Edit tour

Windows Analysis Report
T858989498.exe

Overview

General Information

Sample name:T858989498.exe
Analysis ID:1670595
MD5:2e32380eecb399e8f85cf30e8a4f6ba7
SHA1:6217ece3cf61036c583b632555b5b26c4a275ac8
SHA256:24cdb0aaafbf6e551f5ef4b0d12a3bfe3edb4ba9e66a3bce4d23db2e55c82d7b
Tags:exeuser-NatrXN1O1
Infos:

Detection

Score:64
Range:0 - 100
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Allocates memory in foreign processes
Found API chain indicative of debugger detection
Injects a PE file into a foreign processes
Writes to foreign memory regions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • T858989498.exe (PID: 7560 cmdline: "C:\Users\user\Desktop\T858989498.exe" MD5: 2E32380EECB399E8F85CF30E8A4F6BA7)
    • dfrgui.exe (PID: 2420 cmdline: C:\windows\syswow64\dfrgui.exe MD5: 1167953AFDD83E704CE79B8814E54D69)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: T858989498.exeVirustotal: Detection: 45%Perma Link
Source: T858989498.exeReversingLabs: Detection: 52%
Source: T858989498.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: global trafficTCP traffic: 192.168.2.4:49723 -> 5.42.221.140:7455
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: unknownTCP traffic detected without corresponding DNS query: 5.42.221.140
Source: T858989498.exe, 00000000.00000000.1264240108.0000000000E7C000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameVertexSystems< vs T858989498.exe
Source: T858989498.exe, 00000000.00000000.1264157945.0000000000401000.00000020.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilename vs T858989498.exe
Source: T858989498.exeBinary or memory string: OriginalFilename vs T858989498.exe
Source: T858989498.exeBinary or memory string: OriginalFilenameVertexSystems< vs T858989498.exe
Source: T858989498.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engineClassification label: mal64.evad.winEXE@3/0@0/1
Source: C:\Users\user\Desktop\T858989498.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\T858989498.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: T858989498.exeVirustotal: Detection: 45%
Source: T858989498.exeReversingLabs: Detection: 52%
Source: unknownProcess created: C:\Users\user\Desktop\T858989498.exe "C:\Users\user\Desktop\T858989498.exe"
Source: C:\Users\user\Desktop\T858989498.exeProcess created: C:\Windows\SysWOW64\dfrgui.exe C:\windows\syswow64\dfrgui.exe
Source: C:\Users\user\Desktop\T858989498.exeProcess created: C:\Windows\SysWOW64\dfrgui.exe C:\windows\syswow64\dfrgui.exeJump to behavior
Source: C:\Users\user\Desktop\T858989498.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\T858989498.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\T858989498.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeSection loaded: mswsock.dllJump to behavior
Source: T858989498.exeStatic file information: File size 21199360 > 1048576
Source: T858989498.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x13bf800
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_1477ABC0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,9_2_1477ABC0
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_131955A9 push ecx; ret 9_2_131955BC
Source: C:\Users\user\Desktop\T858989498.exeWindow / User API: threadDelayed 5012Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_9-6854
Source: C:\Windows\SysWOW64\dfrgui.exeAPI coverage: 3.9 %
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 4860Thread sleep count: 295 > 30Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 4860Thread sleep time: -17700000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 4860Thread sleep count: 75 > 30Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 6036Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 4860Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\T858989498.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\dfrgui.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\dfrgui.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\dfrgui.exeThread delayed: delay time: 60000Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeThread delayed: delay time: 30000Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeThread delayed: delay time: 60000Jump to behavior
Source: dfrgui.exe, 00000009.00000002.2531968113.0000000000C58000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\SysWOW64\dfrgui.exeAPI call chain: ExitProcess graph end nodegraph_9-7896

Anti Debugging

barindex
Source: C:\Windows\SysWOW64\dfrgui.exeDebugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleepgraph_9-6843
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_131A1BBF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,9_2_131A1BBF
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_1477ABC0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,9_2_1477ABC0
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_131B2105 mov eax, dword ptr fs:[00000030h]9_2_131B2105
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_131ACCC5 mov eax, dword ptr fs:[00000030h]9_2_131ACCC5
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_131A1BBF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,9_2_131A1BBF
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_13194662 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_13194662

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\Desktop\T858989498.exeMemory allocated: C:\Windows\SysWOW64\dfrgui.exe base: 13140000 protect: page execute and read and writeJump to behavior
Source: C:\Users\user\Desktop\T858989498.exeMemory written: C:\Windows\SysWOW64\dfrgui.exe base: 13140000 value starts with: 4D5AJump to behavior
Source: C:\Users\user\Desktop\T858989498.exeMemory written: C:\Windows\SysWOW64\dfrgui.exe base: 13140000Jump to behavior
Source: C:\Users\user\Desktop\T858989498.exeMemory written: C:\Windows\SysWOW64\dfrgui.exe base: 2FD7008Jump to behavior
Source: C:\Users\user\Desktop\T858989498.exeProcess created: C:\Windows\SysWOW64\dfrgui.exe C:\windows\syswow64\dfrgui.exeJump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: EnumSystemLocalesW,9_2_131B170D
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetLocaleInfoW,9_2_131BB331
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetLocaleInfoW,9_2_131BB79C
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: EnumSystemLocalesW,9_2_131BB3D8
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,9_2_131BBA97
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,9_2_131BB136
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,9_2_131BB549
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetLocaleInfoW,9_2_131BB9C8
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: EnumSystemLocalesW,9_2_131BB423
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: EnumSystemLocalesW,9_2_131BB4BE
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,9_2_131BB8C2
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: GetLocaleInfoW,9_2_131B1CC6
Source: C:\Windows\SysWOW64\dfrgui.exeCode function: 9_2_13181AF4 GetSystemTimeAsFileTime,9_2_13181AF4
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Native API
1
DLL Side-Loading
311
Process Injection
111
Virtualization/Sandbox Evasion
OS Credential Dumping1
System Time Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading
311
Process Injection
LSASS Memory111
Security Software Discovery
Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading
Security Account Manager111
Virtualization/Sandbox Evasion
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information
NTDS1
Application Window Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets12
System Information Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1670595 Sample: T858989498.exe Startdate: 21/04/2025 Architecture: WINDOWS Score: 64 15 Multi AV Scanner detection for submitted file 2->15 6 T858989498.exe 2->6         started        process3 signatures4 17 Writes to foreign memory regions 6->17 19 Allocates memory in foreign processes 6->19 21 Injects a PE file into a foreign processes 6->21 9 dfrgui.exe 1 6->9         started        process5 dnsIp6 13 5.42.221.140, 7455 MIDYAIQ Iraq 9->13 23 Found API chain indicative of debugger detection 9->23 signatures7

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
T858989498.exe46%VirustotalBrowse
T858989498.exe53%ReversingLabsWin32.Trojan.Strictor
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
5.42.221.140
unknownIraq
198802MIDYAIQfalse
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1670595
Start date and time:2025-04-21 22:41:11 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:11
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:T858989498.exe
Detection:MAL
Classification:mal64.evad.winEXE@3/0@0/1
EGA Information:
  • Successful, ratio: 100%
HCA Information:Failed
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.29.183.29, 131.253.33.254, 4.245.163.56
  • Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
TimeTypeDescription
16:42:18API Interceptor25x Sleep call for process: T858989498.exe modified
16:43:48API Interceptor300x Sleep call for process: dfrgui.exe modified
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
5.42.221.140Comunicado_Importante_#8140.exeGet hashmaliciousUnknownBrowse
    Comunicado_Importante_#8140.exeGet hashmaliciousUnknownBrowse
      No context
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      MIDYAIQComunicado_Importante_#8140.exeGet hashmaliciousUnknownBrowse
      • 5.42.221.140
      Comunicado_Importante_#8140.exeGet hashmaliciousUnknownBrowse
      • 5.42.221.140
      http://id1223.adsalliance.xyzGet hashmaliciousUnknownBrowse
      • 5.42.206.66
      https://advertising-cdn.com/Get hashmaliciousUnknownBrowse
      • 5.42.199.45
      Inv_7272023_from637606_583358.jsGet hashmaliciousUnknownBrowse
      • 5.42.199.51
      Inv_7272023_from637606_583358.jsGet hashmaliciousUnknownBrowse
      • 5.42.199.51
      Inv_7272023_from716517_596629.jsGet hashmaliciousUnknownBrowse
      • 5.42.199.51
      Inv_7272023_from857222_403234.jsGet hashmaliciousUnknownBrowse
      • 5.42.199.51
      Inv_7272023_from716517_596629.jsGet hashmaliciousUnknownBrowse
      • 5.42.199.51
      Inv_7272023_from857222_403234.jsGet hashmaliciousUnknownBrowse
      • 5.42.199.51
      No context
      No context
      No created / dropped files found
      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):6.1619146188962945
      TrID:
      • Win32 Executable (generic) a (10002005/4) 98.18%
      • Inno Setup installer (109748/4) 1.08%
      • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
      • UPX compressed Win32 Executable (30571/9) 0.30%
      • Generic Win/DOS Executable (2004/3) 0.02%
      File name:T858989498.exe
      File size:21'199'360 bytes
      MD5:2e32380eecb399e8f85cf30e8a4f6ba7
      SHA1:6217ece3cf61036c583b632555b5b26c4a275ac8
      SHA256:24cdb0aaafbf6e551f5ef4b0d12a3bfe3edb4ba9e66a3bce4d23db2e55c82d7b
      SHA512:56fd4b87a52606ffa7682825c9dce62835211dcfc78953b4797302a7b6a930444c5c8f66c0ff04b25f01165652c4f46194f6ab1ecec516fd3e3ef5931ff7f17b
      SSDEEP:49152:9l/orA4rWaOVruZFMCVHcX47nEnfvvWKKkn80BLwZkQAuTXqj9RNI7BL4rxddHus:9l/Ebc
      TLSH:D7273311BFF54D7AC5BC5238B8BF5F0C1B706E504818D5EB23D4A88F662BB82581B2E5
      File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................
      Icon Hash:1cfac2d2c2d2c2d8
      Entrypoint:0x46a884
      Entrypoint Section:.itext
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
      DLL Characteristics:
      Time Stamp:0x6805CA8E [Mon Apr 21 04:33:18 2025 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:38d37983c9eb8f477e3a62c02cbb3400
      Instruction
      push ebp
      mov ebp, esp
      add esp, FFFFFFF0h
      push ebx
      push esi
      push edi
      mov eax, 00469130h
      call 00007FAB88C191DEh
      xor eax, eax
      push ebp
      push 0046A9DBh
      push dword ptr fs:[eax]
      mov dword ptr fs:[eax], esp
      push 00000000h
      push 00000064h
      call 00007FAB88C7B837h
      xor ecx, ecx
      mov dl, 01h
      mov eax, dword ptr [0044A1C8h]
      call 00007FAB88C5F931h
      mov edx, 0046A9F4h
      call 00007FAB88C4AD7Bh
      xor eax, eax
      push ebp
      push 0046A8F8h
      push dword ptr fs:[eax]
      mov dword ptr fs:[eax], esp
      mov eax, dword ptr [00476894h]
      call 00007FAB88C653F3h
      mov dl, 01h
      mov eax, dword ptr [00476890h]
      mov si, FFB4h
      call 00007FAB88C16443h
      xor eax, eax
      pop edx
      pop ecx
      pop ecx
      mov dword ptr fs:[eax], edx
      jmp 00007FAB88C7D0FCh
      jmp 00007FAB88C16700h
      call 00007FAB88C16B0Bh
      mov eax, dword ptr [0046F6ECh]
      mov byte ptr [eax], 00000000h
      xor eax, eax
      push ebp
      push 0046A936h
      push dword ptr fs:[eax]
      mov dword ptr fs:[eax], esp
      mov eax, dword ptr [00476894h]
      call 00007FAB88C653AFh
      mov eax, dword ptr [00476890h]
      call 00007FAB88C4E655h
      xor eax, eax
      pop edx
      pop ecx
      pop ecx
      mov dword ptr fs:[eax], edx
      jmp 00007FAB88C7D101h
      jmp 00007FAB88C166C2h
      call 00007FAB88C713E1h
      call 00007FAB88C16AC8h
      call 00007FAB88C7B72Bh
      mov eax, 00000088h
      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x770000x2672.idata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x840000x13bf800.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x7c0000x7604.reloc
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x7b0000x18.rdata
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x7774c0x5f8.idata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x684600x6860061fc3f2021f6c6819621ddb855d7aadaFalse0.5166541916167665data6.548853032018104IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      .itext0x6a0000xa1c0xc001aff11072ee38892948217a08b02b3bcFalse0.5276692708333334data5.714325025286978IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      .data0x6b0000x49340x4a00b2df5a6f7255dc9c857c45ab86b5bf2bFalse0.5140413851351351data5.16112904051681IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      .bss0x700000x68a00x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      .idata0x770000x26720x2800885bef561476cb5b81f17a607e786c5dFalse0.3099609375data5.080213932432005IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      .tls0x7a0000x3c0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      .rdata0x7b0000x180x200459a4935b407f13c11734f71f14d8bfaFalse0.05078125data0.2108262677871819IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .reloc0x7c0000x76040x78007167033f69dbb419bdac4d28d56fdd7dFalse0.6189778645833334data6.635938913782678IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      .rsrc0x840000x13bf8000x13bf8005bde8bd0a8224a3991c9d86c8b6ebbb8unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      NameRVASizeTypeLanguageCountryZLIB Complexity
      RTYUI0x84c200x13862acASCII text, with very long lines (65536), with no line terminatorsEnglishUnited States0.7574520111083984
      UNICODEDATA0x140aecc0x723fdata0.36769583205115053
      UNICODEDATA0x141210c0x7ebddata0.42552011095700415
      UNICODEDATA0x1419fcc0x6a8data0.5985915492957746
      UNICODEDATA0x141a6740xaf7ddata0.4191430161380078
      UNICODEDATA0x14255f40xd3cfdata0.4500857569666009
      UNICODEDATA0x14329c40x14c5data0.6482979123565921
      RT_CURSOR0x1433e8c0x134Targa image data - Map 64 x 65536 x 1 +32 "\001"EnglishUnited States0.38636363636363635
      RT_CURSOR0x1433fc00x134dataEnglishUnited States0.4642857142857143
      RT_CURSOR0x14340f40x134dataEnglishUnited States0.4805194805194805
      RT_CURSOR0x14342280x134dataEnglishUnited States0.38311688311688313
      RT_CURSOR0x143435c0x134dataEnglishUnited States0.36038961038961037
      RT_CURSOR0x14344900x134dataEnglishUnited States0.4090909090909091
      RT_CURSOR0x14345c40x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"EnglishUnited States0.4967532467532468
      RT_ICON0x14346f80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 168960.1050425129900803
      RT_ICON0x14389200x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 96000.12105809128630705
      RT_ICON0x143aec80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 42240.15877110694183866
      RT_ICON0x143bf700x988Device independent bitmap graphic, 24 x 48 x 32, image size 24000.20573770491803278
      RT_ICON0x143c8f80x468Device independent bitmap graphic, 16 x 32 x 32, image size 10880.2730496453900709
      RT_STRING0x143cd600x1ccdata0.4608695652173913
      RT_STRING0x143cf2c0x798data0.15637860082304528
      RT_STRING0x143d6c40x85cdata0.14626168224299066
      RT_STRING0x143df200x888data0.1446886446886447
      RT_STRING0x143e7a80x7b4data0.16835699797160245
      RT_STRING0x143ef5c0x920data0.12585616438356165
      RT_STRING0x143f87c0x9fcdata0.128716744913928
      RT_STRING0x14402780x58cdata0.2795774647887324
      RT_STRING0x14408040x268data0.37662337662337664
      RT_STRING0x1440a6c0x204data0.38953488372093026
      RT_STRING0x1440c700x114data0.5833333333333334
      RT_STRING0x1440d840x118data0.5857142857142857
      RT_STRING0x1440e9c0x174data0.5268817204301075
      RT_STRING0x14410100x2e8data0.46639784946236557
      RT_STRING0x14412f80xc0data0.6770833333333334
      RT_STRING0x14413b80x258data0.48833333333333334
      RT_STRING0x14416100x3d8data0.3851626016260163
      RT_STRING0x14419e80x37cdata0.41816143497757846
      RT_STRING0x1441d640x418data0.36736641221374045
      RT_STRING0x144217c0x140data0.515625
      RT_STRING0x14422bc0xccdata0.6127450980392157
      RT_STRING0x14423880x1ecdata0.5345528455284553
      RT_STRING0x14425740x3b0data0.326271186440678
      RT_STRING0x14429240x354data0.4107981220657277
      RT_STRING0x1442c780x2a4data0.4363905325443787
      RT_RCDATA0x1442f1c0x10data1.5
      RT_RCDATA0x1442f2c0x4b0data0.6575
      RT_GROUP_CURSOR0x14433dc0x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
      RT_GROUP_CURSOR0x14433f00x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
      RT_GROUP_CURSOR0x14434040x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
      RT_GROUP_CURSOR0x14434180x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
      RT_GROUP_CURSOR0x144342c0x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
      RT_GROUP_CURSOR0x14434400x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
      RT_GROUP_CURSOR0x14434540x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
      RT_GROUP_ICON0x14434680x4cdata0.8026315789473685
      RT_VERSION0x14434b40x31cdata0.4158291457286432
      DLLImport
      oleaut32.dllSysFreeString, SysReAllocStringLen, SysAllocStringLen
      advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey
      user32.dllGetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
      kernel32.dllGetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
      kernel32.dllTlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
      user32.dllCreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
      gdi32.dllUnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
      version.dllVerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
      kernel32.dlllstrcpyA, WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringW, CompareStringA, CloseHandle
      advapi32.dllRegQueryValueExW, RegQueryValueExA, RegOpenKeyExW, RegOpenKeyExA, RegFlushKey, RegCloseKey
      kernel32.dllSleep
      oleaut32.dllGetErrorInfo, SysFreeString
      ole32.dllCoUninitialize, CoInitialize
      oleaut32.dllSafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
      comctl32.dll_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
      kernel32.dllGetVersionExA
      DescriptionData
      CompanyNameAGLResources
      FileDescriptionVertexSystems
      FileVersion7.8.9.8
      InternalNameVertexSystems
      LegalCopyrightVertexSystems
      LegalTrademarksVertexSystems
      OriginalFilenameVertexSystems
      ProductNameVertexSystems
      ProductVersion7.8.9.8
      Comments
      Translation0x100a 0x04e4
      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States

