Create Interactive Tour

Windows Analysis Report Agent.Listener.exe

Overview

General Information

Sample Name:Agent.Listener.exe
Analysis ID:502173
MD5:6ba29b4fdb125cb2ba962126b1dc49e6
SHA1:97de340fa40f6ae8fcb4cbb98c9d0b0ea580ac2b
SHA256:2a8a9f4848555e5f8077a579fe0d8e3fcdf5ae5a663f33808644655ee6591f4f
Infos:

Most interesting Screenshot:

Detection

Score:4
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sample file is different than original file name gathered from version info
Contains functionality to dynamically determine API calls
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Program does not show much activity (idle)
Detected potential crypto function
Found potential string decryption / allocating functions

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • Agent.Listener.exe (PID: 3216 cmdline: 'C:\Users\user\Desktop\Agent.Listener.exe' MD5: 6BA29B4FDB125CB2BA962126B1DC49E6)
    • conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Agent.Listener.exeStatic PE information: certificate valid
Source: Agent.Listener.exeStatic PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: Agent.Listener.exe
Source: Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: Agent.Listener.exe
Source: Agent.Listener.exeString found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: Agent.Listener.exeString found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=
Source: Agent.Listener.exeBinary or memory string: OriginalFilename vs Agent.Listener.exe
Source: Agent.Listener.exe, 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAgent.Listener.dll> vs Agent.Listener.exe
Source: Agent.Listener.exeBinary or memory string: OriginalFilenameAgent.Listener.dll> vs Agent.Listener.exe
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BD60800_2_00007FF6D7BD6080
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE2C280_2_00007FF6D7BE2C28
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BDFAC00_2_00007FF6D7BDFAC0
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: String function: 00007FF6D7BDBA10 appears 42 times
Source: Agent.Listener.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Agent.Listener.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: classification engineClassification label: clean4.winEXE@2/1@0/0
Source: unknownProcess created: C:\Users\user\Desktop\Agent.Listener.exe 'C:\Users\user\Desktop\Agent.Listener.exe'
Source: C:\Users\user\Desktop\Agent.Listener.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_01
Source: initial sampleStatic PE information: Valid certificate with Microsoft Issuer
Source: Agent.Listener.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: Agent.Listener.exeStatic PE information: certificate valid
Source: Agent.Listener.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Agent.Listener.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Agent.Listener.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Agent.Listener.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Agent.Listener.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Agent.Listener.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Agent.Listener.exeStatic PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Agent.Listener.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: Agent.Listener.exe
Source: Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: Agent.Listener.exe
Source: Agent.Listener.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Agent.Listener.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Agent.Listener.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Agent.Listener.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Agent.Listener.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BDE070 memset,LoadLibraryA,GetProcAddress,_invalid_parameter_noinfo_noreturn,0_2_00007FF6D7BDE070
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE2C28 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF6D7BE2C28
Source: C:\Users\user\Desktop\Agent.Listener.exeAPI coverage: 9.2 %
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BDE070 memset,LoadLibraryA,GetProcAddress,_invalid_parameter_noinfo_noreturn,0_2_00007FF6D7BDE070
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE3F18 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D7BE3F18
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE39C0 SetUnhandledExceptionFilter,_set_new_mode,0_2_00007FF6D7BE39C0
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE40C0 SetUnhandledExceptionFilter,0_2_00007FF6D7BE40C0
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE3BFC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6D7BE3BFC
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE3F18 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D7BE3F18
Source: C:\Users\user\Desktop\Agent.Listener.exeCode function: 0_2_00007FF6D7BE4108 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6D7BE4108

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsNative API1Application Shimming1Process Injection1Process Injection1OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsApplication Shimming1Deobfuscate/Decode Files or Information1LSASS MemorySecurity Software Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 502173 Sample: Agent.Listener.exe Startdate: 13/10/2021 Architecture: WINDOWS Score: 4 5 Agent.Listener.exe 1 2->5         started        process3 7 conhost.exe 5->7         started       

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand
SourceDetectionScannerLabelLink
Agent.Listener.exe0%VirustotalBrowse
Agent.Listener.exe0%ReversingLabs
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=Agent.Listener.exefalse
    high
    https://aka.ms/dotnet-core-applaunch?Agent.Listener.exefalse
      high
      No contacted IP infos

