9b5b93fa018016e2063d859438b4e7
          • Instruction Fuzzy Hash: E002AFB0905219DFEB15DFA4CD94BEDBBB4BF45304F1400D9D209AB282EB71AA89CF51
          APIs
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(00000030,?,?,?,00000000,00000000,00000000,?,?,?,?), ref: 6D057A13
          • ?is@?$ctype@_W@std@@QBE_NF_W@Z.MSVCP140(00000004,?), ref: 6D057A30
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(00000025), ref: 6D057A68
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(00000024), ref: 6D057AAE
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057B5F
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002E), ref: 6D057BC5
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057BE9
          • ?is@?$ctype@_W@std@@QBE_NF_W@Z.MSVCP140(00000004,?), ref: 6D057C10
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000007C), ref: 6D057D0B
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: W@std@@$?widen@?$ctype@_$?is@?$ctype@_
          • String ID: 3
          • API String ID: 4220899879-1842515611
          • Opcode ID: a48f1dee52fcde45668d1ac25a4892da4ae48360cc0364274ac67008fbbc5953
          • Instruction ID: 346987cf8b94fe02f3515808881d1e831bbc9bf2a01f8e412e357ba8917fbeb5
          • Opcode Fuzzy Hash: a48f1dee52fcde45668d1ac25a4892da4ae48360cc0364274ac67008fbbc5953
          • Instruction Fuzzy Hash: 68F15B7191420ADFEB16CF68C688BAA3BB1FF8A304F50C089ED15CB290D371DA65DB51
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04AC0D
          • ?Init@CurlWrapper@curl_wrapper@ierd_tgp@@QAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000300), ref: 6D04AC51
            • Part of subcall function 6D01F613: __EH_prolog3_GS.LIBCMT ref: 6D01F648
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D04BBBE
          Strings
          • [Curlssl_adapter]report failed, rsp_code:%d, task_id:%d, result:%d, curl_perform_result:%d, effective_url: %s, xrefs: 6D04BCDB
          • [Curlssl_adapter]report done, msg:%s, xrefs: 6D04BC0A
          • _tgp_cook_, xrefs: 6D04B180
          • 1, xrefs: 6D04BCA9
          • d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp, xrefs: 6D04BBEA, 6D04BC4A, 6D04BC96
          • [Curlssl_adapter] process_curl_task, task_id: %d, process_curl_task: %s, xrefs: 6D04AC56
          • [Curlssl_adapter]report done, huge rsp., xrefs: 6D04BC61
          • v', xrefs: 6D04AD5F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$?get_log_instance@base@@CurlInit@Logger@1@Wrapper@curl_wrapper@ierd_tgp@@
          • String ID: 1$[Curlssl_adapter] process_curl_task, task_id: %d, process_curl_task: %s$[Curlssl_adapter]report done, huge rsp.$[Curlssl_adapter]report done, msg:%s$[Curlssl_adapter]report failed, rsp_code:%d, task_id:%d, result:%d, curl_perform_result:%d, effective_url: %s$_tgp_cook_$d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp$v'
          • API String ID: 543814229-3434119045
          • Opcode ID: fa4dedf434afd9edfa80d271722487ece9cbbfd3d1c49f5e18ae549341bb4a34
          • Instruction ID: 0c698f83ff0194449ea355131866bcd0d133d0c5fb84e8568348cbc5869e3554
          • Opcode Fuzzy Hash: fa4dedf434afd9edfa80d271722487ece9cbbfd3d1c49f5e18ae549341bb4a34
          • Instruction Fuzzy Hash: 11E1B1B0A45316EFEB24CF24CC84FADB7B4AF04304F1145E9E5596B291DBB0AA85CF91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D083A84
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(000001EC,6D083EB2,?), ref: 6D083A90
          • ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000001), ref: 6D083B98
          • _time64.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,00000001), ref: 6D083BA4
          • ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000001,?,?,00000000), ref: 6D083BD5
          • ?set_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,0000002E,?), ref: 6D083C32
          • ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000001,offline.data.report,00000013,0000002E,?,?,?,0000002E,?), ref: 6D083CD2
          • ?set_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,offline.data.report,00000013), ref: 6D083D54
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
            • Part of subcall function 6D0852E9: __EH_prolog3_GS.LIBCMT ref: 6D0852F0
            • Part of subcall function 6D081F63: __EH_prolog3.LIBCMT ref: 6D081F6A
            • Part of subcall function 6CFFA3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6D0062D8,00000000,6D006649,00000003,23C35E98,?,?,00000000,6D266604,000000FF,?,6D005B05,00000000), ref: 6CFFA3E5
          • ?set_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,0000002E,?,report,0000002E,?,0000002E,?,?,0000002E,?,?,0000002E,?), ref: 6D083DCE
            • Part of subcall function 6D038F60: __EH_prolog3_catch_GS.LIBCMT ref: 6D038F6A
            • Part of subcall function 6D038F60: ?split_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D038FD5
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$U?$less@V12@V?$basic_ptree@$?get_cfg_by_path@common@ierd_tgp@@?set_cfg_by_path@common@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@@D@2@@std@@@2@@property_tree@boost@@_$H_prolog3H_prolog3_H_prolog3_catch_$?get_log_instance@base@@?split_path@common@ierd_tgp@@Logger@1@V34@1@_invalid_parameter_noinfo_noreturn_time64
          • String ID: [qos]SaveOfflineReportDatainfo: %s - %s.$d:\ci_dev\wegame_client\codes\common\src\qos_command.cpp$offline.data$offline.data.report$offline.data.report.%s$report
          • API String ID: 350111151-343298753
          • Opcode ID: e0dc1a4ae421b167758511011e26391316a07ee474c4398c9041991fbd8df417
          • Instruction ID: 2c5597806847168a2f189746b950ccfbc742cbb29f92b92c73487ece1e97d181
          • Opcode Fuzzy Hash: e0dc1a4ae421b167758511011e26391316a07ee474c4398c9041991fbd8df417
          • Instruction Fuzzy Hash: 9BC18C71C0825DEEEF11DBA0CC94BEDBBB8AF15308F104099D205A7192EB755B89DBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0B3CDC
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000070), ref: 6D0B3CE4
          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000070), ref: 6D0B3D49
          • GetCurrentThreadId.KERNEL32 ref: 6D0B3D92
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0B3DA8
          • OpenProcess.KERNEL32(00000410,00000000,?), ref: 6D0B3E09
          • CloseHandle.KERNEL32(?), ref: 6D0B3E47
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0B3E4D
          • CloseHandle.KERNEL32(00000000), ref: 6D0B3F10
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\trace_dump.cpp,000001D9,6D31E62F), ref: 6D0B3ED9
          Strings
          • [TraceDump] dump has been write, process_id=%u, xrefs: 6D0B3E94
          • [TraceDump] Writer Thread started, creating file, xrefs: 6D0B3D1D
          • [TraceDump] dump write failed, process_id=%u, error=%u, xrefs: 6D0B3EE3
          • [TraceDump] Writer Thread will write dump, xrefs: 6D0B3DE3
          • d:\ci_dev\wegame_client\codes\common\src\trace_dump.cpp, xrefs: 6D0B3D0A, 6D0B3DCC, 6D0B3E7D, 6D0B3EC3
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$CloseHandle$CreateCurrentErrorFileH_prolog3H_prolog3_H_prolog3_catch_LastOpenProcessThread
          • String ID: [TraceDump] Writer Thread started, creating file$[TraceDump] Writer Thread will write dump$[TraceDump] dump has been write, process_id=%u$[TraceDump] dump write failed, process_id=%u, error=%u$d:\ci_dev\wegame_client\codes\common\src\trace_dump.cpp
          • API String ID: 262979499-3059024305
          • Opcode ID: 413e39bc6ee7857c231dc43a421a64f0f6d176127d8b3613a9e3497a0cc612e8
          • Instruction ID: 7bf07bd5b759a0ef367727e5b6d64bdfb6fc3bb3938b033906be7f39c4bdb0b7
          • Opcode Fuzzy Hash: 413e39bc6ee7857c231dc43a421a64f0f6d176127d8b3613a9e3497a0cc612e8
          • Instruction Fuzzy Hash: 3C61BE30E48205ABFB50DFA4CC45FAE77B1AF89714F214119EA25BF2C5EB729906CB50
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D0366F6
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,0000018C), ref: 6D036739
          • ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,0000018C), ref: 6D03674D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000018C), ref: 6D036767
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,0000018C), ref: 6D0367D6
          • ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,0000018C), ref: 6D0367E3
          • ?create_directory_ex@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,0000018C), ref: 6D0367F1
          • ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,0000018C), ref: 6D036800
          • ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,?,?,?,?,?,?,?,0000018C), ref: 6D03680D
          • ?backup_cfg_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,?,?,?,?,?,?,?,?,0000018C), ref: 6D03681D
          • ?copy_file@filesystem@ierd_tgp@@YAXABVpath@12@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D036872
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D036879
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [cfg_mgr]file not exist: %s, xrefs: 6D0367AE
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6D03678B, 6D03689D
          • [cfg_mgr]file copied: %s, xrefs: 6D0368C0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?exists@filesystem@ierd_tgp@@?get_log_instance@base@@H_prolog3_catch_Logger@1@U?$char_traits@_V123@V?$allocator@_V?$basic_string@_Vpath@12@@W@std@@$??0path@filesystem@ierd_tgp@@?backup_cfg_folder@?copy_file@filesystem@ierd_tgp@@?create_directory_ex@?filename@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@File_info@common@ierd_tgp@@H_prolog3Sys_wrapper@common@ierd_tgp@@U?$char_traits@V?$allocator@V?$basic_string@Vpath@12@0@Vpath@filesystem@3@Vpath@filesystem@3@@W@2@@std@@W@2@@std@@@
          • String ID: [cfg_mgr]file copied: %s$[cfg_mgr]file not exist: %s$d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp
          • API String ID: 2847872574-1044149114
          • Opcode ID: d1010c5ef9eacaa2610d1cc982c9d56a1c19506fa972aa49ad0e96144cf40fb5
          • Instruction ID: 4f5d73e646d7876e243b55cf8715fbeccd831fe36f727f9f005b83f2ea304ddc
          • Opcode Fuzzy Hash: d1010c5ef9eacaa2610d1cc982c9d56a1c19506fa972aa49ad0e96144cf40fb5
          • Instruction Fuzzy Hash: F261F671C0924AEAFF15CBE8C954BEDB7B4AF15308FA1819CD2007B181DB755B48DBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A6071
          • OpenFileMappingA.KERNEL32(00000004,00000000,00000104), ref: 6D0A60BD
          • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,00000084,6D0A4662,?,?,00000104), ref: 6D0A60D3
          • memmove.VCRUNTIME140(?,00000000,?,?,00000084,6D0A4662,?,?,00000104), ref: 6D0A60E9
          • GetLastError.KERNEL32(?,00000084,6D0A4662,?,?,00000104,?,?,?,?,?,?,?,00000002,00000000), ref: 6D0A60F7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000084,6D0A4662,?,?,00000104,?,?,?,?,?,?,?,00000002,00000000), ref: 6D0A6103
          • GetLastError.KERNEL32(?,00000084,6D0A4662,?,?,00000104,?,?,?,?,?,?,?,00000002,00000000), ref: 6D0A6159
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000084,6D0A4662,?,?,00000104,?,?,?,?,?,?,?,00000002,00000000), ref: 6D0A6165
          • UnmapViewOfFile.KERNEL32(00000000,?,00000005,d:\ci_dev\wegame_client\dependences\tpf_for_tgp_sdk\include\teniobase\template\processhelp_t.h,0000002A,6D31E62F,?,00000084,6D0A4662,?,?,00000104), ref: 6D0A61D6
          • CloseHandle.KERNEL32(00000000,?,00000005,d:\ci_dev\wegame_client\dependences\tpf_for_tgp_sdk\include\teniobase\template\processhelp_t.h,0000002A,6D31E62F,?,00000084,6D0A4662,?,?,00000104), ref: 6D0A61E1
          Strings
          • [ProcessHelp][RetrieveGameImagePathByProcessId]OpenFileMappingA fail, iamge path:%s, err:%d, xrefs: 6D0A61B3
          • TENINSTIP, xrefs: 6D0A607C
          • Global\%s_%X_%d, xrefs: 6D0A60A3
          • [ProcessHelp][RetrieveGameImagePathByProcessId]MapViewOfFile fail, hListMap:%p, err:%d, xrefs: 6D0A6152
          • d:\ci_dev\wegame_client\dependences\tpf_for_tgp_sdk\include\teniobase\template\processhelp_t.h, xrefs: 6D0A6130, 6D0A618A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: File$?get_log_instance@base@@ErrorLastLogger@1@View$CloseH_prolog3_HandleMappingOpenUnmapmemmove
          • String ID: Global\%s_%X_%d$TENINSTIP$[ProcessHelp][RetrieveGameImagePathByProcessId]MapViewOfFile fail, hListMap:%p, err:%d$[ProcessHelp][RetrieveGameImagePathByProcessId]OpenFileMappingA fail, iamge path:%s, err:%d$d:\ci_dev\wegame_client\dependences\tpf_for_tgp_sdk\include\teniobase\template\processhelp_t.h
          • API String ID: 3156181753-426698544
          • Opcode ID: 1e91a3759b378dfe79f2dcf691d84fa91791328ea8673979de31446d6a14a03f
          • Instruction ID: 08841a88c045d6f8d4bd73d35ea01d803b308ff1dd07e9825650954cddb47925
          • Opcode Fuzzy Hash: 1e91a3759b378dfe79f2dcf691d84fa91791328ea8673979de31446d6a14a03f
          • Instruction Fuzzy Hash: 8141807094061AAFFB259FA4CC44FBE7BB4BB45309F454098B914AB292EB318E45DF50
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D09F936
          • CoInitializeEx.OLE32(00000000,00000002,00000064), ref: 6D09F95A
          • CoCreateInstance.OLE32(6D2AC5F0,00000000,00000001,6D2AC570,00000000), ref: 6D09F976
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D09FA47
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000CDC,6D31E62F), ref: 6D09FA80
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D09FB18
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,00000CE4,6D31E62F), ref: 6D09FB55
          • CoUninitialize.OLE32(?), ref: 6D09FB78
          Strings
          • [Sys_wrapper][CreatDesktopShortcut] Save lnk file failed.error_code=%u, xrefs: 6D09FA87
          • [Sys_wrapper][CreatDesktopShortcut] CoCreateInstance failed.error_code=%u, xrefs: 6D09FB5C
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D09FA6B, 6D09FAD1, 6D09FB3C
          • [Sys_wrapper][CreatDesktopShortcut] QueryInterface failed.error_code=%u, xrefs: 6D09FAF1
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@ErrorLastLogger@1@$CreateH_prolog3_InitializeInstanceUninitialize
          • String ID: [Sys_wrapper][CreatDesktopShortcut] CoCreateInstance failed.error_code=%u$[Sys_wrapper][CreatDesktopShortcut] QueryInterface failed.error_code=%u$[Sys_wrapper][CreatDesktopShortcut] Save lnk file failed.error_code=%u$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 2514339084-1395465581
          • Opcode ID: 39c961ccdb8e0cc7bc0ade458bb2fec36c840e579ddd0f3cc9eda45bbb2b889c
          • Instruction ID: d277398b5a077fd0c2e9208505f6f6b545109620f8658599d209439ef636397a
          • Opcode Fuzzy Hash: 39c961ccdb8e0cc7bc0ade458bb2fec36c840e579ddd0f3cc9eda45bbb2b889c
          • Instruction Fuzzy Hash: A4718D70A00305AFEB14DFA4C844FAE7BB9AF86705F210158F915AF291DB71ED45DB60
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A3DDB
          • GetNamedSecurityInfoW.ADVAPI32(?,00000001,00000004,00000000,00000000,?,00000000,?,?,?,?,?,?,00000080), ref: 6D0A3E11
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000080), ref: 6D0A3E1D
          • BuildExplicitAccessWithNameW.ADVAPI32(?,?,001F01FF,00000001,00000003,?,?,?,?,?,00000080), ref: 6D0A3E82
          • SetEntriesInAclW.ADVAPI32(00000001,?,?,?,?,?,?,?,?,00000080), ref: 6D0A3EA3
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000080), ref: 6D0A3EAF
          • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000004,00000000,00000000,?,00000000,?,?,?,?,?,00000080), ref: 6D0A3F0D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000080), ref: 6D0A3F19
          • LocalFree.KERNEL32(00000000), ref: 6D0A3F7F
          • LocalFree.KERNEL32(00000000), ref: 6D0A3F8A
          Strings
          • [ModifyFileAccessTrustee]SetNamedSecurityInfoW failed, error %d, xrefs: 6D0A3F55
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A3E49, 6D0A3EDB, 6D0A3F3D
          • [ModifyFileAccessTrustee]GetNamedSecurityInfoW failed, error %d, xrefs: 6D0A3E5F
          • [ModifyFileAccessTrustee]SetEntriesInAclW failed, error %d, xrefs: 6D0A3EF1
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$FreeInfoLocalNamedSecurity$AccessBuildEntriesExplicitH_prolog3_NameWith
          • String ID: [ModifyFileAccessTrustee]GetNamedSecurityInfoW failed, error %d$[ModifyFileAccessTrustee]SetEntriesInAclW failed, error %d$[ModifyFileAccessTrustee]SetNamedSecurityInfoW failed, error %d$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 1988137380-1624467944
          • Opcode ID: 1c8c4ecbfeebdebe97a215b3826ac756d7ec34eb40d606e668b395e801be4ab1
          • Instruction ID: bf104254383023a5b93da3a418bf7a85ef6d8a6b29e9753694d42e3a6bbe59f1
          • Opcode Fuzzy Hash: 1c8c4ecbfeebdebe97a215b3826ac756d7ec34eb40d606e668b395e801be4ab1
          • Instruction Fuzzy Hash: 7051EC7094070AAFEB25CFD4CC84FAEB7B9AF89708F154119E514AF285DB71AD05CBA0
          APIs
          • memset.VCRUNTIME140(?,00000000,00000100), ref: 6D013D70
          • strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000100,?), ref: 6D013D89
          • CreateWindowExA.USER32(00000000,static,?,00000000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 6D013DC5
          • SetLastError.KERNEL32(00000000), ref: 6D013DD3
          • SetWindowLongA.USER32(00000000,000000FC,?), ref: 6D013DDD
          • GetLastError.KERNEL32 ref: 6D013DF0
          • SetLastError.KERNEL32(00000000), ref: 6D013DF8
          • SetWindowLongA.USER32(00000000,000000EB), ref: 6D013E02
          • GetLastError.KERNEL32 ref: 6D013E0C
          • DestroyWindow.USER32(00000000), ref: 6D013E13
          • ShowWindow.USER32(00000000,00000000), ref: 6D013E20
          • UpdateWindow.USER32(00000000), ref: 6D013E27
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Window$ErrorLast$Long$CreateDestroyShowUpdatememsetstrcpy_s
          • String ID: TCLS_CORE_WND_%u$static
          • API String ID: 698125720-2282508738
          • Opcode ID: 9b2cbad6d79923cc94afa6eab3e92f01f1a43bf943ff0fc9632aac79d7d3e978
          • Instruction ID: 418b92c42811e06dbc011d754517aaad9f569b3adb1c2b6b1d77d467f09db198
          • Opcode Fuzzy Hash: 9b2cbad6d79923cc94afa6eab3e92f01f1a43bf943ff0fc9632aac79d7d3e978
          • Instruction Fuzzy Hash: 6F21A6B1A442157FEB106B648C49FAB77FCEF4F715F000116FA05E2181D770D909CAA4
          APIs
          • Sleep.KERNEL32(00000064), ref: 0283455A
          • timeGetTime.WINMM ref: 0283457B
          • GetCurrentThreadId.KERNEL32 ref: 0283459B
          • InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 028345BD
          • SwitchToThread.KERNEL32 ref: 028345D7
          • SetEvent.KERNEL32(?), ref: 02834620
          • CloseHandle.KERNEL32(?), ref: 02834644
          • send.WS2_32(?,02847440,00000010,00000000), ref: 02834668
          • SetEvent.KERNEL32(?), ref: 02834686
          • InterlockedExchange.KERNEL32(?,00000000), ref: 02834691
          • WSACloseEvent.WS2_32(?), ref: 0283469F
          • shutdown.WS2_32(?,00000001), ref: 028346B3
          • closesocket.WS2_32(?), ref: 028346BD
          • SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 028346F6
          • SetLastError.KERNEL32(000005B4), ref: 0283470A
          • GetCurrentThreadId.KERNEL32 ref: 0284FA44
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: EventThread$CloseCurrentErrorExchangeInterlockedLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
          • String ID:
          • API String ID: 3448239111-0
          • Opcode ID: e40dddbaa3f68841494fabbe69d342f8a57af488784e2ecd5bebe9c1f9850ff7
          • Instruction ID: 7c170b59a647795aa88f5c00a857eee1265250ea8e0f1ab94a5afc8a8c4df32c
          • Opcode Fuzzy Hash: e40dddbaa3f68841494fabbe69d342f8a57af488784e2ecd5bebe9c1f9850ff7
          • Instruction Fuzzy Hash: 5251ED7DA40616ABD726DF24C888BADF7A5FF04709F404525E50AC7A80D778F8A0CBD0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AA6DB
            • Part of subcall function 6D112E95: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D00621D,0000002C,0000000C,6D005702,00000004,6D0057B1,00000214), ref: 6D112EAA
          • memset.VCRUNTIME140(?,00000000,00000208,Select Folder), ref: 6D0AA79B
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000000,00000208,Select Folder), ref: 6D0AA7D6
          • memset.VCRUNTIME140(?,00000000,00000058,?,?,?,?,?,00000000,00000208,Select Folder), ref: 6D0AA7E5
          • GetOpenFileNameW.COMDLG32 ref: 6D0AA897
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000008), ref: 6D0AA8C0
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000008), ref: 6D0AA8C7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0AA945
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0AA8EF, 6D0AA969
          • [Sys_wrapper]dir_select_dialog, path:%s, xrefs: 6D0AA914
          • X, xrefs: 6D0AA849
          • Select Folder, xrefs: 6D0AA77E
          • [Sys_wrapper]dir_select_dialog, GetOpenFileNameW failed, xrefs: 6D0AA980
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@D@std@@Logger@1@U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@std@@memset$?u16to8@common@ierd_tgp@@?u8to16@common@ierd_tgp@@D@2@@4@@D@2@@std@@FileH_prolog3H_prolog3_H_prolog3_catch_NameOpenW@2@@4@@W@2@@std@@malloc
          • String ID: Select Folder$X$[Sys_wrapper]dir_select_dialog, GetOpenFileNameW failed$[Sys_wrapper]dir_select_dialog, path:%s$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 2917205412-840117925
          • Opcode ID: 630f8706007967bc4a824a2b00fc490ece19c813f35913aa1fb851a1ecfbfb8d
          • Instruction ID: 12b2e510ecc745fbcbb42d6eddd0d0821c5a894bdf68f0ac1c19728c879e97e2
          • Opcode Fuzzy Hash: 630f8706007967bc4a824a2b00fc490ece19c813f35913aa1fb851a1ecfbfb8d
          • Instruction Fuzzy Hash: 6681587094925DABEB20CFA5CC88BDEB7B4BF15308F6041E9D118AB291DB749B84CF51
          APIs
          • ?stamp_point@@YAXPBD@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(sys_begin), ref: 6D01789E
            • Part of subcall function 6D09A212: GetCurrentThread.KERNEL32 ref: 6D09A223
            • Part of subcall function 6D09A212: SetThreadAffinityMask.KERNEL32(00000000), ref: 6D09A22A
            • Part of subcall function 6D09A212: QueryPerformanceCounter.KERNEL32(?,?,?,?,6D048462,init plugin end:), ref: 6D09A236
            • Part of subcall function 6D09A212: GetCurrentThread.KERNEL32 ref: 6D09A23D
            • Part of subcall function 6D09A212: SetThreadAffinityMask.KERNEL32(00000000), ref: 6D09A244
            • Part of subcall function 6D09A212: strncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000050,?,000000FF,?,?,?,6D048462,init plugin end:), ref: 6D09A261
          • QueryPerformanceFrequency.KERNEL32(6D3885D0), ref: 6D0178B6
          • QueryPerformanceCounter.KERNEL32(?), ref: 6D0178C1
          • TranslateMessage.USER32(?), ref: 6D0178D8
          • DispatchMessageW.USER32(?), ref: 6D0178E2
          • ?exit_app@Application@common@ierd_tgp@@QAEXH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(0000012C), ref: 6D0178F9
          • QueryPerformanceCounter.KERNEL32(?), ref: 6D017902
          • __aulldiv.LIBCMT ref: 6D017980
          • PeekMessageA.USER32(?,00000000,00000113,00000113,00000000), ref: 6D01799D
          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 6D0179BC
          • ?stamp_point@@YAXPBD@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(sys_end), ref: 6D0179CF
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: MessagePerformanceQueryThread$Counter$?stamp_point@@AffinityCurrentMaskPeek$?exit_app@Application@common@ierd_tgp@@DispatchFrequencyTranslate__aulldivstrncpy_s
          • String ID: sys_begin$sys_end
          • API String ID: 1457437935-3668967762
          • Opcode ID: cea18f24c5769c92ef0db65aef6ffafc295d3a6c3b36aa05399cb4ab1d8fdaf0
          • Instruction ID: cee9055b1bda03cd56671ab169468fd43b817e8176e8f3cdabc68b670ee11c46
          • Opcode Fuzzy Hash: cea18f24c5769c92ef0db65aef6ffafc295d3a6c3b36aa05399cb4ab1d8fdaf0
          • Instruction Fuzzy Hash: A7312C71D44209AFEF45DFE4D999BAF77BDEB8B30AB104526E901A7244EB309909CB10
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D043C66
          • ?gen_seq_num@@YAGXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000090,6D041783,?,?,?,?,?,?,?,?,?,00000004), ref: 6D043C8C
            • Part of subcall function 6D042BF6: __EH_prolog3.LIBCMT ref: 6D042BFD
            • Part of subcall function 6D040AFA: __EH_prolog3.LIBCMT ref: 6D040B01
          • GetTickCount.KERNEL32 ref: 6D043DAD
          • _Copy_construct_from.LIBCPMT ref: 6D043DD2
          • GetTickCount.KERNEL32 ref: 6D043DEE
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D043DFA
          • _Copy_construct_from.LIBCPMT ref: 6D043E84
          • _Copy_construct_from.LIBCPMT ref: 6D043ECD
          • ?PostMainThreadTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@V?$shared_ptr@X@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D043F36
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\comm_center.cpp, xrefs: 6D043E1C
          • send_broadcast post_msg_cpp_func to cpp:%s, execute_time:%u, xrefs: 6D043E36
          • 2, xrefs: 6D043E52
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Copy_construct_fromH_prolog3$CountTick$?gen_seq_num@@?get_log_instance@base@@H_prolog3_H_prolog3_catch_Logger@1@MainPostTask@common@ierd_tgp@@ThreadV?$function@$$V?$shared_ptr@X@4@@Z@std@@
          • String ID: 2$d:\ci_dev\wegame_client\codes\common\src\comm_center.cpp$send_broadcast post_msg_cpp_func to cpp:%s, execute_time:%u
          • API String ID: 3135766933-516385757
          • Opcode ID: ca14447e422a2741c820228c41bb0e1463ac0414b99540b1d365ca0299192607
          • Instruction ID: 1950bcb42b453a068f276364d0d96a3086f44a5d3ccd532b464348b54de69bc5
          • Opcode Fuzzy Hash: ca14447e422a2741c820228c41bb0e1463ac0414b99540b1d365ca0299192607
          • Instruction Fuzzy Hash: 8CA18070D05249EFEF14CFA9C984BEDBBB4BF09308F5081ADD449A7282DB749A85CB51
          APIs
          • calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,0000013C,?,000003FF,00000000,?,6D082AAD,?,00000000,?,00001F40,?,000003FF,?,00000000,00000400), ref: 6CFF2B5B
          • __snprintf_s.LIBCMT ref: 6CFF2B80
          • _time32.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 6CFF2B95
          • srand.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000), ref: 6CFF2B9B
          • rand.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000), ref: 6CFF2BA0
          • __snprintf_s.LIBCMT ref: 6CFF2BD8
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: __snprintf_s$_time32callocrandsrand
          • String ID: calloc err$tqos_create_protohandle err$tqos_find_connd_by_ip fail$tqos_get_qosconnd_iplist fail
          • API String ID: 2558427060-1278875725
          • Opcode ID: 555395b217de548da9ffa2e0cfc68128b89f236729e991c39a65b55294893e4b
          • Instruction ID: 8c8fca54574f1c60566c5406c931eaa56977bca87202efd6e020c047ab27cf27
          • Opcode Fuzzy Hash: 555395b217de548da9ffa2e0cfc68128b89f236729e991c39a65b55294893e4b
          • Instruction Fuzzy Hash: 3A5158B68083415BC200DF249C44AAF77A4EF84238F184B6DE57997791EB33E50B87A2
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07B7BA
          • ?get_proxy_config@net@ierd_tgp@@YA_NPAUproxy_config_t@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3,?,?,0000009C), ref: 6D07B7FF
            • Part of subcall function 6D07B4B5: __EH_prolog3_GS.LIBCMT ref: 6D07B4BC
            • Part of subcall function 6D07B4B5: SetLastError.KERNEL32(00000057,0000005C,6D07B804,?,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3), ref: 6D07B4CA
          • WinHttpOpen.WINHTTP(ProxyResolver/1.0,00000000,00000000,00000000,00000000,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?), ref: 6D07B8B3
          • WinHttpGetProxyForUrl.WINHTTP(00000000,?,?,?), ref: 6D07B8F9
          • GetLastError.KERNEL32 ref: 6D07B8FF
          • WinHttpGetProxyForUrl.WINHTTP(00000000,?,?,?), ref: 6D07B92D
          • WinHttpCloseHandle.WINHTTP(00000000), ref: 6D07B94D
          • GlobalFree.KERNEL32(00000000), ref: 6D07B9A6
            • Part of subcall function 6D07D81D: __EH_prolog3_GS.LIBCMT ref: 6D07D824
            • Part of subcall function 6D07D81D: wcsstr.VCRUNTIME140(?,://,00000024,6D07B8D2,?,00000000), ref: 6D07D83D
          • GlobalFree.KERNEL32(00000000), ref: 6D07B995
            • Part of subcall function 6D07BC07: __EH_prolog3_GS.LIBCMT ref: 6D07BC0E
          • WinHttpCloseHandle.WINHTTP(00000000), ref: 6D07B934
            • Part of subcall function 6D07B293: __EH_prolog3_GS.LIBCMT ref: 6D07B29A
          • SetLastError.KERNEL32(00000057,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3,?,?,0000009C), ref: 6D07BA2D
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_Http$ErrorLast$CloseFreeGlobalHandleProxy$?get_proxy_config@net@ierd_tgp@@OpenUproxy_config_t@12@@wcsstr
          • String ID: ProxyResolver/1.0
          • API String ID: 3254446666-1699298500
          • Opcode ID: 4df6686d630b7516362ec44f062c1e96b8cad0e0cc95d56efd000a368f6d1df6
          • Instruction ID: e7a28a6527fd8a9036b7787cb48c0aba77e8c52d7c74b01b6df8c53c5f91b27b
          • Opcode Fuzzy Hash: 4df6686d630b7516362ec44f062c1e96b8cad0e0cc95d56efd000a368f6d1df6
          • Instruction Fuzzy Hash: 16717F71C09258EEEF21DBA4C854BEEBBB8BF19304F54409AD145BB140DB709B89CF66
          APIs
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,23C35E98,?,?,?,?,6D272B9A,000000FF), ref: 6D04A164
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,23C35E98,?,?,?,?,6D272B9A,000000FF), ref: 6D04A190
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,6D272B9A,000000FF), ref: 6D04A19D
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\crc_helper.cpp,00000040,6D31E62F,?,?,?,?,6D272B9A,000000FF), ref: 6D04A1D7
          • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,?,?,6D272B9A,000000FF), ref: 6D04A234
          • ReadFile.KERNEL32(00000000,?,00010000,?,00000000,?,?,?,?,6D272B9A,000000FF), ref: 6D04A26D
          • ?cal_crc@common@ierd_tgp@@YAIIPAEI@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,?,?,?,?,6D272B9A,000000FF), ref: 6D04A28E
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,6D272B9A,000000FF), ref: 6D04A2B4
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\crc_helper.cpp,0000004F,6D31E62F,?,?,?,?,6D272B9A,000000FF), ref: 6D04A2EE
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\crc_helper.cpp, xrefs: 6D04A1BE, 6D04A2D5
          • [crc_helper] read %s failed, error_code=%u, xrefs: 6D04A2FE
          • [crc_helper] open %s failed, error_code=%u, xrefs: 6D04A1E7
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: File$?get_log_instance@base@@ErrorLastLogger@1@$?cal_crc@common@ierd_tgp@@?u8to16@common@ierd_tgp@@CreateD@2@@std@@D@std@@H_prolog3H_prolog3_ReadSizeU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@4@@W@std@@
          • String ID: [crc_helper] open %s failed, error_code=%u$[crc_helper] read %s failed, error_code=%u$d:\ci_dev\wegame_client\codes\common\src\crc_helper.cpp
          • API String ID: 1463018629-2195461796
          • Opcode ID: d60fffed9cda1fb512d36a85189076bc6e20ef3ba8f262ba749f80548459c8a1
          • Instruction ID: a4b94fd88257c3763eebf8276b37078037336230cec746cf96cbdbf6c27b9a08
          • Opcode Fuzzy Hash: d60fffed9cda1fb512d36a85189076bc6e20ef3ba8f262ba749f80548459c8a1
          • Instruction Fuzzy Hash: 6B61B670944218EFEB22CB64CC44FEEB3B4AF49319F1140A9E599A7180DBB4A7C8DF50
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0B7A4C
          • ?GetInstance@InfoTraceSystem@trace_system@ierd_tgp@@SAAAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(0000013C), ref: 6D0B7A69
          • _time32.API-MS-WIN-CRT-TIME-L1-1-0(00000000,0000013C), ref: 6D0B7A72
          • ?GetTraceIdByType@InfoTraceSystem@trace_system@ierd_tgp@@QAEII@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0B7A87
          • ?GetUIN@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0B7A9A
          • ?GetTraceInstanceID@InfoTraceSystem@trace_system@ierd_tgp@@QAE_K_KII@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,00000000,?), ref: 6D0B7AAA
            • Part of subcall function 6D0B63C1: __EH_prolog3.LIBCMT ref: 6D0B63C8
          • ?GetUIN@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0B7B02
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?TraceInfo@InfoTraceSystem@trace_system@ierd_tgp@@QAE_N_KABUTraceInformation@23@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000002,?,?,?,?,00000000,?,?,session_id,?,?,config,?), ref: 6D0B7CBD
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Trace$InfoSystem@trace_system@ierd_tgp@@$H_prolog3H_prolog3_Info@Information@23@@InstanceInstance@Type@V123@_time32memmove
          • String ID: config$session_id$tgp_trace_task$type
          • API String ID: 2145509307-89081585
          • Opcode ID: 338adcde672afc1bb1f1b112b53190006766d5aa5c05fc0ad784cca0b2957066
          • Instruction ID: 9b2d0503436bd8d6d387c64be071682cb1126ae1d95fde939673b7642a10005e
          • Opcode Fuzzy Hash: 338adcde672afc1bb1f1b112b53190006766d5aa5c05fc0ad784cca0b2957066
          • Instruction Fuzzy Hash: DE713431D04228AAEF15CFA4C994BEDBBB4AF18308F044099E559A72A0EB745F89CF51
          APIs
          • socket.WS2_32(00000002,00000002,00000011), ref: 02833710
          • WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 02833749
          • setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 02833766
          • setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 02833779
          • WSACreateEvent.WS2_32 ref: 0283377B
          • lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,0284D990), ref: 0283378D
          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,0284D990), ref: 02833799
          • lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,0284D990), ref: 028337B8
          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,0284D990), ref: 028337C4
          • gethostbyname.WS2_32(00000000), ref: 028337D2
          • htons.WS2_32(?), ref: 028337F8
          • WSAEventSelect.WS2_32(?,?,00000030), ref: 02833816
          • connect.WS2_32(?,?,00000010), ref: 0283382B
          • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,0284D990), ref: 0283383A
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
          • String ID:
          • API String ID: 1455939504-0
          • Opcode ID: 4f9bd0849874495b48d126224c57a875eeaf6d125d72720b9c2ad8de9d6eae59
          • Instruction ID: 9db0c2cee020bb1e85c18b51c30ed310a15edfb3e965de3628b6abbe6894b622
          • Opcode Fuzzy Hash: 4f9bd0849874495b48d126224c57a875eeaf6d125d72720b9c2ad8de9d6eae59
          • Instruction Fuzzy Hash: 03415EBDA40204ABE720DBA4DC89F7FB7B8EB58710F504919FA15D72C0D774A904CBA5
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04FB19
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04FB35
          • ?get_cpu_id@common@ierd_tgp@@YA_NPA_K@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D04FBA1
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04FBAB
          • ?get_qm_report_guid@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?), ref: 6D04FC33
          • ?Init@md5@@QAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04FC8A
          • ?Update@md5@@QAEXPAEI@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04FCBC
          • ?Finalize@md5@@QAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04FCC7
          • ?PrintMD5Ex@@YAXQAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D04FCD4
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • get_db_encrypt_key,cpu_id: %llu, xrefs: 6D04FBF2
          • get_db_encrypt_key,wegame_id_str:%s, xrefs: 6D04FB7B
          • d:\ci_dev\wegame_client\codes\common\src\encrypt_wrapper.cpp, xrefs: 6D04FB56, 6D04FBCC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@D@std@@Logger@1@U?$char_traits@V?$allocator@V?$basic_string@$?get_cpu_id@common@ierd_tgp@@?get_qm_report_guid@common@ierd_tgp@@D@2@@std@@D@2@@std@@@Ex@@Finalize@md5@@H_prolog3H_prolog3_Init@md5@@PrintUpdate@md5@@
          • String ID: d:\ci_dev\wegame_client\codes\common\src\encrypt_wrapper.cpp$get_db_encrypt_key,cpu_id: %llu$get_db_encrypt_key,wegame_id_str:%s
          • API String ID: 1709066849-882433762
          • Opcode ID: a4813dde36a8c9aa484233b1adcf15a229b90e4e8bdac7d4a472bec62f95ff96
          • Instruction ID: 8737759750d20c0a1bda0aa16211f96a2cbe6c6e893d14bc7d101dbce4b7446c
          • Opcode Fuzzy Hash: a4813dde36a8c9aa484233b1adcf15a229b90e4e8bdac7d4a472bec62f95ff96
          • Instruction Fuzzy Hash: 3551D570805219EBEF20DBA0CD54FED7BB8AF15308F1140D8E604BB282DB759B84CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AE12E
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000068), ref: 6D0AE136
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,00000068), ref: 6D0AE1B7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000068), ref: 6D0AE1C2
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000068), ref: 6D0AE23E
          • ShellExecuteW.SHELL32(00000000,open,EXPLORER,?,00000000,00000001), ref: 6D0AE22D
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • EXPLORER, xrefs: 6D0AE222
          • [Sys_wrapper]Failed to call ShellExecute, ret=%d, xrefs: 6D0AE277
          • [Sys_wrapper]open_file_mgr, path:%s, xrefs: 6D0AE17A
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0AE15C, 6D0AE1EE, 6D0AE262
          • [Sys_wrapper]Failed to convert path for open file mgr, xrefs: 6D0AE202
          • open, xrefs: 6D0AE227
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@ExecuteH_prolog3H_prolog3_ShellU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@4@@W@std@@
          • String ID: EXPLORER$[Sys_wrapper]Failed to call ShellExecute, ret=%d$[Sys_wrapper]Failed to convert path for open file mgr$[Sys_wrapper]open_file_mgr, path:%s$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp$open
          • API String ID: 2199624007-1312911427
          • Opcode ID: b17eaad63d3d92837882c99b593fcb061d2df830cf4597c18aa94b9112d0dae7
          • Instruction ID: ef0feebc87bca7063629cd2f83d0025a577ce760d15c26ec96fa87ee7e08644b
          • Opcode Fuzzy Hash: b17eaad63d3d92837882c99b593fcb061d2df830cf4597c18aa94b9112d0dae7
          • Instruction Fuzzy Hash: A2410171A4420AABFB20DFE4CC54FAE7774AF45718F650118E500BB2C2EB719E45DBA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0BFE3D
          • ?GetUpdatedFilePath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,tcls,teniodl.dll,00000434), ref: 6D0BFE96
          • memset.VCRUNTIME140(?,00000000,00000208,00000000), ref: 6D0BFED6
          • memset.VCRUNTIME140(?,00000000,00000208,?,00000000,00000208,00000000), ref: 6D0BFEE4
          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6D0BFF26
          • GetLongPathNameW.KERNEL32(?,?,00000104), ref: 6D0BFF3B
          • PathRemoveFileSpecW.SHLWAPI(?), ref: 6D0BFF48
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D38A5F8,\tcls\Tenio\TenioDL\TenioDL.dll,?), ref: 6D0BFF7D
          • __Init_thread_footer.LIBCMT ref: 6D0BFFF9
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: File$D@std@@NamePathU?$char_traits@V?$allocator@V?$basic_string@memset$?u16to8@common@ierd_tgp@@D@2@@4@@D@2@@std@@H_prolog3_Init_thread_footerLongModulePath@silence_update@common@ierd_tgp@@RemoveSpecU?$char_traits@_UpdatedV?$allocator@_V?$basic_string@_W@2@@std@@W@std@@
          • String ID: \tcls\Tenio\TenioDL\TenioDL.dll$tcls$teniodl.dll
          • API String ID: 571360966-3993699220
          • Opcode ID: 6bdbdeb570df64ae24c487841db1c2827771e9ae0d13e36503c5214a9ddc7fd4
          • Instruction ID: 0fd005f9147e08239a68288a8c938191b24020d3c4f27aa3ee3c2b173bb54b20
          • Opcode Fuzzy Hash: 6bdbdeb570df64ae24c487841db1c2827771e9ae0d13e36503c5214a9ddc7fd4
          • Instruction Fuzzy Hash: A64161B1908218ABDB20DF54C884FDEB7B8AF46318F5544ADE205A7281CB755B89CF64
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A74B6
          • GetLastError.KERNEL32(00000054), ref: 6D0A74C4
          • ?OpenProcessIdByName@Sys_wrapper@common@ierd_tgp@@SAPAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0A74C7
            • Part of subcall function 6D0A3F97: __EH_prolog3_GS.LIBCMT ref: 6D0A3FA1
            • Part of subcall function 6D0A3F97: memset.VCRUNTIME140(?,00000000,00000208,00000C60), ref: 6D0A3FC4
            • Part of subcall function 6D0A3F97: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000000,00000208,00000C60), ref: 6D0A401D
            • Part of subcall function 6D0A3F97: GetLastError.KERNEL32 ref: 6D0A4029
            • Part of subcall function 6D0A3F97: ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A402F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A74CF
          • TerminateProcess.KERNEL32(00000000,00000000), ref: 6D0A7527
          • GetLastError.KERNEL32 ref: 6D0A7530
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A7534
          • CloseHandle.KERNEL32(00000000), ref: 6D0A7595
          • Sleep.KERNEL32(?), ref: 6D0A759E
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [Sys_wrapper][TerminateProcess]OpenProcessIdByName over, hProcess:%d, xrefs: 6D0A7508
          • [Sys_wrapper][TerminateProcess]ter_result:%d, hProcess:%d, err:%d, xrefs: 6D0A7574
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A74F3, 6D0A7558
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@ErrorLastLogger@1@$D@std@@H_prolog3_ProcessU?$char_traits@V?$allocator@V?$basic_string@$?u8to16@common@ierd_tgp@@CloseD@2@@std@@D@2@@std@@@H_prolog3H_prolog3_catch_HandleName@OpenSleepSys_wrapper@common@ierd_tgp@@TerminateU?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@memset
          • String ID: [Sys_wrapper][TerminateProcess]OpenProcessIdByName over, hProcess:%d$[Sys_wrapper][TerminateProcess]ter_result:%d, hProcess:%d, err:%d$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 3979167991-1212249738
          • Opcode ID: 00e8ae214e53b7d9df427ea9c4610987a0dfb3d9ac13943711007a56cb42031c
          • Instruction ID: f5a46fb7f3ab6ed1299b2d57d0d3b6d205032307d54eb29c73f5c05e32cfb19f
          • Opcode Fuzzy Hash: 00e8ae214e53b7d9df427ea9c4610987a0dfb3d9ac13943711007a56cb42031c
          • Instruction Fuzzy Hash: 3821D130D40305ABFB109BF4CC48FAD37B1AF85719F650104B625BF1C6EBB29A06DA44
          APIs
          • IsWindow.USER32(?), ref: 6D012B85
          • memset.VCRUNTIME140(?,00000000,0000002C,?), ref: 6D012BA7
          • GetModuleHandleA.KERNEL32(00000000,?,?), ref: 6D012BB1
          • GetStockObject.GDI32(00000005), ref: 6D012BC9
          • RegisterClassExA.USER32(00000030), ref: 6D012BDD
          • GetLastError.KERNEL32(?,?), ref: 6D012BEA
          • CreateWindowExA.USER32(?,?,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 6D012C0F
          • IsWindow.USER32(00000000), ref: 6D012C19
          • SetPropA.USER32(?,UtilWndObjt,?), ref: 6D012C2C
          • ShowWindow.USER32(?,00000000,?,?), ref: 6D012C37
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Window$ClassCreateErrorHandleLastModuleObjectPropRegisterShowStockmemset
          • String ID: 0$UtilWndObjt
          • API String ID: 3867323892-1788187670
          • Opcode ID: 94584a715eebdcb5678b9c15153f7bb6108eff09b8c4c9a59810c01f14413a50
          • Instruction ID: ec486c304137d9ff1a7bfac8b3efe418cd03e5b424801cdb5a9e371fe581615c
          • Opcode Fuzzy Hash: 94584a715eebdcb5678b9c15153f7bb6108eff09b8c4c9a59810c01f14413a50
          • Instruction Fuzzy Hash: 07213AB191420AAFEF106FA0CC49FAFBBF8FB0A346F448426F916E1050D7709809CB60
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D09AC63
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(00000000,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA9BB
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D295CA8,00000002,6D29A214,00000001,0000013C), ref: 6D09ACD6
            • Part of subcall function 6D09B318: __EH_prolog3_GS.LIBCMT ref: 6D09B31F
            • Part of subcall function 6CFFA3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6D0062D8,00000000,6D006649,00000003,23C35E98,?,?,00000000,6D266604,000000FF,?,6D005B05,00000000), ref: 6CFFA3E5
            • Part of subcall function 6CFFA8F0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D005839,?,?), ref: 6CFFAA08
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D31E7AC,00000001,?,?,?,?,?,?,?,?,?,6D29A214,00000001), ref: 6D09AD4D
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBBC,6D29BBB8), ref: 6D09ADC5
            • Part of subcall function 6D09B3EC: __EH_prolog3_GS.LIBCMT ref: 6D09B3F3
            • Part of subcall function 6D09B3EC: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000034,6D09ADCA,?,?,?,6D29BBBC,6D29BBB8), ref: 6D09B41D
            • Part of subcall function 6D09B3EC: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000001,?,?,?,00000034,6D09ADCA,?,?,?,6D29BBBC,6D29BBB8), ref: 6D09B43C
            • Part of subcall function 6D09B3EC: ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000001,?,?,?,00000034,6D09ADCA,?,?,?,6D29BBBC,6D29BBB8), ref: 6D09B44A
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBC0,6D29BBB8), ref: 6D09AE32
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBC4,6D29BBB8,?,6D29BBC0,6D29BBB8), ref: 6D09AEA9
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBC8,6D29BBB8,?,6D29BBC4,6D29BBB8,?,6D29BBC0,6D29BBB8), ref: 6D09AF38
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBCC,6D29BBB8,?,6D29BBC8,6D29BBB8,?,6D29BBC4,6D29BBB8,?,6D29BBC0,6D29BBB8), ref: 6D09AFD6
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBD0,6D29BBB8,?,6D29BBCC,6D29BBB8,?,6D29BBC8,6D29BBB8,?,6D29BBC4,6D29BBB8,?,6D29BBC0), ref: 6D09B074
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBD4,6D29BBB8,?,6D29BBD0,6D29BBB8,?,6D29BBCC,6D29BBB8,?,6D29BBC8,6D29BBB8,?,6D29BBC4), ref: 6D09B112
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBD8,6D29BBB8,?,6D29BBD4,6D29BBB8,?,6D29BBD0,6D29BBB8,?,6D29BBCC,6D29BBB8,?,6D29BBC8), ref: 6D09B1B0
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBDC,6D29BBB8,?,6D29BBD8,6D29BBB8,?,6D29BBD4,6D29BBB8,?,6D29BBD0,6D29BBB8,?,6D29BBCC), ref: 6D09B24E
          • ?replace_text@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D29BBE0,6D29BBB8,?,6D29BBDC,6D29BBB8,?,6D29BBD8,6D29BBB8,?,6D29BBD4,6D29BBB8,?,6D29BBD0), ref: 6D09B2EC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?replace_text@common@ierd_tgp@@D@2@@std@@$U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$W@2@@4@1@$H_prolog3_V34@1@$?u16to8@common@ierd_tgp@@D@2@@4@@W@2@@std@@_invalid_parameter_noinfo_noreturnmemmove
          • String ID:
          • API String ID: 1127383377-0
          • Opcode ID: 3962bd7ed1654dc51d67a273cf659890d1f38c7dd12a47512cb9e08a7468265e
          • Instruction ID: dccec5871185fb4e7bb05fc9ea52e6fc2b18f6629e998587bf48b5b3eebdae72
          • Opcode Fuzzy Hash: 3962bd7ed1654dc51d67a273cf659890d1f38c7dd12a47512cb9e08a7468265e
          • Instruction Fuzzy Hash: 1912B4B0C0525CAEEB60CFA4C8807EDFBB4BF15304F5081AAD549A7290EB705B89DF65
          APIs
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E1B4
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E1C0
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E1CD
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E1EF
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E233
          • ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 6D05E245
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E257
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E263
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E26D
          • ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z.MSVCP140(00000000), ref: 6D05E27A
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E28D
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E2BD
          • ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z.MSVCP140(00000002), ref: 6D05E2CF
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$?gptr@?$basic_streambuf@U?$char_traits@_W@std@@@std@@$?pbump@?$basic_streambuf@_$?gbump@?$basic_streambuf@_
          • String ID:
          • API String ID: 3070859240-0
          • Opcode ID: 7db071b8d2a920751c47cdddb21e6ca77603771d0d2d987d599b0e558f07c4d4
          • Instruction ID: 35c97538a2f78236692d4fc37bd75f6e8bdb93cd0b771836c3ba28ca710ca1aa
          • Opcode Fuzzy Hash: 7db071b8d2a920751c47cdddb21e6ca77603771d0d2d987d599b0e558f07c4d4
          • Instruction Fuzzy Hash: 224182316006058FEB088F68CB9C77D7BF1BB86319B05426EED5AD7294DB78D815CB90
          APIs
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F47D
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F489
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F496
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F4B8
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F4FA
          • ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 6D01F50A
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F51C
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F528
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F532
          • ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(00000000), ref: 6D01F53D
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F550
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01F57E
          • ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(00000002), ref: 6D01F58E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$?gptr@?$basic_streambuf@$?pbump@?$basic_streambuf@$?gbump@?$basic_streambuf@
          • String ID:
          • API String ID: 2488814346-0
          • Opcode ID: 0521aaa952975ae8be8253fb516487baf5801fae792f7e9fe208b8ebf90d27e2
          • Instruction ID: 7c48ebc1612fe24f56b2ad939e35c7708719a3a3e607acc2c343caf7cd6090df
          • Opcode Fuzzy Hash: 0521aaa952975ae8be8253fb516487baf5801fae792f7e9fe208b8ebf90d27e2
          • Instruction Fuzzy Hash: F341B7726082018FEB0C8FA8D98CB7D7FE9BF8A329B45425DE916D7290D774D848CB50
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07BFE4
          • GetPrivateProfileStringW.KERNEL32(setting,extra_cmd,6D2911A4,?,?,00000000), ref: 6D07C0B4
          • strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 6D07C118
          • StrStrIA.SHLWAPI(?,--proxy-server,?,?,?,?,?,00000038), ref: 6D07C16E
            • Part of subcall function 6D02B791: __EH_prolog3.LIBCMT ref: 6D02B798
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000003,00000001), ref: 6D07C3F5
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ??1?$basic_ios@D@std@@@std@@H_prolog3H_prolog3_PrivateProfileStringU?$char_traits@strlen
          • String ID: --proxy-auth$--proxy-server$extra_cmd$setting
          • API String ID: 4072278087-1349600155
          • Opcode ID: d4b8b39f66f4dcc65bb9fdef3d1597f1b81964bf78f5c8bbef5156abf7a21d04
          • Instruction ID: 0a308d31550eb4c155332b7920b67b75222fc6346da9fa602ecdcdcb8cebf8d7
          • Opcode Fuzzy Hash: d4b8b39f66f4dcc65bb9fdef3d1597f1b81964bf78f5c8bbef5156abf7a21d04
          • Instruction Fuzzy Hash: DCE17071D08259DFEF25CFA8D844BDDBBB8AF19304F14409ED109AB281DB709A89CF65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D043F88
          • ?gen_seq_num@@YAGXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000090,6D04185C,?,?,?,?,00000001,?,?,?,?,?,00000004), ref: 6D043FB4
            • Part of subcall function 6D042BF6: __EH_prolog3.LIBCMT ref: 6D042BFD
          • GetTickCount.KERNEL32 ref: 6D0440CF
          • GetTickCount.KERNEL32 ref: 6D04411D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04412C
          • GetTickCount.KERNEL32 ref: 6D044198
          • _Copy_construct_from.LIBCPMT ref: 6D0441E4
          • _Copy_construct_from.LIBCPMT ref: 6D04422F
          • ?PostMainThreadTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@V?$shared_ptr@X@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D04428E
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\comm_center.cpp, xrefs: 6D044154
          • post_msg_js_func send_broadcastto js:%s, execute_time:%u, xrefs: 6D044174
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CountTick$Copy_construct_fromH_prolog3$?gen_seq_num@@?get_log_instance@base@@H_prolog3_H_prolog3_catch_Logger@1@MainPostTask@common@ierd_tgp@@ThreadV?$function@$$V?$shared_ptr@X@4@@Z@std@@
          • String ID: post_msg_js_func send_broadcastto js:%s, execute_time:%u$d:\ci_dev\wegame_client\codes\common\src\comm_center.cpp
          • API String ID: 2937546168-1500875528
          • Opcode ID: b0deacbef0dd3e67839035c9ccd150066b15110697f726f50955a53fd5f0c326
          • Instruction ID: 66d8b433da00963f687e15aa54ef539e4411107788fadeaf23e41404131ce88c
          • Opcode Fuzzy Hash: b0deacbef0dd3e67839035c9ccd150066b15110697f726f50955a53fd5f0c326
          • Instruction Fuzzy Hash: F6B17270904249EFEF15CFA8C984BEDBBF4AF09308F1481ADD459A7242DB709A85CF61
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D042D55
          • _Copy_construct_from.LIBCPMT ref: 6D042DC6
          • memset.VCRUNTIME140(?,00000000,00000080), ref: 6D042E80
          • _itoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000080,0000000A,?,00000000,00000080), ref: 6D042E96
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D042EDB
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D042FFD
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$Copy_construct_fromH_prolog3__itoa_smemset
          • String ID: comm_center.on_process_msg$d:\ci_dev\wegame_client\codes\common\src\comm_center.cpp$send_broadcast to js:%d$send_broadcast to lua:%s$sss
          • API String ID: 2982741695-3257472537
          • Opcode ID: 04386f4ffcdadfddbd051d4453889f663495484db783f7b1869658b69a7ff6de
          • Instruction ID: 5f013433ce9ac187d2c569298220021eeb9ae1a2cd33e335fe75b6f3caab34e5
          • Opcode Fuzzy Hash: 04386f4ffcdadfddbd051d4453889f663495484db783f7b1869658b69a7ff6de
          • Instruction Fuzzy Hash: 7691D630A4421AEFFB24DB74C890FED73B5AF05304F1181E8D559AB281DB71AE85CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05A556
            • Part of subcall function 6D05A34B: __EH_prolog3_GS.LIBCMT ref: 6D05A355
            • Part of subcall function 6D05A34B: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000140,6D05A5BC,?,?,?,000000A8,6D05A8E7,?,?,?), ref: 6D05A422
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D05A5C7
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000001), ref: 6D05A63E
          • CreateDirectoryW.KERNEL32(?,00000000), ref: 6D05A654
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D05A65E
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp,00000081,6D31E62F), ref: 6D05A6A3
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D05A73D
          Strings
          • [ExptFileProcesser] Dispose create directory path = %s, failed(%d), xrefs: 6D05A6B6
          • [ExptFileProcesser] Dispose create key fail, id=%u, xrefs: 6D05A77E
          • d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp, xrefs: 6D05A5E8, 6D05A68A, 6D05A761
          • [ExptFileProcesser] Dispose now, key = %s, xrefs: 6D05A60B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$D@std@@H_prolog3_U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@std@@$?u16to8@common@ierd_tgp@@?u8to16@common@ierd_tgp@@CreateD@2@@4@@D@2@@std@@DirectoryErrorH_prolog3H_prolog3_catch_LastW@2@@4@@W@2@@std@@
          • String ID: [ExptFileProcesser] Dispose create directory path = %s, failed(%d)$[ExptFileProcesser] Dispose create key fail, id=%u$[ExptFileProcesser] Dispose now, key = %s$d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp
          • API String ID: 1456112532-392151656