      Download Network PCAP: filteredfull

      TimestampSource PortDest PortSource IPDest IP
      Apr 21, 2025 22:43:48.685729980 CEST497237455192.168.2.45.42.221.140
      Apr 21, 2025 22:43:49.697673082 CEST497237455192.168.2.45.42.221.140
      Apr 21, 2025 22:43:51.714415073 CEST497237455192.168.2.45.42.221.140
      Apr 21, 2025 22:43:55.713313103 CEST497237455192.168.2.45.42.221.140
      Apr 21, 2025 22:44:03.728981018 CEST497237455192.168.2.45.42.221.140
      Apr 21, 2025 22:44:09.838978052 CEST497247455192.168.2.45.42.221.140
      Apr 21, 2025 22:44:10.854100943 CEST497247455192.168.2.45.42.221.140
      Apr 21, 2025 22:44:12.869651079 CEST497247455192.168.2.45.42.221.140
      Apr 21, 2025 22:44:16.895538092 CEST497247455192.168.2.45.42.221.140
      Apr 21, 2025 22:44:24.900875092 CEST497247455192.168.2.45.42.221.140
      050100s020406080100

      Click to jump to process

      050100s0.00204060MB

      Click to jump to process

      • File
      • Registry
      • Network

      Click to dive into process behavior distribution

      Click to jump to process

      Target ID:0
      Start time:16:42:17
      Start date:21/04/2025
      Path:C:\Users\user\Desktop\T858989498.exe
      Wow64 process (32bit):true
      Commandline:"C:\Users\user\Desktop\T858989498.exe"
      Imagebase:0x400000
      File size:21'199'360 bytes
      MD5 hash:2E32380EECB399E8F85CF30E8A4F6BA7
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Borland Delphi
      Reputation:low
      Has exited:false

      Target ID:9
      Start time:16:43:46
      Start date:21/04/2025
      Path:C:\Windows\SysWOW64\dfrgui.exe
      Wow64 process (32bit):true
      Commandline:C:\windows\syswow64\dfrgui.exe
      Imagebase:0xda0000
      File size:97'280 bytes
      MD5 hash:1167953AFDD83E704CE79B8814E54D69
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:moderate
      Has exited:false