      General Information

      Joe Sandbox Version:33.0.0 White Diamond
      Analysis ID:502173
      Start date:13.10.2021
      Start time:17:20:16
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 3m 5s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:Agent.Listener.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:4
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:CLEAN
      Classification:clean4.winEXE@2/1@0/0
      EGA Information:
      • Successful, ratio: 100%
      HDC Information:
      • Successful, ratio: 99.8% (good quality ratio 59.7%)
      • Quality average: 43.5%
      • Quality standard deviation: 41.5%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Stop behavior analysis, all processes terminated
      Warnings:
      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
      • Excluded IPs from analysis (whitelisted): 95.100.218.79
      • Excluded domains from analysis (whitelisted): e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, store-images.s-microsoft.com-c.edgekey.net
      • Not all processes where analyzed, report is missing behavior information
      No simulations
      No context
      No context
      No context
      No context
      No context
      \Device\ConDrv
      Process:C:\Users\user\Desktop\Agent.Listener.exe
      File Type:ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):92
      Entropy (8bit):4.434292017694067
      Encrypted:false
      SSDEEP:3:V2MQrfdA+WFKBWRT5jAuN2+WkDR18YBCen:VgfCpQgRT5jAuN2RkDrCe
      MD5:6872083123A90B552CD8BA7700EFA38B
      SHA1:8536D79934C2E43275C83E0687CF1E2BE1F0AF54
      SHA-256:61B777981E059E1FDB95106EF0DC358C9AED3FF98BC8942CF4A64931F0BC8D03
      SHA-512:F9CBE6C8C36F36917680EAAF02296F1C0E6D91E7CEC9E192EDDAFB3A16AA507204B33CDE0AB892A8848A812F10EBADA2BCD19FB8D7A577753FFCD1408DA3DF5C
      Malicious:false
      Reputation:low
      Preview: The application to execute does not exist: 'C:\Users\user\Desktop\Agent.Listener.dll'...

      Static File Info

      General

      File type:PE32+ executable (console) x86-64, for MS Windows
      Entropy (8bit):5.92591617314015
      TrID:
      • Win64 Executable Console (202006/5) 92.65%
      • Win64 Executable (generic) (12005/4) 5.51%
      • Generic Win/DOS Executable (2004/3) 0.92%
      • DOS Executable Generic (2002/1) 0.92%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:Agent.Listener.exe
      File size:179080
      MD5:6ba29b4fdb125cb2ba962126b1dc49e6
      SHA1:97de340fa40f6ae8fcb4cbb98c9d0b0ea580ac2b
      SHA256:2a8a9f4848555e5f8077a579fe0d8e3fcdf5ae5a663f33808644655ee6591f4f
      SHA512:8dc954db2fbb794eaa5aa7bc859e16b5d8a3d8454c0ce362089fd7235b5bb55831a985e961d1de0251a6206d8de02ee64f9503917331578a8bf2bfce7ad7c39b
      SSDEEP:3072:68eBqhy5aV5gwqY8sXwoEHXfwaN+M+/ORYd532Ms4T6TFZb6SJ:6hT1sXOfDj+d56JZJ
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d......].........."......r.