          • Opcode ID: 2d06101a80edeeb943c956b0f03033b8c699a2dcafd3691edc2b4dd6071a6323
          • Instruction ID: ba76ca9995f9c2dada2f41b5557260c9c12a2ca6c2ecd77b6ff5b4977b866e6d
          • Opcode Fuzzy Hash: 2d06101a80edeeb943c956b0f03033b8c699a2dcafd3691edc2b4dd6071a6323
          • Instruction Fuzzy Hash: 6071A071D05209AFEF14CFA4CD44FEEBBB4AF19304F114099E605BB281EB71AA45CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D09FB8E
          • GetFileAttributesW.KERNEL32(?,?,?,?,?,0000006C), ref: 6D09FBD1
          • ?CreateDirectoryRecursively@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,00000000,00000000,6D38A410,?,?,?,?,?,0000006C), ref: 6D09FC23
          • CreateDirectoryW.KERNEL32(?,00000000,6D38A410,?,?,?,?,?,0000006C), ref: 6D09FC4B
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D09FC7B
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp,000007ED,6D31E62F), ref: 6D09FCBD
          Strings
          • [Common][CreateDirectoryRecursively]Could not create directory %s, already exist item with attr %lX, xrefs: 6D09FD59
          • [Common][CreateDirectoryRecursively]Could not create directory %s with last error %lu, xrefs: 6D09FCD0
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D09FCA7, 6D09FD38
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CreateDirectory$?get_log_instance@base@@AttributesErrorFileH_prolog3_LastLogger@1@Recursively@Sys_wrapper@common@ierd_tgp@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@
          • String ID: [Common][CreateDirectoryRecursively]Could not create directory %s with last error %lu$[Common][CreateDirectoryRecursively]Could not create directory %s, already exist item with attr %lX$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 427642240-2450520477
          • Opcode ID: 2eff393d27817e4e1dd0d820848cd08a02686f83cb11b66bbdcb6476df3b4eaa
          • Instruction ID: 64e51b6dd9b466d3deb176b6eb90246b2a2022d45c7f391e088675dca800405a
          • Opcode Fuzzy Hash: 2eff393d27817e4e1dd0d820848cd08a02686f83cb11b66bbdcb6476df3b4eaa
          • Instruction Fuzzy Hash: F75102B0A05205ABFB14DFA4CD58FAE3BBDAF45719F111018E601AF2C1DB74AA05DB61
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D05A9F2
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(000000B0,6D05A705,?,?,?), ref: 6D05AA27
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000003), ref: 6D05AB3C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000003), ref: 6D05AB43
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp,000001F9,6D31E62F), ref: 6D05AB80
          • ?remove@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000005), ref: 6D05ABEF
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • will not, xrefs: 6D05AA89
          • [ExptFileProcesser] DumpDataFiles: Copying %d files to %s, %s delete after copy, xrefs: 6D05AA94
          • d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp, xrefs: 6D05AA4B, 6D05AB67
          • will, xrefs: 6D05AA7D, 6D05AA91
          • [ExptFileProcesser] DumpDataFiles: data_path = %s, failed(%d), xrefs: 6D05AB93
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$?remove@filesystem@ierd_tgp@@?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@ErrorH_prolog3H_prolog3_catch_LastU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_Vpath@12@@W@2@@std@@W@std@@
          • String ID: [ExptFileProcesser] DumpDataFiles: data_path = %s, failed(%d)$[ExptFileProcesser] DumpDataFiles: Copying %d files to %s, %s delete after copy$d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp$will$will not
          • API String ID: 1176421602-3354156754
          • Opcode ID: ca5554bdea2a691f2be46bbfccd37950261e797a5defcc5110796ff579664ef1
          • Instruction ID: 4f9fcdbeeda1fc67a72df1d1b859f082e25e55178ace3c6ce5465a075e939f52
          • Opcode Fuzzy Hash: ca5554bdea2a691f2be46bbfccd37950261e797a5defcc5110796ff579664ef1
          • Instruction Fuzzy Hash: ED61A170D05249EFEF10DFA8C980BEDBBB5AF55304F21809CD5446B281DB35AB49CBA2
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D086215
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000003,00000001,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002,?,00000000,00000001), ref: 6D086267
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,00000003,00000001,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002), ref: 6D0862FE
          • Concurrency::details::platform::__RegisterWaitForSingleObject.LIBCONCRT(?,?,00000001,?,?,00000000,00000003,00000001,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?), ref: 6D086359
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D086376
            • Part of subcall function 6D082903: __EH_prolog3_GS.LIBCMT ref: 6D08290D
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002), ref: 6D082923
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?), ref: 6D082933
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?), ref: 6D082941
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9), ref: 6D08294F
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,00000000,00000003,00000001,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002), ref: 6D086396
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002,?,00000000,00000001,?,0000007C), ref: 6D0863A0
          • Concurrency::details::platform::__RegisterWaitForSingleObject.LIBCONCRT(?,?,00000001,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002,?,00000000), ref: 6D086404
            • Part of subcall function 6D0161B6: ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,23C35E98,?), ref: 6D01620D
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$?get_log_instance@base@@D@std@@@std@@Logger@1@U?$char_traits@$??1?$basic_ios@Concurrency::details::platform::__H_prolog3_ObjectRegisterSingleWait$??1?$basic_iostream@
          • String ID: cannot report qos by http$d:\ci_dev\wegame_client\codes\common\src\qos_command.cpp$handle is invalid, cannot report qos
          • API String ID: 123105886-869807392
          • Opcode ID: 3176fb8498880f5b59df5df085b7845b10d08a97742fce8218b49215048f0eba
          • Instruction ID: e910a538c5745661986c1367d75294a527e2bf22054c6ae88eefabf6f0ee750b
          • Opcode Fuzzy Hash: 3176fb8498880f5b59df5df085b7845b10d08a97742fce8218b49215048f0eba
          • Instruction Fuzzy Hash: 9951C170844606ABFF25DBA4CC55FED7774AF11318F6200A8E255BB1C2EF719A09CB91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05A7D1
          • EnterCriticalSection.KERNEL32(?,00000094,6D05C8B4), ref: 6D05A7F9
          • ResetEvent.KERNEL32(?,?), ref: 6D05A815
          • LeaveCriticalSection.KERNEL32(?), ref: 6D05A820
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D05A838
          • EnterCriticalSection.KERNEL32(?), ref: 6D05A8F1
          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 6D05A949
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?), ref: 6D05A961
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [TraceSystem] trace queue end, xrefs: 6D05A99C
          • [TraceSystem] now start trace queue, size=%u, xrefs: 6D05A886
          • d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp, xrefs: 6D05A85C, 6D05A985
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$?get_log_instance@base@@EnterLeaveLogger@1@$EventH_prolog3H_prolog3_H_prolog3_catch_Reset
          • String ID: [TraceSystem] now start trace queue, size=%u$[TraceSystem] trace queue end$d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp
          • API String ID: 1397785076-4201567289
          • Opcode ID: 8caca5449981553d0ae15c2f8761746102e80fdfe6120793fb3d3e1fe16cbc7f
          • Instruction ID: defa94cc738aa3bf182e62019fc7eec4bb9b7de4c3116aa093f0a20e50a38abc
          • Opcode Fuzzy Hash: 8caca5449981553d0ae15c2f8761746102e80fdfe6120793fb3d3e1fe16cbc7f
          • Instruction Fuzzy Hash: B151CE70C04258EFEF11DBA4CD44BEEBBB4AF45308F254099D508B7282EB745B4ACBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07BD71
          • ?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,cfg_data.ini), ref: 6D07BDDF
          • memset.VCRUNTIME140(?,00000000,00000208), ref: 6D07BE19
          • GetPrivateProfileStringW.KERNEL32(qblink_path,platform_dir,QBBlinkTrial,?,00000104,00000000), ref: 6D07BE5C
          • ?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?), ref: 6D07BF0E
            • Part of subcall function 6D01712B: __EH_prolog3_GS.LIBCMT ref: 6D017132
            • Part of subcall function 6D01712B: ?get_exe_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,00000024), ref: 6D01714F
            • Part of subcall function 6D01712B: ?gen_relative_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000024), ref: 6D017172
            • Part of subcall function 6D07B293: __EH_prolog3_GS.LIBCMT ref: 6D07B29A
            • Part of subcall function 6CFFA3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6D0062D8,00000000,6D006649,00000003,23C35E98,?,?,00000000,6D266604,000000FF,?,6D005B05,00000000), ref: 6CFFA3E5
          • __Init_thread_footer.LIBCMT ref: 6D07BFCE
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$Application@common@ierd_tgp@@D@2@@std@@H_prolog3_$?get_app_sub_path@V45@@$?gen_relative_path@common@ierd_tgp@@?get_exe_path@D@2@@std@@0Init_thread_footerPrivateProfileStringV34@@_invalid_parameter_noinfo_noreturnmemset
          • String ID: QBBlinkTrial$\qb_setting.ini$cfg_data.ini$platform_dir$qblink_path
          • API String ID: 219117645-3432556680
          • Opcode ID: 6c97d327fda17232f52fbe89567adefa929f8f63e5973f63952eebe8c29f8a8e
          • Instruction ID: d335a93bb39fcb46a8596822683cb85cc69cab8cf695dc26198ba2dca5b05bd3
          • Opcode Fuzzy Hash: 6c97d327fda17232f52fbe89567adefa929f8f63e5973f63952eebe8c29f8a8e
          • Instruction Fuzzy Hash: F5514D70C09258EEDF20DFA4CD88BDDB7B8AF15304F5001E9D119AB291DB755B8ACB61
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A6D33
          • RegOpenKeyW.ADVAPI32(?,?,00000000), ref: 6D0A6D61
          • RegCreateKeyW.ADVAPI32(?,?,00000000), ref: 6D0A6D7D
          • GetLastError.KERNEL32 ref: 6D0A6D89
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A6D94
          • RegSetValueExW.ADVAPI32(00000000,?,00000000,00000001,00000008), ref: 6D0A6E1D
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A6E2C
          • RegCloseKey.ADVAPI32(00000000), ref: 6D0A6E90
          Strings
          • [Sys_wrapper]SetRegValue, open reg path failed, path:{}, error:{}, xrefs: 6D0A6DD9
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A6DC0, 6D0A6E50
          • [Sys_wrapper]SetRegValue, set reg value failed, path:{}, value_name:{}, value:{}, error:{}, xrefs: 6D0A6E74
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$CloseCreateErrorH_prolog3_LastOpenValue
          • String ID: [Sys_wrapper]SetRegValue, open reg path failed, path:{}, error:{}$[Sys_wrapper]SetRegValue, set reg value failed, path:{}, value_name:{}, value:{}, error:{}$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 915176676-4197613765
          • Opcode ID: 3479625ad82776ddcddc6a220da414ae70c7fa40e45828dc2a93a6f15c65b5c8
          • Instruction ID: 1164b00aa15de31590176c1d5fe389dcbc6fdc19e0691893646516f2d5a73562
          • Opcode Fuzzy Hash: 3479625ad82776ddcddc6a220da414ae70c7fa40e45828dc2a93a6f15c65b5c8
          • Instruction Fuzzy Hash: 41414870A00709AFEB14CF98CC98BAEB7B6BF85305F504119E515AF281EB71AD05CB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D027BC3
          • CreateFileW.KERNEL32(?,10000000,00000000,00000000,00000004,00000080,00000000,?,?,?,?,?,00000028), ref: 6D027BE7
          • GetLastError.KERNEL32(?,?,?,?,?,00000028), ref: 6D027BF4
          • OutputDebugStringA.KERNEL32(00000000,?,?,?,?,?,00000028), ref: 6D027C22
          • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000028), ref: 6D027C42
          • WriteFile.KERNEL32(00000000,00000001,00000096,?,00000000), ref: 6D027C62
          • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 6D027C82
          • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 6D027C95
          • WriteFile.KERNEL32(00000000,?,0000000C,00000000,00000000), ref: 6D027CA7
          • FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D027CAE
          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D027CB5
          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D027CC0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: File$Write$CriticalSection$BuffersCloseCreateDebugEnterErrorFlushH_prolog3_HandleLastLeaveOutputString
          • String ID:
          • API String ID: 3827868273-0
          • Opcode ID: 6a92498f6daab2e4c5117eb4bce66ced152bf5a0f0d6bf5101c18d6af90616bb
          • Instruction ID: aeb181dc27e67a044f87a44d89a9493ddc50066234d99a2eae4904bb5db3099c
          • Opcode Fuzzy Hash: 6a92498f6daab2e4c5117eb4bce66ced152bf5a0f0d6bf5101c18d6af90616bb
          • Instruction Fuzzy Hash: 833137B1901209BFEB00DFA8CD49FDABBB8FF4A726F404215F211A6590C770A558CFA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07B4BC
          • SetLastError.KERNEL32(00000057,0000005C,6D07B804,?,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3), ref: 6D07B4CA
          • ?load_proxy_settings@client_helper@net@ierd_tgp@@YAXPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000005C,6D07B804,?,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3), ref: 6D07B529
          • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,iesettings,0000005C,6D07B804,?,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?,00000034), ref: 6D07B54A
          • WinHttpGetIEProxyConfigForCurrentUser.WINHTTP(?), ref: 6D07B565
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?load_proxy_settings@client_helper@net@ierd_tgp@@ConfigCurrentD@2@@std@@@D@std@@ErrorH_prolog3_HttpLastProxyU?$char_traits@UserV?$allocator@V?$basic_string@_stricmp
          • String ID: iesettings
          • API String ID: 2019697548-1491860619
          • Opcode ID: befcaa9ff4d9482cee8b689a50fd85f4adf7558ca3484f2a97bc10c517d9c480
          • Instruction ID: 0cad6346d70386d3d5925ff741636038c307bcb68d6231aca4ce3db4a7056c5b
          • Opcode Fuzzy Hash: befcaa9ff4d9482cee8b689a50fd85f4adf7558ca3484f2a97bc10c517d9c480
          • Instruction Fuzzy Hash: B0619D31909349DFEF24CBE8C894BEEBBB8BF55304F54445DC101AB280DB74AA49CB65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0C7FDF
          • ?is_regular_file@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0C800D
            • Part of subcall function 6D07FDA9: __EH_prolog3_GS.LIBCMT ref: 6D07FDB0
            • Part of subcall function 6D07FDA9: ?is_regular_file@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,?,?,00000024,6D07FD90,?,?,?,?,?,?,?,?,0000001C), ref: 6D07FDE4
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0C8041
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C8048
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0C80FC
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0C810B
          • ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?), ref: 6D0C8123
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?), ref: 6D0C8132
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\xmlconfig.cpp, xrefs: 6D0C8069
          • [E][common::GetXMLDataStr]config_file not exists, path=%s, xrefs: 6D0C808E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$H_prolog3_W@2@@std@@$?wstring@path@filesystem@ierd_tgp@@V123@$?filename@path@filesystem@ierd_tgp@@?get_log_instance@base@@?is_regular_file@common@ierd_tgp@@?is_regular_file@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@H_prolog3H_prolog3_catch_Logger@1@U?$char_traits@V?$allocator@V?$basic_string@Verror_code@std@@@Vpath@12@W@2@@std@@@
          • String ID: [E][common::GetXMLDataStr]config_file not exists, path=%s$d:\ci_dev\wegame_client\codes\common\src\xmlconfig.cpp
          • API String ID: 1371752973-3796669117
          • Opcode ID: a8b04e2ce099e8c68b1c5f04401617b6bc0be4ef02b8e9002ffb3be1932e1263
          • Instruction ID: 14db8cb6adb43ca1ccd88ee65050058ac77b52f6e81005811105bec8dd890f16
          • Opcode Fuzzy Hash: a8b04e2ce099e8c68b1c5f04401617b6bc0be4ef02b8e9002ffb3be1932e1263
          • Instruction Fuzzy Hash: F2617B70808258EFEF24DFA4C854BDDBBB5AF25308F504098D245B7291DB749B89CFA2
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0523CD
          • CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000,?,00000090,6D0525AA,00000000,?,00000000), ref: 6D052415
          • CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000,00000000), ref: 6D052460
          • GetFileInformationByHandle.KERNEL32(?,?), ref: 6D052495
          • GetLastError.KERNEL32 ref: 6D05249F
          • GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6D0524CF
          • GetLastError.KERNEL32 ref: 6D0524D9
          • CloseHandle.KERNEL32(?), ref: 6D052574
          • CloseHandle.KERNEL32(00000000), ref: 6D052580
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: FileHandle$CloseCreateErrorInformationLast$H_prolog3_
          • String ID: ierd_tgp::filesystem::equivalent
          • API String ID: 633139043-749776550
          • Opcode ID: 43aed7c61d04c0768b7a0a3a11606f57e005f1ffc6efdb2feb914e5c8d9cd685
          • Instruction ID: 42446ea68ad7ea672baa612c197e0e5c108f4aa043746441693bcffcc25896d3
          • Opcode Fuzzy Hash: 43aed7c61d04c0768b7a0a3a11606f57e005f1ffc6efdb2feb914e5c8d9cd685
          • Instruction Fuzzy Hash: C7516F71A04108AFFF20DBB8CD94BAE77B9AF06329F500154E91AE7181D770AA59CF60
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D0ABC81
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000094), ref: 6D0ABC9D
          • ?get_largest_free_driver_hd_wmi@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000094), ref: 6D0ABCFA
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000094), ref: 6D0ABD04
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,00000094), ref: 6D0ABD71
          • ?get_largest_free_driver_hd_api@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,00000094), ref: 6D0ABDCF
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [Sys_wrapper]get_largest_free_driver_hd_wmi returned %s, xrefs: 6D0ABD48
          • [Sys_wrapper]get_largest_free_driver_hd, xrefs: 6D0ABCD5
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0ABCC3, 6D0ABD27, 6D0ABD95
          • [Sys_wrapper]get_largest_free_driver_hd_wmi returned empty, try api version, xrefs: 6D0ABDA9
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$D@2@@std@@D@std@@H_prolog3_catch_Sys_wrapper@common@ierd_tgp@@U?$char_traits@V?$allocator@V?$basic_string@$?get_largest_free_driver_hd_api@?get_largest_free_driver_hd_wmi@H_prolog3
          • String ID: [Sys_wrapper]get_largest_free_driver_hd$[Sys_wrapper]get_largest_free_driver_hd_wmi returned %s$[Sys_wrapper]get_largest_free_driver_hd_wmi returned empty, try api version$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 2434815536-3985311550
          • Opcode ID: d869133692d7cd6da4dda8c5714c7b5fb260feb1260fc5390af429646f6b2b82
          • Instruction ID: c0458c2c0a74d1523c23d4e01cdd4e21b0205c08e63ee6e371d1d42f57f3a9dd
          • Opcode Fuzzy Hash: d869133692d7cd6da4dda8c5714c7b5fb260feb1260fc5390af429646f6b2b82
          • Instruction Fuzzy Hash: D941E371D08209EBFB10DBF8CC50FED7BB5AF45208F654058E215B7282EB719A06CB51
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0C7D71
          • ?is_regular_file@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000000E0), ref: 6D0C7D86
            • Part of subcall function 6D07FDA9: __EH_prolog3_GS.LIBCMT ref: 6D07FDB0
            • Part of subcall function 6D07FDA9: ?is_regular_file@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,?,?,00000024,6D07FD90,?,?,?,?,?,?,?,?,0000001C), ref: 6D07FDE4
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,000000E0), ref: 6D0C7DB1
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,000000E0), ref: 6D0C7DB8
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,000000E0), ref: 6D0C7E4A
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,000000E0), ref: 6D0C7E59
          • ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,000000E0), ref: 6D0C7E71
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,000000E0), ref: 6D0C7E80
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\xmlconfig.cpp, xrefs: 6D0C7DD9
          • [E][common::GetXMLDataInt]config_file not exists, path=%s, xrefs: 6D0C7DFC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$H_prolog3_W@2@@std@@$?wstring@path@filesystem@ierd_tgp@@V123@$?filename@path@filesystem@ierd_tgp@@?get_log_instance@base@@?is_regular_file@common@ierd_tgp@@?is_regular_file@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@H_prolog3H_prolog3_catch_Logger@1@U?$char_traits@V?$allocator@V?$basic_string@Verror_code@std@@@Vpath@12@W@2@@std@@@
          • String ID: [E][common::GetXMLDataInt]config_file not exists, path=%s$d:\ci_dev\wegame_client\codes\common\src\xmlconfig.cpp
          • API String ID: 1371752973-3771848454
          • Opcode ID: 1d96adf272980d64242ad232cf755261a3dd36329e3039600e6225b03ab43a59
          • Instruction ID: a10f82c0629a133f720ab482899711337ee8d7850ecde6e3a7a7ae39dff82e59
          • Opcode Fuzzy Hash: 1d96adf272980d64242ad232cf755261a3dd36329e3039600e6225b03ab43a59
          • Instruction Fuzzy Hash: F6517671C08249EBEF14DFE4C894BEDBBB5AF29308F55459CD601B7181DB309A49CBA2
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A61F8
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000074,6D071C8C,?,?,?,?,?,?,?,?,?,0000001C), ref: 6D0A6200
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000074,6D071C8C,?,?,?,?,?,?,?,?,?,0000001C), ref: 6D0A628A
          • CoInitializeEx.OLE32(00000000,00000002,00000074,6D071C8C,?,?,?,?,?,?,?,?,?,0000001C), ref: 6D0A6294
          • CoCreateInstance.OLE32(6D2AC580,00000000,00000001,6D2AC590,?,?,?,?,?,?,0000001C), ref: 6D0A62AB
          • memset.VCRUNTIME140(?,00000000,00000008,?,?,?,?,?,0000001C), ref: 6D0A62C3
          • CoUninitialize.OLE32 ref: 6D0A630C
          • CoUninitialize.OLE32(?,?,?,?,?,0000001C), ref: 6D0A6319
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A6226
          • [Sys_wrapper]SetDesktopWallpaper, pic_path: %s, style: %d, xrefs: 6D0A6248
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Uninitialize$?get_log_instance@base@@?u8to16@common@ierd_tgp@@CreateD@2@@std@@D@std@@H_prolog3H_prolog3_InitializeInstanceLogger@1@U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@4@@W@std@@memset
          • String ID: [Sys_wrapper]SetDesktopWallpaper, pic_path: %s, style: %d$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 1398519230-1089274075
          • Opcode ID: a3ecfd418b5983b089b70a7668546dacee29f2fd52b9835faa8acb1f17150030
          • Instruction ID: ed73f2095d54da588780554f7fceb45b31f89d9abeeb8b0cd2874e114e8d88c0
          • Opcode Fuzzy Hash: a3ecfd418b5983b089b70a7668546dacee29f2fd52b9835faa8acb1f17150030
          • Instruction Fuzzy Hash: 3241B471904209EFEB14CFA8C884EAEB7B8FF45714F64411DE505BB291DB709D45CBA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07E7D7
          • ?instance@Application@common@ierd_tgp@@SAPAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000264), ref: 6D07E7EF
          • ?to_string@version_t@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D07E80D
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?instance@?to_string@version_t@common@ierd_tgp@@Application@common@ierd_tgp@@D@2@@std@@D@std@@H_prolog3_U?$char_traits@V123@V?$allocator@V?$basic_string@
          • String ID: 9.9.9.999$pub_server_url_1$tconndserver
          • API String ID: 2835482490-2782576151
          • Opcode ID: 3943d468238c4f43ce16a85630bfea20eb90ec3aed8979b07dec628a7b62401f
          • Instruction ID: a79d21245e5c09c1e22d9301718f22536cf857c12b56b1ce7f7c56728a693181
          • Opcode Fuzzy Hash: 3943d468238c4f43ce16a85630bfea20eb90ec3aed8979b07dec628a7b62401f
          • Instruction Fuzzy Hash: 66418770909219EEEF24DFA4C898BEDB7B8BF0A308F4041D99149EB191DB715B85CF21
          APIs
          • EnterCriticalSection.KERNEL32(?), ref: 6D01347D
          • IsWindow.USER32(?), ref: 6D0134A3
          • ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69([SimpleIPC]Write peer item: %d.,?), ref: 6D0134C0
          • ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69([SimpleIPC]Erase item, window is destroyed: %d.,?), ref: 6D0134DE
          • LeaveCriticalSection.KERNEL32(?), ref: 6D013501
          • GetCurrentProcessId.KERNEL32 ref: 6D01351B
          • ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69([SimpleIPC]Write self information: %d.,?), ref: 6D01352C
          Strings
          • [SimpleIPC]Erase item, window is destroyed: %d., xrefs: 6D0134D9
          • [SimpleIPC]Write peer item: %d., xrefs: 6D0134BB
          • [SimpleIPC]Write self information: %d., xrefs: 6D013527
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?shutdown@Application@common@ierd_tgp@@$CriticalSection$CurrentEnterLeaveProcessWindow
          • String ID: [SimpleIPC]Erase item, window is destroyed: %d.$[SimpleIPC]Write peer item: %d.$[SimpleIPC]Write self information: %d.
          • API String ID: 871422781-3721007710
          • Opcode ID: de97d14db1113538e64684ec48da961ea7a9c55bf679fb54ca6abe8131c0465e
          • Instruction ID: 445c36f7b93f9280010aa1b163f74c36e61499e26425de334ac2bbc96013bf4d
          • Opcode Fuzzy Hash: de97d14db1113538e64684ec48da961ea7a9c55bf679fb54ca6abe8131c0465e
          • Instruction Fuzzy Hash: 9531583290831AEFEF10DF99D844A9ABBF8FF49325B00806AE959A7250D734F944CF50
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05BF32
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,expt,?,?,?,?,?,?,?,?,?,?,6D05C8DB), ref: 6D05BF70
            • Part of subcall function 6D01712B: __EH_prolog3_GS.LIBCMT ref: 6D017132
            • Part of subcall function 6D01712B: ?get_exe_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,00000024), ref: 6D01714F
            • Part of subcall function 6D01712B: ?gen_relative_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000024), ref: 6D017172
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D05BF80
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000), ref: 6D05BF9F
          • CreateDirectoryW.KERNEL32(?,00000000), ref: 6D05BFB7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D05BFC1
          • GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp,000000C6,6D31E62F), ref: 6D05BFFE
          Strings
          • expt, xrefs: 6D05BF59
          • d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp, xrefs: 6D05BFE5
          • [ExptFileProcesser] GetBasePath create directory failed(%d), xrefs: 6D05C005
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@H_prolog3_$Application@common@ierd_tgp@@$?gen_relative_path@common@ierd_tgp@@?get_app_sub_path@?get_exe_path@?get_log_instance@base@@?u8to16@common@ierd_tgp@@CreateD@2@@std@@0DirectoryErrorLastLogger@1@U?$char_traits@_V34@@V45@@V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@_waccessmemmove
          • String ID: [ExptFileProcesser] GetBasePath create directory failed(%d)$d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp$expt
          • API String ID: 364609222-2129707247
          • Opcode ID: dc92c25b196d44ebca7d2e67be616128edb3e87b69a0aae7d2a6e4533e959367
          • Instruction ID: 95895bce85b88ab908432793bf40a8af9bd288f83de15e3c374807b1653aba7a
          • Opcode Fuzzy Hash: dc92c25b196d44ebca7d2e67be616128edb3e87b69a0aae7d2a6e4533e959367
          • Instruction Fuzzy Hash: C7210670905205ABEB10DFA8CD89BAD77B4EF45328F30025CE510AB2C1EB329A45CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A35A5
          • LoadLibraryW.KERNEL32(ntdll.dll,00000164,6D0A36B7), ref: 6D0A35AF
          • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 6D0A35C5
          • FreeLibrary.KERNEL32(00000000), ref: 6D0A35F0
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A35FA
          • FreeLibrary.KERNEL32(00000000), ref: 6D0A365B
          Strings
          • RtlGetVersion, xrefs: 6D0A35BF
          • [sys_wrapper]IsWin10:major_ver=%d,minor_ver=%d, xrefs: 6D0A363E
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A361E
          • ntdll.dll, xrefs: 6D0A35AA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Library$Free$?get_log_instance@base@@AddressH_prolog3_LoadLogger@1@Proc
          • String ID: RtlGetVersion$[sys_wrapper]IsWin10:major_ver=%d,minor_ver=%d$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp$ntdll.dll
          • API String ID: 99050234-3505789096
          • Opcode ID: 3178e754aca1abbf07a66b865adcd46d119505133d0a584dda37888b27e8b7b1
          • Instruction ID: 70fd69370f348a4d4a960fabac5650ef7c5e74fa568cfd36e19ce6bc346d1bf1
          • Opcode Fuzzy Hash: 3178e754aca1abbf07a66b865adcd46d119505133d0a584dda37888b27e8b7b1
          • Instruction Fuzzy Hash: E5110630844206ABEF259BE4CC09FEE73B06F4A70AF518198E516BB281DF729606DE54
          APIs
          • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,6719FE63), ref: 02835A65
          • InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 02835B04
          • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02835B42
          • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02835B67
          • InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 02835C5F
          • InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 02835C80
          • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02835B8C
            • Part of subcall function 02831280: __CxxThrowException@8.LIBCMT ref: 02831290
            • Part of subcall function 02831280: DeleteCriticalSection.KERNEL32(00000000,?,02847E78), ref: 028312A1
          • InterlockedExchange.KERNEL32(?,00000000), ref: 02835CF1
          • timeGetTime.WINMM ref: 02835CF7
          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 02835D0B
          • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02835D14
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
          • String ID:
          • API String ID: 1400036169-0
          • Opcode ID: 335635b4715c8be31f983f13ad5816bb2ff2ac230700f6044364d9c1cfcbbd82
          • Instruction ID: 3938949ff12d55531c6ec3a460b78f9e53cbdeaf103f5c2ecc5e2acf70eb5122
          • Opcode Fuzzy Hash: 335635b4715c8be31f983f13ad5816bb2ff2ac230700f6044364d9c1cfcbbd82
          • Instruction Fuzzy Hash: 15A1F5B8A01A4AAFD315DF6AC88479AFBE8FB08304F90462ED11DC7640D774A964CFD1
          APIs
          • __EH_prolog3_catch.LIBCMT ref: 6D0562C0
            • Part of subcall function 6D026C50: __EH_prolog3.LIBCMT ref: 6D026C57
            • Part of subcall function 6D026C50: ?good@ios_base@std@@QBE_NXZ.MSVCP140(00000000,00000004,6D0562DB,00000000,00000030,6D058285,?,00000020), ref: 6D026C75
            • Part of subcall function 6D026C50: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140 ref: 6D026C90
            • Part of subcall function 6D026C50: ?good@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6D026C9D
          • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000030,6D058285,?,00000020), ref: 6D0562F2
            • Part of subcall function 6D05855C: __EH_prolog3.LIBCMT ref: 6D058563
            • Part of subcall function 6D05855C: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000018,6D072A73,?,?,?,?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?), ref: 6D05856E
            • Part of subcall function 6D05855C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?,?,?,?,?,?,?), ref: 6D058585
            • Part of subcall function 6D05855C: std::locale::_Getfacet.LIBCPMT ref: 6D05858F
            • Part of subcall function 6D05855C: ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?), ref: 6D0585A8
            • Part of subcall function 6D05855C: std::_Facet_Register.LIBCPMT ref: 6D0585C0
            • Part of subcall function 6D05855C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?,?,?,?,?,?), ref: 6D0585E3
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 6D056318
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 6D056340
          • ?flags@ios_base@std@@QBEHXZ.MSVCP140 ref: 6D05635E
          • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 6D056394
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(?), ref: 6D0563DA
          • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 6D0563E6
          • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 6D056429
          • ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,00000000,00000030,6D058285,?,00000020), ref: 6D056490
          • ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 6D05649F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?sputc@?$basic_streambuf@_?width@ios_base@std@@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@D@std@@@std@@H_prolog3Lockit@std@@U?$char_traits@W@std@@$??0_??1_?flags@ios_base@std@@?flush@?$basic_ostream@?getloc@ios_base@std@@?setstate@?$basic_ios@?widen@?$ctype@_Bid@locale@std@@Facet_Getcat@?$ctype@_GetfacetH_prolog3_catchRegisterV12@V42@@Vfacet@locale@2@Vlocale@2@std::_std::locale::_
          • String ID:
          • API String ID: 1015832547-0
          • Opcode ID: fce5f0cd6f713c14bc27d2ac8760d8f8b03c5115f117d6dad3744c8b153fc176
          • Instruction ID: b16558d8d4e2f1801c9bb8465701e284f4babea66bfcda87e4d5b5bd8af8eb9c
          • Opcode Fuzzy Hash: fce5f0cd6f713c14bc27d2ac8760d8f8b03c5115f117d6dad3744c8b153fc176
          • Instruction Fuzzy Hash: 85517874E052168FDF14CFA8C594ABEBBF1BF49314BA4812AE916E7380C7309E54CB90
          APIs
          • SetLastError.KERNEL32(0000139F,6719FE63,?,?,?,?,00000000,000000FF,00000000), ref: 02834CC6
          • EnterCriticalSection.KERNEL32(?,6719FE63,?,?,?,?,00000000,000000FF,00000000), ref: 02834CED
          • SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 02834D01
          • LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 02834D08
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CriticalErrorLastSection$EnterLeave
          • String ID:
          • API String ID: 2124651672-0
          • Opcode ID: 50c5fa81f5f8d982498a48f5850fc5f3156c333735d3a598d9ab71155d7b8322
          • Instruction ID: a9a739c125f4b35575296c6a9ba5306d67bc3ea8197b6b6f5feb7207880d227f
          • Opcode Fuzzy Hash: 50c5fa81f5f8d982498a48f5850fc5f3156c333735d3a598d9ab71155d7b8322
          • Instruction Fuzzy Hash: 02518B7EA046049FC711DFA8E585B6AF7F5FB48710F004A2AE50AC7780DB75B810CB91
          APIs
          • SetEvent.KERNEL32(?,?,?,?,6D02D372,23C35E98,?,?,?,6D26CEF7,000000FF), ref: 6D02E2D7
          • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,6D02D372,23C35E98,?,?,?,6D26CEF7,000000FF), ref: 6D02E2F6
          • CloseHandle.KERNEL32(?,?,?,?,6D02D372,23C35E98,?,?,?,6D26CEF7,000000FF), ref: 6D02E2FE
          • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,6D02D372,23C35E98,?,?,?,6D26CEF7,000000FF), ref: 6D02E314
          • CloseHandle.KERNEL32(?,?,?,?,6D02D372,23C35E98,?,?,?,6D26CEF7,000000FF), ref: 6D02E31C
          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D02D372), ref: 6D02E333
          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D02D372), ref: 6D02E341
          • CloseHandle.KERNEL32(00000000), ref: 6D02E34F
          • CloseHandle.KERNEL32(?), ref: 6D02E35D
          • CloseHandle.KERNEL32(00000000), ref: 6D02E36B
          • CloseHandle.KERNEL32(?), ref: 6D02E37D
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CloseHandle$ObjectSingleWait$Event
          • String ID:
          • API String ID: 541887017-0
          • Opcode ID: f3f8116a3721e683678b0572808c1ea9be095fef3ae98a29815731d45550edbc
          • Instruction ID: 24e7d08de3e651974328dd6542f9f05e59eeb3350e941b1ea183d297d32d90e1
          • Opcode Fuzzy Hash: f3f8116a3721e683678b0572808c1ea9be095fef3ae98a29815731d45550edbc
          • Instruction Fuzzy Hash: 0521E070145B459FE7219F36CC88B57F7E9BF51319F01492EE4E6D26A0C7B5A848CE10
          APIs
          • SetLastError.KERNEL32(00000057,23C35E98,?,?,00000000,?,6D278D32,000000FF,?,6D07BB65,?,0000009C,00000000,000000B0,6D07BAB2,?), ref: 6D07AA8E
            • Part of subcall function 6D07D783: __EH_prolog3_GS.LIBCMT ref: 6D07D78A
            • Part of subcall function 6D07B293: __EH_prolog3_GS.LIBCMT ref: 6D07B29A
          • memset.VCRUNTIME140(?,00000000,00000040,?,?,?,?,23C35E98,?,?,00000000,?,6D278D32,000000FF,?,6D07BB65), ref: 6D07A6F9
          • memset.VCRUNTIME140(?,00000000,00000200,?,00000000,00000040,?,?,?,?,23C35E98,?,?,00000000,?,6D278D32), ref: 6D07A70C
          • memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000200,?,00000000,00000040,?,?,?,?,23C35E98,?,?), ref: 6D07A720
          • memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000100,?,00000000,00000200,?,00000000,00000040,?,?,?,?), ref: 6D07A72F
          • memset.VCRUNTIME140(?,00000000,00001000), ref: 6D07A745
          • memset.VCRUNTIME140(?,00000000,0000003C,?,00000000,00001000), ref: 6D07A757
          • WinHttpCrackUrl.WINHTTP ref: 6D07A7F0
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$H_prolog3_$CrackErrorHttpLast
          • String ID:
          • API String ID: 2503125090-3916222277
          • Opcode ID: db86c3bc7485193ae1b430b6f42616faf452b2d169a13a448dd9a33ded4582a3
          • Instruction ID: ca1bdf635e0ebf0f7bb6ff2c87528655e53d943bae2f4792794b36fd7e6f0c90
          • Opcode Fuzzy Hash: db86c3bc7485193ae1b430b6f42616faf452b2d169a13a448dd9a33ded4582a3
          • Instruction Fuzzy Hash: 9DC12E71C09259EADB21CBA4CC44BDEB7B8BF55348F1001DAD109A7290EB749B88CF65
          APIs
          • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6D12404E
          • fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,6D2AEB7C), ref: 6D124067
          • fgets.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00001388,00000000,?,?,?,?,?,?,?,?), ref: 6D1240A9
          • fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,?), ref: 6D124108
          • fgets.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00001388,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6D124133
          • fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D12415E
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: fclosefgets$__acrt_iob_funcfopen
          • String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
          • API String ID: 3969962324-4095489131
          • Opcode ID: f2ee31fe7028ff687285cf748e8943c11750e7e44daf6dc146549b8053347f73
          • Instruction ID: e66d47ae9d0a140f787a43689237b81d31d81183e300098a5ea779441b2ca90d
          • Opcode Fuzzy Hash: f2ee31fe7028ff687285cf748e8943c11750e7e44daf6dc146549b8053347f73
          • Instruction Fuzzy Hash: EA618DB194C3569BD7214F249C017EB3BA46F7A708F090068EE846724BE7E3A9C5C796
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D01FE69
          • htons.WS2_32(00000000), ref: 6D01FEBD
          • inet_addr.WS2_32(?), ref: 6D01FED2
          • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 6D01FEF0
          • WSAGetLastError.WS2_32(?,?,?,?,?,00000124), ref: 6D01FEF8
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000124), ref: 6D01FF18
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000124), ref: 6D020000
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp, xrefs: 6D01FF41, 6D020029
          • [common][Asy_udp] sock(%d) sendto (%s:%d) failed, err=%d, xrefs: 6D01FF63
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$ErrorH_prolog3_Lasthtonsinet_addrsendto
          • String ID: [common][Asy_udp] sock(%d) sendto (%s:%d) failed, err=%d$d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp
          • API String ID: 3567040146-4223501694
          • Opcode ID: bc81f90c26e5d5d7310775a21b355cb36d5eee1a8a505b4842fb6458114a2c7d
          • Instruction ID: 5866b366c3b0be5a2f8ecb2c6a7884966b9e6f2d151f4e358a946809bc1909e1
          • Opcode Fuzzy Hash: bc81f90c26e5d5d7310775a21b355cb36d5eee1a8a505b4842fb6458114a2c7d
          • Instruction Fuzzy Hash: 6F71CE71809209ABFB15DFE4CC64FEE77B8AF09304F114198E656AB2C1EB719E44CB61
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D0ABEB2
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?get_local_drivers_hd@Sys_wrapper@common@ierd_tgp@@SAXAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0ABF04
            • Part of subcall function 6D0ACD9B: __EH_prolog3_GS.LIBCMT ref: 6D0ACDA5
            • Part of subcall function 6D0ACD9B: memset.VCRUNTIME140(?,00000000,00000104,000001D8,6D0AC257,?,6D31E62F,00000000,00000088,6D0ABDD4,?), ref: 6D0ACDBD
            • Part of subcall function 6D0ACD9B: GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 6D0ACDCD
            • Part of subcall function 6D0ACD9B: GetDriveTypeA.KERNEL32(?), ref: 6D0ACDEA
            • Part of subcall function 6D0ACD9B: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0ACE57
          • ?get_free_space@Sys_wrapper@common@ierd_tgp@@SA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,00000018), ref: 6D0ABF4F
          • _CxxThrowException.VCRUNTIME140(?,6D33B60C,there is not any hd driver,00000018), ref: 6D0AC037
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D0AC047
          • ?get_local_drivers_hd@Sys_wrapper@common@ierd_tgp@@SAXAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D31E62F,00000000,00000090,?,6D33B60C,there is not any hd driver,00000018), ref: 6D0AC0A2
          • ?get_free_space@Sys_wrapper@common@ierd_tgp@@SA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,00000018,6D31E62F,00000000,00000090,?,6D33B60C,there is not any hd driver,00000018), ref: 6D0AC10A
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: V?$allocator@$D@std@@U?$char_traits@V?$basic_string@$D@2@@std@@Sys_wrapper@common@ierd_tgp@@$?get_free_space@?get_local_drivers_hd@D@2@@std@@@2@@std@@@DriveH_prolog3_catch_V?$vector@$ExceptionH_prolog3_LogicalStringsThrowTypememmovememsetstrlen
          • String ID: there is not any hd driver
          • API String ID: 1211781480-2535490614
          • Opcode ID: df50543b830e9b5efa50b56c70d667a36aa08a6fb78d57b46e927c039a270b34
          • Instruction ID: a9c426493eb768e7a3e57136e45040e639a1131963953304551e74ee97523436
          • Opcode Fuzzy Hash: df50543b830e9b5efa50b56c70d667a36aa08a6fb78d57b46e927c039a270b34
          • Instruction Fuzzy Hash: 326169B0D0821DDAEB20CFE9C980BEDBBB5BF45304F65815ED018AB242CB705A85DF91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05206A
            • Part of subcall function 6D006B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6D388534,6D006BB1,6D388538,?,6D00A235,00000000,?,00000010), ref: 6D006B81
            • Part of subcall function 6D006B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D006B8D
            • Part of subcall function 6D051DD6: __EH_prolog3_GS.LIBCMT ref: 6D051DE0
            • Part of subcall function 6D051DD6: FindNextFileW.KERNEL32(?,?,00000274,6D05212D,?,-00000028,?,?,?,0000008C,6D00BD5A,?,00000000), ref: 6D051E09
            • Part of subcall function 6D051DD6: GetLastError.KERNEL32(?,00000000), ref: 6D051E13
            • Part of subcall function 6D051DD6: ?dir_itr_close@detail@filesystem@ierd_tgp@@YAXAAPAX@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D051E21
          • ?path@directory_entry@filesystem@ierd_tgp@@QBE?BV023@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D052142
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D052151
          • GetLastError.KERNEL32(?,?), ref: 6D0521C1
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?replace_filename@directory_entry@filesystem@ierd_tgp@@QAEXABVpath@23@Vfile_status@23@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?), ref: 6D0521AA
            • Part of subcall function 6D00F117: ?remove_filename@path@filesystem@ierd_tgp@@QAEAAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,6D0521AF,?,?,?,?,?,?), ref: 6D00F11D
            • Part of subcall function 6D00F117: ??_0path@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,6D0521AF,?,?,?,?,?,?), ref: 6D00F127
          • GetLastError.KERNEL32(?,?), ref: 6D0521F1
          • ??0file_status@filesystem@ierd_tgp@@QAE@W4file_type@12@W4perms@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000000), ref: 6D0521FC
          • _CxxThrowException.VCRUNTIME140(?,6D32BC60,?,?,?,?,ierd_tgp::filesystem::directory_iterator::operator++,00000000,00000000), ref: 6D052238
          Strings
          • ierd_tgp::filesystem::directory_iterator::operator++, xrefs: 6D052201
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ErrorLast$H_prolog3_V123@$??0file_status@filesystem@ierd_tgp@@??_0path@filesystem@ierd_tgp@@?dir_itr_close@detail@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?path@directory_entry@filesystem@ierd_tgp@@?remove_filename@path@filesystem@ierd_tgp@@?replace_filename@directory_entry@filesystem@ierd_tgp@@ExceptionExecute_once@std@@FileFindNextThrowUonce_flag@1@V012@V012@@V023@Vfile_status@23@1@Vpath@23@W4file_type@12@W4perms@12@@memmoveterminate
          • String ID: ierd_tgp::filesystem::directory_iterator::operator++
          • API String ID: 494074189-2224817405
          • Opcode ID: fc5587464e7eda3d16b0f24ec874b7fbf6663deaffcb383715a20d5d5703850e
          • Instruction ID: 8933a3fd35deb2750f8a9a94fa09f7b81b151618411c67a35abb49429c08ba75
          • Opcode Fuzzy Hash: fc5587464e7eda3d16b0f24ec874b7fbf6663deaffcb383715a20d5d5703850e
          • Instruction Fuzzy Hash: 48616DB1D04209DFEB14CFE4C944AEEBBF8BF59314F11416EE505AB240DB30AA45CBA0
          APIs
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(00000001), ref: 6D03A743
            • Part of subcall function 6D0348ED: __EH_prolog3.LIBCMT ref: 6D0348F4
            • Part of subcall function 6D0348ED: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008), ref: 6D034911
            • Part of subcall function 6D0348ED: ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,00000008), ref: 6D034929
          • ?decode_stream@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_istream@DU?$char_traits@D@std@@@4@AAV?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000001), ref: 6D03A659
            • Part of subcall function 6D04F60A: __EH_prolog3_GS.LIBCMT ref: 6D04F614
            • Part of subcall function 6D04F60A: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000002,00000001,000000BC), ref: 6D04F644
            • Part of subcall function 6D04F60A: ?decode_string@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D04F665
            • Part of subcall function 6D04F60A: ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?), ref: 6D04F6AC
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D03A668
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D03A6F5
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D03A710
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D03A750
          Strings
          • [cfg_mgr][cfg_file]decode failed, path:%s, xrefs: 6D03A6AF
          • [cfg_file_model]file not exist, path:%s, xrefs: 6D03A79F
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp, xrefs: 6D03A68C, 6D03A77C
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$??1?$basic_ios@D@std@@V?$allocator@$?get_log_instance@base@@D@2@@4@@D@2@@std@@@std@@@std@@H_prolog3Logger@1@V?$basic_istringstream@V?$basic_streambuf@V?$basic_string@V?$optional@V?$reference_wrapper@$??0?$basic_ios@??0?$basic_istream@??6?$basic_ostream@?decode_stream@common@ierd_tgp@@?decode_string@common@ierd_tgp@@D@std@@@1@@D@std@@@1@_D@std@@@4@H_prolog3_H_prolog3_catch_V01@V?$basic_istream@
          • String ID: [cfg_file_model]file not exist, path:%s$[cfg_mgr][cfg_file]decode failed, path:%s$d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp
          • API String ID: 149814805-1166739837
          • Opcode ID: ddd233ef1d88841b86d506871a5fc6fb99f58132138530feaec6f51d7c2b6c6f
          • Instruction ID: 9486e96d891c88645c4411e3a7c3b5f3e559acc407dbc5aea1362165f08196c4
          • Opcode Fuzzy Hash: ddd233ef1d88841b86d506871a5fc6fb99f58132138530feaec6f51d7c2b6c6f
          • Instruction Fuzzy Hash: AB51C03084525AEEFF18CBA4CC48FEE7774AF16308F560098D2447B181EB71AB48CB62
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0C2010
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C20D2
            • Part of subcall function 6D0539CE: __EH_prolog3_GS.LIBCMT ref: 6D0539D5
            • Part of subcall function 6D0539CE: ?parent_path_end@path@filesystem@ierd_tgp@@ABEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000024,6D052156,?,?), ref: 6D0539E7
          • ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C20E1
            • Part of subcall function 6D0529BB: __EH_prolog3_GS.LIBCMT ref: 6D0529C2
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C20F3
            • Part of subcall function 6D00FACF: __EH_prolog3.LIBCMT ref: 6D00FAD6
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C2150
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C215F
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C216E
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C21B8
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6D34A750,parent node is null), ref: 6D0C21CA
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: V123@$?parent_path@path@filesystem@ierd_tgp@@$?wstring@path@filesystem@ierd_tgp@@H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@$?filename@path@filesystem@ierd_tgp@@?parent_path_end@path@filesystem@ierd_tgp@@H_prolog3memmove
          • String ID: child node not found, node name:$parent node is null$rail_files$tcls
          • API String ID: 1466240017-3856246967
          • Opcode ID: 3e8c54976471eec1fb7dbd2910f24de1f460c561c9ff9fed071d9f034eb13956
          • Instruction ID: 755b32b139eff45d6c4a0f307be0fa88ebd55a42fb3f2a2e9084a41382bba35d
          • Opcode Fuzzy Hash: 3e8c54976471eec1fb7dbd2910f24de1f460c561c9ff9fed071d9f034eb13956
          • Instruction Fuzzy Hash: 26513970809248EEEF14CFE4C994BEDBBB4AF29308F55419DD145B7281DB705B48DB62
          APIs
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • _Copy_construct_from.LIBCPMT ref: 6D016F26
          • ?send_msg@@YAXPBDV?$shared_ptr@Umsg_base@@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,00000064), ref: 6D016F34
            • Part of subcall function 6D04565B: __EH_prolog3_GS.LIBCMT ref: 6D045665
            • Part of subcall function 6D014FB8: __EH_prolog3.LIBCMT ref: 6D014FBF
          • _Copy_construct_from.LIBCPMT ref: 6D016F73
          • ?post_msg@@YAXPBDV?$shared_ptr@Umsg_base@@@std@@_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000000), ref: 6D016F81
          • GetTickCount.KERNEL32 ref: 6D016F99
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D016FA8
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\app.cpp, xrefs: 6D016EBA, 6D016FCC
          • [wegame_quit][step1]exit_app:{}., xrefs: 6D016ED2
          • [wegame_quit][step2]exit_app, will_count_:{}, xrefs: 6D016FEA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Copy_construct_fromH_prolog3V?$shared_ptr@$?get_log_instance@base@@?post_msg@@?send_msg@@CountH_prolog3_Logger@1@TickUmsg_base@@@std@@@Umsg_base@@@std@@_
          • String ID: [wegame_quit][step1]exit_app:{}.$[wegame_quit][step2]exit_app, will_count_:{}$d:\ci_dev\wegame_client\codes\common\src\app.cpp
          • API String ID: 101891664-2733568639
          • Opcode ID: 94684f6c1d7a398283d2d5b6fa17ccc8fe4e946b6f41dac8d7c516ff56413508
          • Instruction ID: c28da6ad4ed025949faca89fbf874ba5d5f3e931bd83f4ded65104d97b0734a2
          • Opcode Fuzzy Hash: 94684f6c1d7a398283d2d5b6fa17ccc8fe4e946b6f41dac8d7c516ff56413508
          • Instruction Fuzzy Hash: F0418B70D09309EFFB09CBE4DD54BAD77B8AF49309F21414CE545AB282DB71AA05CBA1
          APIs
          • RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE,00000000,00000102,?), ref: 02835382
          • RegDeleteValueW.ADVAPI32(?,IpDates_info), ref: 02835392
          • RegSetValueExW.ADVAPI32(?,IpDates_info,00000000,00000003,0284C6E0,000012A0), ref: 028353B0
          • RegCloseKey.ADVAPI32(?), ref: 028353BB
          • OpenProcess.KERNEL32(00000400,00000000,?), ref: 0283540F
          • GetExitCodeProcess.KERNEL32(00000000,?), ref: 0283541B
          • Sleep.KERNEL32(00000BB8), ref: 02835434
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: OpenProcessValue$CloseCodeDeleteExitSleep
          • String ID: IpDates_info$SOFTWARE
          • API String ID: 864241144-2243437601
          • Opcode ID: d68ad0bb86adac6862011a581f1c43881cc54c0da43775ebb97ac81298939f72
          • Instruction ID: eb355278d1232a8ba6ac2a945e45e3dda7a46d77997b1a2feddc362d21def99c
          • Opcode Fuzzy Hash: d68ad0bb86adac6862011a581f1c43881cc54c0da43775ebb97ac81298939f72
          • Instruction Fuzzy Hash: 6541297D6842449FD3128F348849B7ABBE5BB5A708FDD0449E489DB182D7B8D502C7D2
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D02E161
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054,6D02E0FA,?,?), ref: 6D02E17F
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054,6D02E0FA,?,?), ref: 6D02E1E1
          • EnterCriticalSection.KERNEL32(?,00000054,6D02E0FA,?,?), ref: 6D02E24C
          • ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,?,?,?,?,?,?,?,00000054), ref: 6D02E27D
          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000054), ref: 6D02E288
          Strings
          • SendData %ws size=%u, xrefs: 6D02E229
          • d:\ci_dev\wegame_client\codes\common\src\base_named_pipe.cpp, xrefs: 6D02E1AB, 6D02E207
          • SendData error, data size:%u too large, xrefs: 6D02E1C2
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@CriticalLogger@1@Section$EnterH_prolog3H_prolog3_H_prolog3_catch_LeaveReleaseSemaphore
          • String ID: SendData %ws size=%u$SendData error, data size:%u too large$d:\ci_dev\wegame_client\codes\common\src\base_named_pipe.cpp
          • API String ID: 2292408840-2360317330
          • Opcode ID: 15eb4c2429b3a35d83ceac882ffb13ad6e5da6bdc41ce1fad8ead5f2a429767c
          • Instruction ID: 6e14a96a7942d0c5f769b2501306b5d1f2422ef52a313c6c9dc72fca5e6bc42a
          • Opcode Fuzzy Hash: 15eb4c2429b3a35d83ceac882ffb13ad6e5da6bdc41ce1fad8ead5f2a429767c
          • Instruction Fuzzy Hash: A831F37094620AFBFB05DFA4CC44FEE7779BF52308F204058E911AB181DB719A4ACBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AE428
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000006C), ref: 6D0AE450
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,0000006C), ref: 6D0AE45B
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 6D0AE4C2
          Strings
          • [Sys_wrapper]Failed to call ShellExecute for %s, ret=%d, xrefs: 6D0AE518
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0AE487, 6D0AE4F8
          • [Sys_wrapper]Failed to convert path for open file mgr, xrefs: 6D0AE49B
          • open, xrefs: 6D0AE4BC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$?get_log_instance@base@@?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@ExecuteH_prolog3H_prolog3_catch_Logger@1@ShellU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@4@@W@std@@
          • String ID: [Sys_wrapper]Failed to call ShellExecute for %s, ret=%d$[Sys_wrapper]Failed to convert path for open file mgr$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp$open
          • API String ID: 1549429978-1288889083
          • Opcode ID: 642d15d50cdd8f6b612200c97d0762e8a114934728300fc62c863001d7f5c677
          • Instruction ID: a4fbc0377f06204856a21b0598d63414cff2add36ff33e1d3a9fa48d67925dc2
          • Opcode Fuzzy Hash: 642d15d50cdd8f6b612200c97d0762e8a114934728300fc62c863001d7f5c677