      Execution Graph

      Execution Coverage

      Dynamic/Packed Code Coverage

      Signature Coverage

      Execution Coverage:2.5%
      Dynamic/Decrypted Code Coverage:7.4%
      Signature Coverage:6.9%
      Total number of Nodes:1128
      Total number of Limit Nodes:3
      Show Legend
      Hide Nodes/Edges
      execution_graph 7897 131c0d1c 7898 13194643 _ValidateLocalCookies 5 API calls 7897->7898 7899 131c0d2f 7898->7899 7903 131bb79c 7904 131bb7bc std::_Locinfo::_Locinfo_ctor 7903->7904 7905 131bb7cf GetLocaleInfoW 7904->7905 7906 131bb7ff 7905->7906 7910 131bb7fa 7905->7910 7915 131b7439 7906->7915 7908 13194643 _ValidateLocalCookies 5 API calls 7909 131bb86d 7908->7909 7910->7908 7911 131bb80e 7911->7910 7912 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 7911->7912 7914 131bb817 7911->7914 7912->7914 7914->7910 7920 131bb9c8 7914->7920 7917 131b7447 7915->7917 7919 131b744d __cftoe 7917->7919 7924 131b7482 7917->7924 7918 131b747d 7918->7911 7919->7911 7921 131b14ae 7920->7921 7922 131bb9d5 GetLocaleInfoW 7921->7922 7923 131bb9fe std::_Locinfo::_Locinfo_ctor 7922->7923 7923->7910 7923->7923 7925 131b74ac 7924->7925 7927 131b7492 __cftoe std::_Locinfo::_Locinfo_ctor 7924->7927 7926 131a0a16 __fassign 36 API calls 7925->7926 7925->7927 7928 131b74d6 7926->7928 7927->7918 7928->7927 7929 131b73fa 36 API calls std::_Locinfo::_Locinfo_ctor 7928->7929 7929->7928 7935 131c0c15 7936 13194643 _ValidateLocalCookies 5 API calls 7935->7936 7937 131c0c28 7936->7937 7938 13194643 _ValidateLocalCookies 5 API calls 7937->7938 7939 131c0c32 7938->7939 7956 131bb549 7957 131bb569 std::_Locinfo::_Locinfo_ctor 7956->7957 7958 131bb57c GetLocaleInfoW 7957->7958 7959 131bb5b2 7958->7959 7978 131bb6df 7958->7978 7960 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 7959->7960 7961 131bb5c1 7960->7961 7963 131bb5cb GetLocaleInfoW 7961->7963 7977 131bb60c std::_Locinfo::_Locinfo_ctor 7961->7977 7962 13194643 _ValidateLocalCookies 5 API calls 7964 131bb798 7962->7964 7965 131bb5f5 7963->7965 7963->7978 7967 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 7965->7967 7966 131bb691 GetLocaleInfoW 7968 131bb6bb 7966->7968 7966->7978 7972 131bb604 7967->7972 7969 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 7968->7969 7970 131bb6ca 7969->7970 7971 131bb73a 7970->7971 7975 131bb6d0 7970->7975 7974 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 7971->7974 7971->7978 7972->7977 7981 131bca01 7972->7981 7976 131bb755 7974->7976 7975->7975 7975->7978 7980 131bb9c8 GetLocaleInfoW 7975->7980 7976->7978 7979 131bb9c8 GetLocaleInfoW 7976->7979 7977->7966 7977->7978 7978->7962 7979->7978 7980->7978 7982 131bca0f 7981->7982 7985 131bca15 __cftoe 7982->7985 7986 131bca4d 7982->7986 7984 131bca48 7984->7977 7985->7977 7987 131bca77 7986->7987 7989 131bca5d __cftoe __fassign 7986->7989 7988 131a0a16 __fassign 36 API calls 7987->7988 7987->7989 7991 131bcab0 7988->7991 7989->7984 7990 131b73fa 36 API calls std::_Locinfo::_Locinfo_ctor 7990->7991 7991->7989 7991->7990 7998 131baec7 7999 131baee6 7998->7999 8010 131b1cc6 7999->8010 8002 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 8005 131baf24 std::_Locinfo::_Locinfo_ctor 8002->8005 8003 13194643 _ValidateLocalCookies 5 API calls 8004 131baf77 8003->8004 8006 131baf7b 8005->8006 8007 131baf0f 8005->8007 8008 131a1d98 __Getctype 11 API calls 8006->8008 8007->8003 8009 131baf85 8008->8009 8011 131b1820 std::_Lockit::_Lockit 5 API calls 8010->8011 8012 131b1cd1 8011->8012 8015 131b1ce0 8012->8015 8016 131b1ea5 8012->8016 8014 131b1cf9 GetLocaleInfoW 8014->8015 8015->8002 8015->8007 8019 131b18bc 8016->8019 8018 131b1eb0 __fassign 8018->8014 8020 131b199d std::_Lockit::_Lockit 5 API calls 8019->8020 8021 131b18d2 8020->8021 8021->8018 6647 13149630 6653 13149662 std::ios_base::_Ios_base_dtor __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 6647->6653 6650 131497fe 6724 131a1d7b 6650->6724 6652 13149721 6654 131a1d7b 11 API calls 6652->6654 6664 1314974b std::ios_base::_Ios_base_dtor 6652->6664 6653->6650 6656 131496f6 6653->6656 6679 13154210 6653->6679 6712 1317e38f 6653->6712 6715 13153a20 6653->6715 6658 13149808 std::locale::_Setgloballocale 6654->6658 6657 13154210 13 API calls 6656->6657 6657->6652 6728 1314ea30 6658->6728 6661 13149885 6665 13154210 13 API calls 6661->6665 6662 1314990c 6742 13150230 6662->6742 6666 131498a7 6665->6666 6738 1314e980 6666->6738 6671 13149953 6761 131419e0 6671->6761 6674 131498d9 std::ios_base::_Ios_base_dtor 6767 13194643 6674->6767 6677 1314e980 64 API calls 6677->6674 6678 131499f7 6680 131542e0 6679->6680 6681 1315422f 6679->6681 6784 131419d0 6680->6784 6682 1315423b std::_Locinfo::_Locinfo_ctor 6681->6682 6684 13154263 6681->6684 6687 131542a7 6681->6687 6688 1315429e 6681->6688 6682->6653 6774 1319485f 6684->6774 6685 131542e5 6787 13141900 6685->6787 6691 1319485f std::_Facet_Register 2 API calls 6687->6691 6693 1315427f std::_Locinfo::_Locinfo_ctor 6687->6693 6688->6684 6688->6685 6690 13154276 6692 131a1d7b 11 API calls 6690->6692 6690->6693 6691->6693 6695 131542ef std::ios_base::_Ios_base_dtor 6692->6695 6693->6653 6694 13154347 6694->6653 6695->6694 6696 131a1d7b 11 API calls 6695->6696 6697 13154350 6696->6697 6698 13154385 6697->6698 6699 1315448d 6697->6699 6702 131543e6 6698->6702 6703 131543f3 6698->6703 6705 1315439a 6698->6705 6700 131419d0 7 API calls 6699->6700 6701 13154492 6700->6701 6704 13141900 Concurrency::cancel_current_task 2 API calls 6701->6704 6702->6701 6702->6705 6707 1319485f std::_Facet_Register 2 API calls 6703->6707 6710 131543aa std::_Locinfo::_Locinfo_ctor 6703->6710 6704->6710 6706 1319485f std::_Facet_Register 2 API calls 6705->6706 6706->6710 6707->6710 6708 131a1d7b 11 API calls 6709 1315449c 6708->6709 6710->6708 6711 1315444f std::ios_base::_Ios_base_dtor std::_Locinfo::_Locinfo_ctor 6710->6711 6711->6653 6824 13181af4 6712->6824 6827 13142d10 6715->6827 6717 131559b0 9 API calls 6718 13153aaf 6717->6718 6718->6653 6719 13153a37 6720 13153a96 6719->6720 6721 13153a7a 6719->6721 6720->6717 6832 131559b0 6721->6832 6725 131a1d8a 6724->6725 6856 131a1d98 IsProcessorFeaturePresent 6725->6856 6727 131a1d97 6729 1314ea6d 6728->6729 6866 13152e00 6729->6866 6736 13149871 6736->6661 6736->6662 6737 13142bb0 69 API calls 6737->6736 6739 1314e9b2 6738->6739 6740 13151c30 64 API calls 6739->6740 6741 1314e9dd std::ios_base::_Ios_base_dtor 6739->6741 6740->6741 6741->6674 6743 13150270 6742->6743 7731 13152bc0 6743->7731 6745 1314991b 6746 13151c30 6745->6746 6747 13151c3f 6746->6747 6751 13149926 6746->6751 7760 13151a50 6747->7760 6749 13151c67 6750 131a0805 64 API calls 6749->6750 6750->6751 6751->6671 6752 13142bb0 6751->6752 6753 13142bd2 6752->6753 6754 13142bca 6752->6754 6753->6671 6755 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 6754->6755 6756 13142be2 6754->6756 6755->6756 7817 13142ad0 6756->7817 6758 13142c18 6759 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 6758->6759 6760 13142c27 6759->6760 6760->6671 6762 13141a09 6761->6762 7870 13155070 6762->7870 6764 13141a47 6765 13194643 _ValidateLocalCookies 5 API calls 6764->6765 6766 13141a55 6765->6766 6766->6677 6768 1319464b 6767->6768 6769 1319464c IsProcessorFeaturePresent 6767->6769 6768->6678 6771 1319469f 6769->6771 7888 13194662 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 6771->7888 6773 13194782 6773->6678 6777 13194864 6774->6777 6776 1319487e 6776->6690 6777->6776 6779 13141900 Concurrency::cancel_current_task 6777->6779 6800 131a2de3 6777->6800 6778 1319488a 6778->6778 6779->6778 6793 1319616b 6779->6793 6781 1314191c 6796 13195dfd 6781->6796 6783 13141943 6783->6690 6804 1317e6f7 6784->6804 6788 1314190e Concurrency::cancel_current_task 6787->6788 6789 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 6788->6789 6790 1314191c 6789->6790 6791 13195dfd ___std_exception_copy RtlAllocateHeap 6790->6791 6792 13141943 6791->6792 6792->6690 6794 131961b2 KiUserExceptionDispatcher 6793->6794 6795 13196185 6793->6795 6794->6781 6795->6794 6797 13195e0a 6796->6797 6799 13195e27 __freea 6796->6799 6798 131a2de3 ___std_exception_copy RtlAllocateHeap 6797->6798 6797->6799 6798->6799 6799->6783 6803 131b10a6 6800->6803 6801 131b10cf RtlAllocateHeap 6802 131b10e2 6801->6802 6801->6803 6802->6777 6803->6801 6803->6802 6813 1317e619 6804->6813 6807 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 6808 1317e716 6807->6808 6816 1317e66e 6808->6816 6811 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 6812 1317e736 6811->6812 6819 13141800 6813->6819 6817 13141800 std::invalid_argument::invalid_argument 6 API calls 6816->6817 6818 1317e680 6817->6818 6818->6811 6820 13195dfd ___std_exception_copy RtlAllocateHeap 6819->6820 6821 13141837 6820->6821 6822 13194643 _ValidateLocalCookies 5 API calls 6821->6822 6823 13141847 6822->6823 6823->6807 6825 13181b11 GetSystemTimeAsFileTime 6824->6825 6826 1317e39d 6824->6826 6825->6826 6826->6653 6840 1317e312 6827->6840 6831 13142d2f __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 6831->6719 6834 131559c8 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 6832->6834 6833 13142d10 2 API calls 6833->6834 6834->6833 6835 13155a77 6834->6835 6838 1317e38f __Xtime_get_ticks GetSystemTimeAsFileTime 6834->6838 6844 1318149a 6834->6844 6836 13194643 _ValidateLocalCookies 5 API calls 6835->6836 6837 13153a8f 6836->6837 6837->6653 6838->6834 6841 1317e32c QueryPerformanceFrequency 6840->6841 6842 13142d23 6840->6842 6841->6842 6843 1317e2fb QueryPerformanceCounter 6842->6843 6843->6831 6852 1317e3b6 6844->6852 6846 131814c5 Sleep 6847 1317e3b6 __Thrd_sleep GetSystemTimeAsFileTime 6846->6847 6848 131814b9 __Xtime_diff_to_millis2 6847->6848 6848->6846 6849 131814fe 6848->6849 6850 13194643 _ValidateLocalCookies 5 API calls 6849->6850 6851 13181509 6850->6851 6851->6834 6853 1317e3c2 6852->6853 6855 1317e3cf __aulldiv __aullrem 6852->6855 6854 1317e38f __Xtime_get_ticks GetSystemTimeAsFileTime 6853->6854 6853->6855 6854->6855 6855->6848 6857 131a1da4 6856->6857 6860 131a1bbf 6857->6860 6861 131a1bdb std::locale::_Setgloballocale 6860->6861 6862 131a1c07 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6861->6862 6863 131a1cd8 std::locale::_Setgloballocale 6862->6863 6864 13194643 _ValidateLocalCookies 5 API calls 6863->6864 6865 131a1cf6 GetCurrentProcess TerminateProcess 6864->6865 6865->6727 6867 13142bb0 69 API calls 6866->6867 6868 13152e79 6867->6868 6869 1319485f std::_Facet_Register 2 API calls 6868->6869 6870 13152e80 6869->6870 6892 13180cdb 6870->6892 6872 13152e97 6904 131532d0 6872->6904 6874 13152f10 6877 1314eae7 6874->6877 6925 13180f54 6874->6925 6875 13152ec8 6875->6874 6876 13142bb0 69 API calls 6875->6876 6876->6874 6879 13151ea0 6877->6879 6880 1319485f std::_Facet_Register 2 API calls 6879->6880 6881 13151ee0 6880->6881 6882 13180cdb std::locale::_Init 30 API calls 6881->6882 6883 1314eb0d 6882->6883 6884 13151d20 6883->6884 6885 13151d60 6884->6885 6891 13151e57 6884->6891 7463 1318112f 6885->7463 6887 13194643 _ValidateLocalCookies 5 API calls 6888 1314eb21 6887->6888 6888->6736 6888->6737 6889 13151d69 6889->6891 7473 13153ea0 6889->7473 6891->6887 6893 13180ce7 __EH_prolog3 6892->6893 6930 1317e438 6893->6930 6898 13180d05 6942 13180e93 6898->6942 6899 13180d63 std::locale::_Init 6899->6872 6903 13180d23 6951 1317e490 6903->6951 6905 1317e438 std::_Lockit::_Lockit 7 API calls 6904->6905 6906 1315330b 6905->6906 6907 1317e438 std::_Lockit::_Lockit 7 API calls 6906->6907 6913 1315334e 6906->6913 6908 1315332e 6907->6908 6911 1317e490 std::_Lockit::~_Lockit 2 API calls 6908->6911 6909 1317e490 std::_Lockit::~_Lockit 2 API calls 6910 131533d8 6909->6910 6912 13194643 _ValidateLocalCookies 5 API calls 6910->6912 6911->6913 6914 131533f2 6912->6914 6922 13153398 6913->6922 7135 13142780 6913->7135 6914->6875 6916 131533a8 6917 131533f6 6916->6917 6918 131533b0 6916->6918 7158 13142050 6917->7158 7155 13180ca9 6918->7155 6922->6909 6924 1315340f 6924->6875 6926 1317e438 std::_Lockit::_Lockit 7 API calls 6925->6926 6927 13180f64 6926->6927 6928 1317e490 std::_Lockit::~_Lockit 2 API calls 6927->6928 6929 13180fa2 6928->6929 6929->6877 6931 1317e447 6930->6931 6932 1317e44e 6930->6932 6958 131a6464 6931->6958 6934 1317e44c 6932->6934 6963 13181b3d RtlEnterCriticalSection 6932->6963 6934->6903 6936 13180e70 6934->6936 6937 1319485f std::_Facet_Register 2 API calls 6936->6937 6939 13180e7b 6937->6939 6938 13180e8f 6938->6898 6939->6938 7028 13180bc3 6939->7028 6943 13180e9f 6942->6943 6945 13180d0d 6942->6945 7031 13181bc1 6943->7031 6946 13150800 6945->6946 6947 1315085c 6946->6947 6948 13150810 __freea 6946->6948 6947->6903 6948->6947 6949 131a2de3 ___std_exception_copy RtlAllocateHeap 6948->6949 6950 1315083f std::_Locinfo::_Locinfo_ctor 6949->6950 6950->6903 6952 131a6472 6951->6952 6954 1317e49a 6951->6954 7134 131a644d RtlLeaveCriticalSection 6952->7134 6955 1317e4ad 6954->6955 7133 13181b4b RtlLeaveCriticalSection 6954->7133 6955->6899 6956 131a6479 6956->6899 6964 131b1f4a 6958->6964 6963->6934 6985 131b17b8 6964->6985 6984 131b1f7c 6984->6984 7015 131b199d 6985->7015 6987 131b17ce 6988 131b17d2 6987->6988 6989 131b199d std::_Lockit::_Lockit 5 API calls 6988->6989 6990 131b17e8 6989->6990 6991 131b17ec 6990->6991 6992 131b199d std::_Lockit::_Lockit 5 API calls 6991->6992 6993 131b1802 6992->6993 6994 131b1806 6993->6994 6995 131b199d std::_Lockit::_Lockit 5 API calls 6994->6995 6996 131b181c 6995->6996 6997 131b1820 6996->6997 6998 131b199d std::_Lockit::_Lockit 5 API calls 6997->6998 6999 131b1836 6998->6999 7000 131b183a 6999->7000 7001 131b199d std::_Lockit::_Lockit 5 API calls 7000->7001 7002 131b1850 7001->7002 7003 131b1854 7002->7003 7004 131b199d std::_Lockit::_Lockit 5 API calls 7003->7004 7005 131b186a 7004->7005 7006 131b186e 7005->7006 7007 131b199d std::_Lockit::_Lockit 5 API calls 7006->7007 7008 131b1884 7007->7008 7009 131b18a2 7008->7009 7010 131b199d std::_Lockit::_Lockit 5 API calls 7009->7010 7011 131b18b8 7010->7011 7012 131b1888 7011->7012 7013 131b199d std::_Lockit::_Lockit 5 API calls 7012->7013 7014 131b189e 7013->7014 7014->6984 7016 131b19cb 7015->7016 7020 131b19c7 std::_Lockit::_Lockit 7015->7020 7016->7020 7021 131b18d6 7016->7021 7019 131b19e5 GetProcAddress 7019->7020 7020->6987 7024 131b18e7 ___vcrt_FlsGetValue 7021->7024 7022 131b1992 7022->7019 7022->7020 7023 131b1905 LoadLibraryExW 7023->7024 7025 131b1920 GetLastError 7023->7025 7024->7022 7024->7023 7026 131b197b FreeLibrary 7024->7026 7027 131b1953 LoadLibraryExW 7024->7027 7025->7024 7026->7024 7027->7024 7029 13150800 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap 7028->7029 7030 13180bfd 7029->7030 7030->6898 7032 13181bd1 RtlEncodePointer 7031->7032 7033 