      File Icon

      Icon Hash:00828e8e8686b000

      General

      Entrypoint:0x140013b60
      Entrypoint Section:.text
      Digitally signed:true
      Imagebase:0x140000000
      Subsystem:windows cui
      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
      DLL Characteristics:GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
      Time Stamp:0x5DCEC899 [Fri Nov 15 15:47:37 2019 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:6
      OS Version Minor:0
      File Version Major:6
      File Version Minor:0
      Subsystem Version Major:6
      Subsystem Version Minor:0
      Import Hash:7d19699275e08b389d5869dc7132efbc
      Signature Valid:true
      Signature Issuer:CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
      Signature Validation Error:The operation completed successfully
      Error Number:0
      Not Before, Not After
      • 12/15/2020 1:31:45 PM 12/2/2021 1:31:45 PM
      Subject Chain
      • CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
      Version:3
      Thumbprint MD5:658DCC2A890351DF97DC9F05146283C0
      Thumbprint SHA-1:ABDCA79AF9DD48A0EA702AD45260B3C03093FB4B
      Thumbprint SHA-256:E39CC80A0DF6F2BED821D11B49717306138C1D19FD20190336BF1C4297638A79
      Serial:33000001DF6BF02E92A74AB4D00000000001DF
      Instruction
      dec eax
      sub esp, 28h
      call 00007F4190A14064h
      dec eax
      add esp, 28h
      jmp 00007F4190A1392Fh
      int3
      int3
      inc eax
      push ebx
      dec eax
      sub esp, 20h
      dec eax
      mov ebx, ecx
      dec eax
      mov eax, edx
      dec eax
      lea ecx, dword ptr [000061F9h]
      dec eax
      mov dword ptr [ebx], ecx
      dec eax
      lea edx, dword ptr [ebx+08h]
      xor ecx, ecx
      dec eax
      mov dword ptr [edx], ecx
      dec eax
      mov dword ptr [edx+08h], ecx
      dec eax
      lea ecx, dword ptr [eax+08h]
      call 00007F4190A14309h
      dec eax
      lea eax, dword ptr [0000DE81h]
      dec eax
      mov dword ptr [ebx], eax
      dec eax
      mov eax, ebx
      dec eax
      add esp, 20h
      pop ebx
      ret
      int3
      dec eax
      and dword ptr [ecx+10h], 00000000h
      dec eax
      lea eax, dword ptr [0000DE78h]
      dec eax
      mov dword ptr [ecx+08h], eax
      dec eax
      lea eax, dword ptr [0000DE5Dh]
      dec eax
      mov dword ptr [ecx], eax
      dec eax
      mov eax, ecx
      ret
      int3
      int3
      dec eax
      sub esp, 48h
      dec eax
      lea ecx, dword ptr [esp+20h]
      call 00007F4190A13A97h
      dec eax
      lea edx, dword ptr [000132EFh]
      dec eax
      lea ecx, dword ptr [esp+20h]
      call 00007F4190A1436Eh
      int3
      jmp 00007F4190A11B30h
      int3
      int3
      int3
      inc eax
      push ebx
      dec eax
      sub esp, 20h
      dec eax
      mov ebx, ecx
      xor ecx, ecx
      call dword ptr [00005553h]
      dec eax
      mov ecx, ebx
      call dword ptr [00005552h]
      call dword ptr [00005474h]
      dec eax
      mov ecx, eax
      mov edx, C0000409h
      dec eax
      add esp, 20h
      Programming Language:
      • [IMP] VS2008 SP1 build 30729
      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x26f9c0x118.rdata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x2c0000x594.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x2a0000x15fc.pdata
      IMAGE_DIRECTORY_ENTRY_SECURITY0x298000x2388
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x2d0000x6dc.reloc
      IMAGE_DIRECTORY_ENTRY_DEBUG0x226300x54.rdata
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x227900x28.rdata
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x226900x100.rdata