          • Instruction Fuzzy Hash: A131BE7198820AABFB10CFE8DC84FEEB7B4AF05754F650019E511BB282E7319A44CB61
          APIs
          • RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE,00000000,00000102,?), ref: 02835382
          • RegDeleteValueW.ADVAPI32(?,IpDates_info), ref: 02835392
          • RegSetValueExW.ADVAPI32(?,IpDates_info,00000000,00000003,0284C6E0,000012A0), ref: 028353B0
          • RegCloseKey.ADVAPI32(?), ref: 028353BB
          • OpenProcess.KERNEL32(00000400,00000000,?), ref: 0283540F
          • GetExitCodeProcess.KERNEL32(00000000,?), ref: 0283541B
          • Sleep.KERNEL32(00000BB8), ref: 02835434
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: OpenProcessValue$CloseCodeDeleteExitSleep
          • String ID: IpDates_info$SOFTWARE
          • API String ID: 864241144-2243437601
          • Opcode ID: 812ea8a3ece5cf682ad01ce0eabb8ea476d716c48973e6fc1c9dad99f8b1d9c7
          • Instruction ID: 2a6c3ec407b572d80b62f6d3c7de6ffa9acc2bb649c4cf528ebe393fc3c56409
          • Opcode Fuzzy Hash: 812ea8a3ece5cf682ad01ce0eabb8ea476d716c48973e6fc1c9dad99f8b1d9c7
          • Instruction Fuzzy Hash: B331C67C6843819FD722CF348408B7ABBE5BB5A308FDD0848E589DB182C3A8D506C7D1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D01E02C
          • socket.WS2_32(00000002,00000002,00000011), ref: 6D01E044
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D01E052
            • Part of subcall function 6D01E3EA: closesocket.WS2_32(000000FF), ref: 6D01E3F6
          • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 6D01E0BA
          • WSAGetLastError.WS2_32 ref: 6D01E0C2
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D01E0CF
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp, xrefs: 6D01E073, 6D01E0F0
          • [common][Asy_udp] socket create failed., xrefs: 6D01E08F
          • [common][Asy_udp] sock(%d) set sock not block failed, ret=%d, err=%d., xrefs: 6D01E10D
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$ErrorH_prolog3_Lastclosesocketioctlsocketsocket
          • String ID: [common][Asy_udp] sock(%d) set sock not block failed, ret=%d, err=%d.$[common][Asy_udp] socket create failed.$d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp
          • API String ID: 1916031119-2745274173
          • Opcode ID: 1a9c7eb6f0a5e02f2f53e37ace8bc89c78cf0b2aa599fffa06d43af2b0526662
          • Instruction ID: 74a903270687e0b8009412dd6aaa8c8ac291f7f11becfffe5fcd4f0b0f4f6416
          • Opcode Fuzzy Hash: 1a9c7eb6f0a5e02f2f53e37ace8bc89c78cf0b2aa599fffa06d43af2b0526662
          • Instruction Fuzzy Hash: A121F6B094871AABFB149BF48C08FAD73617F45729F210314E620BF2C1EBB29885CA40
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AA9DF
          • wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000258,6D0A0748,?,00000050), ref: 6D0AA9E8
          • memset.VCRUNTIME140(?,00000000,00000200), ref: 6D0AAA1F
          • wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?,00000002,?,00000000,00000200), ref: 6D0AAA33
          • GetDriveTypeW.KERNEL32(?), ref: 6D0AAA43
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0AAA53
          Strings
          • [Sys_wrapper]path is not fixed_remote, xrefs: 6D0AAA8E
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0AAA77
          • C:\, xrefs: 6D0AA9FB
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@DriveH_prolog3_Logger@1@Typememsetwcslenwcsncpy_s
          • String ID: C:\$[Sys_wrapper]path is not fixed_remote$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 3729441984-3503112580
          • Opcode ID: 3e017f450932492e9529c1c4ccfd97588a90ae99f0cc0e3e3df1b31456dc8878
          • Instruction ID: 5575c3a4b965a05ab122cb8e6832ceca99ab0245fa660bef3a40bac4c3795c0e
          • Opcode Fuzzy Hash: 3e017f450932492e9529c1c4ccfd97588a90ae99f0cc0e3e3df1b31456dc8878
          • Instruction Fuzzy Hash: 1A11E471988219ABEF20DBA4CC49FED7374AB12708F650181E615EB1C2DBB59EC5CB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D096F8D
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z.MSVCP140(00000000,00000000,00000002), ref: 6D097031
          • ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D31E62F), ref: 6D097040
          • ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z.MSVCP140(00000000,00000000,00000000), ref: 6D097064
          • ?eof@ios_base@std@@QBE_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D31E62F,00000000), ref: 6D097071
          • ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z.MSVCP140(?,?,00000000), ref: 6D097096
          • ?eof@ios_base@std@@QBE_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,6D31E62F,00000000,000000F8), ref: 6D0971A0
          • ?ToHex@common@ierd_tgp@@YAEABE@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D09720B
          • ?ToHex@common@ierd_tgp@@YAEABE@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000001,?), ref: 6D09723A
          • tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,6D31E62F,00000000,000000F8), ref: 6D097273
            • Part of subcall function 6D096AD4: __EH_prolog3.LIBCMT ref: 6D096ADB
            • Part of subcall function 6D0977A2: __EH_prolog3_GS.LIBCMT ref: 6D0977AC
            • Part of subcall function 6D0977A2: ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?,?,?,?,?,6D31E62F,00000000,000000F8), ref: 6D09783E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?eof@ios_base@std@@?seekg@?$basic_istream@H_prolog3_Hex@common@ierd_tgp@@V12@_$??1?$basic_ios@?read@?$basic_istream@?tellg@?$basic_istream@H_prolog3Mbstatet@@@2@V12@V?$fpos@memmovetolower
          • String ID:
          • API String ID: 334280407-0
          • Opcode ID: 29256191cf7f92258365fd861deb290eeb28b2473a125bcbdcbd1c5fd4a8d4f1
          • Instruction ID: 36560d758dbf6dd0ca946bcc118b8c210fec1f000197a64bd683f60fa1042716
          • Opcode Fuzzy Hash: 29256191cf7f92258365fd861deb290eeb28b2473a125bcbdcbd1c5fd4a8d4f1
          • Instruction Fuzzy Hash: BAC14B71D04259DFEF24CFA4C894BDDBBB5AF49304F1080EAE119AB251DB705A89DF60
          APIs
          • memmove.VCRUNTIME140(00000000,7FFFFFFF,00000000,?,00000000,0000000F), ref: 6CFFFDFA
          • memset.VCRUNTIME140(00000010,?,00000000,00000000,7FFFFFFF,00000000,?,00000000,0000000F), ref: 6CFFFE08
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,0000000F), ref: 6CFFFE4B
          • memmove.VCRUNTIME140(00000000,?,00000000,?,00000000,0000000F), ref: 6CFFFE53
          • memset.VCRUNTIME140(7FFFFFFF,?,00000000,00000000,?,00000000,?,00000000,0000000F), ref: 6CFFFE5F
            • Part of subcall function 6D112E95: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D00621D,0000002C,0000000C,6D005702,00000004,6D0057B1,00000214), ref: 6D112EAA
          • memmove.VCRUNTIME140(00000000,7FFFFFFF,00000000,?,00000000), ref: 6CFFFF43
          • memmove.VCRUNTIME140(00000010,00000000,?,00000000,7FFFFFFF,00000000,?,00000000), ref: 6CFFFF51
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000), ref: 6CFFFF94
          • memmove.VCRUNTIME140(00000000,?,00000000,?,00000000), ref: 6CFFFF9C
          • memmove.VCRUNTIME140(7FFFFFFF,00000000,?,00000000,?,00000000,?,00000000), ref: 6CFFFFA8
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$_invalid_parameter_noinfo_noreturnmemset$malloc
          • String ID:
          • API String ID: 1092852243-0
          • Opcode ID: d41b8666529c4b6af243e729410175454457f161a59523afaaf8fed3d4e08235
          • Instruction ID: 7ee1be2356c23631f0530aae51e04323b0f702b37bc6a567c1ea97ae1f64c438
          • Opcode Fuzzy Hash: d41b8666529c4b6af243e729410175454457f161a59523afaaf8fed3d4e08235
          • Instruction Fuzzy Hash: 1181F472A011099FDB05CF68DC80A9EB7E5FF8A354B110279E815DB395E730DE22C7A1
          APIs
          • memmove.VCRUNTIME140(?,06666666,?,?,?,00000000), ref: 6CFFF537
          • memmove.VCRUNTIME140(00000000,00000002,?,?,?,00000000), ref: 6CFFF55C
          • memset.VCRUNTIME140(?,00000000,?,00000000,00000002,?,?,?,00000000), ref: 6CFFF572
          • memset.VCRUNTIME140(?,00000000,?,?,00000000,?,00000000,00000002,?,?,?,00000000), ref: 6CFFF57E
          • memmove.VCRUNTIME140(00000000,00000002,?,?,?,00000000), ref: 6CFFF58F
          • memmove.VCRUNTIME140(?,00000000,00000002,00000000,00000002,?,?,?,00000000), ref: 6CFFF5B0
          • memset.VCRUNTIME140(?,00000000,?,?,00000000,00000002,00000000,00000002,?,?,?,00000000), ref: 6CFFF5BE
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CFFF60C
          • memmove.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6CFFF62D
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CFFF667
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$memset$_invalid_parameter_noinfo_noreturn
          • String ID:
          • API String ID: 3802980928-0
          • Opcode ID: 280a34635a27e1d4c62afb46876b843260f92edb04789b9911ee90eb2546e960
          • Instruction ID: e155e384d9ac78aceeb0c037fb8d8ce48f677d3fd1addd00b8c6025d40d74c0a
          • Opcode Fuzzy Hash: 280a34635a27e1d4c62afb46876b843260f92edb04789b9911ee90eb2546e960
          • Instruction Fuzzy Hash: 8C514672A00105ABDB24CF68DC44F6FB7B9EF85358F254269E425D7A90D730ED12CB90
          APIs
          • strstr.VCRUNTIME140(?,://,00000000,00000000,?,?,?,?,00000020,?,000000FF,?,00000080,?,000000FF,00000000), ref: 6D25FC55
          • memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,00000020,?,000000FF,?,00000080,?,000000FF,00000000), ref: 6D25FC73
          • strchr.VCRUNTIME140(?,0000003F,?,?,?,?,00000020,?,000000FF,?,00000080,?,000000FF,00000000), ref: 6D25FC8E
          • memmove.VCRUNTIME140(00000001,?,?,?,?,?,?,?,?,00000020,?,000000FF,?,00000080,?,000000FF), ref: 6D25FCD9
          • strchr.VCRUNTIME140(-00000001,00000026,?,?,?,?,?,?,00000020,?,000000FF,?,00000080,?,000000FF,00000000), ref: 6D25FD13
          • memchr.VCRUNTIME140(-00000001,0000003D,00000000,?,?,?,?,?,?,?,?,00000020,?,000000FF,?,00000080), ref: 6D25FD47
          • memmove.VCRUNTIME140(-00000094,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000020,?), ref: 6D25FD9C
          • memmove.VCRUNTIME140(-000000B4,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000020,?), ref: 6D25FDDC
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$strchr$memchrstrstr
          • String ID: ://$tcp
          • API String ID: 2271568606-1181326313
          • Opcode ID: de3410c08c3d46287ce2fecf06069d78b4f99bf5208089d2bfea9d1132de5cdc
          • Instruction ID: 55207c6489e645a51c55c454c92a0ff1c827686cd249443c5f572530928e9d88
          • Opcode Fuzzy Hash: de3410c08c3d46287ce2fecf06069d78b4f99bf5208089d2bfea9d1132de5cdc
          • Instruction Fuzzy Hash: 8151257298831F9FD725DF78A880F637BA8EB01256F050639DD6487242E762D93983E1
          APIs
          • __EH_prolog3_catch.LIBCMT ref: 6D02252C
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140(00000024), ref: 6D02255A
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 6D022571
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 6D022589
          • ?flags@ios_base@std@@QBEHXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0225D4
          • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D022603
          • ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D022644
          • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D022672
          • ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0226AE
          • ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0226E7
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?width@ios_base@std@@$?sputc@?$basic_streambuf@_D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@H_prolog3_catch
          • String ID:
          • API String ID: 2240115643-0
          • Opcode ID: 1c8257d6bb54b1559618ba7deb6106849c3347d84c247772c36b9be502c9143e
          • Instruction ID: 3936152d736ede631768718376dc9cd13c2ce8f06a255c5c23e81c41d50012ff
          • Opcode Fuzzy Hash: 1c8257d6bb54b1559618ba7deb6106849c3347d84c247772c36b9be502c9143e
          • Instruction Fuzzy Hash: 74518334A12116CFDF24CFA8C9A8BBEBBF1FF49314B648159E516A7380CB309941CB90
          APIs
          • __EH_prolog3_catch.LIBCMT ref: 6D022BB1
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140(00000018,6D02271C,?,?,?), ref: 6D022BC7
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 6D022BDE
          • ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 6D022BF0
          • ?flags@ios_base@std@@QBEHXZ.MSVCP140(?,?,?), ref: 6D022C26
          • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?), ref: 6D022C4C
          • ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000,?,?,?), ref: 6D022C83
          • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?), ref: 6D022CA8
          • ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,?,?,?), ref: 6D022CDB
          • ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,?,?), ref: 6D022D14
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?width@ios_base@std@@$?sputc@?$basic_streambuf@_D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@H_prolog3_catch
          • String ID:
          • API String ID: 2240115643-0
          • Opcode ID: 623281bd0f9c547442bd1b07db9039585123c0754c3b2e5503b052f44f651ecd
          • Instruction ID: f89d531c68fed5e07babf5b336d00740111e94e6d4b967a3922ae1bac16421d5
          • Opcode Fuzzy Hash: 623281bd0f9c547442bd1b07db9039585123c0754c3b2e5503b052f44f651ecd
          • Instruction Fuzzy Hash: 27414A30A15206CFDB21CFA8C998B7EBBF0FF49304B64845AE546AB391C730EA44CB50
          APIs
          • __EH_prolog3.LIBCMT ref: 6D093D4B
          • closesocket.WS2_32(?), ref: 6D093D6F
          • std::_Cnd_initX.LIBCPMT ref: 6D093D9C
          • std::_Cnd_initX.LIBCPMT ref: 6D093DB6
          • std::_Cnd_initX.LIBCPMT ref: 6D093DC5
          • TerminateThread.KERNEL32(00000000,00000000,00000028,6D094491,00000050,6D095C47,00000054), ref: 6D093DF5
          • std::_Cnd_initX.LIBCPMT ref: 6D093E1A
          • std::_Cnd_initX.LIBCPMT ref: 6D093E29
          • ?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D093EB7
          • std::_Cnd_initX.LIBCPMT ref: 6D093ED0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Cnd_initstd::_$AsyncH_prolog3PushTask@common@ierd_tgp@@TerminateThreadV?$function@$$Z@std@@closesocket
          • String ID:
          • API String ID: 4181131528-0
          • Opcode ID: 50077e841e5e0deaed4ca8e8ca048573186bbf34bf1df3935bc5f930cd621b80
          • Instruction ID: 25dffe13075a2dac08604ae6946e15dc92bd1a1dfcc90579d340cd85e04e111a
          • Opcode Fuzzy Hash: 50077e841e5e0deaed4ca8e8ca048573186bbf34bf1df3935bc5f930cd621b80
          • Instruction Fuzzy Hash: B151B030C0A60AEEEB04DFB4D9847DDBBB4BF09304F61415AD115A7280DB346B04CFA2
          APIs
          • WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 02834F43
          • EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 02834F58
          • WSASetLastError.WS2_32(00002746), ref: 02834F6A
          • LeaveCriticalSection.KERNEL32(000002FF), ref: 02834F71
          • timeGetTime.WINMM ref: 02834F9F
          • timeGetTime.WINMM ref: 02834FC7
          • SetEvent.KERNEL32(?), ref: 02835005
          • InterlockedExchange.KERNEL32(?,00000001), ref: 02835011
          • LeaveCriticalSection.KERNEL32(000002FF), ref: 02835018
          • LeaveCriticalSection.KERNEL32(000002FF), ref: 0283502B
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
          • String ID:
          • API String ID: 1979691958-0
          • Opcode ID: 8772038cd15b68dfe9614a959534d51863fa25affa85829a579c07549ae78110
          • Instruction ID: c7ed987bcd25faf60669a8b48111fbc492b61c4e789b717e1471f45057d7219c
          • Opcode Fuzzy Hash: 8772038cd15b68dfe9614a959534d51863fa25affa85829a579c07549ae78110
          • Instruction Fuzzy Hash: 1941243DA002009FD721DF29D948B6AB7E9FF48314F444959E84ECBA81E77AE844CBC1
          APIs
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E519
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E536
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E542
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E555
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E561
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E56B
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E577
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E587
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E593
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D05E5A0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?pptr@?$basic_streambuf@
          • String ID:
          • API String ID: 2505503336-0
          • Opcode ID: 91d66924a6fbbdf0e9f538611bc9b0562243fb254b0c3cdbada474caa1a8330a
          • Instruction ID: 9345ace786cd8ede21b85d3ff1d22ce08f22310a94e1b6744683a8a471b48573
          • Opcode Fuzzy Hash: 91d66924a6fbbdf0e9f538611bc9b0562243fb254b0c3cdbada474caa1a8330a
          • Instruction Fuzzy Hash: BC11F9347005118FDB159B24C29C23D77B6BB8A30A3450556EC43C7790EB74EC6ACB91
          APIs
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FC7D
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FC97
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FCA3
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FCB6
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FCC2
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FCCC
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FCD8
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FCE8
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FCF4
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01FD01
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?pptr@?$basic_streambuf@
          • String ID:
          • API String ID: 2505503336-0
          • Opcode ID: 765694a48f2f0337fd98aa1c7674299a8eb97ab8de206170309470f7354aeae8
          • Instruction ID: 9a7b5c97d68c7a4887b6bf2a21db9c8744dd3258ff930d40d80c9a7d2cbf94b9
          • Opcode Fuzzy Hash: 765694a48f2f0337fd98aa1c7674299a8eb97ab8de206170309470f7354aeae8
          • Instruction Fuzzy Hash: 3C114C317091118F9B195B28A55C77DBFBBBFC632639C0106D806C7680CB24B859DB80
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D023BD7
            • Part of subcall function 6D02350C: __EH_prolog3.LIBCMT ref: 6D023513
          • _localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,6D29119C,00000000,?,?,?,000004A0), ref: 6D023EDB
          • wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?,?,?,000004A0), ref: 6D023F09
          • wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?), ref: 6D023F5B
          • _CxxThrowException.VCRUNTIME140(?,6D32BCA4,missing '}' in format string,?,000004A0), ref: 6D023FC9
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: wcsftime$ExceptionH_prolog3H_prolog3_Throw_localtime64_s
          • String ID: %Y-%m-%d %H-%M-%S.%f$000000000$missing '}' in format string
          • API String ID: 219940617-3851816617
          • Opcode ID: d7f02b348c3fd5b58df910e14bac5dc4bcfc78b6c24b1ef547a92697fcf8a57e
          • Instruction ID: aa950cdc8cb573aa95f3358ddc39ae23fc6a230d55b965e7595bb68255841bc9
          • Opcode Fuzzy Hash: d7f02b348c3fd5b58df910e14bac5dc4bcfc78b6c24b1ef547a92697fcf8a57e
          • Instruction Fuzzy Hash: 28D1B0B1A05219DFEB14CF68D890BEDB7B5BF4D314F5440ADE209A7280DB709E85CB64
          APIs
          • memmove.VCRUNTIME140(?,?,?,23C35E98,?,0000E845,00000000), ref: 6CFFE102
            • Part of subcall function 6CFFBF60: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,000000FF,?,00000000,?,00000000,6D122CC5,?,%4095[^;=] =%4095[^;],?,?), ref: 6CFFBF7B
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0000E845,00000000), ref: 6CFFE19B
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,19999999,00000000,?,?,?,?,?,?,?,0000E845,00000000), ref: 6CFFE242
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,19999999,00000000,?,?,?,?,?,?,?,0000E845,00000000), ref: 6CFFE28A
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,19999999,00000000,?,?,?,?,?,?,?,0000E845,00000000), ref: 6CFFE2D2
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: _invalid_parameter_noinfo_noreturn$__stdio_common_vsscanfmemmove
          • String ID: %lld$' is not a number.$-
          • API String ID: 4106403372-445355879
          • Opcode ID: 7bfa6467a78d2e82d9c3201d4a10ceb2d84730645cecf62da0d949551383362c
          • Instruction ID: 0235d9f85191ecd222930fed122db16d719d6dc29009202c1770e03cbadad494
          • Opcode Fuzzy Hash: 7bfa6467a78d2e82d9c3201d4a10ceb2d84730645cecf62da0d949551383362c
          • Instruction Fuzzy Hash: 79C1EB71E052089FEB18CFA4CC84B9EBBB5EF45318F24462DE425EB794D7309946CB91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0268B1
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
            • Part of subcall function 6D024512: __EH_prolog3.LIBCMT ref: 6D024519
            • Part of subcall function 6D0266C3: __EH_prolog3.LIBCMT ref: 6D0266CA
          • InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000FA0,?,?,?,00000050,6D0245D9,?,?,?,00000000), ref: 6D026931
          • ?c_str@path@filesystem@ierd_tgp@@QBEPB_WXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D026A2D
          • ~refcount_ptr.LIBCPMT ref: 6D026A40
          • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D026A45
            • Part of subcall function 6D02438A: __EH_prolog3.LIBCMT ref: 6D024391
            • Part of subcall function 6D028DB3: __EH_prolog3.LIBCMT ref: 6D028DBA
          • OutputDebugStringW.KERNEL32(00000000,?,00000000,00000000), ref: 6D026B1F
          • OutputDebugStringW.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,00000000,00000000), ref: 6D026BB7
          Strings
          • forced abort due to illegal log prefix [{}], xrefs: 6D026A11
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$DebugOutputString$?c_str@path@filesystem@ierd_tgp@@CountCriticalH_prolog3_InitializeSectionSpinabortmemmove~refcount_ptr
          • String ID: forced abort due to illegal log prefix [{}]
          • API String ID: 816663753-1525200662
          • Opcode ID: ea44e65dbe6c6c16bc0a43210b5373ad35190a4a81ea5327a6ba678a41840cd4
          • Instruction ID: 0ff261929d17dc623cde129033e260477e82c7480f0c7ccb53375cd1d14242b1
          • Opcode Fuzzy Hash: ea44e65dbe6c6c16bc0a43210b5373ad35190a4a81ea5327a6ba678a41840cd4
          • Instruction Fuzzy Hash: EEB1A371909288EFEB15CBE8C948BDEBFF8AF15308F14449DE141A7281DB749649CB62
          APIs
          • ?u8_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D037624
          • ?cfg_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D037657
            • Part of subcall function 6D0360F5: __EH_prolog3_GS.LIBCMT ref: 6D0360FC
            • Part of subcall function 6D0360F5: ?root_full_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D03610F
            • Part of subcall function 6D0360F5: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D036121
            • Part of subcall function 6D0360F5: ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D036130
            • Part of subcall function 6D0360F5: ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?), ref: 6D03613C
          • ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,?,?), ref: 6D03766C
            • Part of subcall function 6D050948: __EH_prolog3_GS.LIBCMT ref: 6D050952
            • Part of subcall function 6D050948: ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D050975
            • Part of subcall function 6D050948: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D0509EA
            • Part of subcall function 6D050948: ?root_name@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000), ref: 6D050A5B
            • Part of subcall function 6D050948: ?root_name@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D050A6B
            • Part of subcall function 6D050948: ?root_directory@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000000), ref: 6D050A7A
            • Part of subcall function 6D050948: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000000), ref: 6D050A8F
            • Part of subcall function 6D00D1A9: memmove.VCRUNTIME140(?,?,00000018,?,?), ref: 6D00D1C7
            • Part of subcall function 6D00D1A9: memmove.VCRUNTIME140(?,0000000F,00000018,?,?,00000018,?,?), ref: 6D00D1D0
            • Part of subcall function 6D00D1A9: memmove.VCRUNTIME140(0000000F,?,00000018,?,0000000F,00000018,?,?,00000018,?,?), ref: 6D00D1DC
            • Part of subcall function 6CFFA3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6D0062D8,00000000,6D006649,00000003,23C35E98,?,?,00000000,6D266604,000000FF,?,6D005B05,00000000), ref: 6CFFA3E5
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6D03774D
          • relate path string to path fail, xrefs: 6D037764
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: V123@$??0path@filesystem@ierd_tgp@@memmove$?root_name@path@filesystem@ierd_tgp@@E@$$File_info@common@ierd_tgp@@H_prolog3_U?$char_traits@_V012@@V?$allocator@_V?$basic_string@_Vpath@filesystem@3@W@std@@$?absolute@filesystem@ierd_tgp@@?cfg_folder@?is_absolute@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?root_directory@path@filesystem@ierd_tgp@@?root_full_path@?u8_to_path@common@ierd_tgp@@?wstring@path@filesystem@ierd_tgp@@D@2@@std@@D@std@@U?$char_traits@V312@0@V?$allocator@V?$basic_string@Vpath@12@Vpath@filesystem@2@@W@2@@std@@W@2@@std@@@_invalid_parameter_noinfo_noreturn
          • String ID: d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp$relate path string to path fail
          • API String ID: 2122883779-3315596926
          • Opcode ID: ace6f9783e02c1dccf2f4770b36bbf22f2b1db1b436c7dc3d0d310d6619230e6
          • Instruction ID: 118cd80abff79b7194b27ec05afa9ab8d5078657d5e227141db838b90ce2dfd2
          • Opcode Fuzzy Hash: ace6f9783e02c1dccf2f4770b36bbf22f2b1db1b436c7dc3d0d310d6619230e6
          • Instruction Fuzzy Hash: 2AA1A130C0929DEAEF11CBE8C954BDDBBB4AF26308F6580D8C145B7191DBB45B48DB62
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04E103
          • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000005,00000080,00000000,00000114,6D04EF74,?,?,\drivers\etc\hosts), ref: 6D04E134
          • GetLastError.KERNEL32 ref: 6D04E145
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04E151
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D01F613: __EH_prolog3_GS.LIBCMT ref: 6D01F648
          • WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,6D295CA8,00000002,00000000,00000018), ref: 6D04E280
          • CloseHandle.KERNEL32(00000000,00000018), ref: 6D04E2D9
          Strings
          • [repair_hosts]WriteFileLines open file error:%u, xrefs: 6D04E198
          • d:\ci_dev\wegame_client\codes\common\src\dns_repair.cpp, xrefs: 6D04E17D
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: FileH_prolog3_$?get_log_instance@base@@CloseCreateErrorH_prolog3HandleLastLogger@1@Write
          • String ID: [repair_hosts]WriteFileLines open file error:%u$d:\ci_dev\wegame_client\codes\common\src\dns_repair.cpp
          • API String ID: 1019973358-2298770575
          • Opcode ID: 753691b373d2d5616a763bc86c2ef1ddc0917d557177f8196cdc9a619ff71599
          • Instruction ID: d5f4b7d23a44419dbe0745dcbd9515233485808f78ed917d5e37d4868bc09fb9
          • Opcode Fuzzy Hash: 753691b373d2d5616a763bc86c2ef1ddc0917d557177f8196cdc9a619ff71599
          • Instruction Fuzzy Hash: CE517B71941219DFEB18CBA4CD56FEEB7B4EF09314F1041A8E215A7190EB709B89CFA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D01ED40
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000060,6D01E5A3,?,00000000,6D01E541,?), ref: 6D01ED54
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D01EE13
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000060,6D01E5A3,?,00000000,6D01E541), ref: 6D01EE6B
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp, xrefs: 6D01ED78, 6D01EE3F, 6D01EE8F
          • [common][Asy_udp] sock(%d) recv_start failed, invalid params, max_pkg_len_=%d., xrefs: 6D01EEAC
          • [common][Asy_udp] recv thread is already running., xrefs: 6D01ED8C
          • [common][Asy_udp] sock(%d) recv thread create failed., xrefs: 6D01EE59
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$H_prolog3H_prolog3_H_prolog3_catch_
          • String ID: [common][Asy_udp] recv thread is already running.$[common][Asy_udp] sock(%d) recv thread create failed.$[common][Asy_udp] sock(%d) recv_start failed, invalid params, max_pkg_len_=%d.$d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp
          • API String ID: 2321812390-934111829
          • Opcode ID: 50444572aad79ace283ad859d1bfc5c4b50b57053c77cdbfa889d737724dd941
          • Instruction ID: 89257511f0d709597954d21e7dcf9c9f23bfdb53f2cadad9679f2c3fe3d3e086
          • Opcode Fuzzy Hash: 50444572aad79ace283ad859d1bfc5c4b50b57053c77cdbfa889d737724dd941
          • Instruction Fuzzy Hash: 72419F71948706ABFB249BE4CC54FAE73F1BF44704F22411DE651AB5C1EBB2AA41DB00
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A2421
          • _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 6D0A2438
          • _localtime64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 6D0A2451
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A2461
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • UNKOWN, xrefs: 6D0A24CC
          • [Sys_wrapper] get lcoaltime failed, cur_tm=NULL, xrefs: 6D0A249E
          • %d-%d-%d, xrefs: 6D0A24F2
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A2488
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_H_prolog3_catch_Logger@1@_localtime64_time64
          • String ID: %d-%d-%d$UNKOWN$[Sys_wrapper] get lcoaltime failed, cur_tm=NULL$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 3421849107-2033272978
          • Opcode ID: 433a5bbdea5b4a5ace908cf0c899f7a8a6f30654b7bd274a6f570ff6689bd09a
          • Instruction ID: a5f1b3541b99f32d654f48e7f45fca76068b8c46b26a25aba24281bc78357c09
          • Opcode Fuzzy Hash: 433a5bbdea5b4a5ace908cf0c899f7a8a6f30654b7bd274a6f570ff6689bd09a
          • Instruction Fuzzy Hash: 27416271D442189BEB28DFA5DC54BEE7BB4AF55308F0000E9E509AB291EBB49B48DF50
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07E49D
            • Part of subcall function 6D07E23A: __EH_prolog3.LIBCMT ref: 6D07E241
            • Part of subcall function 6D07E23A: ?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000018,6D07E6E7,6D389534,6D389584,00000054,6D07BD53,TGP_COM_URL), ref: 6D07E246
            • Part of subcall function 6D07E23A: ?find_component@Component_mgr@common@ierd_tgp@@QAE?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@23@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000018,6D07E6E7,6D389534,6D389584,00000054,6D07BD53,TGP_COM_URL), ref: 6D07E254
          • fopen.API-MS-WIN-CRT-STDIO-L1-1-0(domain_table.txt,6D2994E0), ref: 6D07E4DE
          • memset.VCRUNTIME140(?,00000000,00000400), ref: 6D07E500
          • memset.VCRUNTIME140(?,00000000,00000400,?,00000000,00000400), ref: 6D07E50E
          • fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D07E5F3
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$?find_component@?get_comp_mgr_instance@common@ierd_tgp@@Component@common@ierd_tgp@@@std@@Component_mgr@12@Component_mgr@common@ierd_tgp@@H_prolog3H_prolog3_V?$weak_ptr@Vcomponent_interface_type@23@@fclosefopen
          • String ID: %s %s$domain_table.txt$domain_table_hk.txt
          • API String ID: 1767544337-3851574225
          • Opcode ID: 54d795ab090c581a8a9035b1558338b8ef82646dce85ee9baa6505b9ca97fe62
          • Instruction ID: a6f734a666a65dbffe2d33220909d00bbbb590e63e7dfbf369fb70214b36cc41
          • Opcode Fuzzy Hash: 54d795ab090c581a8a9035b1558338b8ef82646dce85ee9baa6505b9ca97fe62
          • Instruction Fuzzy Hash: 7B31A0B180511E9EDB20DF64CC40AEA77BCFF45218F0081EAD555AB141EF315B86CFA4
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0837A1
          • ?ConvertJsonStringToQos@qos@adapt_for_imports@ierd_tgp@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAUtagQOSRep@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000054,6D083A66,?), ref: 6D0837EF
            • Part of subcall function 6D082903: __EH_prolog3_GS.LIBCMT ref: 6D08290D
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?,?,?,00000002), ref: 6D082923
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?,00000000,00000001,?), ref: 6D082933
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9,00000001,00000001,?), ref: 6D082941
            • Part of subcall function 6D082903: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6D08622B,00000118,6D0859C9), ref: 6D08294F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D083840
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054,6D083A66,?), ref: 6D083883
          Strings
          • [Qos_Command:ReportFailedTask] upload failed qos udp failed., xrefs: 6D08387C
          • d:\ci_dev\wegame_client\codes\common\src\qos_command.cpp, xrefs: 6D083868, 6D0838A7
          • [Qos_Command:ReportFailedTask] Initial Qos failed., xrefs: 6D0838BB
          • /1m, xrefs: 6D083870, 6D0838CD
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$?get_log_instance@base@@H_prolog3_Logger@1@$ConvertD@2@@std@@D@std@@JsonQos@qos@adapt_for_imports@ierd_tgp@@Rep@@@StringU?$char_traits@UtagV?$allocator@V?$basic_string@
          • String ID: /1m$[Qos_Command:ReportFailedTask] Initial Qos failed.$[Qos_Command:ReportFailedTask] upload failed qos udp failed.$d:\ci_dev\wegame_client\codes\common\src\qos_command.cpp
          • API String ID: 4130527961-1120407735
          • Opcode ID: d556c555445d1b9d59dc15c18c5fee6963db3a06655ac7341448711e6eb60aa2
          • Instruction ID: 957408ff6670aefb3291b2c9032dff7200c006c3b8dd0f8615bf8e947b3ebcef
          • Opcode Fuzzy Hash: d556c555445d1b9d59dc15c18c5fee6963db3a06655ac7341448711e6eb60aa2
          • Instruction Fuzzy Hash: C23104B0905746EBEF15EFA4CC00BEE77A0AF89718F114058E5557B2C3EB729A0AC791
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AE2B0
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(000002C8), ref: 6D0AE2BB
          • memset.VCRUNTIME140(?,00000000,00000208,000002C8), ref: 6D0AE323
          • memset.VCRUNTIME140(?,00000000,00000058,?,00000000,00000208,000002C8), ref: 6D0AE335
          • GetOpenFileNameW.COMDLG32(?,?,?,?,?), ref: 6D0AE3A8
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?), ref: 6D0AE3FD
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [Sys_wrapper]open_sys_openfile_dialog, xrefs: 6D0AE2F6
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0AE2DF
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$?get_log_instance@base@@?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@FileH_prolog3H_prolog3_H_prolog3_catch_Logger@1@NameOpenU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@
          • String ID: [Sys_wrapper]open_sys_openfile_dialog$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 1892290767-937071972
          • Opcode ID: 40cecb7c6b713077d0c1b99e8c51f26fea538cb60b5c7bd87bf78cd0f7bedfb5
          • Instruction ID: a9fe1248f6d07d19259aca5f7359dc9a66fbf0fb56a98f20d359f8970df6dcdf
          • Opcode Fuzzy Hash: 40cecb7c6b713077d0c1b99e8c51f26fea538cb60b5c7bd87bf78cd0f7bedfb5
          • Instruction Fuzzy Hash: 41417A70D85229ABEF60DFA4CC88BCDB7B8AF15714F5042E99508BB281DB745B85CF50
          APIs
          • memmove.VCRUNTIME140(?,00000000,?), ref: 6D002BD0
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?), ref: 6D002C1D
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?), ref: 6D002C69
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?), ref: 6D002CBB
            • Part of subcall function 6CFFFE80: memmove.VCRUNTIME140(00000000,7FFFFFFF,00000000,?,00000000), ref: 6CFFFF43
            • Part of subcall function 6CFFFE80: memmove.VCRUNTIME140(00000010,00000000,?,00000000,7FFFFFFF,00000000,?,00000000), ref: 6CFFFF51
          • memmove.VCRUNTIME140(?,6D31E7AC,00000001,23C35E98), ref: 6D002D18
          • memmove.VCRUNTIME140(?,00000000,?,?,00000002,00000001,00000000,6D31E7AC,00000001,23C35E98), ref: 6D002D95
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?,?,00000002,00000001,00000000,6D31E7AC,00000001,23C35E98), ref: 6D002DE4
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?,?,00000002,00000001,00000000,6D31E7AC,00000001,23C35E98), ref: 6D002E33
            • Part of subcall function 6CFFFBA0: memmove.VCRUNTIME140(?,00000000,?,00000000,?,00000000,?,6D088F61,?,tqos=,00000000,?,?,Body,?,Head), ref: 6CFFFC09
            • Part of subcall function 6CFFFBA0: memmove.VCRUNTIME140(00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,6D088F61,?,tqos=,00000000,?,?), ref: 6CFFFC15
            • Part of subcall function 6CFFFBA0: memmove.VCRUNTIME140(00000000,00000000,00000001,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,6D088F61,?,tqos=), ref: 6CFFFC2D
          • memmove.VCRUNTIME140(?,6D31E7AC,00000001,?,00000000,00000000,?,?,00000002,00000001,00000000,6D31E7AC,00000001,23C35E98), ref: 6D002E7C
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$_invalid_parameter_noinfo_noreturn
          • String ID:
          • API String ID: 2580228974-0
          • Opcode ID: 6393e8a45ff07124dd934d3b789cfcf556d122686d8e868aab3370c28390b265
          • Instruction ID: a193e0e70ca1013a3a6f77ba200a97aedc8287080fbf8ec9a52e8603e5ac750d
          • Opcode Fuzzy Hash: 6393e8a45ff07124dd934d3b789cfcf556d122686d8e868aab3370c28390b265
          • Instruction Fuzzy Hash: 8FB1F731A04245AFFB24CF78CC84B9DBBB6FB89304F2041A9D515AB382D7719985CB91
          APIs
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01E7CF
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D01E7E5
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?pptr@?$basic_streambuf@D@std@@@std@@U?$char_traits@
          • String ID:
          • API String ID: 1676136795-0
          • Opcode ID: 2af5d9c00ddb4c44d53ed0bf40a27dbcaf21d240600cf2f5111e8a4eb3caab2d
          • Instruction ID: 9266df45e6112d34f9cfcc9b0c313580e6c5f922d7fff79d023a998dfb19d2c9
          • Opcode Fuzzy Hash: 2af5d9c00ddb4c44d53ed0bf40a27dbcaf21d240600cf2f5111e8a4eb3caab2d
          • Instruction Fuzzy Hash: 41514771A042108FDB49CF6CC884A6DBBF5FF8A314B1581AAEC1ADB355CB70A804CB90
          APIs
            • Part of subcall function 02833660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02833667
            • Part of subcall function 02833660: _free.LIBCMT ref: 0283369C
            • Part of subcall function 02833660: _malloc.LIBCMT ref: 028336D7
            • Part of subcall function 02833660: _memset.LIBCMT ref: 028336E5
          • InterlockedIncrement.KERNEL32(0284D990), ref: 02833565
          • InterlockedIncrement.KERNEL32(0284D990), ref: 02833573
          • setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0283359A
          • setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 028335B3
          • ResetEvent.KERNEL32(?,?,?,0284D990), ref: 028335EE
          • SetLastError.KERNEL32(00000000), ref: 02833621
          • GetLastError.KERNEL32 ref: 02833639
            • Part of subcall function 02833F60: GetCurrentThreadId.KERNEL32 ref: 02833F65
            • Part of subcall function 02833F60: send.WS2_32(?,02847440,00000010,00000000), ref: 02833FC6
            • Part of subcall function 02833F60: SetEvent.KERNEL32(?), ref: 02833FE9
            • Part of subcall function 02833F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02833FF5
            • Part of subcall function 02833F60: WSACloseEvent.WS2_32(?), ref: 02834003
            • Part of subcall function 02833F60: shutdown.WS2_32(?,00000001), ref: 0283401B
            • Part of subcall function 02833F60: closesocket.WS2_32(?), ref: 02834025
          • SetLastError.KERNEL32(00000000), ref: 02833649
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
          • String ID:
          • API String ID: 127459856-0
          • Opcode ID: c9a4556f295a4ec9abcf2564623cec4e3b81d8fc151f2904c6e3b78413c5adda
          • Instruction ID: b4c0ff5ea36bb9ebe560f09f672f1d390193c8ec860322720e554ba0d85631a6
          • Opcode Fuzzy Hash: c9a4556f295a4ec9abcf2564623cec4e3b81d8fc151f2904c6e3b78413c5adda
          • Instruction Fuzzy Hash: D4417CBD640704AFD360EF69DC81B6AB7E5BB48711F50096EE64AD7680D7B4E404CB90
          APIs
          • ResetEvent.KERNEL32(?), ref: 02834443
          • ResetEvent.KERNEL32(?), ref: 0283444C
          • timeGetTime.WINMM ref: 0283444E
          • InterlockedExchange.KERNEL32(?,00000000), ref: 0283445D
          • WaitForSingleObject.KERNEL32(?,00001770), ref: 028344AB
          • ResetEvent.KERNEL32(?), ref: 028344C8
            • Part of subcall function 02833F60: GetCurrentThreadId.KERNEL32 ref: 02833F65
            • Part of subcall function 02833F60: send.WS2_32(?,02847440,00000010,00000000), ref: 02833FC6
            • Part of subcall function 02833F60: SetEvent.KERNEL32(?), ref: 02833FE9
            • Part of subcall function 02833F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02833FF5
            • Part of subcall function 02833F60: WSACloseEvent.WS2_32(?), ref: 02834003
            • Part of subcall function 02833F60: shutdown.WS2_32(?,00000001), ref: 0283401B
            • Part of subcall function 02833F60: closesocket.WS2_32(?), ref: 02834025
          • ResetEvent.KERNEL32(?), ref: 028344DC
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
          • String ID:
          • API String ID: 542259498-0
          • Opcode ID: 045b89cf0f9c6e6c5d83e3e4e2b3bf1080de43e16db53be0efba51c452767c61
          • Instruction ID: 9b7634bc13dd6bab5e3728ce86df417fe1d46793823ae77ff61c0ed7e0794967
          • Opcode Fuzzy Hash: 045b89cf0f9c6e6c5d83e3e4e2b3bf1080de43e16db53be0efba51c452767c61
          • Instruction Fuzzy Hash: 9E21507E6407046BC620EF69DC84B9BB3E8FF99720F504A1EF58AC7680D675B440CBA1
          APIs
          • __EH_prolog3.LIBCMT ref: 6D06AFDB
          • ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z.MSVCP140(00000000,00000000,00000002,?,00000025,00000040,00000001,000000D8,6D069A84,?,?,0000000C,6D004E50,?,?,?), ref: 6D06B014
          • ?good@ios_base@std@@QBE_NXZ.MSVCP140(?,00000006,00000008,png), ref: 6D06B021
          • ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140(?,?,00000006,00000008,png), ref: 6D06B035
          • ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z.MSVCP140(00000000,00000000,00000000,?,00000006,00000008,png), ref: 6D06B057
          • ?good@ios_base@std@@QBE_NXZ.MSVCP140(?,00000006,00000008,png), ref: 6D06B064
          • ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140(?,?,00000006,00000008,png), ref: 6D06B078
          • ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z.MSVCP140(?,00000010,?,00000010,?,?,00000006,00000008,png), ref: 6D06B0AD
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(00000010,?,?,00000006,00000008,png), ref: 6D06B0C2
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?seekg@?$basic_istream@?tellg@?$basic_istream@Mbstatet@@@2@V12@_V?$fpos@$??1?$basic_ios@?read@?$basic_istream@H_prolog3V12@
          • String ID:
          • API String ID: 2540225853-0
          • Opcode ID: 95ccfed95e768b914f0b9653166a8f2e95f70eaf89b292a0dfb714a03511e92e
          • Instruction ID: 8dd3ef95ae2d0603eee353675ccc66bdc9caf770cb7508367e549176a03b4d7b
          • Opcode Fuzzy Hash: 95ccfed95e768b914f0b9653166a8f2e95f70eaf89b292a0dfb714a03511e92e
          • Instruction Fuzzy Hash: 6B318E31900218DFEB14CF64C988FAE7775FF4A319F158199E61A772A1DB30AE48CB50
          APIs
          • SetLastError.KERNEL32(0000139F,?), ref: 02834E79
          • TryEnterCriticalSection.KERNEL32(?,?), ref: 02834E98
          • TryEnterCriticalSection.KERNEL32(?), ref: 02834EA2
          • SetLastError.KERNEL32(0000139F), ref: 02834EB9
          • LeaveCriticalSection.KERNEL32(?), ref: 02834EC2
          • LeaveCriticalSection.KERNEL32(?), ref: 02834EC9
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$EnterErrorLastLeave
          • String ID:
          • API String ID: 4082018349-0
          • Opcode ID: 8e60829ae1abce62d9d5819f71e5e8ee28f1ecef0c8d8e900bc06ba34e0d3e0f
          • Instruction ID: 7f215719b5a6575e0e9f4f1291351e9e5787bd28141e43b66405e115290460a4
          • Opcode Fuzzy Hash: 8e60829ae1abce62d9d5819f71e5e8ee28f1ecef0c8d8e900bc06ba34e0d3e0f
          • Instruction Fuzzy Hash: 8D11863E7043048BC321EA7DEC84A6BB3DCEB58725B400A2AE645C6580D775E814CBE5
          APIs
          Strings
          • unexpected end of line, xrefs: 6D033F9C
          • expected end of line after \, xrefs: 6D033F43
          • expected ", xrefs: 6D033FE1
          • class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __cdecl boost::property_tree::info_parser::read_string<char>(const char *&,bool *), xrefs: 6D034051
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\info_parser_read.hpp, xrefs: 6D03404C
          • unexpected \, xrefs: 6D034023
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_
          • String ID: class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __cdecl boost::property_tree::info_parser::read_string<char>(const char *&,bool *)$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\info_parser_read.hpp$expected "$expected end of line after \$unexpected \$unexpected end of line
          • API String ID: 2427045233-1274455032
          • Opcode ID: df2a6222d6308fb8f693667102bd855682be3ff6ceecb4cf26c79ec77fa50dfe
          • Instruction ID: b58b4a86c0abfc961a7e2dc88827dfb79bf07100f9e6ee70b279bb88522e3ee1
          • Opcode Fuzzy Hash: df2a6222d6308fb8f693667102bd855682be3ff6ceecb4cf26c79ec77fa50dfe
          • Instruction Fuzzy Hash: F651E83180825AEEFB11CFE4CC84BEEBBB4BF19308F954099D1807B191DB755A49DB61
          APIs
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13BAC0
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13BB00
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13BB6F
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D13BBA1
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
          • String ID: %2I64d:%02I64d:%02I64d$%3I64dd %02I64dh$%7I64dd
          • API String ID: 885266447-564197712
          • Opcode ID: 7cae2ef7308020b2f72eca3f3831707b623deada1717297e68f19203f61ac6ec
          • Instruction ID: 945a0c928eab0d22e16fa08be8041405c71aeda5e41251423724d1def0e1b87c
          • Opcode Fuzzy Hash: 7cae2ef7308020b2f72eca3f3831707b623deada1717297e68f19203f61ac6ec
          • Instruction Fuzzy Hash: 67318C73748B183AE311692C9C41FBF7A59DBC0E58F060138FB08A618DFAE29D0582B1
          APIs
          • strchr.VCRUNTIME140(?,0000003A,00000000,00000000,?,?), ref: 6D25FF69
          • memmove.VCRUNTIME140(?,?,00000000,?,?), ref: 6D25FF8E
          • atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(-00000001), ref: 6D25FFAD
          • htons.WS2_32(00000000), ref: 6D25FFE7
          • strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1234567890.), ref: 6D25FFFB
          • gethostbyname.WS2_32(?), ref: 6D260053
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: atoigethostbynamehtonsmemmovestrchrstrspn
          • String ID: 1234567890.
          • API String ID: 532542645-3734169883
          • Opcode ID: 7b9b7f73b9d65492b2f1c9f1eac9c84ae2e1a868f45e057093b00c4ff2d7a617
          • Instruction ID: 6f1dee6baefd617bf2655ea209ab3acd91376f594d9ca4acccf24b79fd4ce4c7
          • Opcode Fuzzy Hash: 7b9b7f73b9d65492b2f1c9f1eac9c84ae2e1a868f45e057093b00c4ff2d7a617
          • Instruction Fuzzy Hash: 3E31467664C38A9BCB11CF34C940FAB73A8BF47305F01896DE98987241EB31D54AC761
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D053D49
          • ??0file_status@filesystem@ierd_tgp@@QAE@W4file_type@12@W4perms@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000020,00000000,?,?,6D05389E,00000000,00000000,?,00000000), ref: 6D053DBD
          • _CxxThrowException.VCRUNTIME140(?,6D32BC60,00000000,00000000,23C35E98,?,ierd_tgp::filesystem::status,00000020,00000000,?,?,6D05389E,00000000,00000000,?,00000000), ref: 6D053DF2
          • GetFileAttributesW.KERNEL32(00000000,?,00000000,?,?,?,?,6D32BC60,00000000,00000000,23C35E98,?,ierd_tgp::filesystem::status,00000020,00000000), ref: 6D053E0D
          • GetLastError.KERNEL32(00000048,6D054D22,00000000,?,23C35E98,?,?,6D05389E,00000000,00000000,?,00000000,?,00000000,00000000), ref: 6D053D5A
            • Part of subcall function 6D006B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6D388534,6D006BB1,6D388538,?,6D00A235,00000000,?,00000010), ref: 6D006B81
            • Part of subcall function 6D006B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D006B8D
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ??0file_status@filesystem@ierd_tgp@@AttributesErrorExceptionExecute_once@std@@FileH_prolog3_LastThrowUonce_flag@1@W4file_type@12@W4perms@12@@terminate
          • String ID: $ierd_tgp::filesystem::status
          • API String ID: 1821077273-2658930788
          • Opcode ID: 1a27561d58f5b28691ce9b02ba4d5908b19d3926955ec8cc57e8df15472cc655
          • Instruction ID: 35e781ea66dc717ee3cdffa7655eb57c13761851b50fc9dd3a7f4e762ff2660e
          • Opcode Fuzzy Hash: 1a27561d58f5b28691ce9b02ba4d5908b19d3926955ec8cc57e8df15472cc655
          • Instruction Fuzzy Hash: 3231C2B190460AEFFB118FA8D944BAEB7F8EF4D325F114419ED10AB280D771D864CB60
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D053599
          • CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000,00000000,0000002C,6D0536D3,00000000,00000000), ref: 6D0535DB
          • GetLastError.KERNEL32 ref: 6D0535F7
          • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 6D05361E
          • GetLastError.KERNEL32 ref: 6D053628
          • CloseHandle.KERNEL32(00000000), ref: 6D053665
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ErrorFileLast$CloseCreateH_prolog3_HandleTime
          • String ID: ierd_tgp::filesystem::last_write_time
          • API String ID: 625649313-1366802371
          • Opcode ID: 9c64b5fc07e0f2d9829adffd3c664acfd4d8436a7e999a9be6d2c605ad801140
          • Instruction ID: f133ec541dd1986d3bfdd4ef3c18ef99bce5609a4e04a9202e0ffaaeca54dbb2
          • Opcode Fuzzy Hash: 9c64b5fc07e0f2d9829adffd3c664acfd4d8436a7e999a9be6d2c605ad801140
          • Instruction Fuzzy Hash: EB219031904204AFEB209BB9CD88FDE7BF9AF8E325F544219F925A7280D7309515CB61
          APIs
          • memset.VCRUNTIME140(?,00000000,00000100), ref: 6D012C76
          • GetCurrentProcessId.KERNEL32(?), ref: 6D012C7F
            • Part of subcall function 6D0004F0: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,?,?,6D00CB1C,?,?,%s,%lu,?,?,00000010), ref: 6D00050C
          • OpenFileMappingA.KERNEL32(000F001F,00000000,?), ref: 6D012CC9
          • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,?), ref: 6D012CDE
          • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?), ref: 6D012CF6
          • GetLastError.KERNEL32 ref: 6D012D0B
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: File$Mapping$CreateCurrentErrorLastOpenProcessView__stdio_common_vsprintf_smemset
          • String ID: %lu_%sLock
          • API String ID: 2511982081-778973518
          • Opcode ID: 99979c7edbf635dca6d082bbc357b7136a6dc6bd8c258b9c3f20a98d1a2dd41e
          • Instruction ID: 20b7db2ff5eb03e210e6b22419e5f59d942e77d3c0e581bf09f62d57f6f8b1ee
          • Opcode Fuzzy Hash: 99979c7edbf635dca6d082bbc357b7136a6dc6bd8c258b9c3f20a98d1a2dd41e
          • Instruction Fuzzy Hash: 2D21B3B060430ABFEB209F74CC49FA777BCEB46714F00456AB655D6181EB70E549CA24
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0534BD
          • CreateFileW.KERNEL32(?,00000100,00000007,00000000,00000003,02000000,00000000,00000000,0000002C,6D0536B1,00000000,?,?,?,?,6D053698), ref: 6D053503
          • GetLastError.KERNEL32(?,6D053698,00000000,?,?,00000000), ref: 6D05351F
          • SetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 6D053558
          • GetLastError.KERNEL32 ref: 6D053562
          • CloseHandle.KERNEL32(00000000), ref: 6D053586
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ErrorFileLast$CloseCreateH_prolog3_HandleTime
          • String ID: ierd_tgp::filesystem::last_write_time
          • API String ID: 625649313-1366802371
          • Opcode ID: 967e31d1dee3f313bae3b21be399c4c08772dbca6bb149262e3842b95b40bee2
          • Instruction ID: 9f233a0479de8a65ad69b9d3e010d5363b2329b794db7ab18cf71ce00fd1b1e0
          • Opcode Fuzzy Hash: 967e31d1dee3f313bae3b21be399c4c08772dbca6bb149262e3842b95b40bee2
          • Instruction Fuzzy Hash: 21216D71904208EBEB20DFA5DD88FDE7BB8EF8A325F540119F915A6180D7309614CBA1
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D036179
          • ?GetWeGameAppDataPathW@Sys_wrapper@common@ierd_tgp@@SA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D2911A4), ref: 6D0361CA
            • Part of subcall function 6D0A2824: __EH_prolog3_GS.LIBCMT ref: 6D0A282E
            • Part of subcall function 6D0A2824: memset.VCRUNTIME140(?,00000000,00000208,000006A0,6D035F49,?,6D2911A4), ref: 6D0A2845
            • Part of subcall function 6D0A2824: memset.VCRUNTIME140(?,00000000,00000410,?,00000000,00000208,000006A0,6D035F49,?,6D2911A4), ref: 6D0A2857
            • Part of subcall function 6D0A2824: SHGetFolderPathW.SHELL32(00000000,0000801A,00000000,00000000,?), ref: 6D0A286E
            • Part of subcall function 6D0A2824: ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A28AE
          • ??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(config,?,6D2911A4), ref: 6D0361E6
            • Part of subcall function 6D050881: __EH_prolog3_GS.LIBCMT ref: 6D050888
            • Part of subcall function 6D050881: ?append_separator_if_needed@path@filesystem@ierd_tgp@@AAEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000008,0000001C,6D0360EC,00000008,00000004,6D039EAD,?,00000000,?,?,?,0000018C,6D03A607,?,?,?), ref: 6D0508F7
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(6D2911A4), ref: 6D0361FF
          Strings
          • cfg_folder_appdata failed, xrefs: 6D036237
          • config, xrefs: 6D0361DF
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6D036223
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_Pathmemset$??_0path@filesystem@ierd_tgp@@?append_separator_if_needed@path@filesystem@ierd_tgp@@?get_client_version_type@overseas@ierd_tgp@@?get_log_instance@base@@DataFolderGameH_prolog3_catch_Logger@1@Sys_wrapper@common@ierd_tgp@@U?$char_traits@_V012@V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@
          • String ID: cfg_folder_appdata failed$config$d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp
          • API String ID: 4175577088-3990937998
          • Opcode ID: 14f868b622eccf5a6ee51331397a388f78230e5375bb02caafaf09f5abfa437b
          • Instruction ID: 5185c5d35e0f40b43e2e6f151d95047c4e12982341d0fd7c561c8e4f32098bb7
          • Opcode Fuzzy Hash: 14f868b622eccf5a6ee51331397a388f78230e5375bb02caafaf09f5abfa437b
          • Instruction Fuzzy Hash: EE21A470D0920AEBEB25CFA8C950BDCB7B0AF45308F9580ACD214BB281DB749B45D791
          APIs
          • EnterCriticalSection.KERNEL32(?), ref: 6D012F8E
          • IsWindow.USER32(?), ref: 6D012FB0
          • SendMessageTimeoutA.USER32(?,0000004A,?,?,00000000,000007D0,?), ref: 6D012FE5
          • GetLastError.KERNEL32 ref: 6D012FF9
          • LeaveCriticalSection.KERNEL32(?), ref: 6D013013
          Strings
          • [SimpleIPC]Window already destroyed: %d., xrefs: 6D013004
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$EnterErrorLastLeaveMessageSendTimeoutWindow
          • String ID: [SimpleIPC]Window already destroyed: %d.