131a3126 7031->7033 7032->6945 7044 131b3be8 7033->7044 7036 131a3136 7038 131a315f 7036->7038 7039 131a3140 IsProcessorFeaturePresent 7036->7039 7059 131acdca 7038->7059 7040 131a314c 7039->7040 7042 131a1bbf std::locale::_Setgloballocale 8 API calls 7040->7042 7042->7038 7062 131b3b1a 7044->7062 7047 131b3c2d 7048 131b3c39 std::_Locinfo::_Locinfo_ctor std::locale::_Setgloballocale 7047->7048 7049 131b3cd9 7048->7049 7058 131b3c97 __cftoe 7048->7058 7073 131a6405 RtlEnterCriticalSection 7048->7073 7052 131b3e0c 7049->7052 7057 131b3d1b 7049->7057 7053 131b3e17 7052->7053 7078 131a644d RtlLeaveCriticalSection 7052->7078 7055 131acdca std::locale::_Setgloballocale 16 API calls 7053->7055 7056 131b3e1f 7055->7056 7056->7036 7074 131b3db9 7057->7074 7058->7036 7080 131acc61 7059->7080 7063 131b3b26 std::_Locinfo::_Locinfo_ctor 7062->7063 7068 131a6405 RtlEnterCriticalSection 7063->7068 7065 131b3b34 7069 131b3b72 7065->7069 7068->7065 7072 131a644d RtlLeaveCriticalSection 7069->7072 7071 131a312b 7071->7036 7071->7047 7072->7071 7073->7049 7075 131b3dbf 7074->7075 7077 131b3dc6 7074->7077 7079 131a644d RtlLeaveCriticalSection 7075->7079 7077->7058 7078->7053 7079->7077 7081 131acc6f 7080->7081 7089 131acc80 7080->7089 7091 131acd07 GetModuleHandleW 7081->7091 7086 131a3169 7086->6945 7098 131acb27 7089->7098 7092 131acc74 7091->7092 7092->7089 7093 131acd4a GetModuleHandleExW 7092->7093 7094 131acd69 GetProcAddress 7093->7094 7095 131acd7e 7093->7095 7094->7095 7096 131acd9b 7095->7096 7097 131acd92 FreeLibrary 7095->7097 7096->7089 7097->7096 7099 131acb33 std::_Locinfo::_Locinfo_ctor 7098->7099 7114 131a6405 RtlEnterCriticalSection 7099->7114 7101 131acb3d 7115 131acb74 7101->7115 7103 131acb4a 7119 131acb68 7103->7119 7106 131accc5 7126 131b2105 GetPEB 7106->7126 7109 131accf4 7112 131acd4a std::locale::_Setgloballocale 3 API calls 7109->7112 7110 131accd4 GetPEB 7110->7109 7111 131acce4 GetCurrentProcess TerminateProcess 7110->7111 7111->7109 7113 131accfc ExitProcess 7112->7113 7114->7101 7116 131acb80 std::_Locinfo::_Locinfo_ctor 7115->7116 7118 131acbe1 std::locale::_Setgloballocale 7116->7118 7122 131ad899 7116->7122 7118->7103 7125 131a644d RtlLeaveCriticalSection 7119->7125 7121 131acb56 7121->7086 7121->7106 7123 131ad5ca std::locale::_Setgloballocale RtlEnterCriticalSection RtlLeaveCriticalSection 7122->7123 7124 131ad8c4 7123->7124 7124->7118 7125->7121 7127 131b211f 7126->7127 7129 131acccf 7126->7129 7130 131b1a20 7127->7130 7129->7109 7129->7110 7131 131b199d std::_Lockit::_Lockit 5 API calls 7130->7131 7132 131b1a3c 7131->7132 7132->7129 7133->6955 7134->6956 7136 131427c6 7135->7136 7137 1314291e 7135->7137 7136->7137 7138 1319485f std::_Facet_Register 2 API calls 7136->7138 7137->6916 7139 131427d6 7138->7139 7140 1317e438 std::_Lockit::_Lockit 7 API calls 7139->7140 7141 13142808 7140->7141 7142 13142937 7141->7142 7143 1314284a 7141->7143 7194 1317e737 7142->7194 7169 13180ddb 7143->7169 7153 13142889 __freea 7154 1317e490 std::_Lockit::~_Lockit 2 API calls 7153->7154 7154->7137 7156 1319485f std::_Facet_Register 2 API calls 7155->7156 7157 13180cb4 7156->7157 7157->6922 7159 1314205e Concurrency::cancel_current_task 7158->7159 7160 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 7159->7160 7161 1314206c 7160->7161 7162 13195dfd ___std_exception_copy RtlAllocateHeap 7161->7162 7163 13142093 7162->7163 7164 13150960 7163->7164 7165 13150970 7164->7165 7165->7165 7166 13150987 std::_Locinfo::_Locinfo_ctor 7165->7166 7448 131544a0 7165->7448 7166->6924 7168 131509c2 7168->6924 7213 131a9cc2 7169->7213 7172 13150800 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap 7173 13180dff 7172->7173 7174 131a9cc2 std::_Locinfo::_Locinfo_ctor 62 API calls 7173->7174 7175 13180e0f 7173->7175 7174->7175 7176 13150800 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap 7175->7176 7177 13142854 7176->7177 7178 1318117a 7177->7178 7309 131aa02f 7178->7309 7180 13181183 __Getctype 7181 131811bb 7180->7181 7182 1318119d 7180->7182 7184 131aa00b __Getctype 25 API calls 7181->7184 7313 131aa00b 7182->7313 7185 131811a4 7184->7185 7317 131aa079 7185->7317 7188 1314286d 7190 13180e26 7188->7190 7191 13180e32 7190->7191 7193 13180e3c 7190->7193 7192 131a9cc2 std::_Locinfo::_Locinfo_ctor 62 API calls 7191->7192 7192->7193 7193->7153 7357 13141a60 7194->7357 7197 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 7198 1317e756 7197->7198 7362 13198850 7198->7362 7200 13142941 7201 131811e5 7200->7201 7202 131811f4 7201->7202 7206 13181201 7201->7206 7203 131aa079 __Getctype 25 API calls 7202->7203 7204 131811f9 7203->7204 7205 131aa02f __Getctype 25 API calls 7204->7205 7205->7206 7207 13142961 7206->7207 7210 13181242 7206->7210 7211 1318124d 7206->7211 7384 131a49d0 7206->7384 7207->6916 7208 131aa00b __Getctype 25 API calls 7208->7211 7210->7207 7210->7208 7210->7211 7211->7207 7391 13193d00 7211->7391 7214 131b1f4a std::_Lockit::_Lockit 5 API calls 7213->7214 7215 131a9ccf 7214->7215 7218 131a9a6d 7215->7218 7219 131a9a79 std::_Locinfo::_Locinfo_ctor 7218->7219 7226 131a6405 RtlEnterCriticalSection 7219->7226 7221 131a9a87 7227 131a9ac8 7221->7227 7223 131a9a94 7239 131a9abc 7223->7239 7226->7221 7242 131a9c27 7227->7242 7229 131a9ae3 7238 131a9b2e 7229->7238 7263 131a5432 7229->7263 7231 131a9b15 7232 131a9b1c 7231->7232 7267 131b10a6 7231->7267 7234 131a1d98 __Getctype 11 API calls 7232->7234 7232->7238 7236 131a9c26 7234->7236 7235 131a9b41 7237 131a5432 std::_Locinfo::_Locinfo_ctor 37 API calls 7235->7237 7235->7238 7237->7232 7238->7223 7308 131a644d RtlLeaveCriticalSection 7239->7308 7241 13180de7 7241->7172 7243 131a9c33 7242->7243 7244 131a9c41 7242->7244 7271 131ae726 7243->7271 7280 131a5173 7244->7280 7247 131a9c3d 7247->7229 7250 131a1d98 __Getctype 11 API calls 7252 131a9cc1 7250->7252 7251 131a9c73 7253 131a5173 __cftoe 37 API calls 7251->7253 7254 131a9c9b 7251->7254 7255 131b1f4a std::_Lockit::_Lockit 5 API calls 7252->7255 7256 131a9c8a 7253->7256 7254->7229 7258 131a9ccf 7255->7258 7257 131a9c9d 7256->7257 7259 131a9c91 7256->7259 7260 131ae726 std::_Locinfo::_Locinfo_ctor 60 API calls 7257->7260 7261 131a9a6d std::_Locinfo::_Locinfo_ctor 62 API calls 7258->7261 7259->7250 7259->7254 7260->7254 7262 131a9cf8 7261->7262 7262->7229 7264 131a5449 7263->7264 7266 131a546e __cftoe 7264->7266 7287 131a5193 7264->7287 7266->7231 7269 131b10e2 7267->7269 7270 131b10b4 7267->7270 7268 131b10cf RtlAllocateHeap 7268->7269 7268->7270 7269->7235 7270->7268 7270->7269 7272 131ae750 7271->7272 7273 131ae73c __cftoe 7271->7273 7274 131b1f4a std::_Lockit::_Lockit 5 API calls 7272->7274 7273->7247 7275 131ae75d 7274->7275 7276 131ba969 __Getctype 25 API calls 7275->7276 7277 131ae762 7276->7277 7278 131add2e std::_Locinfo::_Locinfo_ctor 60 API calls 7277->7278 7279 131ae7a4 7278->7279 7279->7247 7281 131a5093 __cftoe 37 API calls 7280->7281 7282 131a518e 7281->7282 7282->7259 7283 131b2064 7282->7283 7286 131b2071 7283->7286 7284 131b209c RtlAllocateHeap 7285 131b20af 7284->7285 7284->7286 7285->7251 7286->7284 7286->7285 7288 131a519f __EH_prolog3_GS 7287->7288 7289 131a51bb __cftoe 7288->7289 7290 131a0a16 __fassign 36 API calls 7288->7290 7292 131955bd std::_Locinfo::_Locinfo_ctor 5 API calls 7289->7292 7291 131a51e9 7290->7291 7294 131a51fa 7291->7294 7295 131a5219 7291->7295 7293 131a5431 7292->7293 7293->7266 7296 131b56b8 std::_Locinfo::_Locinfo_ctor 5 API calls 7294->7296 7297 131a5221 7295->7297 7298 131a53b6 7295->7298 7296->7289 7297->7289 7300 131a52ca 7297->7300 7305 131a5269 7297->7305 7298->7289 7299 131b5601 std::_Locinfo::_Locinfo_ctor WideCharToMultiByte 7298->7299 7299->7289 7301 131b5601 std::_Locinfo::_Locinfo_ctor WideCharToMultiByte 7300->7301 7302 131a52dd 7301->7302 7302->7289 7304 131a52f8 GetLastError 7302->7304 7303 131b5601 std::_Locinfo::_Locinfo_ctor WideCharToMultiByte 7303->7289 7304->7289 7306 131a5307 7304->7306 7305->7303 7306->7289 7307 131b5601 std::_Locinfo::_Locinfo_ctor WideCharToMultiByte 7306->7307 7307->7306 7308->7241 7310 131aa03a 7309->7310 7328 131b1fe2 7310->7328 7314 131aa016 7313->7314 7315 131b1fe2 __Getctype 25 API calls 7314->7315 7316 131aa026 7315->7316 7316->7185 7318 131aa084 7317->7318 7319 131b1fe2 __Getctype 25 API calls 7318->7319 7320 131811cc 7319->7320 7320->7188 7321 131aa523 7320->7321 7322 131aa530 7321->7322 7325 131aa56b 7321->7325 7322->7322 7323 131a2de3 ___std_exception_copy RtlAllocateHeap 7322->7323 7324 131aa553 __Getctype 7323->7324 7324->7325 7326 131a1d98 __Getctype 11 API calls 7324->7326 7325->7188 7327 131aa581 7326->7327 7329 131b1ff5 7328->7329 7331 131aa04a 7328->7331 7329->7331 7332 131ba969 7329->7332 7331->7180 7333 131ba975 std::_Locinfo::_Locinfo_ctor 7332->7333 7334 131ba9c4 7333->7334 7341 131a6405 RtlEnterCriticalSection 7333->7341 7334->7331 7336 131ba99c __Getctype 7342 131ba9c9 7336->7342 7341->7336 7356 131a644d RtlLeaveCriticalSection 7342->7356 7344 131ba9c0 7344->7334 7345 131a3126 7344->7345 7346 131b3be8 std::locale::_Setgloballocale 2 API calls 7345->7346 7347 131a312b 7346->7347 7348 131a3136 7347->7348 7349 131b3c2d std::locale::_Setgloballocale 16 API calls 7347->7349 7350 131a315f 7348->7350 7351 131a3140 IsProcessorFeaturePresent 7348->7351 7349->7348 7353 131acdca std::locale::_Setgloballocale 16 API calls 7350->7353 7352 131a314c 7351->7352 7354 131a1bbf std::locale::_Setgloballocale 8 API calls 7352->7354 7355 131a3169 7353->7355 7354->7350 7356->7344 7358 13195dfd ___std_exception_copy RtlAllocateHeap 7357->7358 7359 13141a97 7358->7359 7360 13194643 _ValidateLocalCookies 5 API calls 7359->7360 7361 13141aad 7360->7361 7361->7197 7363 13198859 7362->7363 7364 1319885c GetLastError 7362->7364 7363->7200 7367 131a01cd 7364->7367 7372 131a006c 7367->7372 7370 131a01ff TlsGetValue 7371 13198871 SetLastError 7370->7371 7371->7200 7373 131a0089 7372->7373 7376 131a008d 7372->7376 7373->7370 7373->7371 7375 131a00f5 GetProcAddress 7375->7373 7376->7373 7376->7375 7377 131a00e6 7376->7377 7379 131a010c LoadLibraryExW 7376->7379 7377->7375 7378 131a00ee FreeLibrary 7377->7378 7378->7375 7380 131a0123 GetLastError 7379->7380 7381 131a0153 7379->7381 7380->7381 7382 131a012e ___vcrt_FlsGetValue 7380->7382 7381->7376 7382->7381 7383 131a0144 LoadLibraryExW 7382->7383 7383->7376 7385 131a4a01 7384->7385 7386 131a49e7 7384->7386 7387 131b1fe2 __Getctype 25 API calls 7385->7387 7386->7210 7388 131a4a16 7387->7388 7388->7386 7411 131b219f 7388->7411 7392 13193d2e MultiByteToWideChar 7391->7392 7396 13193d1a __fassign 7391->7396 7393 13193d5c 7392->7393 7395 13193e9c 7392->7395 7393->7395 7398 131a2de3 ___std_exception_copy RtlAllocateHeap 7393->7398 7399 13193d75 __fassign 7393->7399 7394 13194643 _ValidateLocalCookies 5 API calls 7397 13193eca 7394->7397 7395->7394 7396->7392 7397->7207 7398->7399 7399->7395 7400 13193da9 MultiByteToWideChar 7399->7400 7400->7395 7401 13193dc2 LCMapStringEx 7400->7401 7401->7395 7402 13193de1 7401->7402 7403 13193e1b 7402->7403 7404 13193deb 7402->7404 7403->7395 7406 131a2de3 ___std_exception_copy RtlAllocateHeap 7403->7406 7407 13193e2d __fassign 7403->7407 7404->7395 7405 13193dfe LCMapStringEx 7404->7405 7405->7395 7406->7407 7407->7395 7408 13193e5d LCMapStringEx 7407->7408 7408->7395 7409 13193e79 WideCharToMultiByte 7408->7409 7409->7395 7418 131a0a16 7411->7418 7413 131b21cc 7416 13194643 _ValidateLocalCookies 5 API calls 7413->7416 7417 131a4a43 7416->7417 7417->7210 7419 131a0a2d 7418->7419 7420 131a0a36 7418->7420 7419->7413 7424 131b72ba 7419->7424 7420->7419 7421 131b1fe2 __Getctype 25 API calls 7420->7421 7422 131a0a6c 7421->7422 7437 131b200f 7422->7437 7425 131a0a16 __fassign 35 API calls 7424->7425 7426 131b72da 7425->7426 7445 131b10f4 7426->7445 7428 13194643 _ValidateLocalCookies 5 API calls 7431 131b73bb 7428->7431 7429 131b7307 7430 131b10a6 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap 7429->7430 7432 131b7392 __freea 7429->7432 7433 131b732d __fassign std::locale::_Setgloballocale 7429->7433 7430->7433 7431->7413 7432->7428 7433->7432 7434 131b10f4 __fassign MultiByteToWideChar 7433->7434 7435 131b737b 7434->7435 7435->7432 7436 131b7382 GetStringTypeW 7435->7436 7436->7432 7438 131b2037 7437->7438 7439 131b2022 7437->7439 7438->7419 7439->7438 7441 131b8884 7439->7441 7442 131b888e 7441->7442 7443 131b879c __fassign 36 API calls 7442->7443 7444 131b8894 7443->7444 7444->7438 7447 131b1105 MultiByteToWideChar 7445->7447 7447->7429 7449 131545eb 7448->7449 7450 131544cb 7448->7450 7451 131419d0 7 API calls 7449->7451 7453 1315452c 7450->7453 7454 13154539 7450->7454 7455 131544e0 7450->7455 7452 131545f0 7451->7452 7456 13141900 Concurrency::cancel_current_task 2 API calls 7452->7456 7453->7452 7453->7455 7458 1319485f std::_Facet_Register 2 API calls 7454->7458 7461 131544f0 std::_Locinfo::_Locinfo_ctor 7454->7461 7457 1319485f std::_Facet_Register 2 API calls 7455->7457 7456->7461 7457->7461 7458->7461 7459 131a1d7b 11 API calls 7460 131545fa 7459->7460 7461->7459 7462 131545a9 std::ios_base::_Ios_base_dtor std::_Locinfo::_Locinfo_ctor 7461->7462 7462->7168 7466 13181094 7463->7466 7464 131810f7 7464->6889 7465 131810ea 7467 13181138 11 API calls 7465->7467 7472 131810f1 7465->7472 7466->7464 7466->7465 7514 13181138 7466->7514 7469 13181108 7467->7469 7469->7464 7525 131a2dc8 7469->7525 7472->7464 7517 131a0805 7472->7517 7474 1317e438 std::_Lockit::_Lockit 7 API calls 7473->7474 7475 13153edb 7474->7475 7476 1317e438 std::_Lockit::_Lockit 7 API calls 7475->7476 7480 13153f1d 7475->7480 7477 13153efd 7476->7477 7481 1317e490 std::_Lockit::~_Lockit 2 API calls 7477->7481 7478 1317e490 std::_Lockit::~_Lockit 2 API calls 7479 13153f44 7478->7479 7482 13194643 _ValidateLocalCookies 5 API calls 7479->7482 7483 13153f3c 7480->7483 7485 1319485f std::_Facet_Register 2 API calls 7480->7485 7481->7480 7484 13153f5e 7482->7484 7483->7478 7484->6891 7486 13153f90 7485->7486 7487 1317e438 std::_Lockit::_Lockit 7 API calls 7486->7487 7488 13153fbd 7487->7488 7489 13153fff 7488->7489 7490 131540da 7488->7490 7491 13180ddb std::_Locinfo::_Locinfo_ctor 63 API calls 7489->7491 7492 1317e737 15 API calls 7490->7492 7493 13154009 7491->7493 7494 131540e4 7492->7494 7495 13180e26 std::_Locinfo::_Locinfo_dtor 62 API calls 7493->7495 7496 13154115 7494->7496 7497 131541fe 7494->7497 7510 13154023 __freea 7495->7510 7500 13154172 7496->7500 7501 1315417f 7496->7501 7503 13154129 7496->7503 7498 131419d0 7 API calls 7497->7498 7499 13154203 7498->7499 7502 13141900 Concurrency::cancel_current_task 2 API calls 7499->7502 7500->7499 7500->7503 7505 1319485f std::_Facet_Register 2 API calls 7501->7505 7508 13154139 std::_Locinfo::_Locinfo_ctor 7501->7508 7502->7508 7504 1319485f std::_Facet_Register 2 API calls 