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x190000x468.rdata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x171fc0x17200False0.497086148649data6.29227878169IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .rdata0x190000xef440xf000False0.334000651042data4.08095539026IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .data0x280000x19e80xe00False0.181640625data3.04517754121IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .pdata0x2a0000x15fc0x1600False0.495205965909PEX Binary Archive5.21615997761IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .rsrc0x2c0000x5940x600False0.4140625data4.50806221751IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .reloc0x2d0000x6dc0x800False0.54150390625data5.08553064642IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      NameRVASizeTypeLanguageCountry
      RT_VERSION0x2c0a00x308data
      RT_MANIFEST0x2c3a80x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
      DLLImport
      KERNEL32.dllFindClose, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, GetFullPathNameW, GetTempPathW, GetLastError, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetEnvironmentVariableW, GetCurrentProcess, IsWow64Process, GetModuleFileNameW, GetModuleHandleExW, GetProcAddress, LoadLibraryExW, LoadLibraryA, MultiByteToWideChar, WideCharToMultiByte, FreeLibrary, RtlUnwindEx, RaiseException, OutputDebugStringW, GetModuleHandleW, GetCurrentProcessId, Sleep, RemoveDirectoryW, DeleteCriticalSection, CreateDirectoryW, RtlPcToFileHeader, InitializeSListHead, GetCurrentThreadId, QueryPerformanceCounter, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, LCMapStringW, GetSystemTimeAsFileTime, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, SwitchToThread, InitializeCriticalSectionAndSpinCount, SetLastError, DecodePointer, EncodePointer, GetStringTypeW
      USER32.dllMessageBoxW
      SHELL32.dllShellExecuteW
      ADVAPI32.dllRegOpenKeyExW, RegCloseKey, ReportEventW, RegisterEventSourceW, DeregisterEventSource, RegGetValueW
      api-ms-win-crt-runtime-l1-1-0.dll_initialize_wide_environment, _set_app_type, _invalid_parameter_noinfo_noreturn, _seh_filter_exe, _cexit, _crt_atexit, _register_onexit_function, terminate, _configure_wide_argv, exit, _exit, __p___argc, __p___wargv, _c_exit, _register_thread_local_exe_atexit_callback, abort, _get_initial_wide_environment, _errno, _initterm, _initialize_onexit_table, _initterm_e
      api-ms-win-crt-heap-l1-1-0.dllmalloc, calloc, free, _callnewh, _set_new_mode
      api-ms-win-crt-math-l1-1-0.dll__setusermatherr, frexp
      api-ms-win-crt-stdio-l1-1-0.dll_wfopen, __stdio_common_vswprintf, fclose, fread, fseek, fwrite, __acrt_iob_func, _set_fmode, fputwc, fputws, __stdio_common_vfwprintf, fflush, __p__commode, __stdio_common_vsprintf_s
      api-ms-win-crt-string-l1-1-0.dll_wcsicmp, _wcsdup, _wcsnicmp, wcsncmp, strcspn, wcsnlen, memset, strcpy_s
      api-ms-win-crt-locale-l1-1-0.dll_unlock_locales, __pctype_func, ___lc_locale_name_func, ___mb_cur_max_func, setlocale, _configthreadlocale, _lock_locales, localeconv, ___lc_codepage_func
      api-ms-win-crt-filesystem-l1-1-0.dll_wremove, _wrename
      api-ms-win-crt-convert-l1-1-0.dll_wtoi, wcstoul
      api-ms-win-crt-time-l1-1-0.dllwcsftime, _gmtime64, _time64
      DescriptionData
      Translation0x0000 0x04b0
      LegalCopyright
      Assembly Version2.193.0.0
      InternalNameAgent.Listener.dll
      FileVersion2.193.0.0
      CompanyNameAgent.Listener
      ProductNameAgent.Listener
      ProductVersion2.193.0
      FileDescriptionAgent.Listener
      OriginalFilenameAgent.Listener.dll