          • API String ID: 2514143000-681933670
          • Opcode ID: 0d029600d68812b7c3f25a208f41dcc63f49a5da2737a4331c0056da37b3ab12
          • Instruction ID: efbd54b80768620b08d85ce41a5610ed37404c3e7b259b054714d75c694d6104
          • Opcode Fuzzy Hash: 0d029600d68812b7c3f25a208f41dcc63f49a5da2737a4331c0056da37b3ab12
          • Instruction Fuzzy Hash: FD216D76A04206EFEF11DFA9C845BAE7BF4FB8A341B00842AE859D7240D731E954DB60
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D046610
            • Part of subcall function 6D046725: __EH_prolog3.LIBCMT ref: 6D04672C
          • ?native@path@filesystem@ierd_tgp@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000064,6D046603), ref: 6D046662
          Strings
          • bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_, xrefs: 6D0466C3
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp, xrefs: 6D0466BE
          • hL8m, xrefs: 6D046667
          • " failed, xrefs: 6D046695
          • conversion of data to type ", xrefs: 6D046673
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?native@path@filesystem@ierd_tgp@@H_prolog3H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@
          • String ID: " failed$bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_$conversion of data to type "$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp$hL8m
          • API String ID: 1752058968-4033847162
          • Opcode ID: d8c78db13fb324d4e024e49423dabc3cb2fce8af1c942a3689fb54e8e7136670
          • Instruction ID: 71ec37cc1750ee89d80e5d30165f7a773dbf7bef4ef3fe3e0ea936b4b2275fb8
          • Opcode Fuzzy Hash: d8c78db13fb324d4e024e49423dabc3cb2fce8af1c942a3689fb54e8e7136670
          • Instruction Fuzzy Hash: 32219370C05288EAEB10DBF4C809FDEBFB86F55318F55819CA154BB282DB745A09D7A1
          APIs
          • memmove.VCRUNTIME140(?,0FFFFFFF,?,?,?,00000000,00000000,23C35E98,?,?,00000000), ref: 6CFFF94D
          • memmove.VCRUNTIME140(00000000,00000002,?,?,?,00000000,00000000,23C35E98,?,?,00000000), ref: 6CFFF972
          • memset.VCRUNTIME140(00000000,00000000,00000001,00000000,00000002,?,?,?,00000000,00000000,23C35E98,?,?,00000000), ref: 6CFFF98A
          • memset.VCRUNTIME140(00000000,00000000,?,00000000,00000000,00000001,00000000,00000002,?,?,?,00000000,00000000,23C35E98,?,?), ref: 6CFFF996
          • memmove.VCRUNTIME140(00000000,00000002,?,?,?,00000000,00000000,23C35E98,?,?,00000000), ref: 6CFFF9A7
          • memmove.VCRUNTIME140(00000000,00000000,?,00000000,00000002,?,?,?,00000000,00000000,23C35E98,?,?,00000000), ref: 6CFFF9BF
          • memset.VCRUNTIME140(00000000,00000000,?,00000000,00000000,?,00000000,00000002,?,?,?,00000000,00000000,23C35E98,?,?), ref: 6CFFF9CD
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,23C35E98,?,?), ref: 6CFFFA1B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$memset$_invalid_parameter_noinfo_noreturn
          • String ID:
          • API String ID: 3802980928-0
          • Opcode ID: b47f627047a655a8d071d7d650d8335cd9f41e496f9a7ed372bd00ef44357ed2
          • Instruction ID: 8d7fd113ab33292257c58da9bdacc19784a3d707096d5e7f62985a02e2675b8a
          • Opcode Fuzzy Hash: b47f627047a655a8d071d7d650d8335cd9f41e496f9a7ed372bd00ef44357ed2
          • Instruction Fuzzy Hash: 03412672E10115AFDB24CB68CC40A5FB7E9EF85368F258229E525E76A0E770ED12C790
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D02BD3D
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(00000028), ref: 6D02BD44
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02BD5A
          • ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 6D02BD66
          • ungetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6D02BE84
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$Gninc@?$basic_streambuf@H_prolog3_ungetc
          • String ID:
          • API String ID: 4215999511-0
          • Opcode ID: 702c17d4cf293ee419f58457ac68d4872769fe61bea364dc003307fe408da10b
          • Instruction ID: dab1f2eaf98c1b9c2e6d54ec81d03ad92ac03b6a40c07f16411ee36e85d8e743
          • Opcode Fuzzy Hash: 702c17d4cf293ee419f58457ac68d4872769fe61bea364dc003307fe408da10b
          • Instruction Fuzzy Hash: 7A519031E1551ADFDF15CFA4C890AEDBBB5FF09335B54011AD611B3590DB30A944CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05BC4B
            • Part of subcall function 6D0160AA: __EH_prolog3_GS.LIBCMT ref: 6D0160B1
            • Part of subcall function 6D0160AA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040,00000034,6D017475,0000001C,6D0159BA,?,?,?,000000D4,6D014672,?,?), ref: 6D0160C6
            • Part of subcall function 6D0173AA: __EH_prolog3_GS.LIBCMT ref: 6D0173B1
            • Part of subcall function 6D0173AA: CryptGenRandom.ADVAPI32(?,?,?,00000034,6D01748A,?,00000010,0000001C,6D0159BA,?,?,?,000000D4,6D014672,?,?), ref: 6D0173BF
            • Part of subcall function 6D0030A0: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(23C35E98,?), ref: 6D0030E3
            • Part of subcall function 6D0030A0: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,23C35E98,?), ref: 6D003101
            • Part of subcall function 6D0030A0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 6D00312B
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?,00000002,00000001,?,00000010,000000E8,6D05BAD8,?,?,000000D8,6D05A41A,?,?,?,00000140), ref: 6D05BCCD
          • ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z.MSVCP140(0000005F), ref: 6D05BCE8
            • Part of subcall function 6D003E10: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(23C35E98,?,?,00000000), ref: 6D003E86
            • Part of subcall function 6D003E10: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,00000040,23C35E98,?,?,00000000), ref: 6D003F18
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z.MSVCP140(Function_00010520), ref: 6D05BD02
          • ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z.MSVCP140(00000030), ref: 6D05BD1B
          • ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000002,00000000), ref: 6D05BD43
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(00000000), ref: 6D05BD53
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(00000002), ref: 6D05BD96
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@H_prolog3_$?widen@?$basic_ios@CryptV01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@?flush@?$basic_ostream@?sputc@?$basic_streambuf@?width@ios_base@std@@AcquireContextD@std@@@1@_RandomV01@_V12@V21@@V?$basic_streambuf@Vios_base@1@
          • String ID:
          • API String ID: 1132785525-0
          • Opcode ID: 473d6428fd24eea8c1fea8c165cbfebc25bb1665294bec013ec301e9982f45db
          • Instruction ID: 4d828a004a3dbc96e0530918fadf58c6aa7702d3f58f5238339eb8cec49311d6
          • Opcode Fuzzy Hash: 473d6428fd24eea8c1fea8c165cbfebc25bb1665294bec013ec301e9982f45db
          • Instruction Fuzzy Hash: 53418131D0425ADFDF15DFA4C959BEEBBB0AF05309F1040A9D605AB181EBB46B49CF81
          APIs
          • ConnectNamedPipe.KERNEL32(?,00000000), ref: 6D03AD35
          • GetLastError.KERNEL32 ref: 6D03AD3F
          • ReadFile.KERNEL32(?,?,000003FF,?,00000000), ref: 6D03AD68
          • EnterCriticalSection.KERNEL32(?), ref: 6D03AD80
          • LeaveCriticalSection.KERNEL32(?,00000000,?), ref: 6D03ADBE
          • SetEvent.KERNEL32(?), ref: 6D03ADC7
          • ReadFile.KERNEL32(?,?,000003FF,00000000,00000000), ref: 6D03ADE5
          • DisconnectNamedPipe.KERNEL32(?), ref: 6D03ADF3
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CriticalFileNamedPipeReadSection$ConnectDisconnectEnterErrorEventLastLeave
          • String ID:
          • API String ID: 1260156429-0
          • Opcode ID: 694a2d0088b5f487d08364604c7597704fa6e75d04308402163709b48f6cb52f
          • Instruction ID: 912d000bae8620cea4d5231c178a7dff0195dc49c90c0bba3e3f09b2febde005
          • Opcode Fuzzy Hash: 694a2d0088b5f487d08364604c7597704fa6e75d04308402163709b48f6cb52f
          • Instruction Fuzzy Hash: A92182B150422AAFEF10DF20CD48FAA77BDEF46306F504469E742A2150DB71A949CB64
          APIs
          • EnterCriticalSection.KERNEL32(?,?,00000000,02834039,?,771ADFA0,02833648), ref: 02834074
          • ResetEvent.KERNEL32(?,?,00000000,02834039,?,771ADFA0,02833648), ref: 02834087
          • ResetEvent.KERNEL32(?,?,00000000,02834039,?,771ADFA0,02833648), ref: 02834090
          • ResetEvent.KERNEL32(?,?,00000000,02834039,?,771ADFA0,02833648), ref: 02834099
            • Part of subcall function 02831350: HeapFree.KERNEL32(?,00000000,?,?,?,028340A6,?,00000000,02834039,?,771ADFA0,02833648), ref: 02831390
            • Part of subcall function 02831420: HeapFree.KERNEL32(?,00000000,?,?,?,028340B1,?,00000000,02834039,?,771ADFA0,02833648), ref: 0283143D
            • Part of subcall function 02831420: _free.LIBCMT ref: 02831459
          • HeapDestroy.KERNEL32(?,?,00000000,02834039,?,771ADFA0,02833648), ref: 028340B9
          • HeapCreate.KERNEL32(?,?,?,?,00000000,02834039,?,771ADFA0,02833648), ref: 028340D4
          • SetEvent.KERNEL32(?,?,00000000,02834039,?,771ADFA0,02833648), ref: 02834150
          • LeaveCriticalSection.KERNEL32(?,?,00000000,02834039,?,771ADFA0,02833648), ref: 02834157
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
          • String ID:
          • API String ID: 1219087420-0
          • Opcode ID: cd8741e3aa766afe683abc449857085dbe24576b6f9ae5b915afae72daec9ff8
          • Instruction ID: 0d3da87df12ba81e90bc5c0277253fb6703ecb0c9eca274622ea2be86a68f2f7
          • Opcode Fuzzy Hash: cd8741e3aa766afe683abc449857085dbe24576b6f9ae5b915afae72daec9ff8
          • Instruction Fuzzy Hash: 0531037C600A06AFD746DB68C898B9AF7E9FF48310F148659E429C7250DB39B865CFD0
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0C2C8D
          • ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000018,6D0C265E,00000000,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2C98
          • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2CAF
          • std::locale::_Getfacet.LIBCPMT ref: 6D0C2CB9
            • Part of subcall function 6D00D022: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000008,?,?,6D008242,00000000), ref: 6D00D047
          • ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2CD2
          • std::_Facet_Register.LIBCPMT ref: 6D0C2CEA
          • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2D0D
          • _CxxThrowException.VCRUNTIME140(?,6D32BC28,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2D2C
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Lockit@std@@$??0_??1_Bid@locale@std@@D@std@@@std@@@std@@ExceptionFacet_Getcat@?$time_get@GetfacetGetgloballocale@locale@std@@H_prolog3Locimp@12@RegisterThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@std::_std::locale::_
          • String ID:
          • API String ID: 1636399683-0
          • Opcode ID: 1b81b14c9185a95c4372c653cff5d7d1414d13aeefd2e800034daa05786afc5c
          • Instruction ID: bf3b49db324f1ec824830033c7c116f542adb54ecf6003a2055e1cc38fe982d2
          • Opcode Fuzzy Hash: 1b81b14c9185a95c4372c653cff5d7d1414d13aeefd2e800034daa05786afc5c
          • Instruction Fuzzy Hash: E0115E71C05229DFCF15CFA4C988AEEBBB4BF0A315B114559E511B7290DB30AE09CB90
          APIs
            • Part of subcall function 02831610: __vswprintf.LIBCMT ref: 02831646
          • _malloc.LIBCMT ref: 02832330
            • Part of subcall function 02836E83: __FF_MSGBANNER.LIBCMT ref: 02836E9C
            • Part of subcall function 02836E83: __NMSG_WRITE.LIBCMT ref: 02836EA3
            • Part of subcall function 02836E83: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F), ref: 02836EC8
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: AllocHeap__vswprintf_malloc
          • String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
          • API String ID: 3475126156-868042568
          • Opcode ID: c8ba2b4e298e23493b91035a5dfa1943591e9e6f05825d9f5b6098096515daae
          • Instruction ID: 74eea3c49db8a3d8ba95a5d00a3257678d40ade6e3286ce076e670e4defbecac
          • Opcode Fuzzy Hash: c8ba2b4e298e23493b91035a5dfa1943591e9e6f05825d9f5b6098096515daae
          • Instruction Fuzzy Hash: 7CB1917DA002058BCF19CF6CD8806AAB7A6BF44714F0886AADD09DB34AE771DD41CBD1
          APIs
          • ?widen@?$ctype@D@std@@QBEDD@Z.MSVCP140(00000025), ref: 6D01E9B0
            • Part of subcall function 6D01A55E: __EH_prolog3.LIBCMT ref: 6D01A565
            • Part of subcall function 6D01E5D8: __EH_prolog3_GS.LIBCMT ref: 6D01E5E2
            • Part of subcall function 6D01E5D8: ?widen@?$ctype@D@std@@QBEDD@Z.MSVCP140(00000020,?,00000088), ref: 6D01E605
          • ?widen@?$ctype@D@std@@QBEDD@Z.MSVCP140(00000020), ref: 6D01EC48
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(00000000,?,?,00000000,?,00000000), ref: 6D01ECD3
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,?,?,00000000,?,00000000), ref: 6D01ECE5
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,?,00000000,?,00000000), ref: 6D01ED00
          • ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(000000FF,?,?,00000000,?,00000000), ref: 6D01ED0F
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,?,00000000,?,00000000), ref: 6D01ED1C
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?widen@?$ctype@D@std@@$?gbump@?$basic_streambuf@H_prolog3H_prolog3_
          • String ID:
          • API String ID: 2712489532-0
          • Opcode ID: 58f5a95910209863a767ede503f0cf455a5ec2e499ca9f2635397251cb0b92d4
          • Instruction ID: f96f0a7472d894ce8118489c3f37423638f49671f7ee8c1780f531f7206b2998
          • Opcode Fuzzy Hash: 58f5a95910209863a767ede503f0cf455a5ec2e499ca9f2635397251cb0b92d4
          • Instruction Fuzzy Hash: 3AB19470A082248FEB24CF68CC84BAEBBB6BF86314F5442D9D559D7691D7309E85CF11
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0B77C3
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000088,6D0B6946,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0B77E9
          • ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000), ref: 6D0B79D4
          • ?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000001,?,00000000), ref: 6D0B79E4
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • [PerfEvent] Qos main thread warning, type=%d, duration=%.2lf, top1_name=%s, top1_duration=%.2lf, top2_name=%s, top2_duration=%.2lf, top3_name=%s, top3_duration=%.2lf, running_state=%d, after_create=%.2lf, after_login=%.2lf, is_main_wnd_show=%d, xrefs: 6D0B78A0
          • d:\ci_dev\wegame_client\codes\common\src\trace_event.cpp, xrefs: 6D0B7815
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?report@H_prolog3H_prolog3_Logger@1@Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@Qos_occasion@234@@
          • String ID: [PerfEvent] Qos main thread warning, type=%d, duration=%.2lf, top1_name=%s, top1_duration=%.2lf, top2_name=%s, top2_duration=%.2lf, top3_name=%s, top3_duration=%.2lf, running_state=%d, after_create=%.2lf, after_login=%.2lf, is_main_wnd_show=%d$d:\ci_dev\wegame_client\codes\common\src\trace_event.cpp
          • API String ID: 85306453-2629279815
          • Opcode ID: 14a691bab0e67b423881b8dbd22faa65aad021e96d236a2c096c905d9b367030
          • Instruction ID: 935fea7f991116041284a033fcf85b69480dde403bd682fc470114c0498d7078
          • Opcode Fuzzy Hash: 14a691bab0e67b423881b8dbd22faa65aad021e96d236a2c096c905d9b367030
          • Instruction Fuzzy Hash: 8F61C071C14B09AFEB06CF74C812ADEB7B5EF56384F108349B4193B192DB719992CB80
          APIs
          • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(23C35E98,?,?,00000000), ref: 6D003E86
          • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,00000040,23C35E98,?,?,00000000), ref: 6D003F18
          • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(00000000,00000040,23C35E98,?,?,00000000), ref: 6D003F43
          • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 6D003F7B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@V12@
          • String ID:
          • API String ID: 2696997341-0
          • Opcode ID: 5db04d16fc7ed7825baf693cf4572e38617c4bc88dcaa2ba325eacb4efda9e95
          • Instruction ID: d29663e83f04d0dac5af44556f405e3537a57a5f7485a3a2b0e3cfd1d1447577
          • Opcode Fuzzy Hash: 5db04d16fc7ed7825baf693cf4572e38617c4bc88dcaa2ba325eacb4efda9e95
          • Instruction Fuzzy Hash: 6A61BF75A00645AFEB01CF68C584B6DBBB1FF8E324F258259EA159B392C731ED45CB80
          APIs
          • _free.LIBCMT ref: 02831878
          • _free.LIBCMT ref: 028318B6
          • _free.LIBCMT ref: 028318F5
          • _free.LIBCMT ref: 02831935
          • _free.LIBCMT ref: 0283195D
          • _free.LIBCMT ref: 02831981
          • _free.LIBCMT ref: 028319B9
            • Part of subcall function 02836E49: HeapFree.KERNEL32(00000000,00000000,?,02839900,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F), ref: 02836E5F
            • Part of subcall function 02836E49: GetLastError.KERNEL32(00000000,?,02839900,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000), ref: 02836E71
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: _free$ErrorFreeHeapLast
          • String ID:
          • API String ID: 776569668-0
          • Opcode ID: 32644b570dee62bc655ab06e40f45a2c665617d8ad2fbf5ca1ce5fd0cd9d551d
          • Instruction ID: 707de4c584b10ba43c0b4864254068070e13dd5a22875fa79aa0d99759b40cff
          • Opcode Fuzzy Hash: 32644b570dee62bc655ab06e40f45a2c665617d8ad2fbf5ca1ce5fd0cd9d551d
          • Instruction Fuzzy Hash: 3951297EA00114DFD715DF5CC484965BBE6BF8931872980ADC90EAB311D732AD42CBD1
          APIs
          • GetCurrentThreadId.KERNEL32 ref: 02833883
          • SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 028338C4
          • WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 02833931
          • GetCurrentThreadId.KERNEL32 ref: 0283395C
          • GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 028339F4
          • SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 02833A22
          • WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 02833A39
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
          • String ID:
          • API String ID: 3058130114-0
          • Opcode ID: da8692251464322d2f202de6d862e26ad5028dae5a1195c28a9e0fa0dc0c6f71
          • Instruction ID: 5217781dfa464aaadcd4c66bdfaf6f15f5514a02240e8e581fbefcddd0fc5d68
          • Opcode Fuzzy Hash: da8692251464322d2f202de6d862e26ad5028dae5a1195c28a9e0fa0dc0c6f71
          • Instruction Fuzzy Hash: 2B517B7CA04701DBDB22DF28C984BAAB7E5BF06719F504959DD5ADB280EB34E840CBD1
          APIs
          • std::_Cnd_initX.LIBCPMT ref: 6D08ADED
            • Part of subcall function 6D0217D4: _Mtx_lock.MSVCP140(?,?,?,6D021B80,?,00000014), ref: 6D0217DB
            • Part of subcall function 6D0217D4: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021B80,?,00000014), ref: 6D0217E8
          • memmove.VCRUNTIME140(?,?,?,23C35E98,?,?,?,00000000,6D27B78B,000000FF,?,6D0862F6,?,?,00000000,00000003), ref: 6D08AE05
          • std::_Cnd_initX.LIBCPMT ref: 6D08AE32
            • Part of subcall function 6D0217F3: _Mtx_unlock.MSVCP140(?,?,?,6D021BC0,?,?,?), ref: 6D0217FA
            • Part of subcall function 6D0217F3: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021BC0,?,?,?), ref: 6D021807
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D08AE38
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D01F613: __EH_prolog3_GS.LIBCMT ref: 6D01F648
          Strings
          • [Qos_http_handler]report qos id= %d, xrefs: 6D08AE80
          • d:\ci_dev\wegame_client\codes\common\src\qos_http_handler.cpp, xrefs: 6D08AE61
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: C_error@std@@Cnd_initThrow_std::_$?get_log_instance@base@@H_prolog3H_prolog3_Logger@1@Mtx_lockMtx_unlockmemmove
          • String ID: [Qos_http_handler]report qos id= %d$d:\ci_dev\wegame_client\codes\common\src\qos_http_handler.cpp
          • API String ID: 1988896588-2901712207
          • Opcode ID: 005ccb9086c5ab59648273cb6a4041aea170cfd33e16f85fabacdbfa3952b3d7
          • Instruction ID: ab4e9930a9b630c9c3ae3c1ef60351f844faa7a2e5858adc31d7a693122e4a80
          • Opcode Fuzzy Hash: 005ccb9086c5ab59648273cb6a4041aea170cfd33e16f85fabacdbfa3952b3d7
          • Instruction Fuzzy Hash: E8411571908249EFEF14DBA4C840FEEBBB8EF45318F20016DD611A72C1DB75AA05CBA1
          APIs
          • std::_Cnd_initX.LIBCPMT ref: 6D08AF44
            • Part of subcall function 6D0217D4: _Mtx_lock.MSVCP140(?,?,?,6D021B80,?,00000014), ref: 6D0217DB
            • Part of subcall function 6D0217D4: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021B80,?,00000014), ref: 6D0217E8
          • memmove.VCRUNTIME140(?,?,00000000,23C35E98,?,?,00000000,00000000,6D27B78B,000000FF,?,6D083815,?,?), ref: 6D08AF5C
          • std::_Cnd_initX.LIBCPMT ref: 6D08AF89
            • Part of subcall function 6D0217F3: _Mtx_unlock.MSVCP140(?,?,?,6D021BC0,?,?,?), ref: 6D0217FA
            • Part of subcall function 6D0217F3: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021BC0,?,?,?), ref: 6D021807
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?), ref: 6D08AF8F
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D01F613: __EH_prolog3_GS.LIBCMT ref: 6D01F648
          Strings
          • [Qos_http_handler] report offline data qos id= %d, xrefs: 6D08AFD7
          • d:\ci_dev\wegame_client\codes\common\src\qos_http_handler.cpp, xrefs: 6D08AFB8
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: C_error@std@@Cnd_initThrow_std::_$?get_log_instance@base@@H_prolog3H_prolog3_Logger@1@Mtx_lockMtx_unlockmemmove
          • String ID: [Qos_http_handler] report offline data qos id= %d$d:\ci_dev\wegame_client\codes\common\src\qos_http_handler.cpp
          • API String ID: 1988896588-2836032468
          • Opcode ID: a2f00ddaa2a4cd67545234eb716a0804d44d77b0cc01cfff6da1ce5887fea58e
          • Instruction ID: cdebff9bb73c99f2b2ddf49793fa2f0573a1524882123d1523fd6a021df50e0e
          • Opcode Fuzzy Hash: a2f00ddaa2a4cd67545234eb716a0804d44d77b0cc01cfff6da1ce5887fea58e
          • Instruction Fuzzy Hash: 9B411571908249AFEB15DBA4C850FEEBBB8EF49318F10016DD211A72C2DB759B05CB61
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0C22DC
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000006C,6D0C228A,?,?,?,?,00000054), ref: 6D0C241A
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
            • Part of subcall function 6D035AA6: __EH_prolog3_GS.LIBCMT ref: 6D035AAD
            • Part of subcall function 6D035AA6: ??_0path@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,00000024,6D050C4F,?,?,?), ref: 6D035ADD
            • Part of subcall function 6D035AA6: ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000000,?,00000024,6D050C4F,?,?,?), ref: 6D035AE5
          • ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,00000000), ref: 6D0C238F
            • Part of subcall function 6D07F111: _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,?,6D07F0F8,?,?,?,?,?,?,?,?,0000001C), ref: 6D07F122
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000), ref: 6D0C2385
            • Part of subcall function 6D00FACF: __EH_prolog3.LIBCMT ref: 6D00FAD6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?wstring@path@filesystem@ierd_tgp@@H_prolog3_W@2@@std@@W@2@@std@@@$??0path@filesystem@ierd_tgp@@??_0path@filesystem@ierd_tgp@@?file_exists@common@ierd_tgp@@H_prolog3V012@V012@@_waccessmemmove
          • String ID: TCLS$rail_files\TCLS
          • API String ID: 1928432721-1818506932
          • Opcode ID: 4082a4f1db2b42a7316b15542ca09d46b5844ac258d7ba9df8ca376671a7a316
          • Instruction ID: dbd34c778b8544b5e69c8d226218791be9ff4330452bcfd941d6b012a5713b99
          • Opcode Fuzzy Hash: 4082a4f1db2b42a7316b15542ca09d46b5844ac258d7ba9df8ca376671a7a316
          • Instruction Fuzzy Hash: 3241F871C09288EAEB10DBE4C884BDDFBB4BF25308F55416DD201B7191DB745B49DBA2
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D02E05B
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054), ref: 6D02E080
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054), ref: 6D02E0FC
          Strings
          • SendData error, input param is invalid, xrefs: 6D02E134
          • d:\ci_dev\wegame_client\codes\common\src\base_named_pipe.cpp, xrefs: 6D02E0AC, 6D02E120
          • SendData error, data size:%u too large, xrefs: 6D02E0C4
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@$H_prolog3H_prolog3_H_prolog3_catch_
          • String ID: SendData error, data size:%u too large$SendData error, input param is invalid$d:\ci_dev\wegame_client\codes\common\src\base_named_pipe.cpp
          • API String ID: 2321812390-4266514423
          • Opcode ID: 9c7d0b2fd033e83d0a6dfc47c617ed09771002eab5746bc14f9183c58647ef84
          • Instruction ID: ae6b10d20d5010965450d75a50f950161c8dd5fce0c960b16e3395a46dab8a10
          • Opcode Fuzzy Hash: 9c7d0b2fd033e83d0a6dfc47c617ed09771002eab5746bc14f9183c58647ef84
          • Instruction Fuzzy Hash: 41212570E82706B7FB24DBA4CC46FAE3365AF81714F224118A920BF3C5DB719A46C685
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D032EAB
            • Part of subcall function 6D032F8D: __EH_prolog3.LIBCMT ref: 6D032F94
          • ?native@path@filesystem@ierd_tgp@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,0000006C,6D032E8E,00000002,00000002,00000004,6D032E5D,00000002,?,00000004,6D0B7512,?,?,net_daemon_path,0000002E), ref: 6D032F1D
          Strings
          • class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std, xrefs: 6D032F81
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp, xrefs: 6D032F7C
          • " failed, xrefs: 6D032F53
          • conversion of data to type ", xrefs: 6D032F2E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?native@path@filesystem@ierd_tgp@@H_prolog3H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@
          • String ID: " failed$class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std$conversion of data to type "$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp
          • API String ID: 1752058968-2167445750
          • Opcode ID: 3469236e4ad44c8e0c070415ec4746545562c813e97fd0121e81bec4ac87c77f
          • Instruction ID: dc7de3dcf47271bf1bff224a08a730cc36bab9ce88d279f0b4adcacbce79350c
          • Opcode Fuzzy Hash: 3469236e4ad44c8e0c070415ec4746545562c813e97fd0121e81bec4ac87c77f
          • Instruction Fuzzy Hash: 8521AC71C0538CAAEB10CFF4C844AEEBBB8AF19208F554459E551BB242DB745A09DBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A67BE
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,6D2911A4,00000068), ref: 6D0A67F3
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,6D2911A4,00000068), ref: 6D0A67FF
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • ?SetFileAuthority@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,6D2911A4,00000068), ref: 6D0A6860
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A6823
          • [Sys_wrapper]SetFileAuthority, path empty: %s, xrefs: 6D0A6840
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?get_log_instance@base@@?u8to16@common@ierd_tgp@@Authority@D@2@@std@@D@std@@FileH_prolog3Logger@1@Sys_wrapper@common@ierd_tgp@@U?$char_traits@V?$allocator@V?$basic_string@W@2@@4@@W@2@@std@@@
          • String ID: [Sys_wrapper]SetFileAuthority, path empty: %s$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 2090060014-4293479081
          • Opcode ID: 57ed402068f3e34315e10eada47912ed920752749ae74d0ebb10a4477eb9fd87
          • Instruction ID: e65142bb9cf8538f4ea843ede641df9785c57cbb87ee633f2fc38530933b8d07
          • Opcode Fuzzy Hash: 57ed402068f3e34315e10eada47912ed920752749ae74d0ebb10a4477eb9fd87
          • Instruction Fuzzy Hash: DA219370849609AFEB10DFE8C880BEDB774EF05714FA5012DE5147F191DB719A44CBA1
          APIs
          • ___set_flsgetvalue.LIBCMT ref: 02837240
          • __calloc_crt.LIBCMT ref: 0283724C
          • __getptd.LIBCMT ref: 02837259
          • CreateThread.KERNEL32(00000000,?,028371B6,00000000,00000000,02832F79), ref: 02837290
          • GetLastError.KERNEL32(?,75C9F070,00000001,?,02832F79,00000000,00000000,02832FB0,?,00000000,?), ref: 0283729A
          • _free.LIBCMT ref: 028372A3
          • __dosmaperr.LIBCMT ref: 028372AE
            • Part of subcall function 0283710D: __getptd_noexit.LIBCMT ref: 0283710D
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
          • String ID:
          • API String ID: 155776804-0
          • Opcode ID: 45859b87f01dba3b87c5a1e9ed2a04e08cccc6c8fe1faa01f7249465dd7421cb
          • Instruction ID: d01280a46fcb1fa184af42cff3128ece75d32eddef1cea51009132ca3bf48ba2
          • Opcode Fuzzy Hash: 45859b87f01dba3b87c5a1e9ed2a04e08cccc6c8fe1faa01f7249465dd7421cb
          • Instruction Fuzzy Hash: E11182BE105705AFEB13AFA9DC40A9FB7DAEF45364B100419FA19D6180DB71D4108AE1
          APIs
          • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Internet Explorer,00000000,00020019,?), ref: 6D0ABBE9
          • memset.VCRUNTIME140(?,00000000,00000104), ref: 6D0ABC0D
          • RegQueryValueExA.ADVAPI32(?,Version,00000000,?,?,?), ref: 6D0ABC36
          • RegCloseKey.ADVAPI32(?), ref: 6D0ABC42
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CloseOpenQueryValuememset
          • String ID: Software\Microsoft\Internet Explorer$Version
          • API String ID: 1830152886-2486530099
          • Opcode ID: d47a2ef1c9b7433151ccbece04b577adecec9c8de14ca69a2de42c4168369cbe
          • Instruction ID: 4d3fc48e3efbb570867cecda9b301d132d03642e38a718568cc405201d4ecb3e
          • Opcode Fuzzy Hash: d47a2ef1c9b7433151ccbece04b577adecec9c8de14ca69a2de42c4168369cbe
          • Instruction Fuzzy Hash: B0115E7190415DAFDF21CB65CC49EEBB7BCEB86704F0041A6A649A6100DB709A89DFA0
          APIs
          • __EH_prolog3.LIBCMT ref: 6D08E96C
          • ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000014,6D090919,?,?,?,6D08ECAD,00000004,6D09BB84,00000008,6D09BE3F,?,00000001,0000001C,6D09BD63,?), ref: 6D08E977
          • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,6D08ECAD,00000004,6D09BB84,00000008,6D09BE3F,?,00000001,0000001C,6D09BD63,?,?,?,00000038), ref: 6D08E98F
          • std::locale::_Getfacet.LIBCPMT ref: 6D08E999
            • Part of subcall function 6D00D022: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000008,?,?,6D008242,00000000), ref: 6D00D047
          • std::_Facet_Register.LIBCPMT ref: 6D08E9CA
          • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,6D08ECAD,00000004,6D09BB84,00000008,6D09BE3F,?,00000001,0000001C,6D09BD63,?,?,?,00000038), ref: 6D08E9EA
          • _CxxThrowException.VCRUNTIME140(?,6D32BC28,00000000,?,?,6D08ECAD,00000004,6D09BB84,00000008,6D09BE3F,?,00000001,0000001C,6D09BD63,?,?), ref: 6D08EA09
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Lockit@std@@$??0_??1_Bid@locale@std@@ExceptionFacet_GetfacetGetgloballocale@locale@std@@H_prolog3Locimp@12@RegisterThrowstd::_std::locale::_
          • String ID:
          • API String ID: 2295579510-0
          • Opcode ID: ef8b74374c2893c9cd9cb3c13ec7a00ec2f0060dfd247bd796e707750f81957c
          • Instruction ID: 725741515c4dce71051b2787a88751eb57cc95e271e6bd31c5f501dbc1058cf7
          • Opcode Fuzzy Hash: ef8b74374c2893c9cd9cb3c13ec7a00ec2f0060dfd247bd796e707750f81957c
          • Instruction Fuzzy Hash: E0110631C08229DFCF15CFA4C848AFEB7B8BF4A314B250619E665B7390DBB09A05CB50
          APIs
          • __EH_prolog3.LIBCMT ref: 6D06E561
          • ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000014,6D072A6B,?,?,?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?), ref: 6D06E56C
          • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?,?,?,?,?,?,?), ref: 6D06E584
          • std::locale::_Getfacet.LIBCPMT ref: 6D06E58E
            • Part of subcall function 6D00D022: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000008,?,?,6D008242,00000000), ref: 6D00D047
          • std::_Facet_Register.LIBCPMT ref: 6D06E5BF
          • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?,?,?,?,?,?), ref: 6D06E5DF
          • _CxxThrowException.VCRUNTIME140(?,6D32BC28,00000000,?,6D06E983,00000004,6D06EAC7,00000008,6D071858,?,00000001,?,?), ref: 6D06E5FE
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Lockit@std@@$??0_??1_Bid@locale@std@@ExceptionFacet_GetfacetGetgloballocale@locale@std@@H_prolog3Locimp@12@RegisterThrowstd::_std::locale::_
          • String ID:
          • API String ID: 2295579510-0
          • Opcode ID: e8c5edb49abea3a27a56e070235cfef15a0aee47e20be77e7a7561dab006761f
          • Instruction ID: a5fec2ff92e436e7d59b6f537794c5384e0a725ce6d681acdbc07f57e3288227
          • Opcode Fuzzy Hash: e8c5edb49abea3a27a56e070235cfef15a0aee47e20be77e7a7561dab006761f
          • Instruction Fuzzy Hash: 9411A331C08229EFDF15DFA4CC88AEE77B4BF4A315B214659E525B7390EB709A05CB60
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AE85F
          • ?disk_is_fixed_remote@Sys_wrapper@common@ierd_tgp@@SA_NPB_W@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000050), ref: 6D0AE868
            • Part of subcall function 6D0AA9D5: __EH_prolog3_GS.LIBCMT ref: 6D0AA9DF
            • Part of subcall function 6D0AA9D5: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000258,6D0A0748,?,00000050), ref: 6D0AA9E8
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000050), ref: 6D0AE872
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,00000050), ref: 6D0AE8CF
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0AE896
          • [Sys_wrapper]path is not valid in waccess_fixed_remote, xrefs: 6D0AE8AA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$?disk_is_fixed_remote@?get_log_instance@base@@H_prolog3H_prolog3_catch_Logger@1@Sys_wrapper@common@ierd_tgp@@_waccesswcslen
          • String ID: [Sys_wrapper]path is not valid in waccess_fixed_remote$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 673643358-2021405213
          • Opcode ID: 11e8183379af2277135377f8c563019d514214d5ab00f48401534eca2673cc79
          • Instruction ID: 521935b567d0d9682230cb4d5263ae43c784b6cadadf780eba901e0242a67250
          • Opcode Fuzzy Hash: 11e8183379af2277135377f8c563019d514214d5ab00f48401534eca2673cc79
          • Instruction Fuzzy Hash: 79014931A48706BBFB24ABE0DC15FAD3320AF42728F714014E624BF1C6CB669A069794
          APIs
          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,02847C00,00000008,028398EA,00000000,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C), ref: 028397F3
          • __lock.LIBCMT ref: 02839827
            • Part of subcall function 0283C144: __mtinitlocknum.LIBCMT ref: 0283C15A
            • Part of subcall function 0283C144: __amsg_exit.LIBCMT ref: 0283C166
            • Part of subcall function 0283C144: EnterCriticalSection.KERNEL32(00000000,00000000,?,028399BA,0000000D,02847C28,00000008,02839AB1,00000000,?,02837711,00000000,02847B60,00000008,02837776,?), ref: 0283C16E
          • InterlockedIncrement.KERNEL32(?), ref: 02839834
          • __lock.LIBCMT ref: 02839848
          • ___addlocaleref.LIBCMT ref: 02839866
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
          • String ID: KERNEL32.DLL
          • API String ID: 637971194-2576044830
          • Opcode ID: aa5964d562e2e3253401c4a4b308c684b454573b22fa167c87bd405a03cf8454
          • Instruction ID: 293adcdc7d18a3afb108ab9e6632f85f9eda8ce3e075a45eee802a11496feff7
          • Opcode Fuzzy Hash: aa5964d562e2e3253401c4a4b308c684b454573b22fa167c87bd405a03cf8454
          • Instruction Fuzzy Hash: 79018B7D844B00DBE321AFA9C44574EFBE1AF60324F10890AD59AD6290CBB8A644CF92
          APIs
          • ___set_flsgetvalue.LIBCMT ref: 028371BC
            • Part of subcall function 02839754: TlsGetValue.KERNEL32(00000000,028398AD,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000,00000000), ref: 0283975D
            • Part of subcall function 02839754: DecodePointer.KERNEL32(?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000,00000000,?,028399BA,0000000D), ref: 0283976F
            • Part of subcall function 02839754: TlsSetValue.KERNEL32(00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000,00000000,?,028399BA), ref: 0283977E
          • ___fls_getvalue@4.LIBCMT ref: 028371C7
            • Part of subcall function 02839734: TlsGetValue.KERNEL32(?,?,028371CC,00000000), ref: 02839742
          • ___fls_setvalue@8.LIBCMT ref: 028371DA
            • Part of subcall function 02839788: DecodePointer.KERNEL32(?,?,?,028371DF,00000000,?,00000000), ref: 02839799
          • GetLastError.KERNEL32(00000000,?,00000000), ref: 028371E3
          • ExitThread.KERNEL32 ref: 028371EA
          • GetCurrentThreadId.KERNEL32 ref: 028371F0
          • __freefls@4.LIBCMT ref: 02837210
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
          • String ID:
          • API String ID: 2383549826-0
          • Opcode ID: 7bf0de31e6491162a19ef635b87d017ad65a2f979715a8126d24a814335523f0
          • Instruction ID: 26633e5c30ec9850342bf132cc04a38a93fc0b00863ad087709163f798986299
          • Opcode Fuzzy Hash: 7bf0de31e6491162a19ef635b87d017ad65a2f979715a8126d24a814335523f0
          • Instruction Fuzzy Hash: 5EF030BD400244AFC706BFB9C94894EBBAAAF493547148D58E909C7255DB78D842CFE2
          APIs
          • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 6D0A6FAB
          • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess), ref: 6D0A6FC1
          • GetProcAddress.KERNEL32(00000000), ref: 6D0A6FC8
          • CloseHandle.KERNEL32(00000000), ref: 6D0A6FD2
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Handle$AddressCloseModuleOpenProcProcess
          • String ID: NtSuspendProcess$ntdll
          • API String ID: 4274107956-3692088986
          • Opcode ID: 23962608fd91ce7373d3e0ae98017bb5f5f6e5596def0c1745b8fc8fd293af8f
          • Instruction ID: 84b72ab2a003278a24ad71775f452e8482ba293f9b4375a50873a6ed41ac62db
          • Opcode Fuzzy Hash: 23962608fd91ce7373d3e0ae98017bb5f5f6e5596def0c1745b8fc8fd293af8f
          • Instruction Fuzzy Hash: 70E08632481629BFDA112AE94C0CFEB3B78AF8775BB000001F914D5207C761950DDAE6
          APIs
          • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 6D0A6031
          • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess), ref: 6D0A6047
          • GetProcAddress.KERNEL32(00000000), ref: 6D0A604E
          • CloseHandle.KERNEL32(00000000), ref: 6D0A6058
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Handle$AddressCloseModuleOpenProcProcess
          • String ID: NtResumeProcess$ntdll
          • API String ID: 4274107956-2815025094
          • Opcode ID: 6cbcd6081375eed4e95d8c86af2ab86760c350f63632888aa79e9ede5006e0e5
          • Instruction ID: eec37ec08a4d573462363bd4621cd5e4ae9e3c80ae27d2cb4087c8c1f93aceae
          • Opcode Fuzzy Hash: 6cbcd6081375eed4e95d8c86af2ab86760c350f63632888aa79e9ede5006e0e5
          • Instruction Fuzzy Hash: 63E08636481639BFDA512BE98C0CFEF7B78BF87756B404001FA14D6202CB61944DDAE6
          APIs
          • __getptd.LIBCMT ref: 02843412
            • Part of subcall function 0283990F: __getptd_noexit.LIBCMT ref: 02839912
            • Part of subcall function 0283990F: __amsg_exit.LIBCMT ref: 0283991F
          • __getptd.LIBCMT ref: 02843423
          • __getptd.LIBCMT ref: 02843431
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __getptd$__amsg_exit__getptd_noexit
          • String ID: MOC$RCC$csm
          • API String ID: 803148776-2671469338
          • Opcode ID: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
          • Instruction ID: bb0a56ac9c58cf8c7ae72d7af3739749cf1cfa30f409b4f4b403c8563e8ecff5
          • Opcode Fuzzy Hash: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
          • Instruction Fuzzy Hash: 7EE0123C50410C8FC7119768C0497A832E5FB94319FA940E2D81DDB222CB68E9508983
          APIs
          • memset.VCRUNTIME140(?), ref: 6D096DB1
          • ?eof@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6D096DCE
          • ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z.MSVCP140(?,00002000,00000000), ref: 6D096DEC
          • ?eof@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6D096E1F
          • ?ToHex@common@ierd_tgp@@YAEABE@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D096EAE
          • ?ToHex@common@ierd_tgp@@YAEABE@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000001,?), ref: 6D096EE0
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?eof@ios_base@std@@Hex@common@ierd_tgp@@$?read@?$basic_istream@D@std@@@std@@U?$char_traits@V12@memset
          • String ID:
          • API String ID: 2389642554-0
          • Opcode ID: dbdc8403207011b391aa11025a9da0ad92b371044f62490dc7af59ad789eb2a7
          • Instruction ID: b20bacfa9189f74abbcab39099930d22e2341dce94e95b183cd6920b08125e3d
          • Opcode Fuzzy Hash: dbdc8403207011b391aa11025a9da0ad92b371044f62490dc7af59ad789eb2a7
          • Instruction Fuzzy Hash: 4C515B71904358DEEB25CF64CC9CBDEBBB9AF08344F4045DAD149AB242D771AA98CF60
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0838F0
          • GetCurrentThreadId.KERNEL32 ref: 6D083907
          • std::_Cnd_initX.LIBCPMT ref: 6D083933
            • Part of subcall function 6D0217D4: _Mtx_lock.MSVCP140(?,?,?,6D021B80,?,00000014), ref: 6D0217DB
            • Part of subcall function 6D0217D4: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021B80,?,00000014), ref: 6D0217E8
            • Part of subcall function 6D081BF3: __EH_prolog3.LIBCMT ref: 6D081BFA
          • std::_Cnd_initX.LIBCPMT ref: 6D0839B4
            • Part of subcall function 6D0217F3: _Mtx_unlock.MSVCP140(?,?,?,6D021BC0,?,?,?), ref: 6D0217FA
            • Part of subcall function 6D0217F3: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021BC0,?,?,?), ref: 6D021807
          • ?PushUniqueThreadAsyncTask@common@ierd_tgp@@YAIV?$function@$$A6AXXZ@std@@IK@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0839A4
            • Part of subcall function 6D02158B: __EH_prolog3.LIBCMT ref: 6D021592
          • ?PushUniqueThreadAsyncTask@common@ierd_tgp@@YAIV?$function@$$A6AXXZ@std@@IK@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D083A26
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3Thread$AsyncC_error@std@@Cnd_initPushTask@common@ierd_tgp@@Throw_UniqueV?$function@$$Z@std@@std::_$CurrentMtx_lockMtx_unlock
          • String ID:
          • API String ID: 1795170273-0
          • Opcode ID: 35ee314da74d184bafdc620e5a262f21da2e535fdd88f696ccf4d95c46835798
          • Instruction ID: 530b5c15202e77e809ffc7d557d9f42ddec4131d3b5d9cfa4fbc4f74756fe05e
          • Opcode Fuzzy Hash: 35ee314da74d184bafdc620e5a262f21da2e535fdd88f696ccf4d95c46835798
          • Instruction Fuzzy Hash: 0A515B71C0A288EEDF02DFA8C5406DEBFF4AF1A208F14419DD455AB342D7759B09DB92
          APIs
          • __EH_prolog3.LIBCMT ref: 6D02B85A
          • __alldvrm.LIBCMT ref: 6D02B8F0
          • _Xtime_get_ticks.MSVCP140(00000008,6D0267E1,?,00000024,6D0244C8,?,?,?,?), ref: 6D02B93C
          • __Init_thread_footer.LIBCMT ref: 6D02B95E
            • Part of subcall function 6D11367B: EnterCriticalSection.KERNEL32(6D38AB18,6D388BA0,6D388BB8,?,6D0522F4,6D388BB8,00000000,6D053CE2,6D053744,?,?,?,00000004,6D0515A5), ref: 6D113686
            • Part of subcall function 6D11367B: LeaveCriticalSection.KERNEL32(6D38AB18,?,6D0522F4,6D388BB8,00000000,6D053CE2,6D053744,?,?,?,00000004,6D0515A5), ref: 6D1136C3
          • __Init_thread_footer.LIBCMT ref: 6D02B9AA
          • __Init_thread_footer.LIBCMT ref: 6D02B9FA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Init_thread_footer$CriticalSection$EnterH_prolog3LeaveXtime_get_ticks__alldvrm
          • String ID:
          • API String ID: 719337207-0
          • Opcode ID: 72d0a67440985f3ae1db23b441878b72f9d18f9ec3645b93e9a72e780a389106
          • Instruction ID: c79d72fe2c65994b871aa5dd507f786e9ee725a77785e730d4e4582624628c48
          • Opcode Fuzzy Hash: 72d0a67440985f3ae1db23b441878b72f9d18f9ec3645b93e9a72e780a389106
          • Instruction Fuzzy Hash: 57417BB0C09201EFEB14DF68EC80B6977F8FB47305B25842AF2089B358D770A941EB14
          APIs
          • EnterCriticalSection.KERNEL32(000002FF), ref: 028350AA
          • WSASetLastError.WS2_32(0000139F), ref: 028350C2
          • LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 028350CC
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$EnterErrorLastLeave
          • String ID:
          • API String ID: 4082018349-0
          • Opcode ID: 72a5e1338652c3fe6f4452dd6ec98a30828c0c61c1329c979ba64651ba0703b1
          • Instruction ID: 93152c89d042be3a17c013d400e1ee3888045f80e5f03fe91c2753fcf1fb96d6
          • Opcode Fuzzy Hash: 72a5e1338652c3fe6f4452dd6ec98a30828c0c61c1329c979ba64651ba0703b1
          • Instruction Fuzzy Hash: D831DE7EA046449BD711CF68E885B6EB3E9FB48711F404A1AFD05C7780D73AE810CB90
          APIs
          • WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 028348E1
          • WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 028348EC
          • Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 028348F9
          • CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 02834914
          • CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 0283491D
          • Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 0283492E
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CloseHandleObjectSingleSleepWait
          • String ID:
          • API String ID: 640476663-0
          • Opcode ID: 48c74f764e6705194bc12a95b23adbb86fe6632cff1bccea00465ea9215da981
          • Instruction ID: 49ec8baf94ebb47a14dec86e969f43e92be8aa5a95e28a38645ef03aff6a3819
          • Opcode Fuzzy Hash: 48c74f764e6705194bc12a95b23adbb86fe6632cff1bccea00465ea9215da981
          • Instruction Fuzzy Hash: CC21487E1042889BC711EBA8DC58A8BF3F9FF997147544B09E558C7385C638A806CFE0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07EF38
          • ?str_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000006C), ref: 6D07EF6A
            • Part of subcall function 6D0801EA: __EH_prolog3_GS.LIBCMT ref: 6D0801F1
            • Part of subcall function 6D0801EA: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,0000001C,6D07F183,?,?,00000064,6D017177,?,?,?,?), ref: 6D08021C
          • ?has_parent_path@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,0000006C), ref: 6D07EF7C
            • Part of subcall function 6D00E57D: __EH_prolog3_GS.LIBCMT ref: 6D00E584
            • Part of subcall function 6D00E57D: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(0000001C,0000001C,6D03884F), ref: 6D00E58D
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,0000006C), ref: 6D07EF8F
            • Part of subcall function 6D0539CE: __EH_prolog3_GS.LIBCMT ref: 6D0539D5
            • Part of subcall function 6D0539CE: ?parent_path_end@path@filesystem@ierd_tgp@@ABEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000024,6D052156,?,?), ref: 6D0539E7
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D07EFA5
            • Part of subcall function 6D00FACF: __EH_prolog3.LIBCMT ref: 6D00FAD6
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?path_to_str@common@ierd_tgp@@YA_NABVpath@filesystem@2@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D07EFD1
            • Part of subcall function 6D080002: __EH_prolog3_GS.LIBCMT ref: 6D080009
            • Part of subcall function 6D080002: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,0000001C), ref: 6D08002E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$D@std@@U?$char_traits@V?$allocator@V?$basic_string@$U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?parent_path@path@filesystem@ierd_tgp@@D@2@@std@@V123@W@2@@std@@$?has_parent_path@path@filesystem@ierd_tgp@@?parent_path_end@path@filesystem@ierd_tgp@@?path_to_str@common@ierd_tgp@@?str_to_path@common@ierd_tgp@@?u16to8@common@ierd_tgp@@?u8to16@common@ierd_tgp@@?wstring@path@filesystem@ierd_tgp@@D@2@@4@@D@2@@std@@@H_prolog3Vpath@filesystem@2@Vpath@filesystem@2@@W@2@@4@@memmove
          • String ID:
          • API String ID: 266873086-0
          • Opcode ID: 24c866c8a88ed22b8c4c4b09e4252f4af68991ec57451bbfb6b17d3d1d95763c
          • Instruction ID: 991e78b7c75e83cc22a7dcdc069667d360da9565704f56383312d2bbcdedbee5
          • Opcode Fuzzy Hash: 24c866c8a88ed22b8c4c4b09e4252f4af68991ec57451bbfb6b17d3d1d95763c
          • Instruction Fuzzy Hash: E23139B1C49248DAEF20CFE8C891BDCFFB4AF15314F64015ED115AB292D7711A49CB64
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05BDB9
            • Part of subcall function 6D0160AA: __EH_prolog3_GS.LIBCMT ref: 6D0160B1
            • Part of subcall function 6D0160AA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040,00000034,6D017475,0000001C,6D0159BA,?,?,?,000000D4,6D014672,?,?), ref: 6D0160C6
            • Part of subcall function 6D0173AA: __EH_prolog3_GS.LIBCMT ref: 6D0173B1
            • Part of subcall function 6D0173AA: CryptGenRandom.ADVAPI32(?,?,?,00000034,6D01748A,?,00000010,0000001C,6D0159BA,?,?,?,000000D4,6D014672,?,?), ref: 6D0173BF
            • Part of subcall function 6D0588B8: __EH_prolog3.LIBCMT ref: 6D0588BF
            • Part of subcall function 6D0588B8: ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ.MSVCP140(00000008,6D05BE0C,00000002,00000001,00000000,00000010,000000E4,6D05A18D,?,.guid.,000000FF,00000000,?,00000000,?), ref: 6D0588DC
            • Part of subcall function 6D0588B8: ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z.MSVCP140(00000003,00000000,00000000,00000008,6D05BE0C,00000002,00000001,00000000,00000010,000000E4,6D05A18D,?,.guid.,000000FF,00000000,?), ref: 6D0588F4
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z.MSVCP140(Function_00010520,00000002,00000001,00000000,00000010,000000E4,6D05A18D,?,.guid.,000000FF,00000000,?,00000000,?), ref: 6D05BE35
          • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(00000030), ref: 6D05BE4E
          • ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000002,00000000), ref: 6D05BE7A
          • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z.MSVCP140(00000000), ref: 6D05BE8A
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?), ref: 6D05BECA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_$W@std@@@std@@$H_prolog3_$CryptD@std@@@std@@U?$char_traits@V01@$??0?$basic_ios@_??0?$basic_ostream@_??1?$basic_ios@??6?$basic_ostream@??6?$basic_ostream@_?widen@?$basic_ios@_?width@ios_base@std@@AcquireContextH_prolog3RandomV21@@V?$basic_streambuf@_Vios_base@1@W@std@@@1@_
          • String ID:
          • API String ID: 1745564666-0
          • Opcode ID: d32ab9ee4afbe181edb5deeeb584d38837e751fc124347b17f601c46062b6db3
          • Instruction ID: ae2f57402863bcb22c8bf649e7c7bc3b5b8fae5fa7252a0acb39889fe27388c4
          • Opcode Fuzzy Hash: d32ab9ee4afbe181edb5deeeb584d38837e751fc124347b17f601c46062b6db3
          • Instruction Fuzzy Hash: 20317A31D0425EDFDF10DFA0C858BEDBBB0BF05309F0440A9D645AB181EBB46A49CB81
          APIs
          • __EH_prolog3.LIBCMT ref: 6D01A47A
            • Part of subcall function 6D0192AA: __EH_prolog3.LIBCMT ref: 6D0192B1
            • Part of subcall function 6D0191B9: __EH_prolog3.LIBCMT ref: 6D0191C0
          • _CxxThrowException.VCRUNTIME140(?,6D32F138,6D01A559,?,?), ref: 6D01A4A9
          • __EH_prolog3.LIBCMT ref: 6D01A4B6
            • Part of subcall function 6D0192D9: __EH_prolog3.LIBCMT ref: 6D0192E0