7503->7504 7504->7508 7505->7508 7506 131a1d7b 11 API calls 7507 1315420d 7506->7507 7508->7506 7512 131541ce std::ios_base::_Ios_base_dtor std::_Locinfo::_Locinfo_ctor 7508->7512 7509 1317e490 std::_Lockit::~_Lockit 2 API calls 7511 131540b8 7509->7511 7510->7509 7513 13180ca9 std::_Facet_Register 2 API calls 7511->7513 7512->6891 7513->7483 7528 131aa000 7514->7528 7516 13181150 7516->7465 7518 131a0811 std::_Locinfo::_Locinfo_ctor 7517->7518 7523 131a081b __cftoe 7518->7523 7571 131a2020 RtlEnterCriticalSection 7518->7571 7520 131a084d 7572 131a078e 7520->7572 7522 131a0858 7578 131a087f 7522->7578 7523->7464 7705 131a2b6b 7525->7705 7527 131a2dde 7527->7472 7529 131a9f49 std::_Locinfo::_Locinfo_ctor 7528->7529 7533 131a9f5c __cftoe 7529->7533 7534 131b0f00 7529->7534 7531 131a9f97 7531->7533 7542 131a9fe9 7531->7542 7533->7516 7535 131b0f0c std::_Locinfo::_Locinfo_ctor 7534->7535 7546 131a6405 RtlEnterCriticalSection 7535->7546 7537 131b0f1a 7547 131b0fa4 7537->7547 7543 131a9fed 7542->7543 7570 131a2034 RtlLeaveCriticalSection 7543->7570 7545 131a9ffe 7545->7533 7546->7537 7551 131b0fc7 7547->7551 7548 131b101f 7549 131b2064 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap 7548->7549 7552 131b1028 7549->7552 7551->7548 7551->7551 7557 131b0f27 7551->7557 7561 131a2020 RtlEnterCriticalSection 7551->7561 7562 131a2034 RtlLeaveCriticalSection 7551->7562 7552->7557 7563 131b1d86 7552->7563 7558 131b0f60 7557->7558 7569 131a644d RtlLeaveCriticalSection 7558->7569 7560 131b0f4b 7560->7531 7561->7551 7562->7551 7564 131b199d std::_Lockit::_Lockit 5 API calls 7563->7564 7565 131b1da2 7564->7565 7566 131b1dc0 InitializeCriticalSectionAndSpinCount 7565->7566 7567 131b1050 7565->7567 7566->7567 7568 131a2020 RtlEnterCriticalSection 7567->7568 7568->7557 7569->7560 7570->7545 7571->7520 7573 131a07b0 7572->7573 7577 131a079b __cftoe 7572->7577 7573->7577 7581 131a0683 7573->7581 7575 131a07c5 7585 131b0dd7 7575->7585 7577->7522 7704 131a2034 RtlLeaveCriticalSection 7578->7704 7580 131a0887 7580->7523 7582 131a069b 7581->7582 7584 131a06c0 7581->7584 7582->7584 7589 131b0a45 7582->7589 7584->7575 7586 131b0dfd 7585->7586 7588 131b0de8 __cftoe __dosmaperr 7585->7588 7586->7588 7680 131b0d4b 7586->7680 7588->7577 7590 131b0a51 std::_Locinfo::_Locinfo_ctor 7589->7590 7596 131b0a59 __cftoe __dosmaperr 7590->7596 7597 131b96cd RtlEnterCriticalSection 7590->7597 7592 131b0aa9 7594 131b0ac5 __dosmaperr 7592->7594 7598 131b0b37 7592->7598 7621 131b0b04 7594->7621 7596->7584 7597->7592 7599 131b0b59 7598->7599 7620 131b0b5d __cftoe __dosmaperr 7598->7620 7600 131b0bc3 7599->7600 7599->7620 7624 131b387d 7599->7624 7627 131b06de 7600->7627 7604 131b0c0a 7606 131b0c1e 7604->7606 7607 131b0c64 WriteFile 7604->7607 7605 131b0bd1 7608 131b0bf7 7605->7608 7609 131b0bd5 7605->7609 7612 131b0c26 7606->7612 7613 131b0c54 7606->7613 7610 131b0c87 GetLastError 7607->7610 7607->7620 7636 131b02ca GetConsoleOutputCP 7608->7636 7609->7620 7631 131b0676 7609->7631 7610->7620 7614 131b0c2b 7612->7614 7615 131b0c44 7612->7615 7664 131b074f 7613->7664 7614->7620 7649 131b082a 7614->7649 7656 131b0913 7615->7656 7620->7594 7679 131b9782 RtlLeaveCriticalSection 7621->7679 7623 131b0b0a 7623->7596 7671 131b37e6 7624->7671 7626 131b3893 7626->7600 7628 131b06ef 7627->7628 7629 131b072c GetConsoleMode 7628->7629 7630 131b0745 7628->7630 7629->7630 7630->7604 7630->7605 7634 131b06cd 7631->7634 7635 131b0698 7631->7635 7632 131bc206 CreateFileW CloseHandle WriteConsoleW GetLastError WriteConsoleW 7632->7635 7633 131b06cf GetLastError 7633->7634 7634->7620 7635->7632 7635->7633 7635->7634 7637 131a0a16 __fassign 36 API calls 7636->7637 7639 131b0326 std::_Locinfo::_Locinfo_ctor 7637->7639 7638 131b05cc 7640 13194643 _ValidateLocalCookies 5 API calls 7638->7640 7639->7638 7641 131aa00b __Getctype 25 API calls 7639->7641 7643 131b41f3 36 API calls __fassign 7639->7643 7644 131b5506 5 API calls __cftoe 7639->7644 7646 131b054f WriteFile 7639->7646 7648 131b0587 WriteFile 7639->7648 7676 131b5601 7639->7676 7642 131b0674 7640->7642 7641->7639 7642->7620 7643->7639 7644->7639 7646->7639 7647 131b0644 GetLastError 7646->7647 7647->7638 7648->7639 7648->7647 7653 131b0839 7649->7653 7650 131b08f8 7652 13194643 _ValidateLocalCookies 5 API calls 7650->7652 7651 131b08ae WriteFile 7651->7653 7654 131b08fa GetLastError 7651->7654 7655 131b0911 7652->7655 7653->7650 7653->7651 7654->7650 7655->7620 7663 131b0922 7656->7663 7657 131b0a2a 7658 13194643 _ValidateLocalCookies 5 API calls 7657->7658 7659 131b0a43 7658->7659 7659->7620 7660 131b5601 std::_Locinfo::_Locinfo_ctor WideCharToMultiByte 7660->7663 7661 131b0a2c GetLastError 7661->7657 7662 131b09e1 WriteFile 7662->7661 7662->7663 7663->7657 7663->7660 7663->7661 7663->7662 7665 131b075e 7664->7665 7668 131b07ce WriteFile 7665->7668 7670 131b080f 7665->7670 7666 13194643 _ValidateLocalCookies 5 API calls 7667 131b0828 7666->7667 7667->7620 7668->7665 7669 131b0811 GetLastError 7668->7669 7669->7670 7670->7666 7672 131b37f8 7671->7672 7673 131b3811 SetFilePointerEx 7672->7673 7675 131b3800 __dosmaperr 7672->7675 7674 131b3829 GetLastError 7673->7674 7673->7675 7674->7675 7675->7626 7678 131b5618 WideCharToMultiByte 7676->7678 7678->7639 7679->7623 7681 131b0d57 std::_Locinfo::_Locinfo_ctor 7680->7681 7688 131b96cd RtlEnterCriticalSection 7681->7688 7683 131b0d65 7685 131b0d92 7683->7685 7689 131b0e64 7683->7689 7696 131b0dcb 7685->7696 7688->7683 7691 131b0e74 7689->7691 7690 131b0e7a 7699 131b98b8 7690->7699 7691->7690 7693 131b0eb8 CloseHandle 7691->7693 7693->7690 7694 131b0ec4 GetLastError 7693->7694 7694->7690 7695 131b0ed2 __dosmaperr 7695->7685 7703 131b9782 RtlLeaveCriticalSection 7696->7703 7698 131b0db4 7698->7588 7700 131b991e __dosmaperr 7699->7700 7702 131b98c7 7699->7702 7700->7695 7701 131b9918 SetStdHandle 7701->7700 7702->7700 7702->7701 7703->7698 7704->7580 7706 131a2b77 std::_Locinfo::_Locinfo_ctor 7705->7706 7712 131a2b7d __cftoe 7706->7712 7713 131a2020 RtlEnterCriticalSection 7706->7713 7708 131a2baf 7714 131a2ccf 7708->7714 7710 131a2bc3 7723 131a2bec 7710->7723 7712->7527 7713->7708 7715 131a2cf2 7714->7715 7716 131a2ce2 7714->7716 7726 131a2bf6 7715->7726 7716->7710 7718 131a2d98 7718->7710 7719 131a2d15 7719->7718 7720 131a0683 59 API calls 7719->7720 7721 131a2d3c 7720->7721 7722 131b387d 2 API calls 7721->7722 7722->7718 7730 131a2034 RtlLeaveCriticalSection 7723->7730 7725 131a2bf4 7725->7712 7727 131a2c07 7726->7727 7728 131a2c5f 7726->7728 7727->7728 7729 131b387d 2 API calls 7727->7729 7728->7719 7729->7728 7730->7725 7732 13152c2d 7731->7732 7733 13152bfe 7731->7733 7738 13152c39 7732->7738 7742 13152a00 7732->7742 7734 13142bb0 69 API calls 7733->7734 7735 13152c17 7734->7735 7735->6745 7737 13152d06 7737->6745 7738->7737 7739 131532d0 80 API calls 7738->7739 7740 13152c76 7739->7740 7740->7737 7741 13142bb0 69 API calls 7740->7741 7741->7737 7743 13152a44 7742->7743 7744 13152aef 7742->7744 7752 131516a0 7743->7752 7746 13194643 _ValidateLocalCookies 5 API calls 7744->7746 7747 13152b22 7746->7747 7747->7738 7749 13152ad7 7749->7744 7756 13152b30 7749->7756 7750 13142bb0 69 API calls 7750->7749 7754 131516dc 7752->7754 7753 131516f7 7753->7749 7753->7750 7754->7753 7755 13152a00 69 API calls 7754->7755 7755->7753 7757 13152b99 7756->7757 7758 13152b6e 7756->7758 7757->7744 7758->7757 7759 13142bb0 69 API calls 7758->7759 7759->7757 7761 13151a6d 7760->7761 7762 13151b0a 7760->7762 7761->7762 7767 13151a77 7761->7767 7763 13194643 _ValidateLocalCookies 5 API calls 7762->7763 7764 13151b17 7763->7764 7764->6749 7765 13151af8 7766 13194643 _ValidateLocalCookies 5 API calls 7765->7766 7768 13151b06 7766->7768 7767->7765 7769 13151ac0 7767->7769 7770 13151aa6 7767->7770 7768->6749 7772 13151ae1 7769->7772 7779 131a2267 7769->7779 7770->7765 7771 13151aab 7770->7771 7773 13194643 _ValidateLocalCookies 5 API calls 7771->7773 7775 13194643 _ValidateLocalCookies 5 API calls 7772->7775 7776 13151abc 7773->7776 7778 13151af4 7775->7778 7776->6749 7777 13151ada 7777->7765 7777->7772 7778->6749 7780 131a2275 7779->7780 7782 131a2282 __cftoe 7779->7782 7780->7782 7784 131a2048 7780->7784 7782->7777 7785 131a2054 std::_Locinfo::_Locinfo_ctor 7784->7785 7792 131a2020 RtlEnterCriticalSection 7785->7792 7787 131a2062 7793 131a20a3 7787->7793 7792->7787 7803 131b2512 7793->7803 7795 131a20b7 7807 131a20e6 7795->7807 7797 131a20d2 7812 131b25be 7797->7812 7800 131a2097 7816 131a2034 RtlLeaveCriticalSection 7800->7816 7802 131a2080 7802->7777 7804 131b2523 7803->7804 7805 131b10a6 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap 7804->7805 7806 131b257d 7804->7806 7805->7806 7806->7795 7808 131a2106 __cftoe 7807->7808 7810 131a20f8 std::_Locinfo::_Locinfo_ctor 7807->7810 7808->7797 7809 131a0683 59 API calls 7809->7810 7810->7808 7810->7809 7811 131b0a45 59 API calls 7810->7811 7811->7810 7813 131b25c9 7812->7813 7815 131a206f 7812->7815 7814 131a0683 59 API calls 7813->7814 7813->7815 7814->7815 7815->7800 7816->7802 7818 13142b28 7817->7818 7818->7818 7819 13154210 13 API calls 7818->7819 7820 13142b3c 7819->7820 7833 13141c70 7820->7833 7822 13142b76 std::ios_base::_Ios_base_dtor 7822->6758 7823 13142b50 7823->7822 7824 131a1d7b 11 API calls 7823->7824 7826 13142ba1 7824->7826 7825 13142bd2 7825->6758 7826->7825 7827 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 7826->7827 7828 13142be2 7826->7828 7827->7828 7829 13142ad0 69 API calls 7828->7829 7830 13142c18 7829->7830 7831 1319616b Concurrency::cancel_current_task KiUserExceptionDispatcher 7830->7831 7832 13142c27 7831->7832 7832->6758 7851 13150ae0 7833->7851 7835 13141cc2 7836 13141ce8 7835->7836 7837 131544a0 13 API calls 7835->7837 7838 131544a0 13 API calls 7836->7838 7839 13141d51 std::_Locinfo::_Locinfo_ctor 7836->7839 7837->7836 7838->7839 7840 13141db0 std::ios_base::_Ios_base_dtor 7839->7840 7842 13141e7b 7839->7842 7841 13195dfd ___std_exception_copy RtlAllocateHeap 7840->7841 7843 13141e0e 7841->7843 7844 131a1d7b 11 API calls 7842->7844 7845 13141e3d std::ios_base::_Ios_base_dtor 7843->7845 7846 13141e80 7843->7846 7844->7846 7847 13194643 _ValidateLocalCookies 5 API calls 7845->7847 7849 131a1d7b 11 API calls 7846->7849 7848 13141e72 7847->7848 7848->7823 7850 13141e85 std::ios_base::_Ios_base_dtor ___std_exception_destroy 7849->7850 7850->7823 7852 13150b0a 7851->7852 7853 13150b1e 7852->7853 7854 13150bc9 7852->7854 7855 13150b2a std::_Locinfo::_Locinfo_ctor 7853->7855 7857 13150b51 7853->7857 7859 13150b95 7853->7859 7860 13150b8c 7853->7860 7856 131419d0 7 API calls 7854->7856 7855->7835 7858 13150bce 7856->7858 7862 1319485f std::_Facet_Register 2 API calls 7857->7862 7861 13141900 Concurrency::cancel_current_task 2 API calls 7858->7861 7865 1319485f std::_Facet_Register 2 API calls 7859->7865 7868 13150b6d std::_Locinfo::_Locinfo_ctor 7859->7868 7860->7857 7860->7858 7863 13150b64 7861->7863 7862->7863 7864 131a1d7b 11 API calls 7863->7864 7863->7868 7866 13150bd8 7864->7866 7865->7868 7867 1314e980 64 API calls 7866->7867 7869 13150c2b std::ios_base::_Ios_base_dtor 7867->7869 7868->7835 7869->7835 7871 131550ac 7870->7871 7872 1315509b 7870->7872 7873 13155173 7871->7873 7877 131550ba 7871->7877 7872->6764 7875 131419d0 7 API calls 7873->7875 7874 131550c6 std::_Locinfo::_Locinfo_ctor 7874->6764 7876 13155178 7875->7876 7878 13141900 Concurrency::cancel_current_task 2 API calls 7876->7878 7877->7874 7879 13155117 7877->7879 7882 13155138 7877->7882 7886 13155124 7878->7886 7879->7876 7880 1315511e 7879->7880 7883 1319485f std::_Facet_Register 2 API calls 7880->7883 7881 131a1d7b 11 API calls 7884 13155182 7881->7884 7885 1319485f std::_Facet_Register 2 API calls 7882->7885 7887 1315512d std::_Locinfo::_Locinfo_ctor 7882->7887 7883->7886 7885->7887 7886->7881 7886->7887 7887->6764 7888->6773 8031 131bb331 8032 131bb351 std::_Locinfo::_Locinfo_ctor 8031->8032 8033 131bb364 GetLocaleInfoW 8032->8033 8034 131bb394 8033->8034 8036 131bb38f std::_Locinfo::_Locinfo_ctor 8033->8036 8035 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 8034->8035 8035->8036 8037 13194643 _ValidateLocalCookies 5 API calls 8036->8037 8038 131bb3d4 8037->8038 8047 13180ef6 8048 1317e438 std::_Lockit::_Lockit 7 API calls 8047->8048 8049 13180f04 __Deletegloballocale 8048->8049 8050 1317e490 std::_Lockit::~_Lockit 2 API calls 8049->8050 8051 13180f1e 8050->8051 6644 1319616b 6645 131961b2 KiUserExceptionDispatcher 6644->6645 6646 13196185 6644->6646 6646->6645 7889 1477abc0 7890 1477abd0 7889->7890 7891 1477ad2f VirtualProtect VirtualProtect 7890->7891 7892 1477acea LoadLibraryA 7890->7892 7894 1477ad63 7891->7894 7893 1477ad01 7892->7893 7893->7890 7895 1477ad13 GetProcAddress 7893->7895 7894->7894 7895->7893 7896 1477ad29 ExitProcess 7895->7896 8057 13196f60 8058 13196f7e 8057->8058 8071 13196f20 8058->8071 8072 13196f3f 8071->8072 8073 13196f32 8071->8073 8074 13194643 _ValidateLocalCookies 5 API calls 8073->8074 8074->8072 8078 131babe7 8079 131bac06 8078->8079 8080 131b1cc6 std::_Locinfo::_Locinfo_ctor 6 API calls 8079->8080 8081 131bac2b 8080->8081 8082 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 8081->8082 8089 131bac2f 8081->8089 8084 131bac48 8082->8084 8083 13194643 _ValidateLocalCookies 5 API calls 8085 131baeb6 8083->8085 8086 131b1cc6 std::_Locinfo::_Locinfo_ctor 6 API calls 8084->8086 8098 131bac9f std::_Locinfo::_Locinfo_ctor 8084->8098 8087 131bac7b 8086->8087 8087->8089 8091 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 8087->8091 8088 131b1cc6 std::_Locinfo::_Locinfo_ctor 6 API calls 8090 131bad4c 8088->8090 8089->8083 8090->8089 8092 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 8090->8092 8095 131bac96 8091->8095 8096 131bad94 8092->8096 8093 131badaf std::_Locinfo::_Locinfo_ctor 8093->8089 8100 131baeba 8093->8100 8094 131bacda 8094->8098 8114 131bb07c 8094->8114 8095->8094 8097 131bca01 36 API calls 8095->8097 8095->8098 8096->8089 8096->8093 8102 131bb07c 11 API calls 8096->8102 8097->8094 8098->8088 8098->8089 8098->8100 8101 131a1d98 __Getctype 11 API calls 8100->8101 8103 131baec6 8101->8103 8102->8093 8104 131b1cc6 std::_Locinfo::_Locinfo_ctor 6 API calls 8103->8104 8105 131baf0b 8104->8105 8106 131b7439 std::_Locinfo::_Locinfo_ctor 36 API calls 8105->8106 8111 131baf0f 8105->8111 8109 131baf24 std::_Locinfo::_Locinfo_ctor 8106->8109 8107 13194643 _ValidateLocalCookies 5 API calls 8108 131baf77 8107->8108 8110 131baf7b 8109->8110 8109->8111 8112 131a1d98 __Getctype 11 API calls 8110->8112 8111->8107 8113 131baf85 8112->8113 8115 131b1cc6 std::_Locinfo::_Locinfo_ctor 6 API calls 8114->8115 8117 131bb0a0 ___vcrt_FlsGetValue 8115->8117 8116 13194643 _ValidateLocalCookies 5 API calls 8118 131bb0c7 8116->8118 8117->8116 8118->8098