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      0510s020406080100

      Click to jump to process

      Memory Usage

      Click to jump to process

      Behavior

      Click to jump to process

      System Behavior

      Start time:17:21:14
      Start date:13/10/2021
      Path:C:\Windows\System32\conhost.exe
      Wow64 process (32bit):false
      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Imagebase:0x7ff61de10000
      File size:625664 bytes
      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:high

      Disassembly

      Code Analysis

      Execution Graph

      Execution Coverage

      Dynamic/Packed Code Coverage

      Signature Coverage

      Execution Coverage:5.3%
      Dynamic/Decrypted Code Coverage:0%
      Signature Coverage:7.4%
      Total number of Nodes:893
      Total number of Limit Nodes:7

      Graph

      Show Legend
      Hide Nodes/Edges
      execution_graph 6896 7ff6d7be39c0 6900 7ff6d7be40c0 SetUnhandledExceptionFilter 6896->6900 6967 7ff6d7be39dc 6990 7ff6d7be3670 6967->6990 6970 7ff6d7be3b33 6972 7ff6d7be3f18 __scrt_fastfail 9 API calls 6970->6972 6971 7ff6d7be39fd __scrt_acquire_startup_lock 6973 7ff6d7be3b3d 6971->6973 6977 7ff6d7be3a1b __scrt_is_nonwritable_in_current_image __scrt_release_startup_lock 6971->6977 6972->6973 6974 7ff6d7be3f18 __scrt_fastfail 9 API calls 6973->6974 6975 7ff6d7be3b48 6974->6975 6978 7ff6d7be3b50 _exit 6975->6978 6976 7ff6d7be3a40 6977->6976 6979 7ff6d7be3ac6 __p___wargv __p___argc _get_initial_wide_environment 6977->6979 6982 7ff6d7be3abe _register_thread_local_exe_atexit_callback 6977->6982 6996 7ff6d7be1bb0 6979->6996 6982->6979 6985 7ff6d7be3af3 6986 7ff6d7be3afd 6985->6986 6987 7ff6d7be3af8 _cexit 6985->6987 7015 7ff6d7be3854 6986->7015 6987->6986 6991 7ff6d7be3692 __scrt_initialize_crt 6990->6991 7019 7ff6d7be5130 6991->7019 6993 7ff6d7be369b 6993->6970 6993->6971 6994 7ff6d7be3697 __scrt_uninitialize_crt 6994->6993 7027 7ff6d7be5164 6994->7027 7085 7ff6d7bdbd30 6996->7085 6998 7ff6d7be1bca 6999 7ff6d7be1c24 6998->6999 7234 7ff6d7bdbc60 6998->7234 7099 7ff6d7bda780 6999->7099 7003 7ff6d7be1bf9 7005 7ff6d7be1c18 7003->7005 7008 7ff6d7bdbc60 4 API calls 7003->7008 7006 7ff6d7bdbc60 4 API calls 7005->7006 7006->6999 7008->7003 7010 7ff6d7be1c3f 7216 7ff6d7bdb2e0 7010->7216 7013 7ff6d7be406c GetModuleHandleW 7014 7ff6d7be3aef 7013->7014 7014->6975 7014->6985 7017 7ff6d7be3865 __scrt_uninitialize_crt 7015->7017 7016 7ff6d7be3877 7016->6976 7017->7016 7018 7ff6d7be5164 __vcrt_uninitialize 10 API calls 7017->7018 7018->7016 7020 7ff6d7be5139 __vcrt_initialize_winapi_thunks __vcrt_initialize 7019->7020 7035 7ff6d7be6ae8 7020->7035 7023 7ff6d7be5147 7023->6994 7028 7ff6d7be517d 7027->7028 7029 7ff6d7be516c 7027->7029 7028->6993 7073 7ff6d7be557c 7029->7073 7032 7ff6d7be6b30 __vcrt_uninitialize_locks DeleteCriticalSection 7033 7ff6d7be5176 7032->7033 7077 7ff6d7be6f00 7033->7077 7038 7ff6d7be6af0 7035->7038 7037 7ff6d7be6b21 7040 7ff6d7be6b30 __vcrt_uninitialize_locks DeleteCriticalSection 7037->7040 7038->7037 7039 7ff6d7be5143 7038->7039 7052 7ff6d7be6e6c 7038->7052 7039->7023 7041 7ff6d7be5528 7039->7041 7040->7039 7069 7ff6d7be6d40 7041->7069 7057 7ff6d7be6b68 7052->7057 7055 7ff6d7be6eac 7055->7038 7056 7ff6d7be6eb7 InitializeCriticalSectionAndSpinCount 7056->7055 7058 7ff6d7be6bc9 7057->7058 7065 7ff6d7be6bc4 7057->7065 7058->7055 7058->7056 7059 7ff6d7be6cac 7059->7058 7061 7ff6d7be6cba GetProcAddress 7059->7061 7060 7ff6d7be6bf8 