            • Part of subcall function 6D0191EA: __EH_prolog3.LIBCMT ref: 6D0191F1
          • _CxxThrowException.VCRUNTIME140(?,6D32F38C), ref: 6D01A4E1
          • __EH_prolog3.LIBCMT ref: 6D01A4EE
            • Part of subcall function 6D019308: __EH_prolog3.LIBCMT ref: 6D01930F
            • Part of subcall function 6D01921B: __EH_prolog3.LIBCMT ref: 6D019222
          • _CxxThrowException.VCRUNTIME140(?,6D32F410,?,0000005C,?,6D32F38C), ref: 6D01A519
            • Part of subcall function 6D01BB85: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D01BB9E
            • Part of subcall function 6D01BB85: __allrem.LIBCMT ref: 6D01BBC9
            • Part of subcall function 6D01E726: QueryPerformanceFrequency.KERNEL32(?,?,6D01A53C,?,?,?,?,?,?,?,?,?,?,?,?,6D32F38C), ref: 6D01E731
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$ExceptionThrow$FrequencyPerformanceQueryUnothrow_t@std@@@__allrem__ehfuncinfo$??2@
          • String ID:
          • API String ID: 3221096486-0
          • Opcode ID: e7760f6b4e627f403106d46d69c6462178b7648002e83f51733ea544fc8cba90
          • Instruction ID: ac9e376d3866d828a453c4bc32812fc4b230bb67461a08fe5e38b8390830ab9f
          • Opcode Fuzzy Hash: e7760f6b4e627f403106d46d69c6462178b7648002e83f51733ea544fc8cba90
          • Instruction Fuzzy Hash: D6212CB2C0820CEBDF10EBE4DC48EDEB7BDAF04208F114465F619A7145EB75A6548BA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07FEC0
          • ?str_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,0000004C), ref: 6D07FF10
          • ?str_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,0000004C), ref: 6D07FF20
          • ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(0000004C), ref: 6D07FF2E
          • ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,0000004C), ref: 6D07FF43
          • ?path_to_str@common@ierd_tgp@@YA_NABVpath@filesystem@2@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,0000004C), ref: 6D07FF51
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?str_to_path@common@ierd_tgp@@D@2@@std@@Vpath@filesystem@2@@$?absolute@filesystem@ierd_tgp@@?is_absolute@path@filesystem@ierd_tgp@@?path_to_str@common@ierd_tgp@@D@2@@std@@@H_prolog3_V312@0@Vpath@12@Vpath@filesystem@2@
          • String ID:
          • API String ID: 888674445-0
          • Opcode ID: 84f34b38fb8e9cb068c14162dbcc555ad21972a77ad4e52dc52a4e75c48d1428
          • Instruction ID: 8cfde80d1e9ad8482c8b60bdbd0bb984f3205f07b706783ebf274375da2ae211
          • Opcode Fuzzy Hash: 84f34b38fb8e9cb068c14162dbcc555ad21972a77ad4e52dc52a4e75c48d1428
          • Instruction Fuzzy Hash: 32218E71C09249EAEF10CFE5C880AEDFBB8BF1A324F94415DD504BB280DB709A45CB65
          APIs
          • OpenFileMappingA.KERNEL32(000F001F,00000001,?), ref: 6D013F56
          • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,?), ref: 6D013F77
          • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,?,?,?,6D014068,?,?,?,?,6D32C388,00000008), ref: 6D013F9D
          • memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,6D014068,?,?,?,?,6D32C388,00000008), ref: 6D013FAD
          • UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,6D32C388,00000008), ref: 6D013FCC
          • CloseHandle.KERNEL32(00000000,?,?,?,?,6D014068,?,?,?,?,6D32C388,00000008), ref: 6D013FD5
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: File$MappingView$CloseCreateHandleOpenUnmapmemset
          • String ID:
          • API String ID: 2211058034-0
          • Opcode ID: 954a412e125b87776b100f3ae7d4dfe272157e5ba227c0a8cbd96a1857f94ba4
          • Instruction ID: ba09b5fb8fc86faac066bdaf4412a9f513d0a9126f712e11a00db38510eb4830
          • Opcode Fuzzy Hash: 954a412e125b87776b100f3ae7d4dfe272157e5ba227c0a8cbd96a1857f94ba4
          • Instruction Fuzzy Hash: 53110431249705ABF7214E8A8C48FA777F8EF8AB69F10001DFE555B6C1C7709848CBA1
          APIs
          • _CxxThrowException.VCRUNTIME140(?,6D34A350,unexpected end of data,?,?,?,?,?,?,?,?,00000000), ref: 6D0BEB3F
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ExceptionThrow
          • String ID: expected ' or "$expected =$expected >$expected attribute name$unexpected end of data
          • API String ID: 432778473-2454120470
          • Opcode ID: 7493e508d0f59624b7154b8fe88bba4d06b6a8d31acf84bb63f733b9e9374c3b
          • Instruction ID: 0ff900d17c78993a3251796a91632c623d7f5b5c5a9411555c6c28fc6adaa078
          • Opcode Fuzzy Hash: 7493e508d0f59624b7154b8fe88bba4d06b6a8d31acf84bb63f733b9e9374c3b
          • Instruction Fuzzy Hash: D111E3B150C104AEF7119F68CC40EBAB7ECFF56214B25449AE6C2D7181DB72A842CB66
          APIs
          • GetCurrentThreadId.KERNEL32 ref: 6D047A85
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D048561
            • Part of subcall function 6D009A0E: __EH_prolog3.LIBCMT ref: 6D009A15
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0485B0
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?), ref: 6D048602
            • Part of subcall function 6D036F4F: ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N3@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000001,00000000,?,6D037552,?,00000000,?,files,00000005), ref: 6D036F5F
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D0350FC: __EH_prolog3.LIBCMT ref: 6D035103
            • Part of subcall function 6D037433: __EH_prolog3_GS.LIBCMT ref: 6D03743A
            • Part of subcall function 6CFFA3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6D0062D8,00000000,6D006649,00000003,23C35E98,?,?,00000000,6D266604,000000FF,?,6D005B05,00000000), ref: 6CFFA3E5
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$?get_cfg@common@ierd_tgp@@H_prolog3H_prolog3_U?$less@V12@V?$basic_ptree@Vpath@filesystem@2@memmove$?u8to16@common@ierd_tgp@@CurrentD@2@@std@@@2@@property_tree@boost@@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3_catch_ThreadU?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@_invalid_parameter_noinfo_noreturn
          • String ID: plugins
          • API String ID: 814859467-3968202353
          • Opcode ID: ad28d2f4659b54fbc25381a702edf807c830ac2c19bf6c7d2f9e469fbb1aa8bf
          • Instruction ID: f9fceac2d6e064d77b7260c9a80e24d7651dfbe568d1819c6db81648a9ec1fd0
          • Opcode Fuzzy Hash: ad28d2f4659b54fbc25381a702edf807c830ac2c19bf6c7d2f9e469fbb1aa8bf
          • Instruction Fuzzy Hash: 0AE19BB1C06298DEEB11CF94C944BDDBBB4AF11308F6480E9CA486B291D7B45F88DF95
          APIs
          • __EH_prolog3.LIBCMT ref: 6D00E3B4
            • Part of subcall function 6D009990: __EH_prolog3.LIBCMT ref: 6D009997
            • Part of subcall function 6D009990: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D0478AA,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D0099B4
            • Part of subcall function 6D009990: ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,00000008,6D0478AA,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?), ref: 6D0099CC
          • ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(00000000,?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3,?,?,?,00000064,6D0077B3), ref: 6D00E3E7
            • Part of subcall function 6D00DBB9: ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z.MSVCP140(000002A0,?,?,6D00E405,?,?,?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3), ref: 6D00DBC5
            • Part of subcall function 6D00DBB9: ?eof@ios_base@std@@QBE_NXZ.MSVCP140(?,?,6D00E405,?,?,?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3,?), ref: 6D00DBD2
            • Part of subcall function 6D00DBB9: ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(Function_0001974B,?,?,6D00E405,?,?,?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3), ref: 6D00DBE3
          • ?fail@ios_base@std@@QBE_NXZ.MSVCP140(?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3,?,?,?,00000064,6D0077B3), ref: 6D00E418
          • ?bad@ios_base@std@@QBE_NXZ.MSVCP140(?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3,?,?,?,00000064,6D0077B3), ref: 6D00E433
          • ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3,?,?,?,00000064,6D0077B3), ref: 6D00E443
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,00000001,00000001,000000B8,6D0078D1,?,?,00000000,6D0077F3,?,?,?,00000064,6D0077B3), ref: 6D00E477
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$V01@$??5?$basic_istream@H_prolog3$??0?$basic_ios@??0?$basic_istream@??1?$basic_ios@?bad@ios_base@std@@?eof@ios_base@std@@?fail@ios_base@std@@?get@?$basic_istream@?imbue@?$basic_ios@D@std@@@1@_V01@@V32@@V?$basic_streambuf@Vlocale@2@
          • String ID:
          • API String ID: 3692561807-0
          • Opcode ID: 674808ddc0f06c8beb6fb3f36f686f42e394f0cc75e1fb093cbf25bcf832c42c
          • Instruction ID: 8d0e26e85682b389ba526548c3328526874424de4b926f82f1602ead752e7203
          • Opcode Fuzzy Hash: 674808ddc0f06c8beb6fb3f36f686f42e394f0cc75e1fb093cbf25bcf832c42c
          • Instruction Fuzzy Hash: 4F215530904209DFEF14CB64C998FEDB7B0BF16319F108199E64AA72D1DB70AA48CF10
          APIs
          • __EH_prolog3.LIBCMT ref: 6D00E2DD
            • Part of subcall function 6D009990: __EH_prolog3.LIBCMT ref: 6D009997
            • Part of subcall function 6D009990: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D0478AA,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D0099B4
            • Part of subcall function 6D009990: ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,00000008,6D0478AA,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?), ref: 6D0099CC
          • ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF,?,?,?,00000060,6D00769F), ref: 6D00E310
            • Part of subcall function 6D00DB86: ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z.MSVCP140(?,?,?,6D00E32E,?,?,?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF), ref: 6D00DB92
            • Part of subcall function 6D00DB86: ?eof@ios_base@std@@QBE_NXZ.MSVCP140(?,?,6D00E32E,?,?,?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF,?), ref: 6D00DB9F
            • Part of subcall function 6D00DB86: ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(Function_0001974B,?,?,6D00E32E,?,?,?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF), ref: 6D00DBB0
          • ?fail@ios_base@std@@QBE_NXZ.MSVCP140(?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF,?,?,?,00000060,6D00769F), ref: 6D00E341
          • ?bad@ios_base@std@@QBE_NXZ.MSVCP140(?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF,?,?,?,00000060,6D00769F), ref: 6D00E35C
          • ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF,?,?,?,00000060,6D00769F), ref: 6D00E36C
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,00000001,00000001,000000B0,6D00789E,?,?,00000000,6D0076DF,?,?,?,00000060,6D00769F), ref: 6D00E39A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$V01@$??5?$basic_istream@H_prolog3$??0?$basic_ios@??0?$basic_istream@??1?$basic_ios@?bad@ios_base@std@@?eof@ios_base@std@@?fail@ios_base@std@@?get@?$basic_istream@?imbue@?$basic_ios@D@std@@@1@_V01@@V32@@V?$basic_streambuf@Vlocale@2@
          • String ID:
          • API String ID: 3692561807-0
          • Opcode ID: fe9ee80cc9d31c10724636f3f5b93f8016aba65ae1b9d34a44d098d8fd428f70
          • Instruction ID: 951810a367499a2c5cccb59cd78025ec582388ca834604b292baf1baa13a809b
          • Opcode Fuzzy Hash: fe9ee80cc9d31c10724636f3f5b93f8016aba65ae1b9d34a44d098d8fd428f70
          • Instruction Fuzzy Hash: D0212931904219EFEF14CF64C988FDDB7B5AF15329F10809EE516A7281EB70AA49CF61
          APIs
          • __EH_prolog3.LIBCMT ref: 6D047891
            • Part of subcall function 6D009990: __EH_prolog3.LIBCMT ref: 6D009997
            • Part of subcall function 6D009990: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D0478AA,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D0099B4
            • Part of subcall function 6D009990: ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,00000008,6D0478AA,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?), ref: 6D0099CC
          • ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D0478C4
            • Part of subcall function 6D0476DB: ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z.MSVCP140(?,?,?,6D0478E2,?,?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643), ref: 6D0476E7
            • Part of subcall function 6D0476DB: ?fail@ios_base@std@@QBE_NXZ.MSVCP140(?,?,6D0478E2,?,?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?), ref: 6D0476F4
            • Part of subcall function 6D0476DB: ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,6D0478E2,?,?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000), ref: 6D047709
            • Part of subcall function 6D0476DB: ?setf@ios_base@std@@QAEHH@Z.MSVCP140(00004000,?,?,6D0478E2,?,?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643), ref: 6D04771B
            • Part of subcall function 6D0476DB: ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z.MSVCP140(?,?,?,6D0478E2,?,?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643), ref: 6D047726
            • Part of subcall function 6D0476DB: ?eof@ios_base@std@@QBE_NXZ.MSVCP140(?,?,6D0478E2,?,?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?), ref: 6D047733
            • Part of subcall function 6D0476DB: ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(6D00974B,?,?,6D0478E2,?,?,?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643), ref: 6D047744
          • ?fail@ios_base@std@@QBE_NXZ.MSVCP140(?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D0478F5
          • ?bad@ios_base@std@@QBE_NXZ.MSVCP140(?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D047910
          • ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D047920
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,00000001,00000001,000000B0,6D046741,?,?,00000000,6D046643,?,?,?,00000064,6D046603), ref: 6D04794E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$V01@$??5?$basic_istream@$?fail@ios_base@std@@H_prolog3$??0?$basic_ios@??0?$basic_istream@??1?$basic_ios@?bad@ios_base@std@@?clear@?$basic_ios@?eof@ios_base@std@@?get@?$basic_istream@?imbue@?$basic_ios@?setf@ios_base@std@@D@std@@@1@_V01@@V32@@V?$basic_streambuf@Vlocale@2@
          • String ID:
          • API String ID: 4005712577-0
          • Opcode ID: 6ba60842a41206e8414562a2f044400842776f312e0099414a2f4f007b51334b
          • Instruction ID: 2568facbaba7d671a6298f63e65209df95187eec003929c03c5ccd165f7c4ed3
          • Opcode Fuzzy Hash: 6ba60842a41206e8414562a2f044400842776f312e0099414a2f4f007b51334b
          • Instruction Fuzzy Hash: A8214F31904219DFEF14CF64C888FDDB7B5AF15319F10809DE945A7281DBB0AE49CB61
          APIs
          • __CreateFrameInfo.LIBCMT ref: 028436CB
            • Part of subcall function 0284325B: __getptd.LIBCMT ref: 02843269
            • Part of subcall function 0284325B: __getptd.LIBCMT ref: 02843277
          • __getptd.LIBCMT ref: 028436D5
            • Part of subcall function 0283990F: __getptd_noexit.LIBCMT ref: 02839912
            • Part of subcall function 0283990F: __amsg_exit.LIBCMT ref: 0283991F
          • __getptd.LIBCMT ref: 028436E3
          • __getptd.LIBCMT ref: 028436F1
          • __getptd.LIBCMT ref: 028436FC
          • _CallCatchBlock2.LIBCMT ref: 02843722
            • Part of subcall function 02843300: __CallSettingFrame@12.LIBCMT ref: 0284334C
            • Part of subcall function 028437C9: __getptd.LIBCMT ref: 028437D8
            • Part of subcall function 028437C9: __getptd.LIBCMT ref: 028437E6
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
          • String ID:
          • API String ID: 1602911419-0
          • Opcode ID: b2df9bd07f9a6c494133b1e89c301f813b8fcb87381d0e29bfba75303bed8ee3
          • Instruction ID: d066c176e168a74112044f568b6394716a6ea1987c349d49be0914bb2b06b707
          • Opcode Fuzzy Hash: b2df9bd07f9a6c494133b1e89c301f813b8fcb87381d0e29bfba75303bed8ee3
          • Instruction Fuzzy Hash: C41107B9C00209DFDB01EFA8D445AADBBB2FF04315F1080A9E864E7250DB789A119F91
          APIs
          • __getptd.LIBCMT ref: 0283D9CA
            • Part of subcall function 0283990F: __getptd_noexit.LIBCMT ref: 02839912
            • Part of subcall function 0283990F: __amsg_exit.LIBCMT ref: 0283991F
          • __amsg_exit.LIBCMT ref: 0283D9EA
          • __lock.LIBCMT ref: 0283D9FA
          • InterlockedDecrement.KERNEL32(?), ref: 0283DA17
          • _free.LIBCMT ref: 0283DA2A
          • InterlockedIncrement.KERNEL32(029F1688), ref: 0283DA42
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
          • String ID:
          • API String ID: 3470314060-0
          • Opcode ID: dfc581d02000ab33ca64a6141121617e2b07d5f06df66516407c89591ba96ab7
          • Instruction ID: 01c0497894c062265c04925fc8147fb9f28f7fafcbb16bc969d2183a9ff7c443
          • Opcode Fuzzy Hash: dfc581d02000ab33ca64a6141121617e2b07d5f06df66516407c89591ba96ab7
          • Instruction Fuzzy Hash: 36018C3ED45621ABDB23AF68900579EB3E2AF00722F040505E858E7280CB74B961DFDA
          APIs
          • WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 028348E1
          • WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 028348EC
          • Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 028348F9
          • CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 02834914
          • CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 0283491D
          • Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 0283492E
            • Part of subcall function 02833F60: GetCurrentThreadId.KERNEL32 ref: 02833F65
            • Part of subcall function 02833F60: send.WS2_32(?,02847440,00000010,00000000), ref: 02833FC6
            • Part of subcall function 02833F60: SetEvent.KERNEL32(?), ref: 02833FE9
            • Part of subcall function 02833F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02833FF5
            • Part of subcall function 02833F60: WSACloseEvent.WS2_32(?), ref: 02834003
            • Part of subcall function 02833F60: shutdown.WS2_32(?,00000001), ref: 0283401B
            • Part of subcall function 02833F60: closesocket.WS2_32(?), ref: 02834025
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
          • String ID:
          • API String ID: 1019945655-0
          • Opcode ID: 6fad8f0d07a7746ade4bcace0d72a403d3a2aef88b360a8be4ce675fd1451c43
          • Instruction ID: 3a8536b326b879b4267aa5b354365a1311f562ab03c8032efb7d52f6b908a2c0
          • Opcode Fuzzy Hash: 6fad8f0d07a7746ade4bcace0d72a403d3a2aef88b360a8be4ce675fd1451c43
          • Instruction Fuzzy Hash: 95F0127E2046045BC624ABAADC8494AF3E9EF95720B554B09E269C76D4CA74F805CBE0
          APIs
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D0234AF: __EH_prolog3.LIBCMT ref: 6D0234B6
          • _localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?,?,6D291198,00000000), ref: 6D023ABA
          • strftime.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?), ref: 6D023AE1
          • strftime.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?), ref: 6D023B33
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: strftime$H_prolog3_localtime64_smemmove
          • String ID: %Y-%m-%d %H:%M:%S.%f$000000000
          • API String ID: 2888848054-1131709979
          • Opcode ID: 67f0f618bf0414ed95e16cb6c6df3d629df2f5307a6b635c35a84bd78cddc043
          • Instruction ID: 68561f048e25acb37054cda4b80d05cabd504164e390db9da83ac8bfb193eac9
          • Opcode Fuzzy Hash: 67f0f618bf0414ed95e16cb6c6df3d629df2f5307a6b635c35a84bd78cddc043
          • Instruction Fuzzy Hash: E2B1C171A05209EFEB15CFA8CC94BEDB7B5FF49314F54019DE119A7280DB709A86CB60
          APIs
          • GetCurrentThread.KERNEL32 ref: 6D09A223
          • SetThreadAffinityMask.KERNEL32(00000000), ref: 6D09A22A
          • QueryPerformanceCounter.KERNEL32(?,?,?,?,6D048462,init plugin end:), ref: 6D09A236
          • GetCurrentThread.KERNEL32 ref: 6D09A23D
          • SetThreadAffinityMask.KERNEL32(00000000), ref: 6D09A244
          • strncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000050,?,000000FF,?,?,?,6D048462,init plugin end:), ref: 6D09A261
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Thread$AffinityCurrentMask$CounterPerformanceQuerystrncpy_s
          • String ID:
          • API String ID: 1905445695-0
          • Opcode ID: 8543a9e88a422a5e8bedea4a2a72470c595ba11c9e82601767a119fa0715ce0f
          • Instruction ID: c6e2df41b1b88e4e260e50b1f2fbaf65e827270d70a9cc1cc6e3cddc3e2f57b2
          • Opcode Fuzzy Hash: 8543a9e88a422a5e8bedea4a2a72470c595ba11c9e82601767a119fa0715ce0f
          • Instruction Fuzzy Hash: 2301E472800354EFCF04ABA4C84DF8A7BBCEB4776AF10414AF50296281D7B5A649DB50
          APIs
          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 028332F1
          • Sleep.KERNEL32(00000258), ref: 028332FE
          • InterlockedExchange.KERNEL32(?,00000000), ref: 02833306
          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 02833312
          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0283331A
          • Sleep.KERNEL32(0000012C), ref: 0283332B
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
          • String ID:
          • API String ID: 3137405945-0
          • Opcode ID: a93a284d35a079c8a390facc44acc727a142ac20a412198bf3e3aeeaae472d41
          • Instruction ID: ab71c3f2b8799396ad319d5f97ab8c544201091c050ee798327a1134e381f404
          • Opcode Fuzzy Hash: a93a284d35a079c8a390facc44acc727a142ac20a412198bf3e3aeeaae472d41
          • Instruction Fuzzy Hash: E9F0827A2443046BD610EBA9DC84E4AF3E8AF95330B204B09F221872D0CAB4F801CBA0
          APIs
            • Part of subcall function 6CFFF060: memmove.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CFFF138
          • memmove.VCRUNTIME140(?,00000000,?,?,?,?,?,00000009,0000000D,0000000A,0000000C,00000008,0000005C,0000002F,00000022,-00000002), ref: 6CFFE598
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,00000002,Empty escape sequence in string,0000001F,-00000002,23C35E98,?,?,00000001,?,?,?,?), ref: 6CFFE690
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$_invalid_parameter_noinfo_noreturn
          • String ID: /1m$Bad escape sequence in string$Empty escape sequence in string
          • API String ID: 2580228974-2567847592
          • Opcode ID: 59edd101e857d7d799970c5e47cbab698ae00159b65f771216e497567f0c52f4
          • Instruction ID: 42c423ee593c7c9d0e4789d525ba6df383e5108fa0d502e1d666ef72fbaa5f9b
          • Opcode Fuzzy Hash: 59edd101e857d7d799970c5e47cbab698ae00159b65f771216e497567f0c52f4
          • Instruction Fuzzy Hash: 59710671A1425DAFDB15CF98C880BEEBBB6EF49314F144119E420A77A1DB309946CBE1
          APIs
          • memmove.VCRUNTIME140(?,00000000,?,?,00000000,23C35E98,?,6D05B7C7,?,000000FF,?,6D0018DB,6D05B7C7,6D31E62F,00000000,6D31E62F), ref: 6D0029E7
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?,?,00000000,23C35E98,?), ref: 6D002A30
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?,?,00000000,23C35E98,?), ref: 6D002A7F
          • memmove.VCRUNTIME140(?,6D31E7AC,00000001,?,00000000,00000000,?,?,00000000,23C35E98,?), ref: 6D002AC8
            • Part of subcall function 6CFFFE80: memmove.VCRUNTIME140(00000000,7FFFFFFF,00000000,?,00000000), ref: 6CFFFF43
            • Part of subcall function 6CFFFE80: memmove.VCRUNTIME140(00000010,00000000,?,00000000,7FFFFFFF,00000000,?,00000000), ref: 6CFFFF51
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove$_invalid_parameter_noinfo_noreturn
          • String ID: /1m
          • API String ID: 2580228974-2423615382
          • Opcode ID: b03e910e9fcc1dd008bbee13d23ee71d8c7a1ff167211c564955bc2abff341d3
          • Instruction ID: ed4a51b47d3704703bb88ed209dd64a6b1da6fbf8c1433a78ebbca2dcd3d4edb
          • Opcode Fuzzy Hash: b03e910e9fcc1dd008bbee13d23ee71d8c7a1ff167211c564955bc2abff341d3
          • Instruction Fuzzy Hash: 0451B371A04245BFFB24CF78CC84BAEBBB6FB8A304F144129E51197381DB759985CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D032B30
            • Part of subcall function 6D035281: __EH_prolog3.LIBCMT ref: 6D035288
            • Part of subcall function 6D0341F1: __EH_prolog3.LIBCMT ref: 6D0341F8
          Strings
          • character expected after backslash, xrefs: 6D032BF9
          • class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __cdecl boost::property_tree::info_parser::expand_escapes<const char*>(const char *,const char *), xrefs: 6D032C61
          • unknown escape sequence, xrefs: 6D032C37
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\info_parser_read.hpp, xrefs: 6D032C5C
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$H_prolog3_
          • String ID: character expected after backslash$class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __cdecl boost::property_tree::info_parser::expand_escapes<const char*>(const char *,const char *)$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\info_parser_read.hpp$unknown escape sequence
          • API String ID: 4240126716-3458890962
          • Opcode ID: aeb96f65ccd2185892d35c60dc53e962361611b65068d85b70e5a35750a87a29
          • Instruction ID: 9b0046ee0a374fbe6e12350386d128bb9fefaa53b77e01e35b7d2e35a402529f
          • Opcode Fuzzy Hash: aeb96f65ccd2185892d35c60dc53e962361611b65068d85b70e5a35750a87a29
          • Instruction Fuzzy Hash: 1F41A77099827FEEFB319E68C840FED77B87B15704F928056D18476581C7701A8697A2
          APIs
          • QueryPerformanceFrequency.KERNEL32(00000000,23C35E98,?,?,00000000), ref: 6D117A8C
          • QueryPerformanceCounter.KERNEL32(?,?,?,00000000), ref: 6D117ACB
          • GetLastError.KERNEL32(?,?,00000000), ref: 6D117B0E
          • _CxxThrowException.VCRUNTIME140(00000001,6D352CF4,-00000047,00000001), ref: 6D117BB7
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: PerformanceQuery$CounterErrorExceptionFrequencyLastThrow
          • String ID: chrono::steady_clock
          • API String ID: 3314207056-370487861
          • Opcode ID: 8e794b6ee7326e5fed48c90b2be94c947dec08c3a785bd5e2e9ddd39b61eaae7
          • Instruction ID: 205622bc353106c67df312277ecbf5355db5df1389fe7d36f80dc34e9ff435b8
          • Opcode Fuzzy Hash: 8e794b6ee7326e5fed48c90b2be94c947dec08c3a785bd5e2e9ddd39b61eaae7
          • Instruction Fuzzy Hash: E241AC71D08209EFCB01DFB8C844BAEB7B8FF45354F20862AE525A7344EBB06945CB80
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D00E671
            • Part of subcall function 6D006B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6D388534,6D006BB1,6D388538,?,6D00A235,00000000,?,00000010), ref: 6D006B81
            • Part of subcall function 6D006B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D006B8D
          • ??Edirectory_iterator@filesystem@ierd_tgp@@QAEAAV012@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000000,00000054,6D00E7C6,00000000,23C35E98,?,00000000,6D267428,000000FF,?,6D00BD8D,00000000), ref: 6D00E6AE
          • ?equal@directory_iterator@filesystem@ierd_tgp@@QBE_NABV123@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,00000000,00000054,6D00E7C6,00000000,23C35E98,?,00000000,6D267428,000000FF,?,6D00BD8D,00000000), ref: 6D00E6CB
          • _CxxThrowException.VCRUNTIME140(?,6D32BC60,?,00000000,?,filesystem::recursive_directory_iterator directory error,00000000,00000054,6D00E7C6,00000000,23C35E98,?,00000000,6D267428,000000FF), ref: 6D00E772
          Strings
          • filesystem::recursive_directory_iterator directory error, xrefs: 6D00E74A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?equal@directory_iterator@filesystem@ierd_tgp@@Edirectory_iterator@filesystem@ierd_tgp@@ExceptionExecute_once@std@@H_prolog3_ThrowUonce_flag@1@V012@V123@@terminate
          • String ID: filesystem::recursive_directory_iterator directory error
          • API String ID: 175330673-1223082086
          • Opcode ID: d0298b948d359456de9ce29cd157a41b9940e922ccdd0676096fad9b07936647
          • Instruction ID: 75b3c90f92d074092b23937ae31def214f23dfd44bf2b0452d329a79dcca90b9
          • Opcode Fuzzy Hash: d0298b948d359456de9ce29cd157a41b9940e922ccdd0676096fad9b07936647
          • Instruction Fuzzy Hash: C341A9B2D05619BBFB14DFA4D844BEDB7B2BF45324F11421DE625BB280CB70A901CBA4
          APIs
          • ?string@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,: ",00000003,00000000), ref: 6D00F94B
          • ?string@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,, ",00000003,00000000), ref: 6D00F9A0
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?string@path@filesystem@ierd_tgp@@D@2@@std@@D@std@@U?$char_traits@V?$allocator@V?$basic_string@
          • String ID: , "$: "$Unknown exception
          • API String ID: 1973100904-2574047376
          • Opcode ID: f1e67e3757c1813ba1ac116e75f182fd3a7cdc4d372eeba9409dad4a787a5280
          • Instruction ID: 7b9ba46350b627b3964bd72946fbdbbb1ed4091cff259e4c6f47ee13f528102f
          • Opcode Fuzzy Hash: f1e67e3757c1813ba1ac116e75f182fd3a7cdc4d372eeba9409dad4a787a5280
          • Instruction Fuzzy Hash: 8B41E470914309EBEB28CF94D950BEAB7F9EF44708F10011DE0536B6C0DBB0A94ACB62
          APIs
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057B5F
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002E), ref: 6D057BC5
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057BE9
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000007C), ref: 6D057D0B
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?widen@?$ctype@_W@std@@
          • String ID:
          • API String ID: 1759116752-3916222277
          • Opcode ID: 0d5f28c2f30446b1aba7639ff109a35be84abefb557ada1b7d5d416dc1e646d8
          • Instruction ID: cbe1dac3dbf32c66bbfea8aaf1dc556d74807a0d23b3b48da74e13f457136114
          • Opcode Fuzzy Hash: 0d5f28c2f30446b1aba7639ff109a35be84abefb557ada1b7d5d416dc1e646d8
          • Instruction Fuzzy Hash: A2311E74A0420ADFEB15CF54C294B697BB2FBCA345B60C449EC16CB240E7319EA5DF92
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0121B9
            • Part of subcall function 6D012011: __EH_prolog3_GS.LIBCMT ref: 6D012018
            • Part of subcall function 6D011745: __EH_prolog3.LIBCMT ref: 6D01174C
          • PathFileExistsW.SHLWAPI(00000000), ref: 6D0121FD
          • PathFileExistsW.SHLWAPI(00000000,?,00000000,\wkData64.dll,?,?), ref: 6D012243
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ExistsFileH_prolog3_Path$H_prolog3
          • String ID: \wkData.dll$\wkData64.dll
          • API String ID: 1018888864-160068528
          • Opcode ID: 053795c17d25ca1e967fb517bea54219abc0a9e652797c4b7febc1ef2b4eb458
          • Instruction ID: 6758c952b70955c2d7302c2a512f27903c07480a2172f18ffff3a71c83e89133
          • Opcode Fuzzy Hash: 053795c17d25ca1e967fb517bea54219abc0a9e652797c4b7febc1ef2b4eb458
          • Instruction Fuzzy Hash: 7B3117B5C48309AEFB20CFF4CC89B9DBBB4AF56318F64025DD521672D2D7788649CA20
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0120A7
            • Part of subcall function 6D012011: __EH_prolog3_GS.LIBCMT ref: 6D012018
            • Part of subcall function 6D011745: __EH_prolog3.LIBCMT ref: 6D01174C
          • PathFileExistsW.SHLWAPI(00000000), ref: 6D0120EB
          • PathFileExistsW.SHLWAPI(00000000,?,00000000,\dbData64.dll,?,?), ref: 6D012131
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ExistsFileH_prolog3_Path$H_prolog3
          • String ID: \dbData.dll$\dbData64.dll
          • API String ID: 1018888864-3053325790
          • Opcode ID: aedd3a304feedc2cb92f756800908759d5bd06888dabb3afe12a535a658f6b34
          • Instruction ID: 387f254ec9485da4d7e2cc08c568159de6d04ae890b8c58c32e463f7ca19733f
          • Opcode Fuzzy Hash: aedd3a304feedc2cb92f756800908759d5bd06888dabb3afe12a535a658f6b34
          • Instruction Fuzzy Hash: 54311CB5C48309AAFB20CFF0CC89B9DBBB4AF66358F64025DD511672D2D7788649CB10
          APIs
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D04BBBE
          Strings
          • [Curlssl_adapter]report done, msg:%s, xrefs: 6D04BC0A
          • d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp, xrefs: 6D04BBEA
          • /1m, xrefs: 6D04BB29
          • /, xrefs: 6D04BBFD
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@Logger@1@
          • String ID: /$/1m$[Curlssl_adapter]report done, msg:%s$d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp
          • API String ID: 1403022985-931949670
          • Opcode ID: 4548802f62f20347784b0a9c2040207fb353dcf1fb7bd2806d9f72af541aed5d
          • Instruction ID: ba541580844781c953fd3b951e37de59c636cb2bc511e8448d5cebdb6fcc7c0c
          • Opcode Fuzzy Hash: 4548802f62f20347784b0a9c2040207fb353dcf1fb7bd2806d9f72af541aed5d
          • Instruction Fuzzy Hash: E531E23090925ADBEB15DB24CC94BEDB7B0AF42308F2080E8C4556B1A2DFB15F86CB51
          APIs
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
            • Part of subcall function 6D05A272: __EH_prolog3_GS.LIBCMT ref: 6D05A279
            • Part of subcall function 6D05A272: ?is_directory@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,0000003C,6D05AB09,00000005), ref: 6D05A2C6
            • Part of subcall function 6D05A272: ?CopyDir@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,0000003C,6D05AB09,00000005), ref: 6D05A2D9
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000003), ref: 6D05AB3C
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000003), ref: 6D05AB43
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • GetLastError.KERNEL32(00000000,00000005,d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp,000001F9,6D31E62F), ref: 6D05AB80
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          • ?remove@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000005), ref: 6D05ABEF
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp, xrefs: 6D05AB67
          • [ExptFileProcesser] DumpDataFiles: data_path = %s, failed(%d), xrefs: 6D05AB93
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$?get_log_instance@base@@?is_directory@filesystem@ierd_tgp@@?remove@filesystem@ierd_tgp@@?u16to8@common@ierd_tgp@@CopyD@2@@4@@D@std@@Dir@ErrorH_prolog3H_prolog3_catch_LastLogger@1@Sys_wrapper@common@ierd_tgp@@U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_Verror_code@std@@@Vpath@12@Vpath@12@@Vpath@filesystem@3@0@W@2@@std@@W@std@@memmove
          • String ID: [ExptFileProcesser] DumpDataFiles: data_path = %s, failed(%d)$d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp
          • API String ID: 1082621659-1985600348
          • Opcode ID: e1414e137b4e1e463da7d83757d441fcbc65f7a062a5dd0e2469e166a1cbd6b9
          • Instruction ID: c4da80b28a32622527cb6d5685f47ae27e586322db6a28de13d9bfd51f9d5ab1
          • Opcode Fuzzy Hash: e1414e137b4e1e463da7d83757d441fcbc65f7a062a5dd0e2469e166a1cbd6b9
          • Instruction Fuzzy Hash: 6B31A271C05249EBEF00DFA8C981BEEBBB5AF15204F61409DD51477242DB31AB4ACFA2
          APIs
          • __EH_prolog3.LIBCMT ref: 6D07E0CE
          • GetModuleHandleA.KERNEL32(common.dll,?dyn_comp_mgr_find_component@@YA?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@common@ierd_tgp@@@Z,00000018,6D07E327,6D389534,6D389584,00000054), ref: 6D07E0DD
          • GetProcAddress.KERNEL32(00000000), ref: 6D07E0E4
            • Part of subcall function 6D07E1B1: __RTDynamicCast.VCRUNTIME140(00000054,00000000,6D3841A8,6D385E4C,00000000,23C35E98,?,6D389510,00000001,?,00000054,6D26DC4A,000000FF,?,6D07E282,00000054), ref: 6D07E1ED
          Strings
          • common.dll, xrefs: 6D07E0D8
          • ?dyn_comp_mgr_find_component@@YA?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@common@ierd_tgp@@@Z, xrefs: 6D07E0D3
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AddressCastDynamicH_prolog3HandleModuleProc
          • String ID: ?dyn_comp_mgr_find_component@@YA?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@common@ierd_tgp@@@Z$common.dll
          • API String ID: 3452073653-2503669440
          • Opcode ID: 117fb16d0cb4f68a0fd3f997a11a64f74b4f7d6cbbadf8a9ecc4678e63850431
          • Instruction ID: b316f4db953bda1a347a88872457c71b0c7c71e0d3f1de20c835aca274346001
          • Opcode Fuzzy Hash: 117fb16d0cb4f68a0fd3f997a11a64f74b4f7d6cbbadf8a9ecc4678e63850431
          • Instruction Fuzzy Hash: A931A930D0A20AEEEF18CFA4C915BFEBBB4AF46214F10805DC115AB290DB749B05DB25
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D017B2D
            • Part of subcall function 6D006B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6D388534,6D006BB1,6D388538,?,6D00A235,00000000,?,00000010), ref: 6D006B81
            • Part of subcall function 6D006B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D006B8D
          • ?current_path@filesystem@ierd_tgp@@YAXABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000), ref: 6D017B46
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D017B57
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00EAA2: __EH_prolog3.LIBCMT ref: 6D00EAA9
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\app.cpp, xrefs: 6D017B7B
          • cannot set app path, %s, xrefs: 6D017BAC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$?current_path@filesystem@ierd_tgp@@?get_log_instance@base@@Execute_once@std@@H_prolog3_H_prolog3_catch_Logger@1@Uonce_flag@1@Verror_code@std@@@Vpath@12@terminate
          • String ID: cannot set app path, %s$d:\ci_dev\wegame_client\codes\common\src\app.cpp
          • API String ID: 2945524706-2428029172
          • Opcode ID: 317fa6c117bd37d89ca33a054b3c03f755efebcead4dff51cbd6dc00f13304d6
          • Instruction ID: 21ce8d80561ebb87444beff896c7cb5e3e72bc08ee48078bf0d6abc2c419fcf3
          • Opcode Fuzzy Hash: 317fa6c117bd37d89ca33a054b3c03f755efebcead4dff51cbd6dc00f13304d6
          • Instruction Fuzzy Hash: 0821AC72C48209ABFB24DBA0CC41BEE77B0AF46319F210169D6107B1C2EB725A45CFA1
          APIs
          • __EH_prolog3.LIBCMT ref: 6D047AA2
            • Part of subcall function 6D040F01: __EH_prolog3_catch.LIBCMT ref: 6D040F08
          • ?stamp_point@@YAXPBD@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(load_eager_plugin begin,0000001C,6D047A06), ref: 6D047AC8
            • Part of subcall function 6D09A212: GetCurrentThread.KERNEL32 ref: 6D09A223
            • Part of subcall function 6D09A212: SetThreadAffinityMask.KERNEL32(00000000), ref: 6D09A22A
            • Part of subcall function 6D09A212: QueryPerformanceCounter.KERNEL32(?,?,?,?,6D048462,init plugin end:), ref: 6D09A236
            • Part of subcall function 6D09A212: GetCurrentThread.KERNEL32 ref: 6D09A23D
            • Part of subcall function 6D09A212: SetThreadAffinityMask.KERNEL32(00000000), ref: 6D09A244
            • Part of subcall function 6D09A212: strncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000050,?,000000FF,?,?,?,6D048462,init plugin end:), ref: 6D09A261
          • ?stamp_point@@YAXPBD@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(load_eager_plugin end,0000001C,6D047A06), ref: 6D047B4F
            • Part of subcall function 6D046006: __EH_prolog3_catch.LIBCMT ref: 6D04600D
            • Part of subcall function 6D03E1A8: __EH_prolog3_catch.LIBCMT ref: 6D03E1C4
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Thread$H_prolog3_catch$?stamp_point@@AffinityCurrentMask$CounterH_prolog3PerformanceQuerystrncpy_s
          • String ID: load_eager_plugin begin$load_eager_plugin end
          • API String ID: 2404959511-516115756
          • Opcode ID: 0e6dfba86d068da92beb7011d720443ca085c5e6f2f01faad311419b66f3723c
          • Instruction ID: 6eb2736bb49fe70ed0d10d151ecc716ed36e852a9a4cdddedf0fc53ca968052e
          • Opcode Fuzzy Hash: 0e6dfba86d068da92beb7011d720443ca085c5e6f2f01faad311419b66f3723c
          • Instruction Fuzzy Hash: 73212871D4811ADFEB18DFA4C891FFEB7B4BF08318F514529D212AB280DB34A945CBA4
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D007FF4
            • Part of subcall function 6D00F01F: __EH_prolog3_GS.LIBCMT ref: 6D00F029
            • Part of subcall function 6D00F01F: ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,00000002,00000001,000000C4,6D00800F,?,?,0000007C,6D007FE5,?,?,?,?,?,00000008), ref: 6D00F069
            • Part of subcall function 6D00F01F: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,00000001,?,00000002,00000001,000000C4,6D00800F,?,?,0000007C,6D007FE5,?), ref: 6D00F082
            • Part of subcall function 6D00F01F: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000002,00000001,000000C4,6D00800F,?,?,0000007C,6D007FE5,?,?,?,?,?,00000008,6D00CB5E), ref: 6D00F099
            • Part of subcall function 6D00F01F: ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,00000002,00000001,000000C4,6D00800F,?,?,0000007C,6D007FE5,?,?,?,?,?,00000008,6D00CB5E), ref: 6D00F0F0
          Strings
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp, xrefs: 6D0080B4
          • void __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_, xrefs: 6D0080B9
          • conversion of type ", xrefs: 6D008066
          • " to data failed, xrefs: 6D008088
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$H_prolog3_$??1?$basic_ios@??6?$basic_ostream@?imbue@?$basic_ios@Bios_base@std@@V01@_V32@@Vlocale@2@
          • String ID: " to data failed$conversion of type "$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp$void __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_
          • API String ID: 872031544-2278185983
          • Opcode ID: 98f90ed4bae459fb15ac66d09c61f2ea16d8b8252208a5441eebc82b702d6010
          • Instruction ID: abe60aa9e3f29c7640c8e8e11f239b3029fc6a8004164f7f7694ced67a505720
          • Opcode Fuzzy Hash: 98f90ed4bae459fb15ac66d09c61f2ea16d8b8252208a5441eebc82b702d6010
          • Instruction Fuzzy Hash: 73219261C0428CBAFB11D7F4C808BDEBBB86F15218F548198E161B7282DB745B09DB62
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D007EC9
            • Part of subcall function 6D00EF41: __EH_prolog3_GS.LIBCMT ref: 6D00EF4B
            • Part of subcall function 6D00EF41: ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008), ref: 6D00EF8B
            • Part of subcall function 6D00EF41: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(?,?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008), ref: 6D00EFA1
            • Part of subcall function 6D00EF41: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008,6D00CC88), ref: 6D00EFB8
            • Part of subcall function 6D00EF41: ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008,6D00CC88), ref: 6D00F00F
          Strings
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp, xrefs: 6D007F89
          • void __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_, xrefs: 6D007F8E
          • conversion of type ", xrefs: 6D007F3B
          • " to data failed, xrefs: 6D007F5D
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$H_prolog3_$??1?$basic_ios@??6?$basic_ostream@?imbue@?$basic_ios@Bios_base@std@@V01@V32@@Vlocale@2@
          • String ID: " to data failed$conversion of type "$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp$void __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_
          • API String ID: 284028645-2278185983
          • Opcode ID: dab0a7025fd243f10c1839ea5d607a059464ed4d945dc4e169980e99031c3f50
          • Instruction ID: 5c3977e5764253b3661b31af935e57d1cf9528e52c3b49e1e477e15fef768ecc
          • Opcode Fuzzy Hash: dab0a7025fd243f10c1839ea5d607a059464ed4d945dc4e169980e99031c3f50
          • Instruction Fuzzy Hash: AD219270C0428CBAEB11D7F4C808BDEBBB85F15218F548198E161B72C2DB785B09CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D047965
            • Part of subcall function 6D009A0E: __EH_prolog3.LIBCMT ref: 6D009A15
          • ?is_profile_on@common@ierd_tgp@@YA_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000040), ref: 6D04797A
          • ?enable_profile_on@common@ierd_tgp@@YAX_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0479F6
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000001,?,?,?,initial.profile.on,00000012,00000040), ref: 6D0479B9
            • Part of subcall function 6D036FB1: __EH_prolog3_catch_GS.LIBCMT ref: 6D036FBB
            • Part of subcall function 6D036FB1: ?split_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@1@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D037020
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$?enable_profile_on@common@ierd_tgp@@?get_cfg_by_path@common@ierd_tgp@@?is_profile_on@common@ierd_tgp@@?split_path@common@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3H_prolog3_H_prolog3_catch_U?$less@V12@V34@1@V?$basic_ptree@memmove
          • String ID: initial.profile.on
          • API String ID: 2365034594-3868740645
          • Opcode ID: 59eb00d683aebbbc67d412c69cb06c2aeb2ea37590b2b42f1b1dfb873e645154
          • Instruction ID: 923a5959d725b09f3dfdcebb880e8d00e26426c61c15e1951dd4b4055d2d8e7b
          • Opcode Fuzzy Hash: 59eb00d683aebbbc67d412c69cb06c2aeb2ea37590b2b42f1b1dfb873e645154
          • Instruction Fuzzy Hash: 6511AFB0C04209DEEF11DFE0C881BEDBBB09F11318F144069C611772C2DBB84A4ADBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A2C3B
          • GetSystemPowerStatus.KERNEL32(?), ref: 6D0A2C4C
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A2C56
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • [Sys_wrapper]ACLineStatus:{},BatteryFlag:{}, xrefs: 6D0A2C96
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A2C7A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_Logger@1@PowerStatusSystem
          • String ID: [Sys_wrapper]ACLineStatus:{},BatteryFlag:{}$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 122112040-3711229193
          • Opcode ID: 8cdc2d72ca50bdb82929305e39c70a5488b6e6b85eaa6b4167f1ee2d069cf2e3
          • Instruction ID: 0f1e6ffd2b9811c6ac2d982f417643cd930faa60b6be32dadc6779158f2ff4a4
          • Opcode Fuzzy Hash: 8cdc2d72ca50bdb82929305e39c70a5488b6e6b85eaa6b4167f1ee2d069cf2e3
          • Instruction Fuzzy Hash: FD01DE3194460AABFF24CBF0CC11BBEB3746F41214F4202289221BB1D1DB649A4ACB90
          APIs
          • ___BuildCatchObject.LIBCMT ref: 02843A63
            • Part of subcall function 028439BE: ___BuildCatchObjectHelper.LIBCMT ref: 028439F4
          • _UnwindNestedFrames.LIBCMT ref: 02843A7A
          • ___FrameUnwindToState.LIBCMT ref: 02843A88
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
          • String ID: csm$csm
          • API String ID: 2163707966-3733052814
          • Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
          • Instruction ID: 6bee178beb15db6662aeb79445f0a41e5456cfbfd15466adf69a9264e6ee8f4d
          • Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
          • Instruction Fuzzy Hash: AD01243D00050EBBDF22AF55CC44EAB7E6AEF18354F208051BD1894120DB32D9B1DBA2
          APIs
          • __EH_prolog3.LIBCMT ref: 6D07BCE4
          • ?get_proxy_for_url_v2@net@ierd_tgp@@YA_NPB_WPAUproxy_info_t@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000004), ref: 6D07BD0E
          • ?LoadStr@overseas@ierd_tgp@@YAPB_WV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(TGP_COM_URL), ref: 6D07BD4E
          • __Init_thread_footer.LIBCMT ref: 6D07BD5D
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_proxy_for_url_v2@net@ierd_tgp@@H_prolog3Init_thread_footerLoadStr@overseas@ierd_tgp@@U?$char_traits@_Uproxy_info_t@12@@V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@
          • String ID: TGP_COM_URL
          • API String ID: 2997012582-77736424
          • Opcode ID: 1a126bb470a9dd15389533f842cb919ff5d6107fe6553bc73c4d72565756929f
          • Instruction ID: 9c9acb89321d5be5491da0a295f083a075b1ce5199f887cca9b14b81bbb11bb9
          • Opcode Fuzzy Hash: 1a126bb470a9dd15389533f842cb919ff5d6107fe6553bc73c4d72565756929f
          • Instruction Fuzzy Hash: E3018F3180C645EAEB21EF78C944B8C37B0BB03329F624259D6115B2C5EB751A01CBAA
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0A2A13
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D31E62F,00000000,00000004), ref: 6D0A2A46
            • Part of subcall function 6D07E999: ?get_client_id@util_client_info@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D0A28B3), ref: 6D07E99D
          • ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D31E62F,00000000,00000004), ref: 6D0A2A59
          Strings
          • Software\Microsoft\Windows\CurrentVersion\App Paths\WeGameX.exe, xrefs: 6D0A2A52
          • Software\Microsoft\Windows\CurrentVersion\App Paths\WeGame.exe, xrefs: 6D0A2A65
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_client_version_type@overseas@ierd_tgp@@$?get_client_id@util_client_info@ierd_tgp@@H_prolog3memmove
          • String ID: Software\Microsoft\Windows\CurrentVersion\App Paths\WeGame.exe$Software\Microsoft\Windows\CurrentVersion\App Paths\WeGameX.exe
          • API String ID: 4280335684-1355461324
          • Opcode ID: 97e791c288ff91f7780c08f9c74a4924a8ef9b789e880e8e9a51f1205684c651
          • Instruction ID: 566020be2d679ee88f2027b419dd2b5d49864b02be4283f19641f9c7f26cef0e
          • Opcode Fuzzy Hash: 97e791c288ff91f7780c08f9c74a4924a8ef9b789e880e8e9a51f1205684c651
          • Instruction Fuzzy Hash: F7F0E970E4531AEBDB349FA9C8407AEB9F4BB01304F40192DD104EF342D7F44A8682C1
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0A2764
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D31E62F,00000000,00000004), ref: 6D0A2797
            • Part of subcall function 6D07E999: ?get_client_id@util_client_info@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D0A28B3), ref: 6D07E99D
          • ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,6D31E62F,00000000,00000004), ref: 6D0A27AA
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_client_version_type@overseas@ierd_tgp@@$?get_client_id@util_client_info@ierd_tgp@@H_prolog3memmove
          • String ID: %APPDATA%\Tencent\WeGame$%APPDATA%\WeGameX
          • API String ID: 4280335684-623866923
          • Opcode ID: f91733d9f431422cf38509a20fb513775ad74e41c19f2981dddca6cb54237f6c
          • Instruction ID: 8257d6a9a58976d50a370f31b0b935608b611a77998e90f422882ea29e79c5a8
          • Opcode Fuzzy Hash: f91733d9f431422cf38509a20fb513775ad74e41c19f2981dddca6cb54237f6c
          • Instruction Fuzzy Hash: B6F0E970A8931A9AEB305FB9888079DB9B0BB05704F80292DD504EB343C7F44A858392
          APIs
          • __EH_prolog3.LIBCMT ref: 6D07E9F9
          • ?get_current_language@overseas@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000004), ref: 6D07EA1F
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_current_language@overseas@ierd_tgp@@H_prolog3
          • String ID: en_US$zh_CN$zh_HK
          • API String ID: 267711143-777672496
          • Opcode ID: 00d61d26c986ca4f27d40b8d1056beeb3daf2d3325a502f8f987c3d75a71e7b4
          • Instruction ID: 07443988dd9cd35d3772a4602a204c994b8d1b4e926600f76e1ef8a484a63b91
          • Opcode Fuzzy Hash: 00d61d26c986ca4f27d40b8d1056beeb3daf2d3325a502f8f987c3d75a71e7b4
          • Instruction Fuzzy Hash: CBF082B0D8A35AEEEB60CF2889007DD7AF0BB02314F414569D544EF341E3B05641879A
          APIs
          • ?Is64Bit_OS@Sys_wrapper@common@ierd_tgp@@SA_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A2B4A
            • Part of subcall function 6D0A2B89: GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 6D0A2BA7
            • Part of subcall function 6D0A2B89: GetProcAddress.KERNEL32(00000000), ref: 6D0A2BAE
          • GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 6D0A2B5D