      Executed Functions

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 0 1477abc0-1477abcd 1 1477abda-1477abdf 0->1 2 1477abe1 1->2 3 1477abe3 2->3 4 1477abd0-1477abd5 2->4 6 1477abe8-1477abea 3->6 5 1477abd6-1477abd8 4->5 5->1 5->2 7 1477abf3-1477abf7 6->7 8 1477abec-1477abf1 6->8 9 1477ac04-1477ac07 7->9 10 1477abf9 7->10 8->7 11 1477ac10-1477ac12 9->11 12 1477ac09-1477ac0e 9->12 13 1477ac23-1477ac28 10->13 14 1477abfb-1477ac02 10->14 11->6 12->11 15 1477ac3b-1477ac3d 13->15 16 1477ac2a-1477ac33 13->16 14->9 14->13 19 1477ac46 15->19 20 1477ac3f-1477ac44 15->20 17 1477ac35-1477ac39 16->17 18 1477acaa-1477acad 16->18 17->19 21 1477acb2-1477acb5 18->21 22 1477ac14-1477ac16 19->22 23 1477ac48-1477ac4b 19->23 20->19 26 1477acb7-1477acb9 21->26 24 1477ac1f-1477ac21 22->24 25 1477ac18-1477ac1d 22->25 27 1477ac54 23->27 28 1477ac4d-1477ac52 23->28 29 1477ac75-1477ac84 24->29 25->24 26->21 30 1477acbb-1477acbe 26->30 27->22 31 1477ac56-1477ac58 27->31 28->27 34 1477ac86-1477ac8d 29->34 35 1477ac94-1477aca1 29->35 30->21 36 1477acc0-1477acdc 30->36 32 1477ac61-1477ac65 31->32 33 1477ac5a-1477ac5f 31->33 32->31 37 1477ac67 32->37 33->32 34->34 38 1477ac8f 34->38 35->35 39 1477aca3-1477aca5 35->39 36->26 40 1477acde 36->40 42 1477ac72 37->42 43 1477ac69-1477ac70 37->43 38->5 39->5 41 1477ace4-1477ace8 40->41 44 1477ad2f-1477ad5f VirtualProtect * 2 41->44 45 1477acea-1477ad00 LoadLibraryA 41->45 42->29 43->31 43->42 47 1477ad63-1477ad67 44->47 46 1477ad01-1477ad06 45->46 46->41 48 1477ad08-1477ad0a 46->48 47->47 49 1477ad69 47->49 50 1477ad13-1477ad20 GetProcAddress 48->50 51 1477ad0c-1477ad12 48->51 52 1477ad22-1477ad27 50->52 53 1477ad29 ExitProcess 50->53 51->50 52->46
      APIs
      • LoadLibraryA.KERNEL32(?), ref: 1477ACFA
      • GetProcAddress.KERNEL32(?,14778FF9), ref: 1477AD18
      • ExitProcess.KERNEL32(?,14778FF9), ref: 1477AD29
      • VirtualProtect.KERNELBASE(13140000,00001000,00000004,?,A8B91237), ref: 1477AD46
      • VirtualProtect.KERNELBASE(13140000,00001000), ref: 1477AD5B
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
      • String ID:
      • API String ID: 1996367037-0
      • Opcode ID: 1da593dc69054658c97e2d39797ceabd76b3d200b6e347a90ec397a07aca52c9
      • Instruction ID: 50d47b9def433bdea4c88b07f6b2aa54abc24b7d88f3dbc197854ce033d7fc70
      • Opcode Fuzzy Hash: 1da593dc69054658c97e2d39797ceabd76b3d200b6e347a90ec397a07aca52c9
      • Instruction Fuzzy Hash: CF512AB1A457936BFB116EF8DDC86507F95EB812227980B3CD6E1CB3C6E79458098360

      Control-flow Graph

      APIs
      • __Xtime_get_ticks.LIBCPMT ref: 131496BA
      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 131496C8
      • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 131499D6
      Strings
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: Ios_base_dtorUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@std::ios_base::_
      • String ID: `
      • API String ID: 585147558-1850852036
      • Opcode ID: 7550f4add18f8fee3f2049973671746e25c75f18adb105e94c81478e47482238
      • Instruction ID: 664adc1dc2da75e969582ba4378492078b05d14e0f6b2f02527fa14919a1482c
      • Opcode Fuzzy Hash: 7550f4add18f8fee3f2049973671746e25c75f18adb105e94c81478e47482238
      • Instruction Fuzzy Hash: 20916C75A002589FDB14CFA8D984BDEB7B5FF48314F1485A9E41AB7380DB74AA84CF90

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 117 131559b0-131559c5 118 131559c8-131559d8 call 13142d10 117->118 121 13155a77-13155a87 call 13194643 118->121 122 131559de 118->122 124 131559e0-131559e3 122->124 125 131559e9-13155a1d call 1317e38f call 13194f10 call 13195310 122->125 124->121 124->125 133 13155a36-13155a38 125->133 134 13155a1f-13155a34 125->134 135 13155a3a-13155a67 call 13194d70 call 1318149a 133->135 134->135 139 13155a6c-13155a72 135->139 139->118
      APIs
      • __Xtime_get_ticks.LIBCPMT ref: 131559E9
      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 13155A4D
      • __Thrd_sleep.LIBCPMT ref: 13155A67
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: Thrd_sleepUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
      • String ID:
      • API String ID: 1616912868-0
      • Opcode ID: 0651708872c7eca31e6d2f3a09a5dabb07ea37f8e3e95630c01839dfd03283d3
      • Instruction ID: 42c3128b516069fad89549013446d2c87810d73ac5d18b0898bbe90d921e88bd
      • Opcode Fuzzy Hash: 0651708872c7eca31e6d2f3a09a5dabb07ea37f8e3e95630c01839dfd03283d3
      • Instruction Fuzzy Hash: 58217F76E002189BCB00DFA8CC91AEEB7B9EB49244F15453AE906B7344D6716D058FA1

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 140 1319616b-13196183 141 131961b2-131961d4 KiUserExceptionDispatcher 140->141 142 13196185-13196188 140->142 143 131961a8-131961ab 142->143 144 1319618a-131961a6 142->144 143->141 145 131961ad 143->145 144->141 144->143 145->141
      APIs
      • KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,131542E5,?,?,?,1317E716,131542E5,13206034,?,131542E5), ref: 131961CB
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: DispatcherExceptionUser
      • String ID:
      • API String ID: 6842923-0
      • Opcode ID: 7b8fda23975c0416dd6ff7b569f1f5692b864476309fedf354eb8bf05cdfe781
      • Instruction ID: 6b1a880d258242a5da12a2c931c105ad1015e38549e13b5ec27598c9add9d1e4
      • Opcode Fuzzy Hash: 7b8fda23975c0416dd6ff7b569f1f5692b864476309fedf354eb8bf05cdfe781
      • Instruction Fuzzy Hash: 7401A7759002199FD7019F68D980BAEBFB9FF84724F154069E945AB395D770D900CBA0