LoadLibraryExW 7062 7ff6d7be6c19 GetLastError 7060->7062 7060->7065 7063 7ff6d7be6ccb 7061->7063 7064 7ff6d7be6c24 wcsncmp 7062->7064 7062->7065 7063->7058 7064->7065 7066 7ff6d7be6c3d wcsncmp 7064->7066 7065->7058 7065->7059 7065->7060 7067 7ff6d7be6c91 FreeLibrary 7065->7067 7066->7065 7068 7ff6d7be6c53 LoadLibraryExW 7066->7068 7067->7065 7068->7065 7070 7ff6d7be6b68 try_get_function 7 API calls 7069->7070 7071 7ff6d7be6d65 TlsAlloc 7070->7071 7074 7ff6d7be558b 7073->7074 7075 7ff6d7be5171 7073->7075 7081 7ff6d7be6d88 7074->7081 7075->7032 7078 7ff6d7be6f04 7077->7078 7080 7ff6d7be6f38 7077->7080 7079 7ff6d7be6f1e FreeLibrary 7078->7079 7078->7080 7079->7078 7080->7028 7082 7ff6d7be6b68 try_get_function 7 API calls 7081->7082 7083 7ff6d7be6daf TlsFree 7082->7083 7239 7ff6d7bdf010 7085->7239 7087 7ff6d7bdbe3e 7255 7ff6d7be3560 7087->7255 7089 7ff6d7bdbe55 _invalid_parameter_noinfo_noreturn 7093 7ff6d7bdbe5b _invalid_parameter_noinfo_noreturn 7089->7093 7090 7ff6d7bdbd72 7098 7ff6d7bdbdc5 7090->7098 7264 7ff6d7bdb810 7090->7264 7097 7ff6d7bdbc60 4 API calls 7097->7098 7098->7087 7098->7089 7098->7093 7327 7ff6d7bdbe70 7099->7327 7102 7ff6d7be1260 7103 7ff6d7be12c5 7102->7103 7104 7ff6d7be1973 7103->7104 7332 7ff6d7bdfac0 7103->7332 7106 7ff6d7bdba10 19 API calls 7104->7106 7108 7ff6d7be1971 7106->7108 7407 7ff6d7bd5300 7108->7407 7109 7ff6d7be12e0 7371 7ff6d7be19e0 7109->7371 7113 7ff6d7be199b 7115 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7113->7115 7114 7ff6d7be1320 7116 7ff6d7bdba10 19 API calls 7114->7116 7117 7ff6d7be19ac 7115->7117 7177 7ff6d7be132c 7116->7177 7213 7ff6d7bdbbe0 EnterCriticalSection 7117->7213 7118 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7119 7ff6d7be1959 7118->7119 7120 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7119->7120 7122 7ff6d7be1966 7120->7122 7121 7ff6d7be1336 7123 7ff6d7be1387 7121->7123 7124 7ff6d7be15b8 7121->7124 7126 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7122->7126 7127 7ff6d7be13bd 7123->7127 7128 7ff6d7be13dc 7123->7128 7427 7ff6d7bdc4c0 7124->7427 7126->7108 7411 7ff6d7bd9440 7127->7411 7130 7ff6d7bd53b0 4 API calls 7128->7130 7131 7ff6d7be13f7 _Yarn 7130->7131 7131->7127 7134 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7182 7ff6d7be1553 7134->7182 7141 7ff6d7be19d5 _invalid_parameter_noinfo_noreturn 7145 7ff6d7bdfac0 39 API calls 7149 7ff6d7be1589 7145->7149 7152 7ff6d7be1645 7149->7152 7153 7ff6d7be1596 7149->7153 7156 7ff6d7bdc4c0 19 API calls 7152->7156 7157 7ff6d7bdba10 19 API calls 7153->7157 7160 7ff6d7be164e 7156->7160 7157->7177 7163 7ff6d7be1669 7160->7163 7164 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7160->7164 7165 7ff6d7be16c8 7163->7165 7169 7ff6d7be19cf _invalid_parameter_noinfo_noreturn 7163->7169 7164->7163 7448 7ff6d7be0a30 7165->7448 7169->7141 7170 7ff6d7be1705 7195 7ff6d7be1709 7170->7195 7523 7ff6d7bdf2c0 7170->7523 7175 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7179 7ff6d7be1945 7175->7179 7177->7118 7184 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7179->7184 7180 7ff6d7be1772 7546 7ff6d7bdeea0 GetProcAddress 7180->7546 7181 7ff6d7be1726 7185 7ff6d7bdba10 19 API calls 7181->7185 7182->7141 7392 7ff6d7bdc2c0 7182->7392 7184->7177 7186 7ff6d7be1749 7185->7186 7188 7ff6d7bdba10 19 API calls 7186->7188 7191 7ff6d7be1755 7188->7191 7189 7ff6d7be178f 7199 7ff6d7bdbc60 4 API calls 7189->7199 7190 7ff6d7be18b9 7192 7ff6d7be18c4 7190->7192 7194 7ff6d7bdbc60 4 API calls 7190->7194 7193 7ff6d7bdba10 19 API