          • GetProcAddress.KERNEL32(00000000), ref: 6D0A2B64
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AddressHandleModuleProc$Bit_Is64Sys_wrapper@common@ierd_tgp@@
          • String ID: IsWow64Process$kernel32
          • API String ID: 357012051-3789238822
          • Opcode ID: 6e24dd42f271d9f6e098a16196158ad033ee4b130ab577da1586d5abbc3f14fe
          • Instruction ID: 4171d7f96613a391548f65168be49cd7014fdd8fe066c4bf3e5bfce84f1d4779
          • Opcode Fuzzy Hash: 6e24dd42f271d9f6e098a16196158ad033ee4b130ab577da1586d5abbc3f14fe
          • Instruction Fuzzy Hash: B9E0127052020AAFEF10DFF2C908BEA37AC9B4539EF041455A419D7042DB75D648EB60
          APIs
          • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 6D0A3819
          • GetProcAddress.KERNEL32(00000000), ref: 6D0A3820
          • GetCurrentProcess.KERNEL32(00000000), ref: 6D0A3830
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AddressCurrentHandleModuleProcProcess
          • String ID: IsWow64Process$kernel32
          • API String ID: 4190356694-3789238822
          • Opcode ID: 424639da888dd3de36820bf35e15c7227340f09360fbc2752bc2fda8b5a21c0e
          • Instruction ID: 781b30ea6cb62ab21c2c765258294434197ed88bd0e952b541576c9346b89669
          • Opcode Fuzzy Hash: 424639da888dd3de36820bf35e15c7227340f09360fbc2752bc2fda8b5a21c0e
          • Instruction Fuzzy Hash: 9EE08672C01619FBDF1097E1890DB9F76BC9F4665AF100491B400EB101C7B8D908EBA0
          APIs
          • lstrlenA.KERNEL32(?,?,?), ref: 6D010011
          • memset.VCRUNTIME140(?,00000000,?,?,00000000,00000004,?,?,?,?,?), ref: 6D0100D2
          • memset.VCRUNTIME140(?,00000000,00000099,?,?), ref: 6D010226
          • memmove.VCRUNTIME140(?,00007A7C,?,?,00000000,00000099,?,?), ref: 6D01023E
          • memset.VCRUNTIME140(?,00000000,00000099,?,?), ref: 6D0102C0
          • memmove.VCRUNTIME140(?,-00007A7C,?,?,00000000,00000099,?,?), ref: 6D0102CA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$memmove$lstrlen
          • String ID:
          • API String ID: 2250256610-0
          • Opcode ID: d427697e481082d9fe7febc6dcf181c0862253d8e4e4d44c2ce503ce20a79c22
          • Instruction ID: aa61ea3df230008c283102c8642f2fc1489f8bab70d8c17ddf0b8b4737cc6065
          • Opcode Fuzzy Hash: d427697e481082d9fe7febc6dcf181c0862253d8e4e4d44c2ce503ce20a79c22
          • Instruction Fuzzy Hash: 0EB18E71A0860B9FDB19CFA9CC80AAEBBB5FF85304F04842DE95597341D734E952CB90
          APIs
          • memmove.VCRUNTIME140(?,00000007,00000010,00000000,?,?,?,?,?,6D0B55A1,?,?,?,?,00000007,?), ref: 6D01EF8B
          • memmove.VCRUNTIME140(?,00000007,00000010,00000000,?,?,?,?,?,6D0B55A1,?,?,?,?,00000007,?), ref: 6D01EFBC
          • memmove.VCRUNTIME140(?,?,00000000,?,00000007,00000010,00000000,?,?,?,?,?,6D0B55A1,?,?,?), ref: 6D01EFCE
          • memmove.VCRUNTIME140(?,?,00000000,00000000,?,?,?,?,?,6D0B55A1,?,?,?,?,00000007,?), ref: 6D01F03F
          • memmove.VCRUNTIME140(?,00000007,00000010,?,?,00000000,00000000,?,?,?,?,?,6D0B55A1,?,?,?), ref: 6D01F04B
          • memmove.VCRUNTIME140(?,00000007,00000010,?,00000007,00000010,?,?,00000000,00000000,?,?,?,?,?,6D0B55A1), ref: 6D01F062
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memmove
          • String ID:
          • API String ID: 2162964266-0
          • Opcode ID: 464f9188ee2b88e5c0e6e9669e38f87082189316a72894ca1f4882de8c2e2018
          • Instruction ID: 0a75d97725cdf9e28738a39593b013d4b8602059e848e05cfd20e92cd8eef422
          • Opcode Fuzzy Hash: 464f9188ee2b88e5c0e6e9669e38f87082189316a72894ca1f4882de8c2e2018
          • Instruction Fuzzy Hash: C141427261421AAFDB05CFACCC84A9E7FA9FF44358B148529F814C7200E771EE61CBA1
          APIs
            • Part of subcall function 6D006B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6D388534,6D006BB1,6D388538,?,6D00A235,00000000,?,00000010), ref: 6D006B81
            • Part of subcall function 6D006B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D006B8D
          • ?m_get_symlink_status@directory_entry@filesystem@ierd_tgp@@ABE?AVfile_status@23@PAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,23C35E98,?,00000000), ref: 6D00EE33
          • ?m_get_status@directory_entry@filesystem@ierd_tgp@@ABE?AVfile_status@23@PAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,23C35E98,?,00000000), ref: 6D00EE5D
          • ?path@directory_entry@filesystem@ierd_tgp@@QBE?BV023@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,23C35E98), ref: 6D00EE7E
          • ??0directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000000,?,?,00000000,23C35E98), ref: 6D00EE8B
          • ?equal@directory_iterator@filesystem@ierd_tgp@@QBE_NABV123@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000000,23C35E98), ref: 6D00EEBA
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Verror_code@std@@@$Vfile_status@23@$??0directory_iterator@filesystem@ierd_tgp@@?equal@directory_iterator@filesystem@ierd_tgp@@?m_get_status@directory_entry@filesystem@ierd_tgp@@?m_get_symlink_status@directory_entry@filesystem@ierd_tgp@@?path@directory_entry@filesystem@ierd_tgp@@Execute_once@std@@Uonce_flag@1@V023@V123@@Vpath@12@terminate
          • String ID:
          • API String ID: 787547266-0
          • Opcode ID: 12cecc8e75683800f1803867e71048fe4ec08aba3fcce27b03c3c6e70fd4368f
          • Instruction ID: 624ba747e41ac10e7d4a06284049834db5dffb21f6a64b47bc39ceaa562e9d1d
          • Opcode Fuzzy Hash: 12cecc8e75683800f1803867e71048fe4ec08aba3fcce27b03c3c6e70fd4368f
          • Instruction Fuzzy Hash: DB418F71E0964ABBFB14CFA9C554BBEB7F5EF49314F10462DE526A3290DB30A905CB10
          APIs
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02A783
          • ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ.MSVCP140 ref: 6D02A7A8
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?pptr@?$basic_streambuf@D@std@@@std@@Pninc@?$basic_streambuf@_U?$char_traits@U?$char_traits@_W@std@@@std@@
          • String ID:
          • API String ID: 3900108780-0
          • Opcode ID: cc352311f1c59c204aea6f417ea4c557cb22d3d1e674eb57718d933a73a1271e
          • Instruction ID: 3130f84d67ae151eee39d75ebb3e2734fa99490f9e492e220b03cefe6e03198e
          • Opcode Fuzzy Hash: cc352311f1c59c204aea6f417ea4c557cb22d3d1e674eb57718d933a73a1271e
          • Instruction Fuzzy Hash: 6241AF75A00606EFDB05DF2CC490AA9BBF1FF49318B61816AE905D7B50EB30E925CB94
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0CE36E
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,00000058), ref: 6D0CE3CE
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,00000058), ref: 6D0CE3D8
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000002,?,?,?,?,?,?,00000058), ref: 6D0CE410
          • ?ZipFilesToFile@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0CE45F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$V?$allocator@$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@U?$char_traits@V?$basic_string@W@2@@4@@$H_prolog3_W@2@@std@@$File@common@ierd_tgp@@FilesV?$vector@W@2@@std@@@2@@4@0@
          • String ID:
          • API String ID: 3245351383-0
          • Opcode ID: 5d98531ffe4b647ea5fb377eb98dda6410e9ff70caa52e4a28a881a306472181
          • Instruction ID: 4802eba9d2a23c47011482fb9043bf256407c4451f86d124c0692ebf9bfb65aa
          • Opcode Fuzzy Hash: 5d98531ffe4b647ea5fb377eb98dda6410e9ff70caa52e4a28a881a306472181
          • Instruction Fuzzy Hash: 424105B1C04258DFEB00CFA9C885ADDFBB4BF19314F95416ED518BB241D730AA45CBA2
          APIs
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02A67C
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02A692
          • ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 6D02A69E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$Pninc@?$basic_streambuf@
          • String ID:
          • API String ID: 2538508077-0
          • Opcode ID: 2bfb43416ad11ffb76cdddbf7119a97987ccf5279ac7eb34254725dd4c063f90
          • Instruction ID: ed2d698877647a4ec3a5b9808bfccd8e744cb9b9521b43906d46ecba0f7d00a1
          • Opcode Fuzzy Hash: 2bfb43416ad11ffb76cdddbf7119a97987ccf5279ac7eb34254725dd4c063f90
          • Instruction Fuzzy Hash: 60317E3561511AAFDF01DFA8C984EEEBBF9BF4A358B14411AE501E3240DF30E958CBA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0B6F8D
          • ?GetInstance@InfoTraceSystem@trace_system@ierd_tgp@@SAAAV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(000000F0), ref: 6D0B6FAD
          • ?GetUIN@InfoTraceSystem@trace_system@ierd_tgp@@QAEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000000F0), ref: 6D0B6FC2
          • ?GetTraceInstanceID@InfoTraceSystem@trace_system@ierd_tgp@@QAE_K_KII@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,00000000,?,000000F0), ref: 6D0B6FCD
            • Part of subcall function 6D0B63C1: __EH_prolog3.LIBCMT ref: 6D0B63C8
          • ?TraceInfo@InfoTraceSystem@trace_system@ierd_tgp@@QAE_N_KABUTraceInformation@23@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D0B70CD
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Trace$InfoSystem@trace_system@ierd_tgp@@$H_prolog3H_prolog3_Info@Information@23@@InstanceInstance@V123@
          • String ID:
          • API String ID: 1333543344-0
          • Opcode ID: ed5cf3c5245e37de1d465ba14a3373af29ff0114c0a00d0a994c15289d7729ec
          • Instruction ID: 778ec3923c8d2e44339d11b68aeae9197481df78e26e99fbaefd897de29eecbe
          • Opcode Fuzzy Hash: ed5cf3c5245e37de1d465ba14a3373af29ff0114c0a00d0a994c15289d7729ec
          • Instruction Fuzzy Hash: 64411371D0425A9FEF20CFA8C940BECBBF5BF48204F0581A9E919A7250EB319E85DF50
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07EDBB
          • ?str_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000006C), ref: 6D07EDED
            • Part of subcall function 6D0801EA: __EH_prolog3_GS.LIBCMT ref: 6D0801F1
            • Part of subcall function 6D0801EA: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,0000001C,6D07F183,?,?,00000064,6D017177,?,?,?,?), ref: 6D08021C
          • ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,0000006C), ref: 6D07EE0B
            • Part of subcall function 6D0529BB: __EH_prolog3_GS.LIBCMT ref: 6D0529C2
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D07EE21
            • Part of subcall function 6D00FACF: __EH_prolog3.LIBCMT ref: 6D00FAD6
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?path_to_str@common@ierd_tgp@@YA_NABVpath@filesystem@2@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D07EE4D
            • Part of subcall function 6D080002: __EH_prolog3_GS.LIBCMT ref: 6D080009
            • Part of subcall function 6D080002: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,0000001C), ref: 6D08002E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@$U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$D@2@@std@@W@2@@std@@$?filename@path@filesystem@ierd_tgp@@?path_to_str@common@ierd_tgp@@?str_to_path@common@ierd_tgp@@?u16to8@common@ierd_tgp@@?u8to16@common@ierd_tgp@@?wstring@path@filesystem@ierd_tgp@@D@2@@4@@D@2@@std@@@H_prolog3V123@Vpath@filesystem@2@Vpath@filesystem@2@@W@2@@4@@memmove
          • String ID:
          • API String ID: 1909183909-0
          • Opcode ID: 3f21de8c90be8d92780084ddcdc0be3f42a580d33b8070756e454e5431dd0beb
          • Instruction ID: bc8537b4dcecab955519cbec3d4ee31744502e6a7510c7488add3282ddc0017e
          • Opcode Fuzzy Hash: 3f21de8c90be8d92780084ddcdc0be3f42a580d33b8070756e454e5431dd0beb
          • Instruction Fuzzy Hash: 8C3136B1C0A249EAEB20CFA8C8917ECBBB0AF19314F64415ED515AB292C7740689CB64
          APIs
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID:
          • API String ID: 431132790-0
          • Opcode ID: 3a7a8408584fc84746f4ea94d4e2eaa26a5b24ddc15eb5718358d830595f5464
          • Instruction ID: 0f0f792b01d5b09582008d52eb76aaff33de4ceed1964921beee8d0da39dc679
          • Opcode Fuzzy Hash: 3a7a8408584fc84746f4ea94d4e2eaa26a5b24ddc15eb5718358d830595f5464
          • Instruction Fuzzy Hash: B731A531915209EFDB14CFACC945AAE7FB4AF46214FA0455AE510DB2E2C770DA84CBD2
          APIs
          • FindFirstUrlCacheEntryA.WININET(00000000,00000000,?), ref: 6D05608B
          • DeleteUrlCacheEntry.WININET(?), ref: 6D0560B2
          • FindNextUrlCacheEntryA.WININET(00000000,00000000,?), ref: 6D0560C1
          • GetLastError.KERNEL32(?,?,?,?,?,?,6D055E21,00000001,?), ref: 6D0560CF
          • FindCloseUrlCache.WININET(00000000), ref: 6D0560F7
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Cache$EntryFind$CloseDeleteErrorFirstLastNext
          • String ID:
          • API String ID: 2077925056-0
          • Opcode ID: 2fcca75f6c50c35e5ef052baa19c496e345827d1df9c79ed15f0b66860a6283a
          • Instruction ID: f28f712c8d1dbd5c5a7e11b5ba5130199167f0509f27474cd6a66b168d28156e
          • Opcode Fuzzy Hash: 2fcca75f6c50c35e5ef052baa19c496e345827d1df9c79ed15f0b66860a6283a
          • Instruction Fuzzy Hash: 3721B075904616AFF7158E64C944BBF7BF8DF83361F50962AEC0193240DB30DE458AA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04F8C4
          • GetTickCount.KERNEL32 ref: 6D04F8FD
          • ?MD5String@@YAPADPAD@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D04F91F
          • free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000001), ref: 6D04F94D
          • __Init_thread_footer.LIBCMT ref: 6D04F9BC
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CountH_prolog3_Init_thread_footerString@@Tickfree
          • String ID:
          • API String ID: 313641035-0
          • Opcode ID: e42103036888bf65b44ebd99d5835572a89939e924eaae481b67c926338f7415
          • Instruction ID: 1a64ed0b5617b3903f6133abf243d119afd73e50dc723e6e76ad93e2f3872a5b
          • Opcode Fuzzy Hash: e42103036888bf65b44ebd99d5835572a89939e924eaae481b67c926338f7415
          • Instruction Fuzzy Hash: 1021EFB1808304EFDF15EF68E558BAD7BB8EB8A314F14416ED0019B385CBB4594ACB51
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05A279
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
            • Part of subcall function 6D006B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6D388534,6D006BB1,6D388538,?,6D00A235,00000000,?,00000010), ref: 6D006B81
            • Part of subcall function 6D006B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D006B8D
          • ?is_directory@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,0000003C,6D05AB09,00000005), ref: 6D05A2C6
          • ?CopyDir@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,0000003C,6D05AB09,00000005), ref: 6D05A2D9
            • Part of subcall function 6D09F646: __EH_prolog3_catch_GS.LIBCMT ref: 6D09F650
            • Part of subcall function 6D09F646: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000130), ref: 6D09F678
            • Part of subcall function 6D09F646: ?create_directory_ex@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000130), ref: 6D09F683
            • Part of subcall function 6D09F646: ??0directory_iterator@filesystem@ierd_tgp@@QAE@ABVpath@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000130), ref: 6D09F690
            • Part of subcall function 6D09F646: ?equal@directory_iterator@filesystem@ierd_tgp@@QBE_NABV123@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D09F6BC
            • Part of subcall function 6D09F646: ?path@directory_entry@filesystem@ierd_tgp@@QBE?BV023@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000), ref: 6D09F6EC
            • Part of subcall function 6D09F646: ?is_directory@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D09F6F9
            • Part of subcall function 6D09F646: ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000), ref: 6D09F711
            • Part of subcall function 6D09F646: ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,00000000), ref: 6D09F71E
          • ?create_directory_for_file@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,0000003C,6D05AB09,00000005), ref: 6D05A2E8
          • CopyFileW.KERNEL32(?,?,00000001,?,?,0000003C,6D05AB09,00000005), ref: 6D05A308
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Sys_wrapper@common@ierd_tgp@@Vpath@12@@$?is_directory@filesystem@ierd_tgp@@CopyU?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@$??0directory_iterator@filesystem@ierd_tgp@@??0path@filesystem@ierd_tgp@@?create_directory_ex@?create_directory_for_file@?equal@directory_iterator@filesystem@ierd_tgp@@?exists@filesystem@ierd_tgp@@?filename@path@filesystem@ierd_tgp@@?path@directory_entry@filesystem@ierd_tgp@@Dir@Execute_once@std@@FileH_prolog3_H_prolog3_catch_Uonce_flag@1@V023@V123@V123@@Verror_code@std@@@Vpath@12@Vpath@filesystem@3@0@Vpath@filesystem@3@@memmoveterminate
          • String ID:
          • API String ID: 411637254-0
          • Opcode ID: d46635c0616f1b8fd821dab7c612436dcbfc09a07771b4e70e7670d73a68cd1f
          • Instruction ID: 46165c0c37c4be3087e7a7b2098ab8bbe5fde342af1f92442698268296c80c05
          • Opcode Fuzzy Hash: d46635c0616f1b8fd821dab7c612436dcbfc09a07771b4e70e7670d73a68cd1f
          • Instruction Fuzzy Hash: 42213971808248EFEF00DFA4C894BDDBBB8AF19318F95416EE605A7190DB74D789CB61
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D03A20E
          • ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D03A22B
            • Part of subcall function 6D00E91A: ?has_root_name@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D05097A), ref: 6D00E91D
            • Part of subcall function 6D00E91A: ?has_root_directory@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D05097A), ref: 6D00E928
          • ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D03A246
            • Part of subcall function 6D051BCB: __EH_prolog3.LIBCMT ref: 6D051BD2
            • Part of subcall function 6D051BCB: ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,0000000C,6D0509B4,?), ref: 6D051BEE
          • ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D03A259
          • ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,00000000,?), ref: 6D03A274
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Vpath@12@$?current_path@filesystem@ierd_tgp@@$??0path@filesystem@ierd_tgp@@?absolute@filesystem@ierd_tgp@@?has_root_directory@path@filesystem@ierd_tgp@@?has_root_name@path@filesystem@ierd_tgp@@?is_absolute@path@filesystem@ierd_tgp@@H_prolog3H_prolog3_catch_U?$char_traits@_V312@0@V?$allocator@_V?$basic_string@_Verror_code@std@@@W@2@@std@@@W@std@@
          • String ID:
          • API String ID: 2341604710-0
          • Opcode ID: 221c99c4766d6b95820b6ecfba9b7554ec171203a7d14ac82405ebb7d8949b6e
          • Instruction ID: 8661a828b7c42675b695473784fcbd5ea9207c7213f6ef58e70b1eb11d210642
          • Opcode Fuzzy Hash: 221c99c4766d6b95820b6ecfba9b7554ec171203a7d14ac82405ebb7d8949b6e
          • Instruction Fuzzy Hash: 1D217AB1D09349EEFF10CFA8C948BDDB7B4AF12318F228198D5546B281C7B55B48CB62
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D037A7E
          • ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(0000005C,6D038B7D,?,?,?,?,0000032C,6D0393D0,?,?,?,0000006C,6D0391B5,?,?,?), ref: 6D037A95
            • Part of subcall function 6D00E91A: ?has_root_name@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D05097A), ref: 6D00E91D
            • Part of subcall function 6D00E91A: ?has_root_directory@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D05097A), ref: 6D00E928
          • ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000005C,6D038B7D,?,?,?,?,0000032C,6D0393D0,?,?,?,0000006C,6D0391B5,?,?), ref: 6D037AB0
            • Part of subcall function 6D051BCB: __EH_prolog3.LIBCMT ref: 6D051BD2
            • Part of subcall function 6D051BCB: ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,0000000C,6D0509B4,?), ref: 6D051BEE
          • ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,0000005C,6D038B7D,?,?,?,?,0000032C,6D0393D0,?,?,?,0000006C,6D0391B5,?,?), ref: 6D037AC3
          • ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,00000000,0000005C,6D038B7D,?,?,?,?,0000032C,6D0393D0,?,?,?,0000006C), ref: 6D037ADB
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Vpath@12@$?current_path@filesystem@ierd_tgp@@$??0path@filesystem@ierd_tgp@@?absolute@filesystem@ierd_tgp@@?has_root_directory@path@filesystem@ierd_tgp@@?has_root_name@path@filesystem@ierd_tgp@@?is_absolute@path@filesystem@ierd_tgp@@H_prolog3H_prolog3_catch_U?$char_traits@_V312@0@V?$allocator@_V?$basic_string@_Verror_code@std@@@W@2@@std@@@W@std@@
          • String ID:
          • API String ID: 2341604710-0
          • Opcode ID: 96fe1ed3659a5915089c75d5b4fabcbf5b124f0ed844d5d2a9627ca6f3d0f2ed
          • Instruction ID: e6d009a2b4b32e02ec4c76d4fbfcd103c2bbc1cf55a0ab31cbad11dbad7c88b1
          • Opcode Fuzzy Hash: 96fe1ed3659a5915089c75d5b4fabcbf5b124f0ed844d5d2a9627ca6f3d0f2ed
          • Instruction Fuzzy Hash: 8C214AB1C09349EAFF00CFA4CA89BDDB7B4AF51318F518158D6156B281D7B85F08CB61
          APIs
          • _malloc.LIBCMT ref: 0283E5E5
            • Part of subcall function 02836E83: __FF_MSGBANNER.LIBCMT ref: 02836E9C
            • Part of subcall function 02836E83: __NMSG_WRITE.LIBCMT ref: 02836EA3
            • Part of subcall function 02836E83: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F), ref: 02836EC8
          • _free.LIBCMT ref: 0283E5F8
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: AllocHeap_free_malloc
          • String ID:
          • API String ID: 2734353464-0
          • Opcode ID: 520c60eab91456eeeee6f41764300abc9aced5db3c1f42cc3199f071cc774e23
          • Instruction ID: 8240b154a38c90b4c58c48d2894f9ae7b5c01324d0a1ec31e30343cf7611de73
          • Opcode Fuzzy Hash: 520c60eab91456eeeee6f41764300abc9aced5db3c1f42cc3199f071cc774e23
          • Instruction Fuzzy Hash: 4511917F944615ABCB232B78EC04B5E3796AF403A4B110825F859EA182FB34C840CED5
          APIs
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02AAFC
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02AB0D
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02AB1E
          • ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 6D02AB2E
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02AB6B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$Gndec@?$basic_streambuf@
          • String ID:
          • API String ID: 2834487908-0
          • Opcode ID: 5269e5826d5fff31ffd1f1e4c2c066dbf84fe9a5a29678a94d326348f8d113da
          • Instruction ID: 9b58696f9a04752fdd54b962c09c4b343f0cdf37a7c526764f4ca24fb8147f1f
          • Opcode Fuzzy Hash: 5269e5826d5fff31ffd1f1e4c2c066dbf84fe9a5a29678a94d326348f8d113da
          • Instruction Fuzzy Hash: 5A1127302061025FDF164A3D9C98F69BBEBAF87335B640216E424C32D2CF24A449C650
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D00EF4B
            • Part of subcall function 6D0030A0: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(23C35E98,?), ref: 6D0030E3
            • Part of subcall function 6D0030A0: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,23C35E98,?), ref: 6D003101
            • Part of subcall function 6D0030A0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 6D00312B
          • ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008), ref: 6D00EF8B
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(?,?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008), ref: 6D00EFA1
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008,6D00CC88), ref: 6D00EFB8
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,00000002,00000001,000000C4,6D007EE4,?,?,0000007C,6D007EBA,?,?,?,?,?,00000008,6D00CC88), ref: 6D00F00F
            • Part of subcall function 6D009D9D: __EH_prolog3.LIBCMT ref: 6D009DA4
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??6?$basic_ostream@?imbue@?$basic_ios@Bios_base@std@@D@std@@@1@_H_prolog3H_prolog3_V01@V32@@V?$basic_streambuf@Vlocale@2@
          • String ID:
          • API String ID: 1745865538-0
          • Opcode ID: 5ad846c8e9dfe3472069425c8cb4b4de10aafb845047f27653ff66e64faa7fe6
          • Instruction ID: 60853ac3e26cc3f53a17c295179a2927416fe2bf77668d8fa64cb9ef9d726d1e
          • Opcode Fuzzy Hash: 5ad846c8e9dfe3472069425c8cb4b4de10aafb845047f27653ff66e64faa7fe6
          • Instruction Fuzzy Hash: 7221E830905258EFEF15DBA4C898BDDBBB4BF1530CF048099E509BB291DBB56A48CF61
          APIs
          • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,6D07F53A,?,?,?), ref: 6D07F588
          • SetLastError.KERNEL32(00000000,?,?,?,?,?,6D07F53A,?,?,?,?), ref: 6D07F599
          • GetFileSize.KERNEL32(00000000,?,?,?,?,?,?,6D07F53A,?,?,?,?), ref: 6D07F5A4
          • GetLastError.KERNEL32(?,?,?,?,?,6D07F53A,?,?,?,?,?,?,?,?,?,0000001C), ref: 6D07F5B2
          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,6D07F53A,?,?,?,?), ref: 6D07F5CE
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ErrorFileLast$CloseCreateHandleSize
          • String ID:
          • API String ID: 3555958901-0
          • Opcode ID: 9cd3e4b118317c74b3b95d2950aa5a4331e18758eabe73499f2d14d35e157bdf
          • Instruction ID: dbf7b8ec128fb3ae78418ee181cc87a102d17c6c898ec255be9b0f15853016b0
          • Opcode Fuzzy Hash: 9cd3e4b118317c74b3b95d2950aa5a4331e18758eabe73499f2d14d35e157bdf
          • Instruction Fuzzy Hash: E8115270605205AFDB109F64D889BAB7BFCEB4A769B50852EF965DB280D730D908CB20
          APIs
          • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 02832BFF
          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 02832C15
          • TranslateMessage.USER32(?), ref: 02832C24
          • DispatchMessageW.USER32(?), ref: 02832C2A
          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 02832C38
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
          • String ID:
          • API String ID: 2015114452-0
          • Opcode ID: e76ebad6a6788aaf48d0fc7f023fa759261c658332fbbf8a78be83556d0890f9
          • Instruction ID: 9b456559847f08433821c846b52934e8cc23ec1ed79a26042ec2684ee40034b3
          • Opcode Fuzzy Hash: e76ebad6a6788aaf48d0fc7f023fa759261c658332fbbf8a78be83556d0890f9
          • Instruction Fuzzy Hash: BC01A97EA80319B7EA119BA49C41FFE73ACAB14B14F504911FF04EA0C8DAA4E801C7F4
          APIs
          • EnterCriticalSection.KERNEL32(?,?,00000000), ref: 02834B63
          • EnterCriticalSection.KERNEL32(?,?,00000000), ref: 02834B6D
          • LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 02834B80
          • LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 02834B83
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$EnterLeave
          • String ID:
          • API String ID: 3168844106-0
          • Opcode ID: 8c46016a06f5d033f5f216fbb074e16fb3da2c6f385f959a9c3cc7afce596e9b
          • Instruction ID: 417376f28489eb0841f367450829b6ae18796f50445a05127e13656608fe4464
          • Opcode Fuzzy Hash: 8c46016a06f5d033f5f216fbb074e16fb3da2c6f385f959a9c3cc7afce596e9b
          • Instruction Fuzzy Hash: B1012C7EA006149BD7219B69FC84B9AB7E8AB88664F014929E14AC3640C778FC45CAA0
          APIs
          • __EH_prolog3.LIBCMT ref: 6D09A6A6
            • Part of subcall function 6D09A36F: __EH_prolog3.LIBCMT ref: 6D09A376
            • Part of subcall function 6D09A36F: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D09A6BF,?,00000003,00000001,000000B8), ref: 6D09A39A
            • Part of subcall function 6D09A36F: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D09A6BF,?,00000003,00000001,000000B8), ref: 6D09A3B3
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z.MSVCP140(?,?,00000003,00000001,000000B8), ref: 6D09A6CD
          • ?fail@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6D09A6DC
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D09A728
            • Part of subcall function 6D09A2A3: __EH_prolog3_catch.LIBCMT ref: 6D09A2AA
            • Part of subcall function 6D09A2A3: ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000000,00000014,6D09A6F6,?,?), ref: 6D09A2D6
            • Part of subcall function 6D09A2A3: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000000,00000014,6D09A6F6,?,?), ref: 6D09A327
          • ??Bios_base@std@@QBE_NXZ.MSVCP140 ref: 6D09A701
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??5?$basic_istream@?fail@ios_base@std@@?sbumpc@?$basic_streambuf@?setstate@?$basic_ios@Bios_base@std@@D@std@@@1@@H_prolog3_catchV01@V?$basic_streambuf@
          • String ID:
          • API String ID: 2886180661-0
          • Opcode ID: 28b2779b9233125b889ee514d9a6478790a5ec7f28f4a338e55f1ead549cf22f
          • Instruction ID: c490422dc13d429f0757f37ff0a75fd525cc0accac27e2d55ce5488cde2fc281
          • Opcode Fuzzy Hash: 28b2779b9233125b889ee514d9a6478790a5ec7f28f4a338e55f1ead549cf22f
          • Instruction Fuzzy Hash: 35113034A091099FEB14DFA4DD95FEDB3B8BF46309F608199E1169B290DB306E09DF10
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0778BD
            • Part of subcall function 6D0030A0: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(23C35E98,?), ref: 6D0030E3
            • Part of subcall function 6D0030A0: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,23C35E98,?), ref: 6D003101
            • Part of subcall function 6D0030A0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 6D00312B
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z.MSVCP140(6D000520,00000002,00000001,000000AC,6D0ACF14,?,6D33B60C,00000000,?), ref: 6D0778E9
          • ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000002,00000000), ref: 6D0778F9
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(00000002), ref: 6D077919
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?), ref: 6D077949
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@V01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@?setw@std@@D@std@@@1@_H_prolog3J@1@_Smanip@_U?$_V21@@V?$basic_streambuf@Vios_base@1@
          • String ID:
          • API String ID: 2948014658-0
          • Opcode ID: 4b333609c26693060272e4d57949dc04b7176d5c72b582a397092118069fda23
          • Instruction ID: ee3245a15e21e10c17f067a92b7e4beddb98979c6662478a833a485c3aa1e0bf
          • Opcode Fuzzy Hash: 4b333609c26693060272e4d57949dc04b7176d5c72b582a397092118069fda23
          • Instruction Fuzzy Hash: 52110870904218ABEB25CB60CC58FEEBB78EF46309F414068E2095B191DF705E49CB91
          APIs
          • __EH_prolog3.LIBCMT ref: 6D07F940
          • strlen.API-MS-WIN-CRT-STRING-L1-1-0(6D389598,00000004), ref: 6D07F950
          • GetModuleHandleA.KERNEL32(00000000,00000004), ref: 6D07F95B
          • GetModuleFileNameA.KERNEL32(00000000,6D389598,00000104), ref: 6D07F968
          • _mbsrchr.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(6D389598,0000005C), ref: 6D07F971
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Module$FileH_prolog3HandleName_mbsrchrstrlen
          • String ID:
          • API String ID: 3308004774-0
          • Opcode ID: 369613d679467861db4f64d2d2e01b211a9c447d5c20d3fe00bc7dced6dd7c28
          • Instruction ID: f125814628f0ce8e74506a16bda4905fe6079d25a2da949830bd088c6182e0ac
          • Opcode Fuzzy Hash: 369613d679467861db4f64d2d2e01b211a9c447d5c20d3fe00bc7dced6dd7c28
          • Instruction Fuzzy Hash: 6601F271608742AFEB145F34C858AAFBFB8AF83318F10046EE6815B681D7F18909C760
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0AE7D7
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(?,00000003,00000001,000000B0,6D09E324,?,?,0000003C,?,6D32D48C,6D381E98,6D381D38), ref: 6D0AE7FC
          • ??Bios_base@std@@QBE_NXZ.MSVCP140 ref: 6D0AE80B
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D0AE84A
            • Part of subcall function 6D0146DC: __EH_prolog3_catch.LIBCMT ref: 6D0146E3
            • Part of subcall function 6D0146DC: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000004C,6D017CDC,?,?,?,?,?,?,00000004), ref: 6D014716
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QBE_JXZ.MSVCP140(00000000,?,?,?,?,00000004), ref: 6D014749
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QBE_JXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 6D01477D
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QBE_JXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 6D014793
            • Part of subcall function 6D0146DC: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140 ref: 6D0147CB
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,?,00000000,0000004C,6D017CDC,?,?,?,?,?,?,00000004), ref: 6D014852
            • Part of subcall function 6D0146DC: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,00000004), ref: 6D01486A
          • ??Bios_base@std@@QBE_NXZ.MSVCP140 ref: 6D0AE82F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$Bios_base@std@@H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??6?$basic_ostream@?getloc@ios_base@std@@?setstate@?$basic_ios@?sgetc@?$basic_streambuf@D@std@@@1@@H_prolog3_catchV01@V?$basic_streambuf@Vlocale@2@
          • String ID:
          • API String ID: 1469493847-0
          • Opcode ID: b4b5bb67e1381879df9a1af7df28d42b67a32e389e608a357c1063e195c9f0d8
          • Instruction ID: 0cdf45b1d3a99aee539f4c56e4804487e94585750f548affe5145b9fc1269bd5
          • Opcode Fuzzy Hash: b4b5bb67e1381879df9a1af7df28d42b67a32e389e608a357c1063e195c9f0d8
          • Instruction Fuzzy Hash: 58019E34608209DFEF08DFE4C898BA973B5EF56308F048099E11A9B2A1DB349E09CB11
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0AE5B3
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(00000003,00000001,000000B0,6D09E267,?,00000000), ref: 6D0AE5E7
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z.MSVCP140(?), ref: 6D0AE5FA
          • ??Bios_base@std@@QBE_NXZ.MSVCP140 ref: 6D0AE609
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D0AE624
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$Bios_base@std@@H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??5?$basic_istream@D@std@@@1@@V01@V?$basic_streambuf@
          • String ID:
          • API String ID: 288696274-0
          • Opcode ID: 2c48b833f20b9319f72fb257fa224940d52211b9d92d287bb82c7d2ae5ceedd0
          • Instruction ID: 0f393af4883a0388f54935ef1acfaa106dc883f73c424d33c16d14a8d93bae9d
          • Opcode Fuzzy Hash: 2c48b833f20b9319f72fb257fa224940d52211b9d92d287bb82c7d2ae5ceedd0
          • Instruction Fuzzy Hash: 0701BC34608208DFEF08DFA0C898BAD73B5EF42308F108199E11A9B291DB349E09CB10
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0C65ED
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(00000003,00000001,000000B0,6D0C5D3D,?,00000000,?,?,?,6D0C6215,?), ref: 6D0C6621
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z.MSVCP140(6D0C6215,?,?,?,6D0C6215,?), ref: 6D0C6634
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(?,?,?,6D0C6215,?), ref: 6D0C6643
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?,6D0C6215,?), ref: 6D0C665E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$Bios_base@std@@H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??5?$basic_istream@D@std@@@1@@V01@V?$basic_streambuf@
          • String ID:
          • API String ID: 288696274-0
          • Opcode ID: 46caaf8b20e13247766149edace367f38d99331267ce50992a9d1c9c9e20c716
          • Instruction ID: f72803af448faaafe211e356fa399ff00c9ec2cf2b06ca71201bd707e5169dda
          • Opcode Fuzzy Hash: 46caaf8b20e13247766149edace367f38d99331267ce50992a9d1c9c9e20c716
          • Instruction Fuzzy Hash: 7001D434608208DFEF08DFA0C898BAD73B5EF42308F108058E11A9B2A1DF349E0DCB11
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0AE74E
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(00000003,00000001,000000B0,6D09E3F9,?,?), ref: 6D0AE782
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z.MSVCP140(?), ref: 6D0AE795
          • ??Bios_base@std@@QBE_NXZ.MSVCP140 ref: 6D0AE7A4
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D0AE7BF
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$Bios_base@std@@H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??5?$basic_istream@D@std@@@1@@V01@V?$basic_streambuf@
          • String ID:
          • API String ID: 288696274-0
          • Opcode ID: e06fdde02c1b6183865bfd221a968314860d8f389dd2bf5a2db50235f15fe48c
          • Instruction ID: 5dfad0c72e70f107426c2524ba69b99def4a765919d411292be0d4eb63da6d9d
          • Opcode Fuzzy Hash: e06fdde02c1b6183865bfd221a968314860d8f389dd2bf5a2db50235f15fe48c
          • Instruction Fuzzy Hash: 8A017134604209DFEF08DFA0C999BAD77B5EF56309F158059E1169B291DB349E49CB10
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0AE63C
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(00000003,00000001,000000B0,6D09E2B2,?,00000000), ref: 6D0AE670
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z.MSVCP140(?), ref: 6D0AE683
          • ??Bios_base@std@@QBE_NXZ.MSVCP140 ref: 6D0AE692
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6D0AE6AD
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$Bios_base@std@@H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??5?$basic_istream@D@std@@@1@@V01@V?$basic_streambuf@
          • String ID:
          • API String ID: 288696274-0
          • Opcode ID: db3ec3be1b83ad3bc10fcf8bb140406e27edcf783c13dc75420db65f08f8f5c8
          • Instruction ID: 2eedad197ae60c9a17df1098982b6f40a9e1d5fd193af9851bb62431fdbeee66
          • Opcode Fuzzy Hash: db3ec3be1b83ad3bc10fcf8bb140406e27edcf783c13dc75420db65f08f8f5c8
          • Instruction Fuzzy Hash: CB017134604209DFEF18DFA0C998BAD77B5EF56309F148459E11A9B292DF34AE0DCB14
          APIs
          • __EH_prolog3.LIBCMT ref: 6D0AE6C5
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(00000003,00000001,000000B0,6D09E3A5,6D381E98,6D381E98,?,?,?,?,6D32D48C,6D381E98), ref: 6D0AE6F9
          • ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z.MSVCP140(6D32D48C,?,?,?,?,6D32D48C,6D381E98), ref: 6D0AE70C
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(?,?,?,?,6D32D48C,6D381E98), ref: 6D0AE71B
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?,?,6D32D48C,6D381E98), ref: 6D0AE736
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$Bios_base@std@@H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??5?$basic_istream@D@std@@@1@@V01@V?$basic_streambuf@
          • String ID:
          • API String ID: 288696274-0
          • Opcode ID: 4fb282bfb401c9e4d8bdfe5a550b649e4eaf88ec3ea6e90a8c6cfd205daf0aa1
          • Instruction ID: 1754888fed15f761ab6a595737abb992bd3e2756c3ad9f7d9872c5deada885f9
          • Opcode Fuzzy Hash: 4fb282bfb401c9e4d8bdfe5a550b649e4eaf88ec3ea6e90a8c6cfd205daf0aa1
          • Instruction Fuzzy Hash: 43017134604209DFEF08DFA0C998BED77B5EF56309F148059E21A9B291DF34AE09CB11
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0360FC
          • ?root_full_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D03610F
            • Part of subcall function 6D0387E1: __EH_prolog3_GS.LIBCMT ref: 6D0387EB
            • Part of subcall function 6D0387E1: ?get_cfg_module_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000008C,6D037514,?,000001E8,6D037082,?,?), ref: 6D038805
            • Part of subcall function 6D0387E1: ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,0000008C,6D037514,?,000001E8,6D037082,?,?), ref: 6D038840
            • Part of subcall function 6D0387E1: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,0000008C,6D037514,?,000001E8,6D037082,?,?), ref: 6D0388A8
            • Part of subcall function 6D0387E1: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,?,00000000,?), ref: 6D0388BA
          • ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D036121
            • Part of subcall function 6D0539CE: __EH_prolog3_GS.LIBCMT ref: 6D0539D5
            • Part of subcall function 6D0539CE: ?parent_path_end@path@filesystem@ierd_tgp@@ABEIXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000024,6D052156,?,?), ref: 6D0539E7
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D036130
            • Part of subcall function 6D00FACF: __EH_prolog3.LIBCMT ref: 6D00FAD6
          • ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?), ref: 6D03613C
            • Part of subcall function 6D00A713: __EH_prolog3.LIBCMT ref: 6D00A71A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$??0path@filesystem@ierd_tgp@@File_info@common@ierd_tgp@@H_prolog3U?$char_traits@_V?$allocator@_V?$basic_string@_Vpath@12@Vpath@filesystem@3@W@std@@$?absolute@filesystem@ierd_tgp@@?exists@filesystem@ierd_tgp@@?get_cfg_module_path@?parent_path@path@filesystem@ierd_tgp@@?parent_path_end@path@filesystem@ierd_tgp@@?root_full_path@?wstring@path@filesystem@ierd_tgp@@E@$$V012@@V123@V312@0@Verror_code@std@@@W@2@@std@@W@2@@std@@@
          • String ID:
          • API String ID: 65828976-0
          • Opcode ID: a9c48258a4c35977e30ea038ff3d6b073562f82df6043a4faf370d24dbceff32
          • Instruction ID: dbd0c1cf3052f1c6afd476d5ed173ff14767d8728613a69d5bf184503d3af5e5
          • Opcode Fuzzy Hash: a9c48258a4c35977e30ea038ff3d6b073562f82df6043a4faf370d24dbceff32
          • Instruction Fuzzy Hash: 06018F70D0D288EBEF14DBE4C8587DCBB746F15308F55449CD205AF180DB745A09CB61
          APIs
          • setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02832D3C
          • CancelIo.KERNEL32(?), ref: 02832D46
          • InterlockedExchange.KERNEL32(00000000,00000000), ref: 02832D4F
          • closesocket.WS2_32(?), ref: 02832D59
          • SetEvent.KERNEL32(00000001), ref: 02832D63
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
          • String ID:
          • API String ID: 1486965892-0
          • Opcode ID: 75f9f3aaca1b9fefd1a69d025f46ea465855bf51b6127a4e29dbc6ec80492a20
          • Instruction ID: 61e1159d72431aa5767eb82ee57ae40cec568e4520d9c3a7058a7181c427f587
          • Opcode Fuzzy Hash: 75f9f3aaca1b9fefd1a69d025f46ea465855bf51b6127a4e29dbc6ec80492a20
          • Instruction Fuzzy Hash: F1F03C7E540704ABD220DF54EC49B5A77F8BB49B11F504A59F686966C0C7B8B904CBA0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A282E
          • memset.VCRUNTIME140(?,00000000,00000208,000006A0,6D035F49,?,6D2911A4), ref: 6D0A2845
          • memset.VCRUNTIME140(?,00000000,00000410,?,00000000,00000208,000006A0,6D035F49,?,6D2911A4), ref: 6D0A2857
          • SHGetFolderPathW.SHELL32(00000000,0000801A,00000000,00000000,?), ref: 6D0A286E
          • ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0A28AE
            • Part of subcall function 6D07E999: ?get_client_id@util_client_info@ierd_tgp@@YAHXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,6D0A28B3), ref: 6D07E99D
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$?get_client_id@util_client_info@ierd_tgp@@?get_client_version_type@overseas@ierd_tgp@@FolderH_prolog3_Path
          • String ID:
          • API String ID: 3134447749-0
          • Opcode ID: e66f4df69cfee07965aa0c69ece76a3ccdea0803794fbd703810ad815c5ac2ef
          • Instruction ID: 5d1c0169597aa6c669e461d82480f21bde25fd12944b5519df363050f1e56c07
          • Opcode Fuzzy Hash: e66f4df69cfee07965aa0c69ece76a3ccdea0803794fbd703810ad815c5ac2ef
          • Instruction Fuzzy Hash: A40181B1D5022CAFFB60DF608CC4EDAB67DBB44348F4005E9E608AB140D7719E958F64
          APIs
          • __getptd.LIBCMT ref: 0283E14B
            • Part of subcall function 0283990F: __getptd_noexit.LIBCMT ref: 02839912
            • Part of subcall function 0283990F: __amsg_exit.LIBCMT ref: 0283991F
          • __getptd.LIBCMT ref: 0283E162
          • __amsg_exit.LIBCMT ref: 0283E170
          • __lock.LIBCMT ref: 0283E180
          • __updatetlocinfoEx_nolock.LIBCMT ref: 0283E194
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
          • String ID:
          • API String ID: 938513278-0
          • Opcode ID: 7b1a058a35135dd5810835ead9be7b2d3a988d67b0ced8461ca3567558dfe899
          • Instruction ID: fe3210a11f128fc7f8c8f21e7e25cbda5671b6dcce8e6b7bac56f0a2d8c1b21a
          • Opcode Fuzzy Hash: 7b1a058a35135dd5810835ead9be7b2d3a988d67b0ced8461ca3567558dfe899
          • Instruction Fuzzy Hash: 6CF09A3EA846149BE73BBBBC940275E32E26F00B26F148149E854E72C0CFA46501CED7
          APIs
          • __EH_prolog3.LIBCMT ref: 6D07F9BE
          • wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6D3896A0,?,?,?,?,00000004), ref: 6D07F9CD
          • GetModuleHandleW.KERNEL32(00000000,?,?,?,00000004), ref: 6D07F9D9
          • GetModuleFileNameW.KERNEL32(00000000,6D3896A0,00000104,?,?,?,00000004), ref: 6D07F9E6
          • wcsrchr.VCRUNTIME140(6D3896A0,0000005C,?,?,?,00000004), ref: 6D07F9EF
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Module$FileH_prolog3HandleNamewcslenwcsrchr
          • String ID:
          • API String ID: 4117574448-0
          • Opcode ID: 9e8a5ad0a3b91bd38d0821d541c292832c4381e01543c8c58a953f5079f8833f
          • Instruction ID: 00b40a383b9d4a18e50145d3159fbd6d4478f93d45cf1435bc5412418c1bc9fa
          • Opcode Fuzzy Hash: 9e8a5ad0a3b91bd38d0821d541c292832c4381e01543c8c58a953f5079f8833f
          • Instruction Fuzzy Hash: A2F05472509616EBFB046BA0DC19BDF3AA8AF0732AF110515E211DB1C0DBB58944CBA9
          APIs
            • Part of subcall function 028382F0: _doexit.LIBCMT ref: 028382FC
          • ___set_flsgetvalue.LIBCMT ref: 028371BC
            • Part of subcall function 02839754: TlsGetValue.KERNEL32(00000000,028398AD,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000,00000000), ref: 0283975D
            • Part of subcall function 02839754: DecodePointer.KERNEL32(?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000,00000000,?,028399BA,0000000D), ref: 0283976F
            • Part of subcall function 02839754: TlsSetValue.KERNEL32(00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000,00000000,?,028399BA), ref: 0283977E
          • ___fls_getvalue@4.LIBCMT ref: 028371C7
            • Part of subcall function 02839734: TlsGetValue.KERNEL32(?,?,028371CC,00000000), ref: 02839742
          • ___fls_setvalue@8.LIBCMT ref: 028371DA
            • Part of subcall function 02839788: DecodePointer.KERNEL32(?,?,?,028371DF,00000000,?,00000000), ref: 02839799
          • GetLastError.KERNEL32(00000000,?,00000000), ref: 028371E3
          • ExitThread.KERNEL32 ref: 028371EA
          • GetCurrentThreadId.KERNEL32 ref: 028371F0
          • __freefls@4.LIBCMT ref: 02837210
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
          • String ID:
          • API String ID: 781180411-0
          • Opcode ID: 6bffa1dc78cca4330f5e6fec8396e0f700f6cdacafd6f3fe6e26c404802886a7
          • Instruction ID: eca4762ad9ada6ec0650cd7c8275705aa1b44c9e30d7950f15b4be6f188808c3
          • Opcode Fuzzy Hash: 6bffa1dc78cca4330f5e6fec8396e0f700f6cdacafd6f3fe6e26c404802886a7
          • Instruction Fuzzy Hash: EBE0B67E8042496B8F123FF98D4D99E7A6EAE45354B144C10FA14E3085EBA8D8118AE7
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_
          • String ID: PD)m
          • API String ID: 2427045233-3936319404
          • Opcode ID: 9d3472a6d7447472614c32d1add6dbce2b781e5eb7c5624000e4ce02b4b72619
          • Instruction ID: 1d8b5f9d63be0dfb1058daa7dd64a54744223831267af0dac5e5a0da96f8c30e
          • Opcode Fuzzy Hash: 9d3472a6d7447472614c32d1add6dbce2b781e5eb7c5624000e4ce02b4b72619
          • Instruction Fuzzy Hash: CA919F71D0424ADFEF15CFA8C884BEDBBB5AF09304F1481ADC149B7641EB705A89CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D09A932
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,0000002C), ref: 6D09A95D
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6CFFBF20: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,000000FF,?,00000000,?,?,6D09AB23,?,6D29BBB4,?,6D31E62F,00000000), ref: 6CFFBF3F
            • Part of subcall function 6CFFF830: memmove.VCRUNTIME140(?,?,00000005,?,?,00000000,?,6D005847,\log\,00000005,?,?), ref: 6CFFF860
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_memmove$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@4@@W@std@@__stdio_common_vsprintf
          • String ID: %02x$%04x
          • API String ID: 1991547636-287146569
          • Opcode ID: 5376cdc793143473494a145ae340676fa829ff63d20d59d8b521b1a29990b6fb
          • Instruction ID: 8135f4ead839aa650f2f4063e7eb9d33ca16ce485cc7b0e17a22d6fa15ee71dd
          • Opcode Fuzzy Hash: 5376cdc793143473494a145ae340676fa829ff63d20d59d8b521b1a29990b6fb
          • Instruction Fuzzy Hash: 37616B60E10219AEDF18CF94D8A0EFDB3F6FF54300FA4506AE152EB592EB74D186D690
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D05A355
            • Part of subcall function 6D05BF2B: __EH_prolog3_GS.LIBCMT ref: 6D05BF32
            • Part of subcall function 6D05BF2B: ?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,expt,?,?,?,?,?,?,?,?,?,?,6D05C8DB), ref: 6D05BF70
            • Part of subcall function 6D05BF2B: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D05BF80
            • Part of subcall function 6D05BF2B: _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000), ref: 6D05BF9F
            • Part of subcall function 6D05BF2B: CreateDirectoryW.KERNEL32(?,00000000), ref: 6D05BFB7
            • Part of subcall function 6D05BF2B: ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D05BFC1
            • Part of subcall function 6D05BF2B: GetLastError.KERNEL32(00000000,00000001,d:\ci_dev\wegame_client\codes\common\src\info_trace_helper.cpp,000000C6,6D31E62F), ref: 6D05BFFE
            • Part of subcall function 6D05BAA6: __EH_prolog3_GS.LIBCMT ref: 6D05BAB0
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,00000140,6D05A5BC,?,?,?,000000A8,6D05A8E7,?,?,?), ref: 6D05A422
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
            • Part of subcall function 6D05E315: __EH_prolog3_GS.LIBCMT ref: 6D05E31C
          • _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,00000000,?,?,?,?,%s\%s), ref: 6D05A4CC
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$D@2@@std@@D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?u8to16@common@ierd_tgp@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@_waccess$?get_app_sub_path@?get_log_instance@base@@Application@common@ierd_tgp@@CreateDirectoryErrorLastLogger@1@V45@@
          • String ID: %s\%s
          • API String ID: 1378938387-4073750446
          • Opcode ID: 184d449ffc097a638371207bf0c69257bd06ce035b08244086b9a0ffb147a2a7
          • Instruction ID: 2432a1ef74d9a4a75984e7f14d14d1ba35f96b1c32ff898c7bd9f1f4a0134364
          • Opcode Fuzzy Hash: 184d449ffc097a638371207bf0c69257bd06ce035b08244086b9a0ffb147a2a7
          • Instruction Fuzzy Hash: E2513770C08258DAEF24CFA9C988BDDFBB4BF19304FA040AED509A7251DB705A49CF61
          APIs
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6CFFEA70: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,23C35E98,?,?,00000000), ref: 6CFFEB96
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,00000000,Bad unicode escape sequence in string: four digits expected.,0000003C,23C35E98,-00000002,?), ref: 6CFFE982
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,00000000,Bad unicode escape sequence in string: hexadecimal digit expected.,00000042,23C35E98,-00000002,?), ref: 6CFFEA3B
          Strings
          • Bad unicode escape sequence in string: hexadecimal digit expected., xrefs: 6CFFE9DC
          • Bad unicode escape sequence in string: four digits expected., xrefs: 6CFFE918
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: _invalid_parameter_noinfo_noreturn$memmove
          • String ID: Bad unicode escape sequence in string: four digits expected.$Bad unicode escape sequence in string: hexadecimal digit expected.