      Non-executed Functions

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 502 131bba97-131bbaed call 131b14ae * 2 507 131bbaef-131bbaf2 502->507 508 131bbb0e-131bbb15 502->508 507->508 511 131bbaf4-131bbb0c call 131bba36 507->511 509 131bbb17-131bbb1a 508->509 510 131bbb85-131bbb89 508->510 509->510 512 131bbb1c-131bbb20 509->512 513 131bbb8b-131bbb8e 510->513 514 131bbb9c-131bbbac GetUserDefaultLCID 510->514 511->508 517 131bbb32-131bbb36 call 131bb4be 512->517 518 131bbb22-131bbb25 512->518 513->514 519 131bbb90-131bbb9a call 131bb3d8 513->519 520 131bbbaf 514->520 526 131bbb3b-131bbb40 517->526 518->517 521 131bbb27-131bbb30 call 131bb423 518->521 519->520 524 131bbbb1-131bbbb5 520->524 521->526 528 131bbbca-131bbbe6 call 131bb8c2 524->528 529 131bbbb7 524->529 532 131bbbc8 526->532 533 131bbb46-131bbb5f call 131bba36 526->533 528->529 539 131bbbe8-131bbbf4 IsValidCodePage 528->539 534 131bbbb9-131bbbc7 call 13194643 529->534 532->528 533->520 542 131bbb61-131bbb67 533->542 539->529 541 131bbbf6-131bbc03 IsValidLocale 539->541 541->529 543 131bbc05-131bbc0a 541->543 544 131bbb79-131bbb7d call 131bb4be 542->544 545 131bbb69-131bbb6c 542->545 548 131bbc0e-131bbc24 call 131b1e09 543->548 549 131bbc0c 543->549 551 131bbb82-131bbb83 544->551 545->544 546 131bbb6e-131bbb77 call 131bb423 545->546 546->551 555 131bbc26-131bbc4b call 131b1e09 GetLocaleInfoW 548->555 556 131bbc84-131bbc87 548->556 549->548 551->524 555->529 559 131bbc51-131bbc6a GetLocaleInfoW 555->559 556->534 559->529 560 131bbc70-131bbc81 call 131bfdfd 559->560 560->556
      APIs
      • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 131BBBA3
      • IsValidCodePage.KERNEL32(00000000), ref: 131BBBEC
      • IsValidLocale.KERNEL32(?,00000001), ref: 131BBBFB
      • GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 131BBC43
      • GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 131BBC62
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: Locale$InfoValid$CodeDefaultPageUser
      • String ID:
      • API String ID: 3475089800-0
      • Opcode ID: 0ae3977e058bdacb143787c57df10f7e7a5818b69653ae0aa15825c98c91e7d3
      • Instruction ID: afedc32bc3157a27b1bb9227ee20d09bfaba48a573c59c5f348b2eaeaf8b4b07
      • Opcode Fuzzy Hash: 0ae3977e058bdacb143787c57df10f7e7a5818b69653ae0aa15825c98c91e7d3
      • Instruction Fuzzy Hash: F0517071A00215AFDB20DFA9CE80ABE77B8FF48700F098469E950E754CEB70E944CB60
      APIs
      • GetACP.KERNEL32(?,?,?,?,?,?,131AE49B,?,?,?,?,?,-00000050,?,?,?), ref: 131BB1F7
      • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,131AE49B,?,?,?,?,?,-00000050,?,?), ref: 131BB222
      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 131BB385
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: CodeInfoLocalePageValid
      • String ID:
      • API String ID: 790303815-0
      • Opcode ID: fc134301e572215c128acbf2ec8e961074ae2ca729c22c173b04d9072d888c82
      • Instruction ID: 7ae5985506d231474800799c650408bbb6d3aa42dee836ac0067fc3814c0ddc5
      • Opcode Fuzzy Hash: fc134301e572215c128acbf2ec8e961074ae2ca729c22c173b04d9072d888c82
      • Instruction Fuzzy Hash: 63712935600302ABE725AB39CD41BAB73BCFF45700F198479E505D7588EBB4F54087A0
      APIs
      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 131BB59D
      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 131BB5E7
      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 131BB6AD
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: 4a02ac013e3c814359dbac52775fc774bedcc5635380544dbfd5503e86594366
      • Instruction ID: 699c1c52dd927a404f7bceb623a44eb17a9f4b6d87b1cf64b215793926ae270f
      • Opcode Fuzzy Hash: 4a02ac013e3c814359dbac52775fc774bedcc5635380544dbfd5503e86594366
      • Instruction Fuzzy Hash: BF6181759102179FEF28DF29CD81BAA77B8FF04304F19817AE905C6A88E774E991CB50
      APIs
      • GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,131BBBE0,?,00000000), ref: 131BB95B
      • GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,131BBBE0,?,00000000), ref: 131BB984
      • GetACP.KERNEL32(?,?,131BBBE0,?,00000000), ref: 131BB999
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: f03eeeb312b93fd919e4d915aacbd692adcba020c5c2c0dfe2f5872d31f5f85b
      • Instruction ID: 435be0d942e38d7c52bb6b244228c6aeb1445daaa1b6849d83a5cca461d0ca77
      • Opcode Fuzzy Hash: f03eeeb312b93fd919e4d915aacbd692adcba020c5c2c0dfe2f5872d31f5f85b
      • Instruction Fuzzy Hash: C221B3B2704102ABD7349F65CA01B87B7BABF44A64B4BC464E949D790CE732D941C350
      APIs
      • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 131A1CB7
      • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 131A1CC1
      • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 131A1CCE
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: ExceptionFilterUnhandled$DebuggerPresent
      • String ID:
      • API String ID: 3906539128-0
      • Opcode ID: 0c128b286cfc047715c7de0ac06750cdd3097c404a6092d6c7baaed9a6387860
      • Instruction ID: 7a532119b9d88d3fefa82a422888a444b0ae5935087f905e95b7a37bb4b94cc8
      • Opcode Fuzzy Hash: 0c128b286cfc047715c7de0ac06750cdd3097c404a6092d6c7baaed9a6387860
      • Instruction Fuzzy Hash: AF31C2B490122C9BCB21DF68D9887CDBBB8BF08354F5041EAE41CA7290E7749B85CF54
      APIs
      • GetCurrentProcess.KERNEL32(?,?,131ACCC4,00000000,00000000,?,00000000,?,131B0BCC), ref: 131ACCE7
      • TerminateProcess.KERNEL32(00000000,?,131ACCC4,00000000,00000000,?,00000000,?,131B0BCC), ref: 131ACCEE
      • ExitProcess.KERNEL32 ref: 131ACD00
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: Process$CurrentExitTerminate
      • String ID:
      • API String ID: 1703294689-0
      • Opcode ID: 48cff778b40dceb4db5abe96677d2ae05e228d108e789d73f3300272d567c447
      • Instruction ID: 132d290930215548ea77e1c3b5109bcde817e05db5cf67fa32a7c239b21e74b1
      • Opcode Fuzzy Hash: 48cff778b40dceb4db5abe96677d2ae05e228d108e789d73f3300272d567c447
      • Instruction Fuzzy Hash: AAE0BF39000295AFCF066B58CA489493F79FB49756B054414F915DA125CF79E991CBA0
      APIs
      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 131BB7F0
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: 5cff533f42989fedd7c60d2f3f7c8cb66dcc4be79859fb7f4b68baf116f2cbca
      • Instruction ID: 520f1211c13c45b98b3246bfc295bce1e85b218b572ca177c59d2e0797c434a7
      • Opcode Fuzzy Hash: 5cff533f42989fedd7c60d2f3f7c8cb66dcc4be79859fb7f4b68baf116f2cbca
      • Instruction Fuzzy Hash: 6C21C272620257AFEB289F29DD81AAA77BCFF44314F05807EE901D6548EB34E9408750
      APIs
      • EnumSystemLocalesW.KERNEL32(131BB549,00000001,00000000,?,?,?,131BBB77,00000000,?,?,?), ref: 131BB495
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: EnumLocalesSystem
      • String ID:
      • API String ID: 2099609381-0
      • Opcode ID: 74e9430b7ea6cd32e5ebe873c10c5a4d08297b4ae4ba5a2969b1f5d371b93287
      • Instruction ID: 1d80a15183d9bfe7d1208c4832a534b194decf2aea361a6bfbe1b223d719e232
      • Opcode Fuzzy Hash: 74e9430b7ea6cd32e5ebe873c10c5a4d08297b4ae4ba5a2969b1f5d371b93287
      • Instruction Fuzzy Hash: CD11C23A2007059FDB289F3999A15AABBB5FB80368B19843DEA4787A44D375B542CB40
      APIs
      • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,131BB765,00000000,00000000,?), ref: 131BB9F4
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: c9cdd0b9db4375edb6156c9754927337d0e321d7535faae7380c9b84abc39a2d
      • Instruction ID: 309d31ff2e320835761b3daa4cf53d885cb901f73b7e529bf1a5e4e28efd7272
      • Opcode Fuzzy Hash: c9cdd0b9db4375edb6156c9754927337d0e321d7535faae7380c9b84abc39a2d
      • Instruction Fuzzy Hash: 4FF0F936E10215EFDB345A348945BBA7B78FB40354F098438DC02B3588EAB4FD41C690
      APIs
      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 131BB385
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: d0feaa6f2fa199607c8c3991322bf1f66584aef40a9c6aad315804cf024a8f91
      • Instruction ID: a90eddc4e202da7474e1baea5b2236a3224f45f41278502666deadeabcd957ef
      • Opcode Fuzzy Hash: d0feaa6f2fa199607c8c3991322bf1f66584aef40a9c6aad315804cf024a8f91
      • Instruction Fuzzy Hash: 9BF02836B10205ABD724AB38C844EBA73FCEF44314F024079E502E7644DA78BD058760
      APIs
      • EnumSystemLocalesW.KERNEL32(131BB79C,00000001,?,?,?,?,131BBB3B,?,?,?,?), ref: 131BB508
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: EnumLocalesSystem
      • String ID:
      • API String ID: 2099609381-0
      • Opcode ID: b14430638c07c67c007f8f2fea047b03f0efe1d0527a0945c265e26a9dc0080a
      • Instruction ID: 9663bff971aeadc02a28f11fcc6c18eed8fc3b03e9fbaccf0aeac6faa424c1ca
      • Opcode Fuzzy Hash: b14430638c07c67c007f8f2fea047b03f0efe1d0527a0945c265e26a9dc0080a
      • Instruction Fuzzy Hash: 16F0F6363003056FD7245F398984A6A7BB5FF81368F19843DF9464BA84C6B1A841CB50
      APIs
        • Part of subcall function 131A6405: RtlEnterCriticalSection.NTDLL(?), ref: 131A6414
      • EnumSystemLocalesW.KERNEL32(131B1700,00000001,13207940,0000000C,131B1B6B,00000000), ref: 131B1745
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: CriticalEnterEnumLocalesSectionSystem
      • String ID:
      • API String ID: 1272433827-0
      • Opcode ID: 0567e4579d7f818c78698ac4febff5fe428bdcf5f0a3422dd861eac9b9bc53e6
      • Instruction ID: 04ca4a0b46b3b565276793cac304e7ae567b793fc40e835e76dd6a773c205245
      • Opcode Fuzzy Hash: 0567e4579d7f818c78698ac4febff5fe428bdcf5f0a3422dd861eac9b9bc53e6
      • Instruction Fuzzy Hash: DCF0373AA00314EFE700EFACD485B9D7BB0EB4872AF10816AE5219B290C7795A44CB80
      APIs
      • EnumSystemLocalesW.KERNEL32(131BB331,00000001,?,?,?,131BBB99,?,?,?,?), ref: 131BB40F
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: EnumLocalesSystem
      • String ID:
      • API String ID: 2099609381-0
      • Opcode ID: 92a39e0bfb3d78d72fd99fb0dafd8786fcd84093133f209ce01fc0117fd2d311
      • Instruction ID: 6427719a5c00e3b88543a171d54af925311fdc5416d6eec37f1fd06d65a1e914
      • Opcode Fuzzy Hash: 92a39e0bfb3d78d72fd99fb0dafd8786fcd84093133f209ce01fc0117fd2d311
      • Instruction Fuzzy Hash: 35F0553A3002055BC714AF3AC98466A7FB8FFC2320B0B8068EF068BA54C271A843C760
      APIs
      • GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?,?,?,131AEFF6,?,20001004,00000000,00000002), ref: 131B1CFA
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: ea980a7f0abbd7b78e89ebb2ea03e3ea97f0de5d2c0882d2dbe7c3bacdc30094
      • Instruction ID: fc439df45bb3f64621ed995c908520ff230f5b0f21afb3da698105e1e642b1b2
      • Opcode Fuzzy Hash: ea980a7f0abbd7b78e89ebb2ea03e3ea97f0de5d2c0882d2dbe7c3bacdc30094
      • Instruction Fuzzy Hash: FAE04F36500228BBCF022F60DC08B9E3F36FF487A1F064030FC0465158CB76A9219AE4
      APIs
      • GetSystemTimeAsFileTime.KERNEL32(?,?,?,1317E39D,?,00000000,00000000,?,131496BF,131FAA7C,0000000D,?), ref: 13181B11
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: Time$FileSystem
      • String ID:
      • API String ID: 2086374402-0
      • Opcode ID: 956952612f98133d7df473c51a676aca218964e048126e0c148fb68827c8105d
      • Instruction ID: ea30fdeb5513f46ee97151717f02d9fa9153f162b67e50bfc3e0dd923f07fc92
      • Opcode Fuzzy Hash: 956952612f98133d7df473c51a676aca218964e048126e0c148fb68827c8105d
      • Instruction Fuzzy Hash: 94D01233601A389FCE053B99DD4949E7F28EE49B5930A00F5FD0997214DBA55D408FE5
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 3b0300da1575cefb37510d4859f88c7245e0fc884c1313f11d636de1200edffd
      • Instruction ID: 0f2a8175a69fb3286acc027d8f186df4430594f3b3da2d1d4647421f36cba262
      • Opcode Fuzzy Hash: 3b0300da1575cefb37510d4859f88c7245e0fc884c1313f11d636de1200edffd
      • Instruction Fuzzy Hash: 92E0EC72A11278EBCB15DF98CA44D8AB3FCEB45A50B1544A6F602E3214C670EE05D7D0

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 181 13153ea0-13153ef2 call 1317e438 184 13153ef4-13153f03 call 1317e438 181->184 185 13153f23-13153f30 181->185 194 13153f15-13153f1d call 1317e490 184->194 195 13153f05-13153f10 184->195 187 13153f62 185->187 188 13153f32-13153f3a 185->188 189 13153f64-13153f68 187->189 188->189 191 13153f3c-13153f61 call 1317e490 call 13194643 188->191 192 13153f7a-13153f7c 189->192 193 13153f6a-13153f72 call 13180cd5 189->193 192->191 199 13153f7e-13153f83 192->199 193->199 207 13153f74-13153f77 193->207 194->185 195->194 203 13153f85-13153f87 199->203 204 13153f89-13153fa0 call 1319485f 199->204 203->191 210 13153fa2-13153fa7 204->210 211 13153fae 204->211 207->192 212 13153fb3-13153ff9 call 1317e438 210->212 213 13153fa9-13153fac 210->213 211->212 216 13153fff-1315402b call 13180ddb call 13180e26 212->216 217 131540da-1315410f call 1317e737 212->217 213->212 231 13154036-13154042 216->231 232 1315402d-13154033 call 131a25bc 216->232 223 13154115-13154127 217->223 224 131541fe call 131419d0 217->224 227 1315414f-13154157 223->227 228 13154129 223->228 233 13154203 call 13141900 224->233 229 13154160-13154170 227->229 230 13154159-1315415e 227->230 234 1315412b-13154130 228->234 235 13154172-13154177 229->235 236 1315417f-13154181 229->236 230->234 239 13154044-1315404a call 131a25bc 231->239 240 1315404d-13154059 231->240 232->231 248 13154208-1315420f call 131a1d7b 233->248 241 13154133-1315413e call 1319485f 234->241 235->233 244 1315417d 235->244 245 13154190 236->245 246 13154183-1315418e call 1319485f 236->246 239->240 242 13154064-13154070 240->242 243 1315405b-13154061 call 131a25bc 240->243 241->248 259 13154144-1315414d 241->259 254 13154072-13154078 call 131a25bc 242->254 255 1315407b-13154087 242->255 243->242 244->241 257 13154192-131541a4 245->257 246->257 254->255 262 13154092-1315409e 255->262 263 13154089-1315408f call 131a25bc 255->263 265 131541e7-131541fb call 131961e0 257->265 266 131541a6-131541bc call 131961e0 257->266 259->257 271 131540a0-131540a6 call 131a25bc 262->271 272 131540a9-131540d5 call 1317e490 call 13180ca9 262->272 263->262 280 131541d0-131541e4 call 13194ae0 266->280 281 131541be-131541cc 266->281 271->272 272->191 281->248 283 131541ce 281->283 283->280
      APIs
      • std::_Lockit::_Lockit.LIBCPMT ref: 13153ED6
      • std::_Lockit::_Lockit.LIBCPMT ref: 13153EF8
      • std::_Lockit::~_Lockit.LIBCPMT ref: 13153F18
      • std::_Lockit::~_Lockit.LIBCPMT ref: 13153F3F
      • std::_Lockit::_Lockit.LIBCPMT ref: 13153FB8
      • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 13154004
      • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1315401E
      • std::_Lockit::~_Lockit.LIBCPMT ref: 131540B3
      • std::_Facet_Register.LIBCPMT ref: 131540C0
      • Concurrency::cancel_current_task.LIBCPMT ref: 13154203
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Concurrency::cancel_current_taskFacet_Locinfo_ctorLocinfo_dtorRegister
      • String ID:
      • API String ID: 3458317536-0
      • Opcode ID: 842647fbc0430210d70acbcb7457cb3aee7465d91d5850da8a4b8c155e14684b
      • Instruction ID: a17e0d952b87a410aa25ec03a5acbc2a928c605935e6a910a7307e6153c07d09
      • Opcode Fuzzy Hash: 842647fbc0430210d70acbcb7457cb3aee7465d91d5850da8a4b8c155e14684b
      • Instruction Fuzzy Hash: 15A1E175E003149FDB04DFA8D984B9EBBB4AF45314F194569E825FB340EB34E909CBA1