calls 7191->7193 7196 7ff6d7bdba10 19 API calls 7192->7196 7212 7ff6d7be1856 pre_c_initialization 7192->7212 7193->7195 7197 7ff6d7be18e4 7194->7197 7195->7175 7196->7212 7198 7ff6d7bdbbe0 6 API calls 7197->7198 7200 7ff6d7be18e9 7198->7200 7201 7ff6d7be17ec 7199->7201 7203 7ff6d7bdeea0 5 API calls 7200->7203 7202 7ff6d7bdbc60 4 API calls 7201->7202 7204 7ff6d7be1806 7202->7204 7203->7192 7205 7ff6d7bdbc60 4 API calls 7204->7205 7206 7ff6d7be1820 7205->7206 7207 7ff6d7bdbc60 4 API calls 7206->7207 7208 7ff6d7be183d 7207->7208 7209 7ff6d7bdeea0 5 API calls 7208->7209 7210 7ff6d7be184e 7209->7210 7211 7ff6d7bdbbe0 6 API calls 7210->7211 7211->7212 7212->7195 7214 7ff6d7be1cdc 7213->7214 7215 7ff6d7bdbc05 __acrt_iob_func fflush __acrt_iob_func fflush LeaveCriticalSection 7214->7215 7215->7010 7217 7ff6d7bdb4a5 7216->7217 7220 7ff6d7bdb321 7216->7220 7218 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7217->7218 7219 7ff6d7bdb4b1 7218->7219 7219->7013 7228 7ff6d7bdb370 7220->7228 7831 7ff6d7bdccc0 7220->7831 7223 7ff6d7bdb35b 7226 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7223->7226 7223->7228 7225 7ff6d7bdb402 7843 7ff6d7bda950 7225->7843 7226->7228 7232 7ff6d7bdb4d0 _invalid_parameter_noinfo_noreturn 7228->7232 7805 7ff6d7bdb4e0 RegisterEventSourceW 7228->7805 7229 7ff6d7bdb4d6 _invalid_parameter_noinfo_noreturn 7230 7ff6d7bdb4a0 7230->7217 7231 7ff6d7bdb417 7231->7217 7231->7229 7231->7230 7233 7ff6d7bdb4ca _invalid_parameter_noinfo_noreturn 7231->7233 7232->7229 7233->7232 7235 7ff6d7bdbcdc 7234->7235 7236 7ff6d7bdbc8c EnterCriticalSection 7234->7236 7235->7003 8157 7ff6d7bd88d0 7236->8157 7238 7ff6d7bdbca9 __stdio_common_vfwprintf fputwc LeaveCriticalSection 7238->7235 7240 7ff6d7bdf036 7239->7240 7241 7ff6d7bdf039 GetEnvironmentVariableW 7239->7241 7240->7241 7242 7ff6d7bdf095 7241->7242 7243 7ff6d7bdf051 GetLastError 7241->7243 7247 7ff6d7bdf0ba GetEnvironmentVariableW 7242->7247 7244 7ff6d7bdf082 7243->7244 7245 7ff6d7bdf05e GetLastError 7243->7245 7244->7090 7246 7ff6d7bdf068 7245->7246 7285 7ff6d7bdba10 EnterCriticalSection 7246->7285 7249 7ff6d7bdf100 7247->7249 7250 7ff6d7bdf0d0 GetLastError 7247->7250 7249->7249 7297 7ff6d7bd56f0 7249->7297 7251 7ff6d7bdf0da 7250->7251 7252 7ff6d7bdba10 19 API calls 7251->7252 7254 7ff6d7bdf0f4 7252->7254 7254->7090 7256 7ff6d7be356a 7255->7256 7257 7ff6d7bdbe50 7256->7257 7258 7ff6d7be3c30 IsProcessorFeaturePresent 7256->7258 7257->6998 7259 7ff6d7be3c47 7258->7259 7322 7ff6d7be3d04 RtlCaptureContext 7259->7322 7265 7ff6d7bdb85d EnterCriticalSection __acrt_iob_func 7264->7265 7266 7ff6d7bdb994 7264->7266 7268 7ff6d7bdf010 25 API calls 7265->7268 7267 7ff6d7bdb9cf 7266->7267 7270 7ff6d7bdb9f9 _invalid_parameter_noinfo_noreturn 7266->7270 7269 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7267->7269 7274 7ff6d7bdb894 7268->7274 7271 7ff6d7bdb9e4 7269->7271 7273 7ff6d7bdb9ff _invalid_parameter_noinfo_noreturn 7270->7273 7271->7098 7279 7ff6d7bdef60 7271->7279 7272 7ff6d7bdf010 25 API calls 7276 7ff6d7bdb8e9 7272->7276 7274->7272 7275 7ff6d7bdb957 LeaveCriticalSection 7275->7266 7277 7ff6d7bdb977 7275->7277 7276->7273 7276->7275 7278 7ff6d7bdba10 19 API calls 7277->7278 7278->7266 7280 7ff6d7bdef8a 7279->7280 7281 7ff6d7bd56f0 6 API calls 7280->7281 7282 7ff6d7bdefe8 7281->7282 7283 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7282->7283 7284 7ff6d7bdbda7 7283->7284 7284->7097 7309 7ff6d7bd88d0 7285->7309 7287 7ff6d7bdba5b __stdio_common_vswprintf 7310 7ff6d7bdb6f0 