          • API String ID: 15630516-3825735986
          • Opcode ID: c0f2c9a0e132a8e8128c1dcad542ca9888e1d67d9e7ef4a15a82058a4614daed
          • Instruction ID: 2ac836fbfec14f6b644dbf563c9a276cde69545c8aa8aed255980b84305bec32
          • Opcode Fuzzy Hash: c0f2c9a0e132a8e8128c1dcad542ca9888e1d67d9e7ef4a15a82058a4614daed
          • Instruction Fuzzy Hash: FA412571A005089FDB14CFA8C884BEEBBB5FF8A324F14451AE461E77A5C7349586CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04EDFF
          • memset.VCRUNTIME140(?,00000000,00000208,00000234,6D04E38F,?), ref: 6D04EE16
          • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 6D04EE2A
            • Part of subcall function 6D04DF33: __EH_prolog3_GS.LIBCMT ref: 6D04DF3D
            • Part of subcall function 6D04DF33: CreateFileW.KERNEL32(?,00000001,00000003,00000000,00000003,00000080,00000000,00000110,6D04EEB6,?,?,\drivers\etc\hosts), ref: 6D04DF77
            • Part of subcall function 6D04DF33: GetLastError.KERNEL32 ref: 6D04DF88
            • Part of subcall function 6D04DF33: ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D04DF94
            • Part of subcall function 6CFFA2C0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CFFA32F
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$?get_log_instance@base@@CreateDirectoryErrorFileLastLogger@1@System_invalid_parameter_noinfo_noreturnmemset
          • String ID: \drivers\etc\hosts
          • API String ID: 3358435848-1867556408
          • Opcode ID: 3e3430c1c9cf0d01e262e9e76df577f4076c12810377cc9f66fcf51c0450d0a7
          • Instruction ID: 9b41d863ab1b8d91a1cf08cdf1e7d9376f091bfe27caa4b1a1385b9189529a94
          • Opcode Fuzzy Hash: 3e3430c1c9cf0d01e262e9e76df577f4076c12810377cc9f66fcf51c0450d0a7
          • Instruction Fuzzy Hash: 3F41CD30949218EEEF20CF65CC98BDDB7B4AF15314F5081E9D418AB290DB346B89CFA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04BD6A
          • ?get_global_proxy_info@net@ierd_tgp@@YA_NPAUproxy_info_t@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000009C,6D04A824,00000000,?), ref: 6D04BD8C
            • Part of subcall function 6D07B444: __EH_prolog3.LIBCMT ref: 6D07B44B
          • ?get_proxy_for_url_v2@net@ierd_tgp@@YA_NPBDPAUproxy_info_t@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,0000009C,6D04A824,00000000,?), ref: 6D04BD9E
            • Part of subcall function 6D07BA3B: __EH_prolog3_GS.LIBCMT ref: 6D07BA42
            • Part of subcall function 6D07BA3B: ?get_proxy_for_url_v2@net@ierd_tgp@@YA_NPB_WPAUproxy_info_t@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000034,6D04BDA3,?,?,0000009C,6D04A824,00000000,?), ref: 6D07BAAD
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Uproxy_info_t@12@@$?get_proxy_for_url_v2@net@ierd_tgp@@H_prolog3_$?get_global_proxy_info@net@ierd_tgp@@H_prolog3
          • String ID: ://
          • API String ID: 1862413449-1869659232
          • Opcode ID: 2d176fba2768e41313b66236f0c754254ff74a4865ec35b1735a56fc2f088dbd
          • Instruction ID: 5c6127d5df97633013a7a7101eb92aa90279e98a2cad180d0c19a1403fa88214
          • Opcode Fuzzy Hash: 2d176fba2768e41313b66236f0c754254ff74a4865ec35b1735a56fc2f088dbd
          • Instruction Fuzzy Hash: E7415E71D04219EEDF20CFA4C894FEDB7B4AF45308F6440A9E614BB191DB705A8ACB62
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07E6C2
            • Part of subcall function 6D07E23A: __EH_prolog3.LIBCMT ref: 6D07E241
            • Part of subcall function 6D07E23A: ?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000018,6D07E6E7,6D389534,6D389584,00000054,6D07BD53,TGP_COM_URL), ref: 6D07E246
            • Part of subcall function 6D07E23A: ?find_component@Component_mgr@common@ierd_tgp@@QAE?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@23@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000018,6D07E6E7,6D389534,6D389584,00000054,6D07BD53,TGP_COM_URL), ref: 6D07E254
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054,6D07BD53,TGP_COM_URL), ref: 6D07E722
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\overseas.cpp, xrefs: 6D07E746
          • [LoadStrErr] oversea strid=%ws, xrefs: 6D07E766
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?find_component@?get_comp_mgr_instance@common@ierd_tgp@@?get_log_instance@base@@Component@common@ierd_tgp@@@std@@Component_mgr@12@Component_mgr@common@ierd_tgp@@H_prolog3H_prolog3_Logger@1@V?$weak_ptr@Vcomponent_interface_type@23@@memmove
          • String ID: [LoadStrErr] oversea strid=%ws$d:\ci_dev\wegame_client\codes\common\src\overseas.cpp
          • API String ID: 1054616610-3045326849
          • Opcode ID: 6c778713ca3bb04e8d3720eb20c805d8b89949e6ab7b4540728450a5449519e1
          • Instruction ID: ccc246a352091eaa1b7eb40ee325c631de0b1b09b615c96166c75d3238ae287f
          • Opcode Fuzzy Hash: 6c778713ca3bb04e8d3720eb20c805d8b89949e6ab7b4540728450a5449519e1
          • Instruction Fuzzy Hash: 6C310570906249EFEF14DFA8C844BED7BB4AF46308F15419CD504AF282D7319A46CBE5
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07E302
            • Part of subcall function 6D07E0C7: __EH_prolog3.LIBCMT ref: 6D07E0CE
            • Part of subcall function 6D07E0C7: GetModuleHandleA.KERNEL32(common.dll,?dyn_comp_mgr_find_component@@YA?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@common@ierd_tgp@@@Z,00000018,6D07E327,6D389534,6D389584,00000054), ref: 6D07E0DD
            • Part of subcall function 6D07E0C7: GetProcAddress.KERNEL32(00000000), ref: 6D07E0E4
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054), ref: 6D07E362
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\overseas.cpp, xrefs: 6D07E386
          • [LoadStrErr] oversea strid=%ws, xrefs: 6D07E3A6
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@AddressH_prolog3H_prolog3_HandleLogger@1@ModuleProcmemmove
          • String ID: [LoadStrErr] oversea strid=%ws$d:\ci_dev\wegame_client\codes\common\src\overseas.cpp
          • API String ID: 2895597790-3045326849
          • Opcode ID: 115e0cf013665f58a1bffd84cea33ecb4f397e044209be9956c7a154a20d3f71
          • Instruction ID: 9b688c6b0e89e7bac2c7321e581decc82b5a909748f6a64acaf6030331655b48
          • Opcode Fuzzy Hash: 115e0cf013665f58a1bffd84cea33ecb4f397e044209be9956c7a154a20d3f71
          • Instruction Fuzzy Hash: 1C31C430905249EFEF14DFA8C854BED7BB4AF46208F65419CD5047F282D7319A46CBA5
          APIs
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(23C35E98,00000000,?), ref: 6D0B3B94
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          • GetTickCount.KERNEL32 ref: 6D0B3BCE
          Strings
          • [TraceDump][%s] spend %10dms, xrefs: 6D0B3BE3
          • d:\ci_dev\wegame_client\codes\common\src\trace_dump.cpp, xrefs: 6D0B3BB8
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@CountH_prolog3Logger@1@Tick
          • String ID: [TraceDump][%s] spend %10dms$d:\ci_dev\wegame_client\codes\common\src\trace_dump.cpp
          • API String ID: 2738212413-155335725
          • Opcode ID: 7d624b2a16637306b80f7207f0d5fa65bc5ff7c647d83d4c000672ad137da729
          • Instruction ID: 7ff316faaac78e5857b87db85902f38adbbc1dabc8bcddd0707c156d70c8c297
          • Opcode Fuzzy Hash: 7d624b2a16637306b80f7207f0d5fa65bc5ff7c647d83d4c000672ad137da729
          • Instruction Fuzzy Hash: 1A21C671904209AFEB14DF68CD41FBEB7B5EB45718F20416DE422AB2C5EF71A905CB50
          APIs
          • __EH_prolog3.LIBCMT ref: 6D036DF5
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
          • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(00000000,00000029,00000003,00000001,000000B4,6D0351ED,?,?,?,?,00000028,6D0352A0,?,?,?,00000004), ref: 6D036E56
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,00000003,00000001,000000B4,6D0351ED,?,?,?,?,00000028,6D0352A0,?,?,?,00000004,6D032C18), ref: 6D036EA2
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$H_prolog3$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@??6?$basic_ostream@D@std@@@1@@V01@V?$basic_streambuf@
          • String ID: <unspecified file>
          • API String ID: 3606716362-520387994
          • Opcode ID: 0572692eb8e32b4831b9d7c6f6004c193e8284a9c014acbdfe27da444fa6ea31
          • Instruction ID: 357c600efd1257fb12d7afe04b3831d93ce09731afbf2940800fbc2255a66b1f
          • Opcode Fuzzy Hash: 0572692eb8e32b4831b9d7c6f6004c193e8284a9c014acbdfe27da444fa6ea31
          • Instruction Fuzzy Hash: 2311603180825AEFFF14DBA4DC19F9E77B9FF05318F51445AE2009B180DBB09A98CB91
          APIs
          • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,6D0061E9,?,?,?,?,00000000), ref: 6D0060E2
          • memmove.VCRUNTIME140(?,?,?), ref: 6D0060FD
          • OutputDebugStringA.KERNEL32(Check log buffer fail.,?,?,?,?,?,6D0061E9,?,?,?,?,00000000), ref: 6D006113
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: DebugOutputStringmemmovestrncmp
          • String ID: Check log buffer fail.
          • API String ID: 2262755192-1520868631
          • Opcode ID: 990e39a25c007ee497c1889bf886ca37f6df790b37332b205e54eec8f079fe00
          • Instruction ID: e28a8804483fb773ed2e329214eeea1c4359cba6b08407463c17151365c6801d
          • Opcode Fuzzy Hash: 990e39a25c007ee497c1889bf886ca37f6df790b37332b205e54eec8f079fe00
          • Instruction Fuzzy Hash: 23116D3140021AEFFB218F15D844BDA7BF6FF42359F44091AE9555B152D370E998CBD1
          APIs
          • fopen.API-MS-WIN-CRT-STDIO-L1-1-0(stamp_record.log,6D298B58), ref: 6D09A15F
          • fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D09A1DB
            • Part of subcall function 6D05E5E2: __vfprintf_l.MSPDB140-MSVCRT ref: 6D05E5F1
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: __vfprintf_lfclosefopen
          • String ID: %80s%12.3f$stamp_record.log
          • API String ID: 2839667847-2832209799
          • Opcode ID: 23a7319e0657d89c3d0fa979cabd610f4e00dbb781106d463ffbb94341dce283
          • Instruction ID: c8c08960f1b0a0e1245ad7c65d3caeaab1e60e18360f57f14dc6f385f5e230d2
          • Opcode Fuzzy Hash: 23a7319e0657d89c3d0fa979cabd610f4e00dbb781106d463ffbb94341dce283
          • Instruction Fuzzy Hash: 9A110036A05B08FFCB00DF68C885E9BB7BDFF87659321421AE80157285DB70B905DAA0
          APIs
            • Part of subcall function 6D034133: __EH_prolog3.LIBCMT ref: 6D03413A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0379FB
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • ", xrefs: 6D037A49
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6D037A1F
          • std exception in get_file_path_by_key: %1%, xrefs: 6D0379A8
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$?get_log_instance@base@@Logger@1@
          • String ID: "$d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp$std exception in get_file_path_by_key: %1%
          • API String ID: 1369574949-2532590550
          • Opcode ID: 18c538f9399129073ca35f8cb17d3f9d306862a692c447045468dcb36da75b80
          • Instruction ID: 9441dab64e72e3d09c495700e27728dc7c70d0d702773429b0db3460394d47dd
          • Opcode Fuzzy Hash: 18c538f9399129073ca35f8cb17d3f9d306862a692c447045468dcb36da75b80
          • Instruction Fuzzy Hash: 1811EF3080516AEBEB25CB64CD14FEDB3B0AF90308F5280D8D545BB281EB359F48CB91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D087CAE
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000050,6D087D5B,?,?,?), ref: 6D087CB8
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\qos_command.cpp, xrefs: 6D087CDC
          • [qos]Set launcher info: %s - %llu., xrefs: 6D087D01
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_Logger@1@
          • String ID: [qos]Set launcher info: %s - %llu.$d:\ci_dev\wegame_client\codes\common\src\qos_command.cpp
          • API String ID: 52498757-2497862619
          • Opcode ID: 3e4f01a17c3ad0564ea2864888bab450e616cefa458a97e6834f391793f0559b
          • Instruction ID: d62c4a5f91a21d8bc4dc5f4924b7df63acf2f0caa37dda697ba7c3a6a5229cd7
          • Opcode Fuzzy Hash: 3e4f01a17c3ad0564ea2864888bab450e616cefa458a97e6834f391793f0559b
          • Instruction Fuzzy Hash: CB11C470A44305ABEF04DF94CC50FAD73A1BF54314F114128E925AF2C6DB719946DB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D052DD4
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?string@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D052E36
            • Part of subcall function 6D054C8B: __EH_prolog3_GS.LIBCMT ref: 6D054C92
            • Part of subcall function 6D054C8B: ?u16_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000028,6D052E3B), ref: 6D054CC0
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@$?string@path@filesystem@ierd_tgp@@?u16_to_loc@common@ierd_tgp@@D@2@@4@@D@2@@std@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@memmove
          • String ID: /$\
          • API String ID: 2552136784-1600464054
          • Opcode ID: bf1f9b51e05b5696253ec493b521b8e560806cdfee5a1dd358b55eef9c365862
          • Instruction ID: 1221c294bf5af38e30d3f07ec71f4109483f133b36608e47558fcea470edace8
          • Opcode Fuzzy Hash: bf1f9b51e05b5696253ec493b521b8e560806cdfee5a1dd358b55eef9c365862
          • Instruction Fuzzy Hash: 021125B1D05208EBEB10CF98C984AEEFBB4EF98314F555119E60277240D7B05686CFA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D052E5E
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D052EC0
            • Part of subcall function 6D00FACF: __EH_prolog3.LIBCMT ref: 6D00FAD6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?wstring@path@filesystem@ierd_tgp@@H_prolog3H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@memmove
          • String ID: /$\
          • API String ID: 3222246860-1600464054
          • Opcode ID: ad9fad6959fe243c003ed725110c3570eb088271036c4ffd093be5384b7c8fb8
          • Instruction ID: c49e508e87e2b87212eba05d9e022104b94e2aec5b746b11f45705522fc33981
          • Opcode Fuzzy Hash: ad9fad6959fe243c003ed725110c3570eb088271036c4ffd093be5384b7c8fb8
          • Instruction Fuzzy Hash: D71113B1D05208EFEB10DF98C984AEEFBB5AF98314F55501AE60177240D7B05A89CFA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04A52F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000054), ref: 6D04A534
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp, xrefs: 6D04A558
          • [CurlWrapper]get_qq_skey_value, CurlWriteCallback buf_size: {}, xrefs: 6D04A579
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_Logger@1@
          • String ID: [CurlWrapper]get_qq_skey_value, CurlWriteCallback buf_size: {}$d:\ci_dev\wegame_client\codes\common\src\curl_wrapper.cpp
          • API String ID: 52498757-2245295932
          • Opcode ID: 95e39e0eb4e63972794fbf567c14c2ac69887fea22ba72e202239ecc0ac94541
          • Instruction ID: ccb2343ce1ea1f0989b625e797618132e7ebeff14364a9c419132a1999c3774c
          • Opcode Fuzzy Hash: 95e39e0eb4e63972794fbf567c14c2ac69887fea22ba72e202239ecc0ac94541
          • Instruction Fuzzy Hash: 79F08170A44359ABEF19DB94CC51FBD7321AF84318F214119EA252F2C4DB75AA06CA40
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D03743A
            • Part of subcall function 6D0350A3: __EH_prolog3.LIBCMT ref: 6D0350AA
            • Part of subcall function 6D0397C8: __EH_prolog3_GS.LIBCMT ref: 6D0397CF
          Strings
          • d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp, xrefs: 6D03749F
          • No such node, xrefs: 6D037478
          • class boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_string<cha, xrefs: 6D0374A4
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$H_prolog3
          • String ID: No such node$class boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_string<cha$d:\ci_dev\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp
          • API String ID: 3952504126-916780329
          • Opcode ID: d3c3f69debb23ea31965301e5529ee1b5752bbd508c7022dc21c6cfbbe0c635c
          • Instruction ID: 0b401d0091f094a0de3300ea67af86c40237bc96a4a70487d9b9ee45f8e47c36
          • Opcode Fuzzy Hash: d3c3f69debb23ea31965301e5529ee1b5752bbd508c7022dc21c6cfbbe0c635c
          • Instruction Fuzzy Hash: D701FF3180516EABEB14D7A0CC04FEDB778AF56718F860158E215BB1D0DB70AA0AE795
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0A2ADA
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000050), ref: 6D0A2ADF
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [Sys_wrapper]has modal exist : %d, xrefs: 6D0A2B1F
          • d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6D0A2B03
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_H_prolog3_catch_Logger@1@
          • String ID: [Sys_wrapper]has modal exist : %d$d:\ci_dev\wegame_client\codes\common\src\sys_wrapper.cpp
          • API String ID: 245828788-1483221781
          • Opcode ID: fb0ac85cdb630656c2757dee4f1c5e466c76c82f2b081809c1cc739fb938cdc9
          • Instruction ID: 669916eae9eb158fdaff454dcb0031730e6c7edb74913a0748f2450cf49e8d2f
          • Opcode Fuzzy Hash: fb0ac85cdb630656c2757dee4f1c5e466c76c82f2b081809c1cc739fb938cdc9
          • Instruction Fuzzy Hash: ACF02B709483457BFB24D7B0CC65FBC37205F01705F510154E6617F1C9DB925A03E690
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D0374E3
            • Part of subcall function 6D009A0E: __EH_prolog3.LIBCMT ref: 6D009A15
          • ?root_full_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000001E8,6D037082,?,?), ref: 6D03750F
            • Part of subcall function 6D0387E1: __EH_prolog3_GS.LIBCMT ref: 6D0387EB
            • Part of subcall function 6D0387E1: ?get_cfg_module_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000008C,6D037514,?,000001E8,6D037082,?,?), ref: 6D038805
            • Part of subcall function 6D0387E1: ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,0000008C,6D037514,?,000001E8,6D037082,?,?), ref: 6D038840
            • Part of subcall function 6D0387E1: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,0000008C,6D037514,?,000001E8,6D037082,?,?), ref: 6D0388A8
            • Part of subcall function 6D0387E1: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,?,?,00000000,?), ref: 6D0388BA
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
          • ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000,?,files,00000005,?,?,?,?,?,?,?,?,000001E8,6D037082,?), ref: 6D03754D
            • Part of subcall function 6D036F4F: ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N3@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000001,00000000,?,6D037552,?,00000000,?,files,00000005), ref: 6D036F5F
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$?get_cfg@common@ierd_tgp@@File_info@common@ierd_tgp@@U?$less@V12@V?$basic_ptree@Vpath@12@Vpath@filesystem@2@Vpath@filesystem@3@$??0path@filesystem@ierd_tgp@@?absolute@filesystem@ierd_tgp@@?exists@filesystem@ierd_tgp@@?get_cfg_module_path@?root_full_path@D@2@@std@@@2@@property_tree@boost@@@D@2@@std@@@2@@property_tree@boost@@_E@$$H_prolog3H_prolog3_H_prolog3_catch_V012@@V312@0@Verror_code@std@@@memmove
          • String ID: files
          • API String ID: 2783065443-104153177
          • Opcode ID: ee0e183005016dc205898441d47c70cf17bca0491014258a35d7e6239d48bfe4
          • Instruction ID: 222468977364f55f1604a58e9d233ff1b5778d6320606e90f43b82da6a7f8730
          • Opcode Fuzzy Hash: ee0e183005016dc205898441d47c70cf17bca0491014258a35d7e6239d48bfe4
          • Instruction Fuzzy Hash: 9F01E871C0539C9EDB11CFA9C984BCDBBB4AF05304F6141AAD508AB241D7705F89DB51
          APIs
          • GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 6D0A2BA7
          • GetProcAddress.KERNEL32(00000000), ref: 6D0A2BAE
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AddressHandleModuleProc
          • String ID: GetNativeSystemInfo$kernel32.dll
          • API String ID: 1646373207-192647395
          • Opcode ID: 64e30b4ea2387473f8b8224039495eb9c1ed8a64a048379a230ce07df8fecd46
          • Instruction ID: b14c0b44d76c5dda83c4acc2d4f93879927663447543f0c8397467ba080b6968
          • Opcode Fuzzy Hash: 64e30b4ea2387473f8b8224039495eb9c1ed8a64a048379a230ce07df8fecd46
          • Instruction Fuzzy Hash: B9E0EC71A102056FDF30AEF78908AEF77F8DBC9744B4014ABE501A6142E7619985C6B0
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: 0)m$8)m$x(m
          • API String ID: 431132790-1112687379
          • Opcode ID: 4f28c0ea7512e52369fc31334d3edcf506c7cd10d692669df0ede078c88384ca
          • Instruction ID: 7e29d6636fdd378e51d05333445547287d44b187f7066b38cf4a925d87b385ac
          • Opcode Fuzzy Hash: 4f28c0ea7512e52369fc31334d3edcf506c7cd10d692669df0ede078c88384ca
          • Instruction Fuzzy Hash: D9011270540728CFDB20CF96CA4A75EBBB0FB05319F50865CE5A65F290C7B2AA05CB51
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: p)m$x)m$x(m
          • API String ID: 431132790-3127159814
          • Opcode ID: 74397680ef28c30b4877dfb416d98bd8508c6d938454c8ae02da7a69c1efc890
          • Instruction ID: 42ed2351ae59b2e2678a5ff1cd550487d6388f109ed1f782e774f350db5c26fa
          • Opcode Fuzzy Hash: 74397680ef28c30b4877dfb416d98bd8508c6d938454c8ae02da7a69c1efc890
          • Instruction Fuzzy Hash: 5B012470540B18CFDB20CF96CA49B59FBB0FF08328F51865DE0955B290C770AA04CF95
          APIs
          • __EH_prolog3.LIBCMT ref: 6D012835
            • Part of subcall function 6D0126B2: __EH_prolog3.LIBCMT ref: 6D0126B9
          • ??0CShareMem@@QAE@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000008), ref: 6D01285A
            • Part of subcall function 6D01278E: __EH_prolog3.LIBCMT ref: 6D012795
            • Part of subcall function 6D012687: lstrcpyA.KERNEL32(?,?,?,?,?,UtilWndClass,?,?,6D01287C,?,?), ref: 6D0126A5
          • InitializeCriticalSection.KERNEL32(?,?,?), ref: 6D012884
            • Part of subcall function 6D013380: lstrlenA.KERNEL32(?,?,?,6D012897,WeGameIPCWndClass10,?,?), ref: 6D013389
            • Part of subcall function 6D013380: lstrcpynA.KERNEL32(?,?,00000020,?,?,6D012897,WeGameIPCWndClass10,?,?), ref: 6D0133A1
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$CriticalInitializeMem@@SectionSharelstrcpylstrcpynlstrlen
          • String ID: WeGameIPCWndClass10
          • API String ID: 3803824369-583084041
          • Opcode ID: a3423c30f1d6151de1c2db69a96cc8350a4dcf02b64f2949700a201b587ae52b
          • Instruction ID: 2b67987463b4d4461bffec3c9593912a3f60cd4eb06592619ef34460eb1d45db
          • Opcode Fuzzy Hash: a3423c30f1d6151de1c2db69a96cc8350a4dcf02b64f2949700a201b587ae52b
          • Instruction Fuzzy Hash: 95F0A47040964AEBD714DFA4CD49BDDFBB0BF12318FA1415CD101976C0CBB49618CB91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D02AD82
          • EnterCriticalSection.KERNEL32(-00000039,?), ref: 6D02AF1B
          • LeaveCriticalSection.KERNEL32(-00000039,?), ref: 6D02AF3C
          • ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6D02AF4B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$EnterH_prolog3_LeaveReleaseSemaphore
          • String ID:
          • API String ID: 1606114100-0
          • Opcode ID: b5388b5bf82bcc221a92ad09819151fe677741adc60d845bde58cbe5ab9b1d30
          • Instruction ID: baee2e260dd5633fd24c6a54afcb4e3419731c95203bce11072f2b26b615865f
          • Opcode Fuzzy Hash: b5388b5bf82bcc221a92ad09819151fe677741adc60d845bde58cbe5ab9b1d30
          • Instruction Fuzzy Hash: BAA1DE7180524ADFDB15CFA4C980BEEFBB4BF05308F2080ADD146A7651EB716A4ADF60
          APIs
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_
          • String ID:
          • API String ID: 2427045233-0
          • Opcode ID: 6ec4750f30355adaafe0ea88503b1c09c3b3be119158c244a2451cfeece107dd
          • Instruction ID: a382f3288ab5c716bd28a29ffb5c7fdf9e9f63a9139c715c89381aae0b6d09f4
          • Opcode Fuzzy Hash: 6ec4750f30355adaafe0ea88503b1c09c3b3be119158c244a2451cfeece107dd
          • Instruction Fuzzy Hash: 21615C70C08259DEEF24CFA8C4847EDBBF4BF09318F64426DD415A7292EB315A4ACB61
          APIs
          • ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 6D0034EE
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@Pninc@?$basic_streambuf@U?$char_traits@
          • String ID:
          • API String ID: 3551493264-0
          • Opcode ID: 43a7b4a1bda6f86488ea008f3326a9552023e4f049488da9337dc0fdd20ef012
          • Instruction ID: 4f04edb1966e56e1395e8d8bfc4e5546211f0eb721746a99e73dbdfcb6e16271
          • Opcode Fuzzy Hash: 43a7b4a1bda6f86488ea008f3326a9552023e4f049488da9337dc0fdd20ef012
          • Instruction Fuzzy Hash: 4151B372A04605AFE716CF6CD4C0A99F7A4FF4E325700826AD9158BB90D731F864CB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0C6F59
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,000000A4,6D0C7904,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0C6FDF
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,000000A4,6D0C7904,?,?,?,?,?,?,?,?,?,?), ref: 6D0C7019
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000008,?,?,000000A4,6D0C7904,?,?,?,?,?,?,?,?,?), ref: 6D0C704D
            • Part of subcall function 6D112E95: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D00621D,0000002C,0000000C,6D005702,00000004,6D0057B1,00000214), ref: 6D112EAA
            • Part of subcall function 6D0B0BBC: __EH_prolog3.LIBCMT ref: 6D0B0BC3
            • Part of subcall function 6D0B0BBC: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000001,00000004,6D0C70F9,?), ref: 6D0B0BF5
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@$H_prolog3H_prolog3_mallocstrlen
          • String ID:
          • API String ID: 148002567-0
          • Opcode ID: 6e53bc245602aca96412ea6751777d9cd162419f343eddd16876210b3c564d5c
          • Instruction ID: 954d4edae1b3c2823b07255a2da0dda51cecf8439739da0ef380f80a6b7f50c0
          • Opcode Fuzzy Hash: 6e53bc245602aca96412ea6751777d9cd162419f343eddd16876210b3c564d5c
          • Instruction Fuzzy Hash: 0E616B71D08358DEEF24CFA8C8807DDFBB4AF55314F24819AD449A7291DB705A89CB62
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0CE692
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000001,?,0000004C,6D0CE667,?,?), ref: 6D0CE71D
          • ?CloseZipU@@YAKPAUHZIP__@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000), ref: 6D0CE799
          • ?CloseZipU@@YAKPAUHZIP__@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000001,?,0000004C,6D0CE667,?,?), ref: 6D0CE7B8
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CloseP__@@@$?extract_name@common@ierd_tgp@@H_prolog3_U?$char_traits@_V34@@V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@memmove
          • String ID:
          • API String ID: 2542853892-0
          • Opcode ID: 86afd7ce9a9d9fe0163f84355290f086743ee8069f6a4d7563d37af12a2bea21
          • Instruction ID: e55d3b587b3698a9d9354875ce1135b3312630cd6ff6a9e1e6aea82c97885ecc
          • Opcode Fuzzy Hash: 86afd7ce9a9d9fe0163f84355290f086743ee8069f6a4d7563d37af12a2bea21
          • Instruction Fuzzy Hash: CF41BF71908249EFEF00CFE8C985BEDBBB4AF15318F61416DD510BB180DB30AA46CB62
          APIs
          • __EH_prolog3.LIBCMT ref: 6D02F8EA
          • _Copy_construct_from.LIBCPMT ref: 6D02F906
          • _Copy_construct_from.LIBCPMT ref: 6D02F91C
            • Part of subcall function 6D02CF9F: __EH_prolog3_catch.LIBCMT ref: 6D02CFA6
          • _Copy_construct_from.LIBCPMT ref: 6D02F97A
            • Part of subcall function 6D02D524: __EH_prolog3.LIBCMT ref: 6D02D52B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Copy_construct_from$H_prolog3$H_prolog3_catch
          • String ID:
          • API String ID: 1972245701-0
          • Opcode ID: 793e7cb43d041ee53fb0866c2629a3feee19152cd20d512977546c5cc6393a0f
          • Instruction ID: 37f6d2a2278d7b3f45837050091a105efca6d8b5c69144cb1eedae2c35d18301
          • Opcode Fuzzy Hash: 793e7cb43d041ee53fb0866c2629a3feee19152cd20d512977546c5cc6393a0f
          • Instruction Fuzzy Hash: 56416E31D06249EFEF05CFA5C890BEDBBB9AF09308F15819CD545B7241C775AA04CBA1
          APIs
          • __EH_prolog3.LIBCMT ref: 6D02FA2A
          • _Copy_construct_from.LIBCPMT ref: 6D02FA46
          • _Copy_construct_from.LIBCPMT ref: 6D02FA5C
            • Part of subcall function 6D02CF9F: __EH_prolog3_catch.LIBCMT ref: 6D02CFA6
          • _Copy_construct_from.LIBCPMT ref: 6D02FABA
            • Part of subcall function 6D02D565: __EH_prolog3.LIBCMT ref: 6D02D56C
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Copy_construct_from$H_prolog3$H_prolog3_catch
          • String ID:
          • API String ID: 1972245701-0
          • Opcode ID: f2b145343ff46a7f93b641df60e6d1e73233935c72ddc289af05fbd5ab1c6cd3
          • Instruction ID: da1e1efe898b92586b125f45bf9c533cfade0ccfea7830b965924cd8aa16dfb2
          • Opcode Fuzzy Hash: f2b145343ff46a7f93b641df60e6d1e73233935c72ddc289af05fbd5ab1c6cd3
          • Instruction Fuzzy Hash: E8418131D05249EFEF05CFA5C890BEDBBB9AF09308F15809CD64577241C775AA04CBA1
          APIs
          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0283E459
          • __isleadbyte_l.LIBCMT ref: 0283E48C
          • MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 0283E4BD
          • MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 0283E52B
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
          • String ID:
          • API String ID: 3058430110-0
          • Opcode ID: e3c4b78bb239ad2f614a58cc13c2b239a89049dc4077c52171c0b6c2bf46bb87
          • Instruction ID: 68b18f6e5eadcb3ce1afaf6d6d36b6f558b62a4f97f112b23fd70a450c38716a
          • Opcode Fuzzy Hash: e3c4b78bb239ad2f614a58cc13c2b239a89049dc4077c52171c0b6c2bf46bb87
          • Instruction Fuzzy Hash: B931A03DA00655EFDB22DF64C880ABD3BA5AF09224F19C5A9E469DB191E330D940DFD1
          APIs
          • rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 6CFF288A
          • inet_addr.WS2_32(00000690), ref: 6CFF28DB
          • inet_addr.WS2_32(?), ref: 6CFF28E4
          • inet_addr.WS2_32(00000000), ref: 6CFF28E9
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: inet_addr$rand
          • String ID:
          • API String ID: 2589549786-0
          • Opcode ID: 1531e32bbe45e2e58b1cbd5cc3a4ced3b25c7c2b591b0fff6743f3b1253e44d6
          • Instruction ID: fad16f411771a2539db68e9a8b77710a587d3314fc055d87881027127df68f7c
          • Opcode Fuzzy Hash: 1531e32bbe45e2e58b1cbd5cc3a4ced3b25c7c2b591b0fff6743f3b1253e44d6
          • Instruction Fuzzy Hash: 0831E6326093964BC714CF25D48465AB7E6FFC9228F09066DD8A493710D737E91ECB91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07BAE0
          • ?get_proxy_for_url@net@ierd_tgp@@YA_NPB_WPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3,?,?,0000009C,6D04A824,00000000,?), ref: 6D07BB1B
            • Part of subcall function 6D07B7B0: __EH_prolog3_GS.LIBCMT ref: 6D07B7BA
            • Part of subcall function 6D07B7B0: ?get_proxy_config@net@ierd_tgp@@YA_NPAUproxy_config_t@12@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3,?,?,0000009C), ref: 6D07B7FF
            • Part of subcall function 6D07B7B0: WinHttpOpen.WINHTTP(ProxyResolver/1.0,00000000,00000000,00000000,00000000,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?,?,?), ref: 6D07B8B3
            • Part of subcall function 6D07B7B0: WinHttpGetProxyForUrl.WINHTTP(00000000,?,?,?), ref: 6D07B8F9
            • Part of subcall function 6D07B7B0: GetLastError.KERNEL32 ref: 6D07B8FF
            • Part of subcall function 6D07D55C: __EH_prolog3_GS.LIBCMT ref: 6D07D563
          • ?crack_url@net@ierd_tgp@@YA_NPBDPAUurl_components_t@12@I@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000009C,00000000,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3,?,?,0000009C,6D04A824,00000000), ref: 6D07BB60
            • Part of subcall function 6D07A67F: memset.VCRUNTIME140(?,00000000,00000040,?,?,?,?,23C35E98,?,?,00000000,?,6D278D32,000000FF,?,6D07BB65), ref: 6D07A6F9
            • Part of subcall function 6D07A67F: memset.VCRUNTIME140(?,00000000,00000200,?,00000000,00000040,?,?,?,?,23C35E98,?,?,00000000,?,6D278D32), ref: 6D07A70C
            • Part of subcall function 6D07A67F: memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000200,?,00000000,00000040,?,?,?,?,23C35E98,?,?), ref: 6D07A720
            • Part of subcall function 6D07A67F: memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000100,?,00000000,00000200,?,00000000,00000040,?,?,?,?), ref: 6D07A72F
            • Part of subcall function 6D07A67F: memset.VCRUNTIME140(?,00000000,00001000), ref: 6D07A745
            • Part of subcall function 6D07A67F: memset.VCRUNTIME140(?,00000000,0000003C,?,00000000,00001000), ref: 6D07A757
            • Part of subcall function 6D07A67F: WinHttpCrackUrl.WINHTTP ref: 6D07A7F0
            • Part of subcall function 6D07CBEE: _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sock5,?,6D07BBC7,?), ref: 6D07CBF9
          • SetLastError.KERNEL32(00000057,000000B0,6D07BAB2,?,?,?,?,00000034,6D04BDA3,?,?,0000009C,6D04A824,00000000,?), ref: 6D07BBF9
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset$H_prolog3_Http$ErrorLast$?crack_url@net@ierd_tgp@@?get_proxy_config@net@ierd_tgp@@?get_proxy_for_url@net@ierd_tgp@@CrackOpenProxyU?$char_traits@_Uproxy_config_t@12@@Uurl_components_t@12@V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@_stricmp
          • String ID:
          • API String ID: 2271587755-0
          • Opcode ID: c0535124772cc849e21d736ed71a948cf187d79c81dcf855dcd8ac0f25a7a249
          • Instruction ID: 96b9ac324322409401379f23daab77df6a66e9550314d3628def537523eebfcf
          • Opcode Fuzzy Hash: c0535124772cc849e21d736ed71a948cf187d79c81dcf855dcd8ac0f25a7a249
          • Instruction Fuzzy Hash: FF316D71804208DEEF24DFA4C894FEEB7B8FF15304F60409DD555AB290EBB0AA49CB65
          APIs
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057B5F
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002E), ref: 6D057BC5
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057BE9
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000007C), ref: 6D057D0B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?widen@?$ctype@_W@std@@
          • String ID:
          • API String ID: 1759116752-0
          • Opcode ID: 0acd52de56ead930d264b058943e4c17df1eee596d3c9d03db971f1d7007c060
          • Instruction ID: db2c175e1235183553eb4e038d5e48ee59dbd01d76e7b88b772bcdd64dfafe2f
          • Opcode Fuzzy Hash: 0acd52de56ead930d264b058943e4c17df1eee596d3c9d03db971f1d7007c060
          • Instruction Fuzzy Hash: 64312174A04206DFEB05CF54D194BA93BB1FFCA355B60C449EC16CB280E7319AA5DF91
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0CE5A8
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6D0CE5DD
          • ?ZipFilesToFile@common@ierd_tgp@@YA_NABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6D0CE662
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$V?$allocator@W@2@@4@@$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@File@common@ierd_tgp@@FilesH_prolog3_U?$char_traits@V?$basic_string@V?$vector@W@2@@std@@W@2@@std@@@2@@std@@
          • String ID:
          • API String ID: 161599359-0
          • Opcode ID: 2fa66d627ab9141ae4d2048cf9d78db8b3de5d18e9a2e3faf1a584072503dc00
          • Instruction ID: 9c074cda92e9594c5dc2a35d1101f1c0720622ad4b569a3062903516ab98f3ef
          • Opcode Fuzzy Hash: 2fa66d627ab9141ae4d2048cf9d78db8b3de5d18e9a2e3faf1a584072503dc00
          • Instruction Fuzzy Hash: E7315AB1C19208DFEB14CFA8C4816DDFBB4BF19314F95416ED118B7280D774AA46CB66
          APIs
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(00000024), ref: 6D057AAE
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057B5F
          • ?is@?$ctype@_W@std@@QBE_NF_W@Z.MSVCP140(00000004,?), ref: 6D057B8B
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002E), ref: 6D057BC5
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000002A), ref: 6D057BE9
          • ?is@?$ctype@_W@std@@QBE_NF_W@Z.MSVCP140(00000004,?), ref: 6D057C10
          • ?widen@?$ctype@_W@std@@QBE_WD@Z.MSVCP140(0000007C), ref: 6D057D0B
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: W@std@@$?widen@?$ctype@_$?is@?$ctype@_
          • String ID:
          • API String ID: 4220899879-0
          • Opcode ID: 945938cf17ebfbc7204086d981a90a9936b11462133509669d0b13ae4a903011
          • Instruction ID: 8407e15fb091a4cd8ac728690dc587f7c09207c56644ac520f38bcb7bba4686b
          • Opcode Fuzzy Hash: 945938cf17ebfbc7204086d981a90a9936b11462133509669d0b13ae4a903011
          • Instruction Fuzzy Hash: C8312D74A0420ADFEB05CF54D194BA977B2FFCA355B60C44AEC06CB280E7319AA5DB91
          APIs
          • __EH_prolog3_catch.LIBCMT ref: 6D0C261E
            • Part of subcall function 6D0003D0: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,23C35E98,?,?,00000000,6D265A18,000000FF,?,6D0146FF,?,00000000,0000004C,6D017CDC,?,?), ref: 6D00041C
          • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C264E
            • Part of subcall function 6D0C2C86: __EH_prolog3.LIBCMT ref: 6D0C2C8D
            • Part of subcall function 6D0C2C86: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000018,6D0C265E,00000000,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2C98
            • Part of subcall function 6D0C2C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2CAF
            • Part of subcall function 6D0C2C86: std::locale::_Getfacet.LIBCPMT ref: 6D0C2CB9
            • Part of subcall function 6D0C2C86: ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2CD2
            • Part of subcall function 6D0C2C86: std::_Facet_Register.LIBCPMT ref: 6D0C2CEA
            • Part of subcall function 6D0C2C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C2D0D
          • ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z.MSVCP140(?,?,?,00000000,00000001,00000002,00000000,?,00000002,?,?), ref: 6D0C26B0
          • ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,00000000,0000002C,6D0C4505,?,?,?,00000001,00000001,000000E0), ref: 6D0C26E9
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$V?$istreambuf_iterator@$D@std@@@std@@D@std@@@std@@@std@@Lockit@std@@$??0_??1_?get@?$time_get@?getloc@ios_base@std@@?setstate@?$basic_ios@Bid@locale@std@@D@std@@@2@Facet_Getcat@?$time_get@GetfacetH_prolog3H_prolog3_catchIpfx@?$basic_istream@RegisterUtm@@V32@0V42@@Vfacet@locale@2@Vios_base@2@Vlocale@2@std::_std::locale::_
          • String ID:
          • API String ID: 3804686604-0
          • Opcode ID: 2a0148939c1176f01f9f6a984ef84144771fd552ba8e3a3cafd01231f78e4668
          • Instruction ID: d6b04a9ff6ccddedca9f51ffe52ae1755f36f5c81b724002514d9e8bf3eea2ec
          • Opcode Fuzzy Hash: 2a0148939c1176f01f9f6a984ef84144771fd552ba8e3a3cafd01231f78e4668
          • Instruction Fuzzy Hash: 11315C75A05109EFEB14CFA4C988FEDBBB5BF49314F248088E515AB2A1C770AE44CB51
          APIs
          • SetLastError.KERNEL32(0000139F), ref: 028343EC
            • Part of subcall function 028313A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 028313CB
            • Part of subcall function 02834C50: HeapFree.KERNEL32(?,00000000,?,00000000,02834E35,?,028342C8,02834E35,00000000,?,?,02834E35,?), ref: 02834C77
          • SetLastError.KERNEL32(00000000,?), ref: 028343D7
          • SetLastError.KERNEL32(00000057), ref: 02834401
          • WSAGetLastError.WS2_32(?), ref: 02834410
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ErrorLast$Heap$AllocFree
          • String ID:
          • API String ID: 1906775185-0
          • Opcode ID: 9dcbbdd300a3cf53f0ddbb1710e25ccb072cb6d061d78575b81ee82e20fb6338
          • Instruction ID: 72dd3fa577f6ed876e264fb7c826adf3216408d438895cefa7505b323a9ef7cf
          • Opcode Fuzzy Hash: 9dcbbdd300a3cf53f0ddbb1710e25ccb072cb6d061d78575b81ee82e20fb6338
          • Instruction Fuzzy Hash: 7C110A3FE0512C9B8711EE69F8445DEB7A8EF84732B4405A6ED0DD7200D735991186D1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AA435
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6D0AA45D
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
            • Part of subcall function 6D006B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6D388534,6D006BB1,6D388538,?,6D00A235,00000000,?,00000010), ref: 6D006B81
            • Part of subcall function 6D006B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D006B8D
            • Part of subcall function 6D00CEF6: memmove.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6D00A734,?,00000004,6D00A09E,?,23C35E98), ref: 6D00CF55
          • ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6D0AA48D
          • ?create_directory_ex@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6D0AA4C6
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_$?create_directory_ex@?exists@filesystem@ierd_tgp@@?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@Execute_once@std@@Sys_wrapper@common@ierd_tgp@@U?$char_traits@U?$char_traits@_Uonce_flag@1@V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_Verror_code@std@@@Vpath@12@Vpath@filesystem@3@@W@2@@4@@W@std@@memmoveterminate
          • String ID:
          • API String ID: 4191027491-0
          • Opcode ID: dc92dd59dbad73159ac1ff62b0de71adf8c93d19c62550653b409dc528b3b16b
          • Instruction ID: 8566a684c7e94a587ed8c0c220dab6ef94c44b83d15a86fcdffd4a9723314c3c
          • Opcode Fuzzy Hash: dc92dd59dbad73159ac1ff62b0de71adf8c93d19c62550653b409dc528b3b16b
          • Instruction Fuzzy Hash: 2E213971C09248EAEB14DFE4C884BDDBBB8AF19318F54512EE101B7180DB345A49CB65
          APIs
          • __EH_prolog3.LIBCMT ref: 6D08A4AC
          • std::_Cnd_initX.LIBCPMT ref: 6D08A4C7
            • Part of subcall function 6D0217D4: _Mtx_lock.MSVCP140(?,?,?,6D021B80,?,00000014), ref: 6D0217DB
            • Part of subcall function 6D0217D4: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021B80,?,00000014), ref: 6D0217E8
          • std::_Cnd_initX.LIBCPMT ref: 6D08A4DB
            • Part of subcall function 6D0217F3: _Mtx_unlock.MSVCP140(?,?,?,6D021BC0,?,?,?), ref: 6D0217FA
            • Part of subcall function 6D0217F3: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,?,?,6D021BC0,?,?,?), ref: 6D021807
          • std::_Cnd_initX.LIBCPMT ref: 6D08A554
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Cnd_initstd::_$C_error@std@@Throw_$H_prolog3Mtx_lockMtx_unlock
          • String ID:
          • API String ID: 3974313008-0
          • Opcode ID: 18a89f84abcfe7ae4d236950138a47ce8fdeb2236ec555bd6bab6b090bce9d55
          • Instruction ID: 9bd80c47c3d50d2860568ed928718c27acfebf8e01e6aeb0b985f5117656bc84
          • Opcode Fuzzy Hash: 18a89f84abcfe7ae4d236950138a47ce8fdeb2236ec555bd6bab6b090bce9d55
          • Instruction Fuzzy Hash: 5E21AE3090A24ADAFF05CBA8C841BEEBBB46F06314F204158D615AB6C1DBB84B45CB66
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AAD88
          • GetCommandLineW.KERNEL32(00000040,6D0AABF9,?,?,?,?,?,?,?,?,00000070), ref: 6D0AADB4
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,?,?,?,?,?,?,00000070), ref: 6D0AADD7
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          • ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?), ref: 6D0AAE11
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@$?extract_op_from_cmd@?u16to8@common@ierd_tgp@@CommandD@2@@4@@D@2@@std@@0LineSys_wrapper@common@ierd_tgp@@U?$char_traits@_V45@@V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@
          • String ID:
          • API String ID: 1848217688-0
          • Opcode ID: 6bd353d28528bedd97a2471682db113eb31710cb088045273158b5cbc106142a
          • Instruction ID: ed3b85ae8345c5ef053c10287570d866db79e0c43245fb95ee050114c53ccb7e
          • Opcode Fuzzy Hash: 6bd353d28528bedd97a2471682db113eb31710cb088045273158b5cbc106142a
          • Instruction Fuzzy Hash: A7216071C45249DFDF10DFE8C890ADEBFB4AF1A214F68416AD555B7281D7308A4ACB60
          APIs
          • _Query_perf_frequency.MSVCP140(23C35E98,6D388898,?,00000000,?,?,?,6D26C7DC,000000FF,?,6D030A54,?,?,?,?,6D030386), ref: 6D02A4BE
          • _Query_perf_counter.MSVCP140(23C35E98,6D388898,?,00000000,?,?,?,6D26C7DC,000000FF,?,6D030A54,?,?,?,?,6D030386), ref: 6D02A4CA
          • __alldvrm.LIBCMT ref: 6D02A4D4
          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D02A4F5
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: Query_perf_counterQuery_perf_frequencyUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
          • String ID:
          • API String ID: 3135650852-0
          • Opcode ID: f067cb07a6905a6a42251339c76434ddf879f1c0003b48f906f5360fb731b6d9
          • Instruction ID: 864b1f1644d1dab2cbe20a590054f95c39f61520d2d27aac3e3ed6dd773b9a02
          • Opcode Fuzzy Hash: f067cb07a6905a6a42251339c76434ddf879f1c0003b48f906f5360fb731b6d9
          • Instruction Fuzzy Hash: 2401A5B2A082487FDB14CB69CC40F6BBBFCEB85658F114539B515E7244D774AC008674
          APIs
          • __EH_prolog3.LIBCMT ref: 6D08A091
          • _Mtx_init_in_situ.MSVCP140(?,00000002,00000008,6D082169,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08A0BF
          • _Mtx_init_in_situ.MSVCP140(?,00000002,?,00000002,00000008,6D082169,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08A0D1
          • _Mtx_init_in_situ.MSVCP140(?,00000002,?,00000002,?,00000002,00000008,6D082169,00000008,6D082254,00000004,6D08553B,00000000,6D04AB44), ref: 6D08A0E3
            • Part of subcall function 6D089EEA: __EH_prolog3.LIBCMT ref: 6D089EF1
            • Part of subcall function 6D089EBD: __EH_prolog3.LIBCMT ref: 6D089EC4
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3Mtx_init_in_situ
          • String ID:
          • API String ID: 3035183098-0
          • Opcode ID: 20a09f1a7eea1157eb48e962039504c3e30ecf761b2eb24c59c4837cb2c9bcd0
          • Instruction ID: d37895b14bf88fb1c8316088ae596f8a45ed7eb0d33419df4920544e4da97015
          • Opcode Fuzzy Hash: 20a09f1a7eea1157eb48e962039504c3e30ecf761b2eb24c59c4837cb2c9bcd0
          • Instruction Fuzzy Hash: FF21F77080A785DEDB20DFB8C555B8EFAF0BF15304FA0886ED199A7281D7B46704CB62
          APIs
          • WSAEventSelect.WS2_32(?,02833ABB,00000023), ref: 02833C02
          • WSAGetLastError.WS2_32 ref: 02833C0D
          • send.WS2_32(?,00000000,00000000,00000000), ref: 02833C58
          • WSAGetLastError.WS2_32 ref: 02833C63
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: ErrorLast$EventSelectsend
          • String ID:
          • API String ID: 259408233-0
          • Opcode ID: 6ca9a8dd0ca9305b697506d7777a04f8edfca51ea3de7707ca01034123014ad1
          • Instruction ID: 1dd1e12659f208ac94f122cc94921b57b96b8d06725a6de8bbdd6b828d00b6d1
          • Opcode Fuzzy Hash: 6ca9a8dd0ca9305b697506d7777a04f8edfca51ea3de7707ca01034123014ad1
          • Instruction Fuzzy Hash: 3B1133BE6007005BE3219F79D8C8A5BB6F9FB88714F510A1DE65BC3680D775E441DB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0BFD81
          • ?GetUpdatedFilePath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0BFDB6
            • Part of subcall function 6D0C0259: __EH_prolog3.LIBCMT ref: 6D0C0260
            • Part of subcall function 6D0C0259: ?GetUpdatedFilePathEx@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0AAK@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,?,00000008,6D0BFDBB,?), ref: 6D0C027A
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000003C), ref: 6D0BFDEC
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • PathFileExistsW.SHLWAPI(?,?,?,?,?,?,0000003C), ref: 6D0BFDFF
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@2@@std@@D@std@@FileU?$char_traits@V?$allocator@V?$basic_string@$H_prolog3_PathUpdated$?u8to16@common@ierd_tgp@@Ex@silence_update@common@ierd_tgp@@ExistsH_prolog3Path@silence_update@common@ierd_tgp@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@
          • String ID:
          • API String ID: 4278220595-0
          • Opcode ID: 5c9a922044daa26ef7e95ec3b79566b950fe92754910bc82af449aa5b4e1b8ad
          • Instruction ID: 712db3224a9a0073223be520c0e418f61a4186a070075be265679feb67e51a31
          • Opcode Fuzzy Hash: 5c9a922044daa26ef7e95ec3b79566b950fe92754910bc82af449aa5b4e1b8ad
          • Instruction Fuzzy Hash: 3221E3B0D05249DFEF10CFA4C984AEEBBB8FF08214F64046ED505A7240D7749A49CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0C222B
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000054), ref: 6D0C2278
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • ?get_tcls_path@util_version_cfg@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000054), ref: 6D0C2285
            • Part of subcall function 6D0C22D5: __EH_prolog3_GS.LIBCMT ref: 6D0C22DC
            • Part of subcall function 6D0C22D5: ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000000), ref: 6D0C2385
            • Part of subcall function 6D0C22D5: ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,?,00000000), ref: 6D0C238F
            • Part of subcall function 6D0C22D5: ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,0000006C,6D0C228A,?,?,?,?,00000054), ref: 6D0C241A
          • ?string@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000054), ref: 6D0C22B6
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$H_prolog3_W@2@@std@@$?wstring@path@filesystem@ierd_tgp@@D@2@@std@@D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?file_exists@common@ierd_tgp@@?get_tcls_path@util_version_cfg@ierd_tgp@@?string@path@filesystem@ierd_tgp@@?u8to16@common@ierd_tgp@@V34@@W@2@@4@@W@2@@std@@@
          • String ID:
          • API String ID: 2979718539-0
          • Opcode ID: 91fd53b721454f6c9caddde78a8d56562096a4564778364b42a97134f8018beb
          • Instruction ID: 29d09240ea99bef4bc8a2efa8854750b2fb5ca404825729721900f27fa706504
          • Opcode Fuzzy Hash: 91fd53b721454f6c9caddde78a8d56562096a4564778364b42a97134f8018beb
          • Instruction Fuzzy Hash: 802129B0C09248EAEF14DFE9C944ADDFBF8BF68304F45415AD105BB2A0D7B05A45CBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0C7F32
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,00000040), ref: 6D0C7F74
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • ?GetXMLDataStr@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@PBEI00@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,00000007,?,?,?,?,?,?,?,?,?,00000040), ref: 6D0C7F87
            • Part of subcall function 6D0C7FD5: __EH_prolog3_GS.LIBCMT ref: 6D0C7FDF
            • Part of subcall function 6D0C7FD5: ?is_regular_file@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D0C800D
            • Part of subcall function 6D0C7FD5: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D0C8041
            • Part of subcall function 6D0C7FD5: ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0C8048
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,00000007,?,?,?,?), ref: 6D0C7FAD
            • Part of subcall function 6D09B57E: __EH_prolog3_GS.LIBCMT ref: 6D09B585
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$H_prolog3_$D@std@@U?$char_traits@V?$allocator@V?$basic_string@W@2@@std@@$?u16to8@common@ierd_tgp@@D@2@@4@@$?get_log_instance@base@@?is_regular_file@common@ierd_tgp@@?u8to16@common@ierd_tgp@@D@2@@std@@DataI00@Logger@1@Str@common@ierd_tgp@@V34@W@2@@4@@W@2@@std@@@
          • String ID:
          • API String ID: 2393786824-0
          • Opcode ID: 882483e2eeaf51dd2d894c0485e7151be32256d2aa0adb0ab67ec68c62a5eed0
          • Instruction ID: 76f4ee3abc5b1da94ef746a05dfbc459bb3c8f0f6aadaf2f5394ab85b77befa2
          • Opcode Fuzzy Hash: 882483e2eeaf51dd2d894c0485e7151be32256d2aa0adb0ab67ec68c62a5eed0
          • Instruction Fuzzy Hash: 9C21E7B0C09249DFEF14CFA4C885BDEBBB8AF19318F140059E504AB241D7749A45CBA6
          APIs
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
          • String ID:
          • API String ID: 3016257755-0
          • Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
          • Instruction ID: 50cd85b75f9c0cd9af77f1179a001333540cbfb6a05c7c7c6b9aa45e28442a6c
          • Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
          • Instruction Fuzzy Hash: 18112B3A40014AFBCF136E88CC41CAE3F26BB28358F498415FA5899420C336C9B1ABC1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D04BFAE
          • _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?), ref: 6D04BFDE
          • GetPrivateProfileStringW.KERNEL32(?,?,?,?,00000104,?), ref: 6D04C00F
          • GetLastError.KERNEL32 ref: 6D04C019
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ErrorH_prolog3_LastPrivateProfileString_waccess
          • String ID:
          • API String ID: 1080501792-0
          • Opcode ID: c5c380f930751348e6252f3efbeefc7c3b3d38ea987198a4af2153b90dc15b44
          • Instruction ID: d92c2dbc36cf8b452039b3595524d638fcf8ba4f7ac703e1bf7ec721c85da555
          • Opcode Fuzzy Hash: c5c380f930751348e6252f3efbeefc7c3b3d38ea987198a4af2153b90dc15b44
          • Instruction Fuzzy Hash: DF118E70A44219EBEB209F60DC4CBDE77B4BF49725F104099E504A7180DB709E848F94
          APIs
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02BF03
          • ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02BF27
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02BF48
          • ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 6D02BF5E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?pptr@?$basic_streambuf@
          • String ID:
          • API String ID: 2505503336-0
          • Opcode ID: 7a9f53ca3bf92aa76d122d805da317a0cf29e782d8b82f24e6210c1f85776f06
          • Instruction ID: 3910e4890afff68799ed4ca06ec2540346dce89b576846277983e839f3db4d18
          • Opcode Fuzzy Hash: 7a9f53ca3bf92aa76d122d805da317a0cf29e782d8b82f24e6210c1f85776f06
          • Instruction Fuzzy Hash: 080140753016028FDB659F6AC0D863A77FAEF8A709710456AED1287764DB70E80ACF10
          APIs