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 289 13196f60-13196fb1 call 131c0b7b call 13196f20 call 1319963c 296 1319700d-13197010 289->296 297 13196fb3-13196fc5 289->297 298 13197030-13197039 296->298 299 13197012-1319701f call 1319ffc0 296->299 297->298 300 13196fc7-13196fde 297->300 305 13197024-1319702d call 13196f20 299->305 302 13196fe0-13196fee call 1319ff60 300->302 303 13196ff4 300->303 312 13196ff0 302->312 313 13197004-1319700b 302->313 304 13196ff7-13196ffc 303->304 304->300 307 13196ffe-13197000 304->307 305->298 307->298 310 13197002 307->310 310->305 314 1319703a-13197043 312->314 315 13196ff2 312->315 313->305 316 1319707d-1319708d call 1319ffa0 314->316 317 13197045-1319704c 314->317 315->304 323 1319708f-1319709e call 1319ffc0 316->323 324 131970a1-131970c5 call 13196f20 call 1319ff80 call 13198850 316->324 317->316 319 1319704e-1319705d call 131c05f0 317->319 325 1319707a 319->325 326 1319705f-13197077 319->326 323->324 338 131970cb-131970cd 324->338 339 131970c7-131970ca 324->339 325->316 326->325
      APIs
      • _ValidateLocalCookies.LIBCMT ref: 13196F97
      • ___except_validate_context_record.LIBVCRUNTIME ref: 13196F9F
      • _ValidateLocalCookies.LIBCMT ref: 13197028
      • __IsNonwritableInCurrentImage.LIBCMT ref: 13197053
      • _ValidateLocalCookies.LIBCMT ref: 131970A8
      Strings
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
      • String ID: csm
      • API String ID: 1170836740-1018135373
      • Opcode ID: cf784a0fa25df079171a4effb317c06600db967cd862b042b2ea44c68fc4742f
      • Instruction ID: aeac6a5847060dba7ef26781622c81db701cf02a1b6527a393d5982b81a6a3aa
      • Opcode Fuzzy Hash: cf784a0fa25df079171a4effb317c06600db967cd862b042b2ea44c68fc4742f
      • Instruction Fuzzy Hash: 4041B635E00219AFEF00DF6CC884A9EBBB5FF46324F1980A5E8159B355D731E955CBA0

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 340 131b02ca-131b0342 GetConsoleOutputCP call 131a0a16 343 131b0348-131b036d 340->343 344 131b064d 340->344 346 131b0373-131b037d 343->346 347 131b04a6-131b04ad 343->347 345 131b0650 344->345 348 131b065c-131b0675 call 13194643 345->348 349 131b0652-131b0655 345->349 350 131b0380-131b0383 346->350 351 131b04af-131b04cb 347->351 352 131b04cd-131b04df call 131aa00b 347->352 349->348 354 131b038b-131b0395 350->354 355 131b0385-131b0389 350->355 356 131b0510-131b051f call 131b41f3 351->356 368 131b050d-131b050f 352->368 369 131b04e1-131b04ea 352->369 360 131b039b-131b03b6 354->360 361 131b044c-131b045c 354->361 355->350 355->354 356->344 375 131b0525-131b0549 call 131b5601 356->375 366 131b05cc-131b05ce 360->366 367 131b03bc-131b03c1 360->367 363 131b0462-131b0498 call 131b5506 361->363 364 131b0600-131b0602 361->364 363->344 387 131b049e 363->387 373 131b05f5 364->373 377 131b0604 364->377 372 131b05d0 366->372 366->373 376 131b03c4-131b03ce 367->376 368->356 370 131b0621-131b0642 369->370 371 131b04f0-131b0502 call 131b41f3 369->371 381 131b05f7-131b05fe 370->381 371->344 392 131b0508-131b050b 371->392 379 131b05d2-131b05f0 372->379 373->381 375->344 394 131b054f-131b0564 WriteFile 375->394 376->376 383 131b03d0-131b03d8 376->383 384 131b0607-131b061d 377->384 379->379 386 131b05f2 379->386 381->345 389 131b03da-131b03ed call 131961e0 383->389 390 131b03f0-131b03f3 383->390 384->384 391 131b061f 384->391 386->373 393 131b04a1-131b04a4 387->393 389->390 396 131b03f5-131b0405 390->396 391->386 392->375 393->375 398 131b056a-131b057b 394->398 399 131b0644-131b064a GetLastError 394->399 396->396 397 131b0407-131b0444 call 131b5506 396->397 397->344 407 131b044a 397->407 398->344 402 131b0581-131b0585 398->402 399->344 404 131b05bb-131b05be 402->404 405 131b0587-131b05a4 WriteFile 402->405 404->344 406 131b05c4-131b05c7 404->406 405->399 408 131b05aa-131b05ae 405->408 406->343 407->393 408->344 409 131b05b4-131b05b8 408->409 409->404
      APIs
      • GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 131B0312
      • __fassign.LIBCMT ref: 131B04F7
      • __fassign.LIBCMT ref: 131B0514
      • WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 131B055C
      • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 131B059C
      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 131B0644
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: FileWrite__fassign$ConsoleErrorLastOutput
      • String ID:
      • API String ID: 1735259414-0
      • Opcode ID: 0d0260771ab6e40525fa8019e3b9f0ca9c6e5d597b5451c7d735e0029ad4d575
      • Instruction ID: 5f05812764719a3fc2817b7716f76e13d2258bcb88e036efd2a2a20161e5e529
      • Opcode Fuzzy Hash: 0d0260771ab6e40525fa8019e3b9f0ca9c6e5d597b5451c7d735e0029ad4d575
      • Instruction Fuzzy Hash: 2DC1AEB5D002989FCB04CFA8C9809EDBBB9BF49314F29816AE855F7245D731A946CF60

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 410 13193d00-13193d18 411 13193d1a-13193d2a call 131ac6e1 410->411 412 13193d2e-13193d56 MultiByteToWideChar 410->412 411->412 421 13193d2c 411->421 414 13193eba-13193ecb call 13194643 412->414 415 13193d5c-13193d68 412->415 418 13193eaa 415->418 419 13193d6e-13193d73 415->419 420 13193eae 418->420 423 13193d88-13193d93 call 131a2de3 419->423 424 13193d75-13193d7e call 13195670 419->424 426 13193eb0-13193eb8 call 13193ce7 420->426 421->412 431 13193d9e-13193da3 423->431 432 13193d95 423->432 424->431 434 13193d80-13193d86 424->434 426->414 431->420 436 13193da9-13193dbc MultiByteToWideChar 431->436 435 13193d9b 432->435 434->435 435->431 436->420 437 13193dc2-13193ddb LCMapStringEx 436->437 437->420 438 13193de1-13193de9 437->438 439 13193e1b-13193e27 438->439 440 13193deb-13193df0 438->440 442 13193e29-13193e2b 439->442 443 13193e9c 439->443 440->426 441 13193df6-13193df8 440->441 441->426 444 13193dfe-13193e16 LCMapStringEx 441->444 445 13193e2d-13193e36 call 13195670 442->445 446 13193e40-13193e4b call 131a2de3 442->446 447 13193ea0-13193ea8 call 13193ce7 443->447 444->426 454 13193e38-13193e3e 445->454 455 13193e56-13193e5b 445->455 446->455 456 13193e4d 446->456 447->426 457 13193e53 454->457 455->447 458 13193e5d-13193e77 LCMapStringEx 455->458 456->457 457->455 458->447 459 13193e79-13193e80 458->459 460 13193e82-13193e84 459->460 461 13193e86-13193e89 459->461 462 13193e8c-13193e9a WideCharToMultiByte 460->462 461->462 462->447
      APIs
      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,131FA540,00000000,00000000,?,?,131FA540,00000001,?,00000000,131FA527,00000000,?,131FA540), ref: 13193D49
      • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,131FA540,00000000,00000000,?,00000000,131FA527,00000000,?,131FA540), ref: 13193DB4
      • LCMapStringEx.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,131FA527,00000000,?,131FA540), ref: 13193DD1
      • LCMapStringEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,131FA527,00000000,?,131FA540), ref: 13193E10
      • LCMapStringEx.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,131FA527,00000000,?,131FA540), ref: 13193E6F
      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,?,00000000,131FA527,00000000,?,131FA540), ref: 13193E92
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: ByteCharMultiStringWide
      • String ID:
      • API String ID: 2829165498-0
      • Opcode ID: fcc98c877c0651b15899f2e937da3fcd2166d6c49a7c46937b247c96b9cdb1a7
      • Instruction ID: cdc415166d98875366f2c899f8e61620f74cb9ab8a03f030511bf0cd0e2dac8a
      • Opcode Fuzzy Hash: fcc98c877c0651b15899f2e937da3fcd2166d6c49a7c46937b247c96b9cdb1a7
      • Instruction Fuzzy Hash: 4751BE72A0021AAFFF119FA5CC44FAB3BBAEF40754F195829F904E6190D7749D61CB60

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 463 131532d0-13153323 call 1317e438 466 13153325-13153334 call 1317e438 463->466 467 13153354-13153364 463->467 475 13153346-1315334e call 1317e490 466->475 476 13153336-13153341 466->476 469 13153366-1315336e 467->469 470 13153372-13153374 467->470 472 131533d0-131533f5 call 1317e490 call 13194643 469->472 473 13153370 469->473 474 13153377-1315337b 470->474 473->474 478 13153390-13153392 474->478 479 1315337d-13153385 call 13180cd5 474->479 475->467 476->475 478->472 482 13153394-13153396 478->482 479->482 490 13153387-1315338d 479->490 486 1315339c-131533ae call 13142780 482->486 487 13153398-1315339a 482->487 493 131533f6-1315344c call 13142050 call 13150960 486->493 494 131533b0-131533ca call 13180ca9 486->494 487->472 490->478 494->472
      APIs
      • std::_Lockit::_Lockit.LIBCPMT ref: 13153306
      • std::_Lockit::_Lockit.LIBCPMT ref: 13153329
      • std::_Lockit::~_Lockit.LIBCPMT ref: 13153349
      • std::_Facet_Register.LIBCPMT ref: 131533BB
      • std::_Lockit::~_Lockit.LIBCPMT ref: 131533D3
      • Concurrency::cancel_current_task.LIBCPMT ref: 131533F6
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
      • String ID:
      • API String ID: 2081738530-0
      • Opcode ID: ade16af127ad6b30bb42cdf7a0fb7f22983f10f812d9b7e85a04b42d3debc1d5
      • Instruction ID: 9abd6fdf5662d87634fa4e810f2d1260ad6b36b06dbf15d14744bdd592adbca0
      • Opcode Fuzzy Hash: ade16af127ad6b30bb42cdf7a0fb7f22983f10f812d9b7e85a04b42d3debc1d5
      • Instruction Fuzzy Hash: C841E371900359DFDB05DF58C984B9EBBB4FB05318F184699E8196B340DB35BA84CBE0

      Control-flow Graph

      APIs
      • std::_Lockit::_Lockit.LIBCPMT ref: 13142803
      • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 1314284F
      • __Getctype.LIBCPMT ref: 13142868
      • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 13142884
      • std::_Lockit::~_Lockit.LIBCPMT ref: 13142919
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
      • String ID:
      • API String ID: 1840309910-0
      • Opcode ID: 68046fbc073da44e701535b1f02859e920e63f97c6327acf799b5219fd405bea
      • Instruction ID: d27c02ca30a124b4d081d41d905344a103207915b635d2a7e0cdb490a659296e
      • Opcode Fuzzy Hash: 68046fbc073da44e701535b1f02859e920e63f97c6327acf799b5219fd405bea
      • Instruction Fuzzy Hash: AB5172B5D003989FEB00CFE8D944BDEBBB8AF14315F184169DC04AB281E735E549CBA1

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 612 131b18d6-131b18e2 613 131b1989-131b198c 612->613 614 131b1992 613->614 615 131b18e7-131b18f8 613->615 618 131b1994-131b1998 614->618 616 131b18fa-131b18fd 615->616 617 131b1905-131b191e LoadLibraryExW 615->617 619 131b1903 616->619 620 131b1986 616->620 621 131b1970-131b1979 617->621 622 131b1920-131b1929 GetLastError 617->622 624 131b1982-131b1984 619->624 620->613 623 131b197b-131b197c FreeLibrary 621->623 621->624 625 131b192b-131b193d call 131afd08 622->625 626 131b1960 622->626 623->624 624->620 628 131b1999-131b199b 624->628 625->626 632 131b193f-131b1951 call 131afd08 625->632 627 131b1962-131b1964 626->627 627->621 630 131b1966-131b196e 627->630 628->618 630->620 632->626 635 131b1953-131b195e LoadLibraryExW 632->635 635->627
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: df0e6102cdd4af03bfdbd841d10d74e11cc9aa75b4916d143435a1f765018abc
      • Instruction ID: 64eb4dc916813beebfdc3f36576b3457b6cfd3f093f97e888b399643b3e18ad0
      • Opcode Fuzzy Hash: df0e6102cdd4af03bfdbd841d10d74e11cc9aa75b4916d143435a1f765018abc
      • Instruction Fuzzy Hash: 69210376A012A1EBD7129A288D84B5A777CAF027E4F1B0530FD57BB288D630ED00C6F0

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 636 131bfe85-131bfea6 WriteConsoleW 637 131bfea8-131bfeb1 GetLastError 636->637 638 131bfed5-131bfed9 636->638 637->638 639 131bfeb3-131bfed3 call 131bfe6e call 131bfe30 WriteConsoleW 637->639 639->638
      APIs
      • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,131BC224,00000000,00000001,00000000,00000000,?,131B06A1,?,?,00000000), ref: 131BFE9C
      • GetLastError.KERNEL32(?,131BC224,00000000,00000001,00000000,00000000,?,131B06A1,?,?,00000000,?,00000000,?,131B0BED,00000000), ref: 131BFEA8
        • Part of subcall function 131BFE6E: CloseHandle.KERNEL32(?,131BFEB8,?,131BC224,00000000,00000001,00000000,00000000,?,131B06A1,?,?,00000000,?,00000000), ref: 131BFE7E
      • ___initconout.LIBCMT ref: 131BFEB8
        • Part of subcall function 131BFE30: CreateFileW.KERNEL32(131F9B50,40000000,00000003,00000000,00000003,00000000,00000000,131BFE5F,131BC211,00000000,?,131B06A1,?,?,00000000,?), ref: 131BFE43
      • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,131BC224,00000000,00000001,00000000,00000000,?,131B06A1,?,?,00000000,?), ref: 131BFECD
      Memory Dump Source
      • Source File: 00000009.00000002.2532227876.0000000013140000.00000040.00000400.00020000.00000000.sdmp, Offset: 13140000, based on PE: true
      • Associated: 00000009.00000002.2532227876.0000000014779000.00000040.00000400.00020000.00000000.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_9_2_13140000_dfrgui.jbxd
      Similarity
      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
      • String ID:
      • API String ID: 2744216297-0
      • Opcode ID: 2e9f28c01d0d3bedf5e359b92106b28cb7e48978819117f5c96c6116375dc65a
      • Instruction ID: aa373026242d55a8855818deca057347e9bb802ae45eccb1e99744dab0ff774a
      • Opcode Fuzzy Hash: 2e9f28c01d0d3bedf5e359b92106b28cb7e48978819117f5c96c6116375dc65a
      • Instruction Fuzzy Hash: 98F01C3A500269BBCB162FD9CC4899E3F7AEB492B8F058010FA1995164CB339834DBA0