          • timeGetTime.WINMM(00000001,?,00000001,?,02833C4F,?,?,00000001), ref: 02834AF5
          • InterlockedIncrement.KERNEL32(00000001), ref: 02834B04
          • InterlockedIncrement.KERNEL32(00000001), ref: 02834B11
          • timeGetTime.WINMM(?,02833C4F,?,?,00000001), ref: 02834B28
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: IncrementInterlockedTimetime
          • String ID:
          • API String ID: 159728177-0
          • Opcode ID: 98f2dbacee77363dfa8b46be52d754724b89b359eec4780ac3effa331ab7f6a7
          • Instruction ID: 0356a2cc3dd36b0d843c9bb978874e7af9ef5287c13004869dc37ab29fcf7344
          • Opcode Fuzzy Hash: 98f2dbacee77363dfa8b46be52d754724b89b359eec4780ac3effa331ab7f6a7
          • Instruction Fuzzy Hash: 4B01DAB9A007059FC720DFBED88098AFBF9AF58750740892EE549C7610E774E6458FE0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0CE2BA
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000034), ref: 6D0CE2F8
            • Part of subcall function 6D09B7B8: __EH_prolog3_GS.LIBCMT ref: 6D09B7BF
          • ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,00000034), ref: 6D0CE302
          • ?UnZipToDir@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,00000034), ref: 6D0CE30F
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@W@2@@4@@$Dir@common@ierd_tgp@@W@2@@std@@0@
          • String ID:
          • API String ID: 843940637-0
          • Opcode ID: 8d3d0e77e7bd41e03e941066d6e5d5090f091530dde7cbe431abaa3e0ccef186
          • Instruction ID: 54519ac598765077329b8e77d14398b372852082be3b25cbaaecf6385d75d1f8
          • Opcode Fuzzy Hash: 8d3d0e77e7bd41e03e941066d6e5d5090f091530dde7cbe431abaa3e0ccef186
          • Instruction Fuzzy Hash: 4D1127B0C08218EADF00DFE9C885ADDFBB4BF19210F95512DD208F7290D7705A05CB61
          APIs
          • __EH_prolog3.LIBCMT ref: 6D017C8F
            • Part of subcall function 6D0151EA: __EH_prolog3.LIBCMT ref: 6D0151F1
            • Part of subcall function 6D0151EA: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D015215
            • Part of subcall function 6D0151EA: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000,00000008,6D017CA5,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D01522E
            • Part of subcall function 6D014891: __EH_prolog3.LIBCMT ref: 6D014898
            • Part of subcall function 6D014891: ?flags@ios_base@std@@QBEHXZ.MSVCP140(00000028,6D017CB8,?,?,00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000), ref: 6D0148AC
            • Part of subcall function 6D014891: ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000004), ref: 6D0148ED
            • Part of subcall function 6D014891: ?flags@ios_base@std@@QBEHXZ.MSVCP140(?,?,?,?,00000004), ref: 6D014900
            • Part of subcall function 6D014891: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z.MSVCP140(6D000520,?,?,?,?,00000004), ref: 6D014954
            • Part of subcall function 6D014891: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z.MSVCP140(6D017A68,?,?,?,?,00000004), ref: 6D014961
            • Part of subcall function 6D014891: ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z.MSVCP140(00000030,?,?,?,?,00000004), ref: 6D014972
            • Part of subcall function 6D014891: ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000002,00000000,?,?,?,?,00000004), ref: 6D01499E
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(00000003,00000001,000000B0,6D014E75,?,?,0000003C,6D01743F,?,-00000074,00000000,?,?,?,?,00000004), ref: 6D017CC3
          • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?,?,00000004), ref: 6D017D02
            • Part of subcall function 6D0146DC: __EH_prolog3_catch.LIBCMT ref: 6D0146E3
            • Part of subcall function 6D0146DC: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000004C,6D017CDC,?,?,?,?,?,?,00000004), ref: 6D014716
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QBE_JXZ.MSVCP140(00000000,?,?,?,?,00000004), ref: 6D014749
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QBE_JXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 6D01477D
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QBE_JXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 6D014793
            • Part of subcall function 6D0146DC: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140 ref: 6D0147CB
            • Part of subcall function 6D0146DC: ?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,?,00000000,0000004C,6D017CDC,?,?,?,?,?,?,00000004), ref: 6D014852
            • Part of subcall function 6D0146DC: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,00000004), ref: 6D01486A
          • ??Bios_base@std@@QBE_NXZ.MSVCP140(?,?,?,?,00000004), ref: 6D017CE7
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$H_prolog3$??6?$basic_ostream@?flags@ios_base@std@@Bios_base@std@@V01@V21@@Vios_base@1@$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@?getloc@ios_base@std@@?setstate@?$basic_ios@?sgetc@?$basic_streambuf@?widen@?$basic_ios@D@std@@@1@@H_prolog3_catchV?$basic_streambuf@Vlocale@2@
          • String ID:
          • API String ID: 1933774319-0
          • Opcode ID: 91e96c3dccd26a3a91e21baa279e8048da07d96c664e48c8b62797d389a15605
          • Instruction ID: 5ba1720ed83a8405d7a93399ea930db9039d072d5f97d13e68365c720584c068
          • Opcode Fuzzy Hash: 91e96c3dccd26a3a91e21baa279e8048da07d96c664e48c8b62797d389a15605
          • Instruction Fuzzy Hash: FF018034608209AFEF08DFE0CD98BA973B5EF46308F108059E1165B291DB349A09CA10
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07FF8E
          • ?extract_path@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000001C), ref: 6D07FFBB
            • Part of subcall function 6D07F04B: __EH_prolog3_GS.LIBCMT ref: 6D07F052
            • Part of subcall function 6D07F04B: ?has_parent_path@path@filesystem@ierd_tgp@@QBE_NXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,00000034), ref: 6D07F078
            • Part of subcall function 6D07F04B: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000034), ref: 6D07F088
          • ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,0000001C), ref: 6D07FFCA
            • Part of subcall function 6D07F111: _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,?,6D07F0F8,?,?,?,?,?,?,?,?,0000001C), ref: 6D07F122
          • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,?,0000001C), ref: 6D07FFE1
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?extract_path@common@ierd_tgp@@?file_exists@common@ierd_tgp@@?has_parent_path@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@CreateDirectoryV123@V34@@W@2@@std@@W@2@@std@@@_waccess
          • String ID:
          • API String ID: 2863078902-0
          • Opcode ID: a57df1058165aa61d0abb5d17208602b4e1d512c51cb00191618f19d1c972248
          • Instruction ID: 0b2ee72a355682b1227aff9d43cabc59140742277dd33dc3bfd293aa1333f58e
          • Opcode Fuzzy Hash: a57df1058165aa61d0abb5d17208602b4e1d512c51cb00191618f19d1c972248
          • Instruction Fuzzy Hash: 44015E7180420ADFDF14CFD4C485AEDBFB8AF0A324F55112DD211BB190CB349685CB65
          APIs
          • CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02833667
          • _free.LIBCMT ref: 0283369C
            • Part of subcall function 02836E49: HeapFree.KERNEL32(00000000,00000000,?,02839900,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F), ref: 02836E5F
            • Part of subcall function 02836E49: GetLastError.KERNEL32(00000000,?,02839900,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F,00000000), ref: 02836E71
          • _malloc.LIBCMT ref: 028336D7
          • _memset.LIBCMT ref: 028336E5
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
          • String ID:
          • API String ID: 3340475617-0
          • Opcode ID: b9f1ed7b0fa390858b5f2bb1c198cd33e9229c387b3a69225ed2477c345e6a2c
          • Instruction ID: e221fd83c15a58e53e75fe9eb73ce5c67bb66bcd05d0870694a730f2d1c1793f
          • Opcode Fuzzy Hash: b9f1ed7b0fa390858b5f2bb1c198cd33e9229c387b3a69225ed2477c345e6a2c
          • Instruction Fuzzy Hash: 9401CCF9900B049FE3209F7AD881B97B6E9EB45314F10482ED5AEC3302D634A8048F60
          APIs
          • _malloc.LIBCMT ref: 02836F31
            • Part of subcall function 02836E83: __FF_MSGBANNER.LIBCMT ref: 02836E9C
            • Part of subcall function 02836E83: __NMSG_WRITE.LIBCMT ref: 02836EA3
            • Part of subcall function 02836E83: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02839FB0,00000000,00000001,00000000,?,0283C0CF,00000018,02847C70,0000000C,0283C15F), ref: 02836EC8
          • std::exception::exception.LIBCMT ref: 02836F66
          • std::exception::exception.LIBCMT ref: 02836F80
          • __CxxThrowException@8.LIBCMT ref: 02836F91
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: std::exception::exception$AllocException@8HeapThrow_malloc
          • String ID:
          • API String ID: 1414122017-0
          • Opcode ID: 0fe43c1d1a66a2be52755cd3c789d058adf89f5c2c91a9ac70c2d422e51f14f9
          • Instruction ID: 7cdc7823d91fcaa0ff8f629aa92bdda2c2c8bdbd7de7f08741a2055c9f439948
          • Opcode Fuzzy Hash: 0fe43c1d1a66a2be52755cd3c789d058adf89f5c2c91a9ac70c2d422e51f14f9
          • Instruction Fuzzy Hash: C3F0F93D94011DBBEB06EB6CD810A5E7BEF9B01718F140014D405DA1C0EFB0CA44CBDA
          APIs
            • Part of subcall function 02831420: HeapFree.KERNEL32(?,00000000,?,?,?,028340B1,?,00000000,02834039,?,771ADFA0,02833648), ref: 0283143D
            • Part of subcall function 02831420: _free.LIBCMT ref: 02831459
          • HeapDestroy.KERNEL32(00000000), ref: 028364A3
          • HeapCreate.KERNEL32(?,?,?), ref: 028364B5
          • _free.LIBCMT ref: 028364C5
          • HeapDestroy.KERNEL32 ref: 028364F2
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: Heap$Destroy_free$CreateFree
          • String ID:
          • API String ID: 4097506873-0
          • Opcode ID: df9644ac046c52aa7d907f32566a3212a8396e46172ac7d4550fe0f82d23756f
          • Instruction ID: 118267ceeac5d8e6cc6639430b708ed113e2b80e21ccc33aa8cb1c786448588e
          • Opcode Fuzzy Hash: df9644ac046c52aa7d907f32566a3212a8396e46172ac7d4550fe0f82d23756f
          • Instruction Fuzzy Hash: EEF019BD900712ABD7219F29E808B17B7F9BF44724F108918E859C7240EB34F855CBD0
          APIs
          • ?Lock@CShareMem@@QAEPAXAAH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000001,?,?,?,6D012E23,?,?,?,?,?,0000001C), ref: 6D01341F
            • Part of subcall function 6D012EE1: CreateMutexA.KERNEL32(00000000,00000001,?,?,?,6D012B60,00000000,00000000,?,?,?,6D012EC0,?,?,6D012A5B,23C35E98), ref: 6D012EFD
            • Part of subcall function 6D012EE1: WaitForSingleObject.KERNEL32(00000000,000003E8,?,?,6D012B60,00000000,00000000,?,?,?,6D012EC0,?,?,6D012A5B,23C35E98), ref: 6D012F0F
          • ?ReadPeerList@CSimpleIPC@@AAEXPAXH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000000,?,00000000,00000001,?,?,?,6D012E23,?,?,?,?,?,0000001C), ref: 6D013436
            • Part of subcall function 6D0132CE: EnterCriticalSection.KERNEL32(?,?,00000000,?,?,?,6D01343B,00000000,00000000,?,00000000,00000001,?,?,?,6D012E23), ref: 6D0132DE
            • Part of subcall function 6D0132CE: IsWindow.USER32(?), ref: 6D01332A
            • Part of subcall function 6D0132CE: ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69([SimpleIPC]Read peer list, not a window: %d.,?,?,00000000,?,?,?,6D01343B,00000000,00000000,?,00000000,00000001,?), ref: 6D01334E
            • Part of subcall function 6D0132CE: LeaveCriticalSection.KERNEL32(?,?,00000000,?,?,?,6D01343B,00000000,00000000,?,00000000,00000001,?,?,?,6D012E23), ref: 6D013368
          • ?WritePeerList@CSimpleIPC@@AAEXPAXHH@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000000,00000001,00000000,00000000,?,00000000,00000001,?,?,?,6D012E23), ref: 6D013441
            • Part of subcall function 6D013453: EnterCriticalSection.KERNEL32(?), ref: 6D01347D
            • Part of subcall function 6D013453: IsWindow.USER32(?), ref: 6D0134A3
            • Part of subcall function 6D013453: ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69([SimpleIPC]Write peer item: %d.,?), ref: 6D0134C0
            • Part of subcall function 6D013453: LeaveCriticalSection.KERNEL32(?), ref: 6D013501
            • Part of subcall function 6D013453: GetCurrentProcessId.KERNEL32 ref: 6D01351B
            • Part of subcall function 6D013453: ?shutdown@Application@common@ierd_tgp@@EAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69([SimpleIPC]Write self information: %d.,?), ref: 6D01352C
          • ?UnLock@CShareMem@@QAEXXZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000000,00000001,?,?,?,6D012E23,?,?,?,?,?,0000001C), ref: 6D01344A
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CriticalSection$?shutdown@Application@common@ierd_tgp@@$EnterLeaveList@Lock@Mem@@PeerShareSimpleWindow$CreateCurrentMutexObjectProcessReadSingleWaitWrite
          • String ID:
          • API String ID: 2443044767-0
          • Opcode ID: 8804e650a9f30783a001ddca97c6edc672ce1aa8e0b83744f91021181d9349a7
          • Instruction ID: c3a29c056b4b0e0973b0e473b393732f5ed0c2308c893ab7a9ab3d18db0692f5
          • Opcode Fuzzy Hash: 8804e650a9f30783a001ddca97c6edc672ce1aa8e0b83744f91021181d9349a7
          • Instruction Fuzzy Hash: 14F0E53260812973E716D6C6DCC0FFFB39DAF88668F114129A616631808FA0AE0481A0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D09A7C2
          • StringFromCLSID.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 6D09A7D6
          • ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 6D09A7F8
          • CoTaskMemFree.OLE32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 6D09A804
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@FreeFromH_prolog3_StringTaskU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@
          • String ID:
          • API String ID: 1464910427-0
          • Opcode ID: a8f8b962d5e78d0f29c6e29004cc010023ac6c1a58adb8303ff57e3c18bcf90a
          • Instruction ID: 84860c825b21d6d2ce34d7d49ef8197e7158b245dbce5da57de5b607777c536e
          • Opcode Fuzzy Hash: a8f8b962d5e78d0f29c6e29004cc010023ac6c1a58adb8303ff57e3c18bcf90a
          • Instruction Fuzzy Hash: 72F04F31D08208EFEF149FA4C84ABDDB778AF16329F109115E5107B1A0DB74960ADB30
          APIs
          • __EH_prolog3.LIBCMT ref: 6D026C57
          • ?good@ios_base@std@@QBE_NXZ.MSVCP140(00000000,00000004,6D0562DB,00000000,00000030,6D058285,?,00000020), ref: 6D026C75
          • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140 ref: 6D026C90
          • ?good@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6D026C9D
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?good@ios_base@std@@$?flush@?$basic_ostream@D@std@@@std@@H_prolog3U?$char_traits@V12@
          • String ID:
          • API String ID: 3262895407-0
          • Opcode ID: fab5aba51277182f1e16e27ba1c2c74dc45a0d6380d98061b6b7d7c40989c075
          • Instruction ID: 181475c27b288301134665be6879d02140e8cc076a9b4fd65c77e76a24b25f11
          • Opcode Fuzzy Hash: fab5aba51277182f1e16e27ba1c2c74dc45a0d6380d98061b6b7d7c40989c075
          • Instruction Fuzzy Hash: 3FF0A974202100CFEB28EF18CA58B3DB7F0BF56319B65805EE6568B381CB70E904CB95
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D016E8F
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(00000064), ref: 6D016E96
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3_Logger@1@
          • String ID:
          • API String ID: 2092442621-0
          • Opcode ID: ffc1dfaea7df70928bfc3241b24223c02d0b047196b4001d85d1bf6edf7f4e48
          • Instruction ID: cc25a981d2bccf68de8a26acc51ae81f93c4795f908806ff2bd5751ce0ed2fea
          • Opcode Fuzzy Hash: ffc1dfaea7df70928bfc3241b24223c02d0b047196b4001d85d1bf6edf7f4e48
          • Instruction Fuzzy Hash: 7DF0F671819314DBFB24C7E4DC0479C77B8AF0530DF55815CD5046B282CBB69945CBE1
          APIs
          • ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,00000000,00000000,?,6D0C295B,?,?,00000000,?,?,00000010,?,0000000C,6D0C384B), ref: 6D0C28D6
          • __EH_prolog3_catch.LIBCMT ref: 6D0C28E3
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_catchXlength_error@std@@
          • String ID: map/set<T> too long
          • API String ID: 3765788712-1285458680
          • Opcode ID: 5f12d5135be92217aefb9780a59a5c1c8c9a919a785a835d7754d77f26e5d59b
          • Instruction ID: 09e5b0f7542bd99f6fd8d7e3242b494c3e446e765afd3d31884dc621244f7705
          • Opcode Fuzzy Hash: 5f12d5135be92217aefb9780a59a5c1c8c9a919a785a835d7754d77f26e5d59b
          • Instruction Fuzzy Hash: 36514530609241DFE722CF29C484B5DBBE1EF09318F59C488E8599B762C775EC49CB92
          APIs
          • select.WS2_32(?,?,?,0000002C,00000000), ref: 6CFF2AE7
          • __WSAFDIsSet.WS2_32(?,0000002C), ref: 6CFF2B08
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: select
          • String ID: @
          • API String ID: 1274211008-2766056989
          • Opcode ID: bd162d3f79c723c21392a9b0a59e92278bfabcc4ee22258f0bbab00d9d513942
          • Instruction ID: 9c4f7ad9ae46bf5d995dfdc74b3002178255a8b80241da627e74acc4bbff3ea5
          • Opcode Fuzzy Hash: bd162d3f79c723c21392a9b0a59e92278bfabcc4ee22258f0bbab00d9d513942
          • Instruction Fuzzy Hash: 69418C702047868BD334CF24C884A57B7F5FF45708F050A6CD9A287A51E776E54ECBA2
          APIs
          • ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,6D0C770F,?,?,?,?,6D0C68EB,6D0C770F,00000000,?,?,00000000,?,0000000C,6D0C696A,?), ref: 6D0C686A
          • __EH_prolog3_catch.LIBCMT ref: 6D0C6877
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_catchXlength_error@std@@
          • String ID: map/set<T> too long
          • API String ID: 3765788712-1285458680
          • Opcode ID: 8dcaa0a4650bcb168c7163903c4fdd020699664a383cc47719c8f4ce726e9e09
          • Instruction ID: ab04b9485a7abdf5ced5a034530bbc79759d67dfb8fe33d01bf5924777d9bd96
          • Opcode Fuzzy Hash: 8dcaa0a4650bcb168c7163903c4fdd020699664a383cc47719c8f4ce726e9e09
          • Instruction Fuzzy Hash: AA516834608242DFE721CF08C494B69BBE2BF09318F99C998E9598B362C775EC45CF91
          APIs
          • ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,6D04751F,?,?,?,?,6D046270,6D04751F,?,?,?,?,?,0000000C,6D046385,?), ref: 6D0461EF
          • __EH_prolog3_catch.LIBCMT ref: 6D0461FC
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_catchXlength_error@std@@
          • String ID: map/set<T> too long
          • API String ID: 3765788712-1285458680
          • Opcode ID: df20aca0a4230037b60a6b52aa94388c7706f5fa0b6667dac7506454dfa79ad4
          • Instruction ID: 81f28d5a6cd9bfba07c1c867a693a697549d74deb0bd24d103875ff35e43a7a0
          • Opcode Fuzzy Hash: df20aca0a4230037b60a6b52aa94388c7706f5fa0b6667dac7506454dfa79ad4
          • Instruction Fuzzy Hash: 6C512330608241DFE711CF19C594F99BBE1BB0A318F99C4A8E9599B362D775EC81CF90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D077AD3
          • __Init_thread_footer.LIBCMT ref: 6D077C8C
            • Part of subcall function 6D034133: __EH_prolog3.LIBCMT ref: 6D03413A
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3H_prolog3_Init_thread_footer
          • String ID: %2x%2x%2x%2x%2x%2x
          • API String ID: 3446243043-3828475636
          • Opcode ID: 8c3e51d19c168871fc840848d72264870fc273226c3295f8b9531ee0abc188ff
          • Instruction ID: 05934e7be60c07d425a176e2699c15e77b1894ee291c99db404c5479e58c3404
          • Opcode Fuzzy Hash: 8c3e51d19c168871fc840848d72264870fc273226c3295f8b9531ee0abc188ff
          • Instruction Fuzzy Hash: 94519EB1C18209EFEB15CFA4C858BAEB7B8EF49319F50455DD105AB281D7B56A08CFA0
          APIs
          • ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?,?,?,6D0969DF,?,00000000,?,00000001,00000000,?,00000001,0000000C,6D096943), ref: 6D096801
          • __EH_prolog3_catch.LIBCMT ref: 6D09680E
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_catchXlength_error@std@@
          • String ID: map/set<T> too long
          • API String ID: 3765788712-1285458680
          • Opcode ID: 53220673b3b457d445db27e92b48df72dbe4878e9d483295f2dcc67e39e47e25
          • Instruction ID: dfeb0e463239311ff0a3589d3fa49e478174c07b5a57c7f0ac41bef201f19f46
          • Opcode Fuzzy Hash: 53220673b3b457d445db27e92b48df72dbe4878e9d483295f2dcc67e39e47e25
          • Instruction Fuzzy Hash: 075123342082459FE711CF18C598B59FBE2AF09328F99C498E9598F362C776EC81DF91
          APIs
            • Part of subcall function 6CFFE8D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,00000000,Bad unicode escape sequence in string: four digits expected.,0000003C,23C35E98,-00000002,?), ref: 6CFFE982
          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000003,?,expecting another \u token to begin the second half of a unicode surrogate pair,0000004F,?,?,23C35E98,-00000002,23C35E98,00000000,00000003), ref: 6CFFE81D
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6CFFE8D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,00000000,Bad unicode escape sequence in string: hexadecimal digit expected.,00000042,23C35E98,-00000002,?), ref: 6CFFEA3B
          Strings
          • additional six characters expected to parse unicode surrogate pair., xrefs: 6CFFE7BF
          • expecting another \u token to begin the second half of a unicode surrogate pair, xrefs: 6CFFE89E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: _invalid_parameter_noinfo_noreturn$memmove
          • String ID: additional six characters expected to parse unicode surrogate pair.$expecting another \u token to begin the second half of a unicode surrogate pair
          • API String ID: 15630516-1961466578
          • Opcode ID: 0b0c2692122bfa1324a137e0c60fb2b70c133bf76e0fdfa6cc60e2c3da01ca5c
          • Instruction ID: d061ba1ad83d25e0290e149db16b0e7b8a725c893d5de1f94970aaf534af0ac1
          • Opcode Fuzzy Hash: 0b0c2692122bfa1324a137e0c60fb2b70c133bf76e0fdfa6cc60e2c3da01ca5c
          • Instruction Fuzzy Hash: 1141F171D0420EAFDB14DFA8C890BEEBBB5FF09314F144528E821A7791D7759945CBA0
          APIs
          • __EH_prolog3_catch_GS.LIBCMT ref: 6D0A25AA
            • Part of subcall function 6D0227B2: __EH_prolog3.LIBCMT ref: 6D0227B9
            • Part of subcall function 6D09CF24: __EH_prolog3.LIBCMT ref: 6D09CF2B
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$H_prolog3_catch_
          • String ID: ://(\S+)/$wegame
          • API String ID: 2899319929-1479293945
          • Opcode ID: c17f5bb5ec0e52fd8906b83e495c0c9107d29763965d6739eaa2e20747937496
          • Instruction ID: b5fb0769f76e1274d3c08d1ab9934db7cd3417cb7df82840a14f0895633f5aab
          • Opcode Fuzzy Hash: c17f5bb5ec0e52fd8906b83e495c0c9107d29763965d6739eaa2e20747937496
          • Instruction Fuzzy Hash: E6416C70C09248EEEF10DFE5C944BEEBBB4AF55308F5180ACD605AB251DB746B08CB61
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D09F46F
            • Part of subcall function 6D0123FD: __EH_prolog3.LIBCMT ref: 6D012404
          • ?GetDriveLetter@Sys_wrapper@common@ierd_tgp@@SA_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D09F575
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: DriveH_prolog3H_prolog3_Letter@Sys_wrapper@common@ierd_tgp@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@
          • String ID: \Device\HarddiskVolume
          • API String ID: 1258309497-2610563940
          • Opcode ID: 85adcdf36e6da45c8966f6ba19a661bf77a86db8d9a4954d285f0a4d70c14340
          • Instruction ID: e5ff87891dd028a4dbb78705c0864f84ce73bc0032cbcf132ed39a5ba849ec6d
          • Opcode Fuzzy Hash: 85adcdf36e6da45c8966f6ba19a661bf77a86db8d9a4954d285f0a4d70c14340
          • Instruction Fuzzy Hash: 794147B0C09259EEEF10CFA8C884BEDBBB4BF15314F54816EE518AB290D7705A45CB62
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: /$\
          • API String ID: 431132790-1600464054
          • Opcode ID: f8fea39a8406a6f56ceb647939181f82428005de0034da6101203787e26afc57
          • Instruction ID: 4d8f15f09dbf1ea33c12402e474d7128f7564b4db55854d7d2e1a2bed6d1f2ac
          • Opcode Fuzzy Hash: f8fea39a8406a6f56ceb647939181f82428005de0034da6101203787e26afc57
          • Instruction Fuzzy Hash: 7031377150420DEFEF14CF54C890EEE77B8AF58314F618269E9299B190DB70EB49CB61
          APIs
          • strncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(6BE858E1,00000020,0000061C,000000FF,?,00000000,?,6CFF2776,00000000,0000002C), ref: 6CFF262D
          • strncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(6BE85905,00000020,?,000000FF,00000000,?,6CFF2776,00000000,0000002C), ref: 6CFF2670
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: strncpy_s
          • String ID:
          • API String ID: 1419134015-3916222277
          • Opcode ID: 497a80de21a92ba75da3551667fdd4e854478f562a584d8233261d03625734fe
          • Instruction ID: e93bbf16ff4b7be59015bfd748287f4c6b029e5ee8819167326d3c6acc4a94c3
          • Opcode Fuzzy Hash: 497a80de21a92ba75da3551667fdd4e854478f562a584d8233261d03625734fe
          • Instruction Fuzzy Hash: BE310DB14007469FD314CF24C480B96B7B0FF04324F15865DE8BA9B6A1E732B9A9CB90
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0CF8B9
          • tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000024,6D0CE005,?), ref: 6D0CF946
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_tolower
          • String ID: T37m
          • API String ID: 2132562476-3758268913
          • Opcode ID: d61643a967f19ae0d3d012ae2c28d221ded670ef1880fa9bb6d4fccbcb93cbbb
          • Instruction ID: 8bb61c8fb39469c6e91efce6961324e9220ac57924e9c75ff57ca10f2cac0292
          • Opcode Fuzzy Hash: d61643a967f19ae0d3d012ae2c28d221ded670ef1880fa9bb6d4fccbcb93cbbb
          • Instruction Fuzzy Hash: 7A317E31901219EFEB20DF94C444AEDBBB9FF49324F960069D141BB164DBB0A995CBE3
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D07BC0E
          • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,http,?,?,00000030,6D07B9D5,?,?,000000C4,6D07BB20,?,?,000000B0,6D07BAB2,?,?), ref: 6D07BC81
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3__stricmp
          • String ID: http
          • API String ID: 3123111935-2541227442
          • Opcode ID: 677e50cc0bb60e1c5e0d361cdf28eb7c2f8704b6e6c6ec7a1b22fa2db0000894
          • Instruction ID: 303aed51f472f26bd541809021eba4368fe53b0cd47d2d8d6a3b6cc330947ad6
          • Opcode Fuzzy Hash: 677e50cc0bb60e1c5e0d361cdf28eb7c2f8704b6e6c6ec7a1b22fa2db0000894
          • Instruction Fuzzy Hash: BC214871C0A209EEEB14DFA8D4906EDBBB4EF19324FA4405EE401BB241DB716A45CBA5
          APIs
          • GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 6D052928
          • GetLastError.KERNEL32 ref: 6D052932
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: AttributesErrorFileLast
          • String ID: ierd_tgp::filesystem::file_size
          • API String ID: 1799206407-529503565
          • Opcode ID: 8f6e519ec9bb9f79d758b12fd6df5685174f75d0516ac31e7efeaaa6471fac70
          • Instruction ID: bbfef82130e456a00084b590288074251285b043954d744daefaed75ed0c4781
          • Opcode Fuzzy Hash: 8f6e519ec9bb9f79d758b12fd6df5685174f75d0516ac31e7efeaaa6471fac70
          • Instruction Fuzzy Hash: 6E11CE31A10208ABEB208A79CD49BAFB7F8EF87369F444959E850E7240D770E91487A0
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D02A232
          • OutputDebugStringW.KERNEL32(00000000,?,00000000,/,|<>:#$%{}[]'"^!?+* ,00000038,00000000,00000008,?,?,6D0564F9,00000000,?,?,00000004,6D05A1B9,?), ref: 6D02A2BF
            • Part of subcall function 6D023758: __EH_prolog3.LIBCMT ref: 6D02375F
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: DebugH_prolog3H_prolog3_OutputString
          • String ID: /,|<>:#$%{}[]'"^!?+*
          • API String ID: 823437553-825407933
          • Opcode ID: 96af4284a6273499a16486e7bb389ed2caf465c39e9e543fac518a827ebafd1b
          • Instruction ID: 5b7f2df14c5cca71ad2aa2ca8d5cd288f1545790190b6cb7e72fae40f8b0001c
          • Opcode Fuzzy Hash: 96af4284a6273499a16486e7bb389ed2caf465c39e9e543fac518a827ebafd1b
          • Instruction Fuzzy Hash: 3221D570C4A208EFEF01DFA8C844BDEBBB8AF09318F55015DE104AB190CB345A49C775
          APIs
          • socket.WS2_32(00000002,00000001,00000000), ref: 6D260236
          • socket.WS2_32(00000002,00000002,00000000), ref: 6D260246
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: socket
          • String ID: type
          • API String ID: 98920635-2363381545
          • Opcode ID: f6c392c0a81f63d247726706fae8063c3a95bb7b7a40ec980aa12be398c5d4cf
          • Instruction ID: fab456e729fdbc5165703b9722aca1b56150bd0f8a3cf81496554fcfe8b0c2b2
          • Opcode Fuzzy Hash: f6c392c0a81f63d247726706fae8063c3a95bb7b7a40ec980aa12be398c5d4cf
          • Instruction Fuzzy Hash: 4511AB716C830A5BDB020F259E95F673B62AF9331BF440495F6A8CB1D3D353C428C151
          APIs
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D01FBB1
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D01F613: __EH_prolog3_GS.LIBCMT ref: 6D01F648
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp, xrefs: 6D01FBDD
          • [common][Asy_udp] sock(%d) recv thread interrupted., xrefs: 6D01FBF6
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_Logger@1@
          • String ID: [common][Asy_udp] sock(%d) recv thread interrupted.$d:\ci_dev\wegame_client\codes\common\src\asy_udp.cpp
          • API String ID: 52498757-2567733300
          • Opcode ID: dfd8967d0483469514d7de2545a00185f5bc1343c0840994f80c22d6fa950a9e
          • Instruction ID: a55ebf13840f1566666acff5235f3588136e6dd83244f50ab4915cc4d705d00b
          • Opcode Fuzzy Hash: dfd8967d0483469514d7de2545a00185f5bc1343c0840994f80c22d6fa950a9e
          • Instruction Fuzzy Hash: 3711BC3290C209ABFB19C7A8CD54BED7B649F61308F5180D8D506BB2C1EBB59F09CB91
          APIs
            • Part of subcall function 6D034133: __EH_prolog3.LIBCMT ref: 6D03413A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D036967
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6D03698B
          • filesystem_error in copy_if_notexist: %1%, xrefs: 6D036917
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$?get_log_instance@base@@Logger@1@
          • String ID: d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp$filesystem_error in copy_if_notexist: %1%
          • API String ID: 1369574949-2601342785
          • Opcode ID: 555eab1fab449f7b07f91e184b0cb89e6ff1a027419fc919a9f90bd8aeda7b3a
          • Instruction ID: 600433a23c3b212724f7010bbc98ab0d64147a5380948752ca87515cfad5ebac
          • Opcode Fuzzy Hash: 555eab1fab449f7b07f91e184b0cb89e6ff1a027419fc919a9f90bd8aeda7b3a
          • Instruction Fuzzy Hash: 80119D3080912AABEB25DBA4CC60FEDB774AF55304F5241D896056B281EF719F09DB91
          APIs
            • Part of subcall function 6D034133: __EH_prolog3.LIBCMT ref: 6D03413A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D036A28
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • std exception in copy_if_notexist: %1%, xrefs: 6D0369D8
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6D036A4C
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$?get_log_instance@base@@Logger@1@
          • String ID: d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp$std exception in copy_if_notexist: %1%
          • API String ID: 1369574949-137779819
          • Opcode ID: 7fdc75919353ef78c16339e500e2e2ba9aa400246a6bc4157e16062fc4970c3d
          • Instruction ID: c123de3bd86ae9502c2190cc1688404611988ce8e7a8f4919cdfe50be29a74d0
          • Opcode Fuzzy Hash: 7fdc75919353ef78c16339e500e2e2ba9aa400246a6bc4157e16062fc4970c3d
          • Instruction Fuzzy Hash: C811BF3180912AABEB25DBA4CC20FEDB770AF55308F5181D896057B281EB319F09DBD1
          APIs
            • Part of subcall function 6D034133: __EH_prolog3.LIBCMT ref: 6D03413A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D03A150
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • std exception in copy_if_notexist: %1%, xrefs: 6D03A100
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp, xrefs: 6D03A174
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$?get_log_instance@base@@Logger@1@
          • String ID: d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp$std exception in copy_if_notexist: %1%
          • API String ID: 1369574949-528307446
          • Opcode ID: aa1381315edadd8eef41950a2461067fa1893a3c275d940df21070761c3441f2
          • Instruction ID: 07bed5ea1fc0f77cf3b5fd1d3418f0f8575e81bc658c1a20ba6956cdceea5d4b
          • Opcode Fuzzy Hash: aa1381315edadd8eef41950a2461067fa1893a3c275d940df21070761c3441f2
          • Instruction Fuzzy Hash: 2711BF30805129ABFB25DBA4CC60FEDB370AF55308F6141D8D2057B280EB369F09CB91
          APIs
            • Part of subcall function 6D034133: __EH_prolog3.LIBCMT ref: 6D03413A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D03A08F
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • filesystem_error in copy_if_notexist: %1%, xrefs: 6D03A03F
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp, xrefs: 6D03A0B3
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$?get_log_instance@base@@Logger@1@
          • String ID: d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp$filesystem_error in copy_if_notexist: %1%
          • API String ID: 1369574949-290179427
          • Opcode ID: b78adbcfe8d25c569c45e97b870f34e02039515ea7a53bb2b45a39828cb55e25
          • Instruction ID: 0ebe1509cb2b1c319140e4c69f52fe21b9d4834a65b251d3bf05d7d14aa65463
          • Opcode Fuzzy Hash: b78adbcfe8d25c569c45e97b870f34e02039515ea7a53bb2b45a39828cb55e25
          • Instruction Fuzzy Hash: 2211C130805129EBEB25DBA4CD60FEDB370AF55308F6181D8D2457B280EB319F0ADB91
          APIs
            • Part of subcall function 6D034133: __EH_prolog3.LIBCMT ref: 6D03413A
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D0362A3
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
          Strings
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6D0362C7
          • std exception in cfg_folder_appdata: %1%, xrefs: 6D036253
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3$?get_log_instance@base@@Logger@1@
          • String ID: d:\ci_dev\wegame_client\codes\common\src\cfg_file.cpp$std exception in cfg_folder_appdata: %1%
          • API String ID: 1369574949-2956762213
          • Opcode ID: 47552e059fd8d46b3e07f18716a2a277f38ddb33e83fbad1dfea52606517e94e
          • Instruction ID: da97cef65e8c8e3bc142dfb49370906ea67e44e66334bcb1e7a51e566bd1fa9a
          • Opcode Fuzzy Hash: 47552e059fd8d46b3e07f18716a2a277f38ddb33e83fbad1dfea52606517e94e
          • Instruction Fuzzy Hash: 56118F70804119ABEB29DBA8CD54FED77B49F14304F524098D641BB281EB359F09CBD1
          APIs
          • __output_l.LIBCMT ref: 02837025
            • Part of subcall function 0283710D: __getptd_noexit.LIBCMT ref: 0283710D
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __getptd_noexit__output_l
          • String ID: B
          • API String ID: 2141734944-1255198513
          • Opcode ID: fd1fdc686e426d0524c4a0ace4d10a2df1a110a2837cd7d0ca9d2c171b75a8c9
          • Instruction ID: 60292fe8d840ccbe5e68cb2b1a9ba065443a841648b680c10c793326b9c531cd
          • Opcode Fuzzy Hash: fd1fdc686e426d0524c4a0ace4d10a2df1a110a2837cd7d0ca9d2c171b75a8c9
          • Instruction Fuzzy Hash: 9C0161BA904259ABDF029FA8CC01BEEBBB9FB04364F004115F924E6280E774D501CFA6
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3_
          • String ID: main_thread_tick$system_event
          • API String ID: 2427045233-3037755782
          • Opcode ID: e0ff0443a2b3fc8901059c1f33d4045a67d27d147b4ee77d4e390b4a7b8018b8
          • Instruction ID: 807bc0634c4f3bdc360d232e9de530234f53208109adc94a02864eb03a3e0ec1
          • Opcode Fuzzy Hash: e0ff0443a2b3fc8901059c1f33d4045a67d27d147b4ee77d4e390b4a7b8018b8
          • Instruction Fuzzy Hash: 4801803090420DEBEF05DFA0C940BEEB7B1BF15318F504119D5227B284DBB55A56DB91
          APIs
          • memset.VCRUNTIME140(?,00000000,00000044), ref: 6D0A6EAF
          • CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 6D0A6EE2
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CreateProcessmemset
          • String ID: D
          • API String ID: 2296119082-2746444292
          • Opcode ID: cc73a209fbb1d86de80fde7a2b0c77187a475abbbdc3a6643eb5e1da0bbe387e
          • Instruction ID: 05a418d17a542b8f11bf8809017098fa08114396cf042af9803d95050a95c1df
          • Opcode Fuzzy Hash: cc73a209fbb1d86de80fde7a2b0c77187a475abbbdc3a6643eb5e1da0bbe387e
          • Instruction Fuzzy Hash: 43F0FEB1500509BFEB44DBE8DC89EAB777DAB44208F044429E3069A154E774DD1C8666
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: x)m$x(m
          • API String ID: 431132790-803883669
          • Opcode ID: c40c222af3cef3d1798eaa1c7e9e192fe3a222bb35e2db62c220256c3055d6da
          • Instruction ID: 872355e054edbf02e95df63f706b4e82cfa670d8260e5db9ccf3161d7d2fb982
          • Opcode Fuzzy Hash: c40c222af3cef3d1798eaa1c7e9e192fe3a222bb35e2db62c220256c3055d6da
          • Instruction Fuzzy Hash: F1118B7160461AEFDB14CF61C985B99FBB0FF45328F11821AE8545B780DB70AA05CBD0
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: x)m$x(m
          • API String ID: 431132790-803883669
          • Opcode ID: 9236cc60a1c7cd2e406d08320238cdefb526b1449f2c878ab9b802b281a81682
          • Instruction ID: 00a2536dea69f294bb723be1ac4baeae1234fc6f7fdf047e8a7ba8c2008ce101
          • Opcode Fuzzy Hash: 9236cc60a1c7cd2e406d08320238cdefb526b1449f2c878ab9b802b281a81682
          • Instruction Fuzzy Hash: 4F118B7160461AEFDB14CF61C985B99FBB0FF45328F11821AE4585B780DB30AA05CF90
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: 8)m$x(m
          • API String ID: 431132790-4188164986
          • Opcode ID: 249d1fb9d53230fb3c214f37153fba27d212476122e46195aaf8280daa58cff9
          • Instruction ID: 2baaa89462981a42dd05d9476e0b6517db3230aa994e4a8563c955074f47766c
          • Opcode Fuzzy Hash: 249d1fb9d53230fb3c214f37153fba27d212476122e46195aaf8280daa58cff9
          • Instruction Fuzzy Hash: D811797160466AAFD714CF65C985B9EFBB0FF45318F10821AE9155B680C771AA05CB90
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: 8)m$x(m
          • API String ID: 431132790-4188164986
          • Opcode ID: e473844339ed0910ff9ebda6e266bdd34ff966acb129bb1fd93b18a4bd1bbef7
          • Instruction ID: 2d077a84cc8c89a9f8713eeca0c9b86ea7a0d8ce54c6c2bd5089191f50f28366
          • Opcode Fuzzy Hash: e473844339ed0910ff9ebda6e266bdd34ff966acb129bb1fd93b18a4bd1bbef7
          • Instruction Fuzzy Hash: CF118B7160462EAFD714CF65C985B9EFBB0FF45328F10821AE9545F780C771AA05CB90
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3
          • String ID: x(m$x(m
          • API String ID: 431132790-2163222530
          • Opcode ID: ec28c5076fd2b65f38ede9f7ae3cfefc2e2d237dfcb67c0d6eabdff1b7b63ae2
          • Instruction ID: 322a4f357c697325c0f713c3140e5c4277f2bf1ba016b8783c9ea334df9a6329
          • Opcode Fuzzy Hash: ec28c5076fd2b65f38ede9f7ae3cfefc2e2d237dfcb67c0d6eabdff1b7b63ae2
          • Instruction Fuzzy Hash: C3118B7150461AAFDB10CF52CA85B99FBB0FF49324F10821DE4545BB80CB70AA45CB91
          APIs
          • __EH_prolog3.LIBCMT ref: 6D00EA2B
            • Part of subcall function 6D0038A0: memset.VCRUNTIME140(?,?,?), ref: 6D0038C9
          • ?_Winerror_message@std@@YAKKPADK@Z.MSVCP140(?,?,00007FFF,?,?,?,00007FFF,00000000,00000004), ref: 6D00EA6E
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3Winerror_message@std@@memset
          • String ID: unknown error
          • API String ID: 49990987-3078798498
          • Opcode ID: b0ce4941dab464801a35e4cd7cac28c0de53664836e9cbcc99c191c5d9cb9d3c
          • Instruction ID: 6c01f679a9fd53ddc305f11349e70a5d5a06a0c95ee19667d34e995bea754950
          • Opcode Fuzzy Hash: b0ce4941dab464801a35e4cd7cac28c0de53664836e9cbcc99c191c5d9cb9d3c
          • Instruction Fuzzy Hash: 980181B0A45315ABFB209F998C40A5EBAF8BF45B04F41052EE5449B340C7B49E4587A1
          APIs
            • Part of subcall function 028432AE: __getptd.LIBCMT ref: 028432B4
            • Part of subcall function 028432AE: __getptd.LIBCMT ref: 028432C4
          • __getptd.LIBCMT ref: 028437D8
            • Part of subcall function 0283990F: __getptd_noexit.LIBCMT ref: 02839912
            • Part of subcall function 0283990F: __amsg_exit.LIBCMT ref: 0283991F
          • __getptd.LIBCMT ref: 028437E6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3770308641.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
          • Associated: 00000002.00000002.3770251926.0000000002830000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770367539.0000000002845000.00000002.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770419071.0000000002849000.00000004.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770467312.000000000284F000.00000020.00001000.00020000.00000000.sdmpDownload File
          • Associated: 00000002.00000002.3770524844.0000000002851000.00000002.00001000.00020000.00000000.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_2830000_loaddll32.jbxd
          Similarity
          • API ID: __getptd$__amsg_exit__getptd_noexit
          • String ID: csm
          • API String ID: 803148776-1018135373
          • Opcode ID: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
          • Instruction ID: 20c39548d716feca33beed300a80b8c9ad115d269ea681270f8934ebaca77449
          • Opcode Fuzzy Hash: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
          • Instruction Fuzzy Hash: 7B01283E80124D8BCF35AF2AC4406ACB3B6AF04212F7445AED898D6660CF75A681CE52
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF3972
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: IScript_adapter$IScript_adapter
          • API String ID: 2490025381-2155091468
          • Opcode ID: 5d23d73850df4f85e0c4d9ff425991ad8e1f0030b2ac68aff75cb65a5655a4db
          • Instruction ID: a8f61d3648387ab52b836fa32b2974f3e165567dbf4f054bf4daa5fc08241fa0
          • Opcode Fuzzy Hash: 5d23d73850df4f85e0c4d9ff425991ad8e1f0030b2ac68aff75cb65a5655a4db
          • Instruction Fuzzy Hash: A7F06DB5C4428DEFCB10CFA8C8816EDBBB4BB0A214F64112EC215BB295D7B4464ADB65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF2DF6
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: ITrack_mgr$ITrack_mgr
          • API String ID: 2490025381-376113704
          • Opcode ID: 8d885880da32d788378c7a2076d572c8584d3f6a10504562ca918aacafef4236
          • Instruction ID: 9865e0b88e1514c4ca9fce9231ba00eea8007abd93f56b8ff0d97c6f01fe4241
          • Opcode Fuzzy Hash: 8d885880da32d788378c7a2076d572c8584d3f6a10504562ca918aacafef4236
          • Instruction Fuzzy Hash: 92F06D7094134D9FCB00DFA8D8916EDBBB0EB06314F60012DC2117B2D6D7B04B8ADB66
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF2E6A
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: ITpf_ui$ITpf_ui
          • API String ID: 2490025381-4268338667
          • Opcode ID: 87c8a53ff4e6e5e9ff2ed0a31ed3b31d4add26f5c39653f8d4e3be1ff832bd27
          • Instruction ID: 97a5525ecd6074bf3ba07363da0197c13c8111cac35f8cd6bf0eaba6d36368b7
          • Opcode Fuzzy Hash: 87c8a53ff4e6e5e9ff2ed0a31ed3b31d4add26f5c39653f8d4e3be1ff832bd27
          • Instruction Fuzzy Hash: AAF04971C443499BCB00DFE8D8816EDBAB0AB0A214F64012EC211AB6D6D7704A8A9B65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF2FD4
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: ERROR$ERROR
          • API String ID: 2490025381-2579291623
          • Opcode ID: 6ca1b81fbbab7e12ccb8194c55307c3516c3e393edcf6fab9f0e531ba840b833
          • Instruction ID: f46ae402cb6536944fc7deaeda46914e8121543d76648115c41ef0796585b0fc
          • Opcode Fuzzy Hash: 6ca1b81fbbab7e12ccb8194c55307c3516c3e393edcf6fab9f0e531ba840b833
          • Instruction Fuzzy Hash: 4EF06DB1881289DBCB00DFE4C8806EDBFB0BB06314F64012EC2217B295DBB446899B65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF2F64
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: DEBUG$DEBUG
          • API String ID: 2490025381-3630546843
          • Opcode ID: 165e84123e5a247d6fa18d5d51bffc30a013d10f5b6ae14fdf5c3c11fbcd691b
          • Instruction ID: 0db3123858eaa9ac7a93f2e658e0678f621ac8240de7d5d1514f8c18e0ed6fac
          • Opcode Fuzzy Hash: 165e84123e5a247d6fa18d5d51bffc30a013d10f5b6ae14fdf5c3c11fbcd691b
          • Instruction Fuzzy Hash: 6AF06D71C45349DBCB10DFE9C8816EDBEB4FB0A314FA0002DE211AB295D7744689EB65
          APIs
          • ?get_log_instance@base@@YAPAVILogger@1@XZ.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69 ref: 6D03A2F2
            • Part of subcall function 6D00A5EF: __EH_prolog3.LIBCMT ref: 6D00A5F6
            • Part of subcall function 6D00E945: __EH_prolog3_catch_GS.LIBCMT ref: 6D00E94C
          Strings
          • [cfg_file_model]get_full_cfg_path failed, xrefs: 6D03A32A
          • d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp, xrefs: 6D03A313
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: ?get_log_instance@base@@H_prolog3H_prolog3_catch_Logger@1@
          • String ID: [cfg_file_model]get_full_cfg_path failed$d:\ci_dev\wegame_client\codes\common\src\cfg_file_model.cpp
          • API String ID: 750329627-4001581206
          • Opcode ID: 307573e3bb8d84833d5b8b010fa76d83e7507b922f69bcd0ed0d1345bf8f6c0a
          • Instruction ID: ea81f87c53e31c7a60caf2cc62da8a55f1e47544b96042f8e9c94df8d636ade5
          • Opcode Fuzzy Hash: 307573e3bb8d84833d5b8b010fa76d83e7507b922f69bcd0ed0d1345bf8f6c0a
          • Instruction Fuzzy Hash: 0FF0EC30A49712B7FB68D555CC10F6D33105B55708F224084E2447F2C1EF65DE06C785
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF38FE
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: ITrack_mgr$ITrack_mgr
          • API String ID: 2490025381-376113704
          • Opcode ID: f29bd978430cd7b12b4e21a1f900350b9b555ab38ab2470bb360f1f8e9befe91
          • Instruction ID: 1eeacb9551f972581dc46178cc8b63367be52e1e1a988110737a1a0c20fe0444
          • Opcode Fuzzy Hash: f29bd978430cd7b12b4e21a1f900350b9b555ab38ab2470bb360f1f8e9befe91
          • Instruction Fuzzy Hash: 08F06D7094630DDBCB00DFA4D4816EDFBB0FB0A314F54052EC2116B2D9DB74464A9B95
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF3885
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: ILogin_mgr$ILogin_mgr
          • API String ID: 2490025381-4078649343
          • Opcode ID: 0a9fe6021000a055527dbd586e34ed8507bd64dc22caa450a8297748d98e2a96
          • Instruction ID: f1f13221d421ca7f1e7e831676334d3c2623a5eeb4be9aa1beabc6be4e44c28e
          • Opcode Fuzzy Hash: 0a9fe6021000a055527dbd586e34ed8507bd64dc22caa450a8297748d98e2a96
          • Instruction Fuzzy Hash: 5CF06DB09453499FCB00DFE4C8916EDBA70FB4A314F54002DC2116B295D7B0464ADBA1
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF39F0
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: IDevVersion$IDevVersion
          • API String ID: 2490025381-4082145070
          • Opcode ID: 15ceec6b9ac55ead2b7d19dfa259be9c4211102eb3986756dda9627cb1c0e425
          • Instruction ID: 62b10645c178fb8868c144d1861d8dd50fd4207108b2d64f2cf527d99f6d782f
          • Opcode Fuzzy Hash: 15ceec6b9ac55ead2b7d19dfa259be9c4211102eb3986756dda9627cb1c0e425
          • Instruction Fuzzy Hash: B4F06D7094120A9FCF14DFA488816EDBE70BB06324F60007DC1117B295DB71464ADB65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF3A64
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: IDevVersion$IDevVersion
          • API String ID: 2490025381-4082145070
          • Opcode ID: 8af8cfbd7018f8db9fe48cae35348c6e91bdac84119596ae5da7543515a523fe
          • Instruction ID: f6ff7b520827ea6746e18f004d3c8093012a773491afb31c94476968d1c319ed
          • Opcode Fuzzy Hash: 8af8cfbd7018f8db9fe48cae35348c6e91bdac84119596ae5da7543515a523fe
          • Instruction Fuzzy Hash: C1F06D71C4530D9FCB00DFA8C8816EDBB74BB06314F60102DC2117B295D774464ADB61
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF3BBD
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: ILogin_mgr$ILogin_mgr
          • API String ID: 2490025381-4078649343
          • Opcode ID: 2003073e8f5d238171b137e34c01695142658d176173e44be183177da86bc984
          • Instruction ID: 83454d37205ce749141973d1629acd33f6a61808ca61e34559ee8c5155bff429
          • Opcode Fuzzy Hash: 2003073e8f5d238171b137e34c01695142658d176173e44be183177da86bc984
          • Instruction Fuzzy Hash: 8BF0497198520D9BCB10DFA4C581AEDFAB0BB0A324F50002DC2116A2D5D7B6464A9B65
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6CFF3B14
            • Part of subcall function 6CFFA8F0: memmove.VCRUNTIME140(?,?,6D005839,?,?,00000000,?,?,6D005839,?,?), ref: 6CFFA917
            • Part of subcall function 6D113AA0: __onexit.LIBCMT ref: 6D113AA6
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: H_prolog3___onexitmemmove
          • String ID: ITpf_ui$ITpf_ui
          • API String ID: 2490025381-4268338667
          • Opcode ID: e746edfe9d76a88d3e2dbaa448648fbdc65a0e6728499b69dc757c846bcd98a4
          • Instruction ID: ac080ddf781718710dcecb1c73dd49daa28229e81c7857ec6b588a25a6213061
          • Opcode Fuzzy Hash: e746edfe9d76a88d3e2dbaa448648fbdc65a0e6728499b69dc757c846bcd98a4
          • Instruction Fuzzy Hash: 4DF06DB1845309DFCB14DFE9C8816EDBB70AB0A224FA0102DC211BB295D770464AEB66
          APIs
          • __EH_prolog3_GS.LIBCMT ref: 6D0AA4F8
          • SHCreateDirectoryExW.SHELL32(00000000,00000008,00000000,0000010C,6D039E81,?,?,?,0000018C,6D03A607,?,?,?,?,00000000,00000200), ref: 6D0AA50F
          Strings
          • create_directory_ex fail, error code:%1%, path:%2%, xrefs: 6D0AA52E
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: CreateDirectoryH_prolog3_
          • String ID: create_directory_ex fail, error code:%1%, path:%2%
          • API String ID: 286309480-262898821
          • Opcode ID: 80022d02ace7b205cb5a92dccf2a4fed0d57e9c557315ab379745ffe0f3744fe
          • Instruction ID: 6cac3df6d86805fb65b5f8b485d8912c364de5d9476ff0ecae20d28d55651e92
          • Opcode Fuzzy Hash: 80022d02ace7b205cb5a92dccf2a4fed0d57e9c557315ab379745ffe0f3744fe
          • Instruction Fuzzy Hash: 2DE0D8304081459AE7305B718C09FBF7664EB86B00F004068E52497584CB7085858A72
          APIs
          • ?GetStringCharacters@common@ierd_tgp@@YAIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?), ref: 6D09BC73
            • Part of subcall function 6D09BC9C: __EH_prolog3_GS.LIBCMT ref: 6D09BCA3
            • Part of subcall function 6D09BC9C: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,0000001C,6D09BC78,?), ref: 6D09BCCB
          • ?CutStringByMaxCharacters@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?), ref: 6D09BC84
            • Part of subcall function 6D09BBE1: __EH_prolog3_GS.LIBCMT ref: 6D09BBE8
            • Part of subcall function 6D09BBE1: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000001C), ref: 6D09BC10
            • Part of subcall function 6D09BBE1: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.492C3445EDDADC4B2C411A6EB79813339A0B3FC6D2D69(?,?,?,?,?,?,?,0000001C), ref: 6D09BC54
            • Part of subcall function 6CFFF830: memmove.VCRUNTIME140(?,?,00000005,?,?,00000000,?,6D005847,\log\,00000005,?,?), ref: 6CFFF860
          Strings
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?u8to16@common@ierd_tgp@@Characters@common@ierd_tgp@@H_prolog3_StringW@2@@4@@$?u16to8@common@ierd_tgp@@D@2@@4@@D@2@@std@@@W@2@@std@@memmove
          • String ID: ...
          • API String ID: 844522834-440645147
          • Opcode ID: 39f63da28a05cfda32722c9bd1013438a6673846037453850213c1133c368b0e
          • Instruction ID: 235f58ecb57fdf7c3945fe82463ca56d60a3ebed5b49a4cc9ef0781e7abb28a7
          • Opcode Fuzzy Hash: 39f63da28a05cfda32722c9bd1013438a6673846037453850213c1133c368b0e
          • Instruction Fuzzy Hash: ACD0173204820CBBEB055E50E891A9D3BA5AB00374F208015FA0C0E1A0CF72A692E684
          APIs
          • memset.VCRUNTIME140(00000000,?,?,?,00000003,?,?,?,?), ref: 6D007D3F
          • memset.VCRUNTIME140(00000000,?,?,?,?,?,00000004,?,00000003,?,?,?,?), ref: 6D007D6F
          • memset.VCRUNTIME140(00000000,?,00000000,6D00833F,?,00000000,00000003,00000003,?,?,?,?,6D00833F,00000000,?,00000005), ref: 6D007DDE
          Memory Dump Source
          • Source File: 00000002.00000002.3771037059.000000006CFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CFF0000, based on PE: true
          • Associated: 00000002.00000002.3771008137.000000006CFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771424855.000000006D28D000.00000002.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771583744.000000006D371000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771623525.000000006D372000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771650657.000000006D374000.00000008.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771679330.000000006D388000.00000004.00000001.01000000.00000004.sdmpDownload File
          • Associated: 00000002.00000002.3771700114.000000006D390000.00000002.00000001.01000000.00000004.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_2_2_6cff0000_loaddll32.jbxd
          Similarity
          • API ID: memset
          • String ID:
          • API String ID: 2221118986-0
          • Opcode ID: fb5b9a745ffc88bbbc09174edaaf0543e3d36ac75af149cd69badec622e6d475
          • Instruction ID: 06854e1302f44cfa1a824ac2d375c040d2b22d4a6bb42cc39666e76aede53c02
          • Opcode Fuzzy Hash: fb5b9a745ffc88bbbc09174edaaf0543e3d36ac75af149cd69badec622e6d475
          • Instruction Fuzzy Hash: 0E514C71E05259BFEB15CF68CC94EBF77B8AF89204B054069FA45A7301E634EE14CBA1