7287->7310 7290 7ff6d7bdbaf1 __acrt_iob_func fputws __acrt_iob_func fputwc 7291 7ff6d7bdbb22 OutputDebugStringW 7290->7291 7292 7ff6d7bdbb34 __acrt_iob_func 7291->7292 7296 7ff6d7bdbb79 7291->7296 7293 7ff6d7bdbb50 __stdio_common_vfwprintf fputwc 7292->7293 7294 7ff6d7bdbb4a 7292->7294 7293->7296 7294->7293 7294->7296 7295 7ff6d7bdbbb7 LeaveCriticalSection 7295->7244 7296->7295 7298 7ff6d7bd5744 7297->7298 7305 7ff6d7bd571a _Yarn 7297->7305 7299 7ff6d7bd5807 7298->7299 7300 7ff6d7bd5757 7298->7300 7301 7ff6d7bd5370 3 API calls 7299->7301 7304 7ff6d7bd53b0 4 API calls 7300->7304 7303 7ff6d7bd580c 7301->7303 7306 7ff6d7bd580d _invalid_parameter_noinfo_noreturn 7303->7306 7307 7ff6d7bd578e _Yarn 7304->7307 7305->7254 7307->7306 7308 7ff6d7bd57e0 7307->7308 7308->7305 7309->7287 7311 7ff6d7bdb720 7310->7311 7312 7ff6d7bdb75c __stdio_common_vswprintf 7310->7312 7313 7ff6d7bdb72f 7311->7313 7314 7ff6d7bdb76a 7311->7314 7312->7290 7315 7ff6d7bd53b0 4 API calls 7313->7315 7319 7ff6d7bdb7f0 7314->7319 7317 7ff6d7bdb734 memset 7315->7317 7317->7312 7320 7ff6d7be20a4 3 API calls 7319->7320 7321 7ff6d7bdb800 7320->7321 7323 7ff6d7be3d1e RtlLookupFunctionEntry 7322->7323 7324 7ff6d7be3d34 RtlVirtualUnwind 7323->7324 7325 7ff6d7be3c5a 7323->7325 7324->7323 7324->7325 7326 7ff6d7be3bfc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 7325->7326 7328 7ff6d7bda790 7327->7328 7329 7ff6d7bdbe9c EnterCriticalSection 7327->7329 7328->7102 7330 7ff6d7bdbeb9 __scrt_initialize_default_local_stdio_options 7329->7330 7331 7ff6d7bdbede LeaveCriticalSection 7330->7331 7331->7328 7333 7ff6d7bdfb0d 7332->7333 7334 7ff6d7bd56f0 6 API calls 7333->7334 7336 7ff6d7bdfb45 7334->7336 7335 7ff6d7bdfbbf GetFullPathNameW 7341 7ff6d7bdfbe4 7335->7341 7342 7ff6d7bdfc09 7335->7342 7336->7335 7337 7ff6d7bdffa7 _invalid_parameter_noinfo_noreturn 7336->7337 7338 7ff6d7bdfba7 GetFileAttributesExW 7336->7338 7340 7ff6d7bdffad _invalid_parameter_noinfo_noreturn 7337->7340 7338->7335 7357 7ff6d7bdfbb8 7338->7357 7345 7ff6d7bdffb3 _invalid_parameter_noinfo_noreturn 7340->7345 7350 7ff6d7bdba10 19 API calls 7341->7350 7341->7357 7343 7ff6d7bdfc55 7342->7343 7344 7ff6d7bdfc25 7342->7344 7346 7ff6d7bdfc61 GetFullPathNameW 7343->7346 7550 7ff6d7bddd90 7343->7550 7351 7ff6d7bd56f0 6 API calls 7344->7351 7353 7ff6d7bdfcae 7346->7353 7359 7ff6d7bdfd3f _Yarn 7346->7359 7347 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7349 7ff6d7bdfd22 7347->7349 7349->7104 7349->7109 7350->7357 7367 7ff6d7bdfc4b _Yarn 7351->7367 7356 7ff6d7bdba10 19 API calls 7353->7356 7360 7ff6d7bdfccc 7353->7360 7354 7ff6d7bdff5d GetFileAttributesExW 7355 7ff6d7bdff72 7354->7355 7354->7360 7355->7360 7362 7ff6d7bd56f0 6 API calls 7355->7362 7356->7360 7357->7347 7561 7ff6d7bdf140 7359->7561 7360->7340 7360->7357 7361 7ff6d7bdfe06 7363 7ff6d7bddd90 5 API calls 7361->7363 7364 7ff6d7bdfe16 7361->7364 7362->7360 7363->7364 7365 7ff6d7bdfede 7364->7365 7364->7367 7366 7ff6d7bd53b0 4 API calls 7365->7366 7369 7ff6d7bdfeec _Yarn 7366->7369 7367->7345 7367->7354 7368 7ff6d7bdff3c 7368->7367 7369->7368 7370 7ff6d7bdffa1 _invalid_parameter_noinfo_noreturn 7369->7370 7370->7337 7372 7ff6d7be1a35 7371->7372 7372->7372 7590 7ff6d7bd55a0 7372->7590 7374 7ff6d7be1a49 7615 7ff6d7bdffd0 7374->7615 7377 7ff6d7be1a5b 7378 7ff6d7bdba10 19 API calls 7377->7378 7391 7ff6d7be1a67 7378->7391 7379 7ff6d7be1b24 7381 7ff6d7bdbc60 4 API calls 7379->7381 7380 7ff6d7be1a6e 7380->7379 7383 7ff6d7be1ba4 7380->7383 7389 7ff6d7be1b07 7380->7389 7381->7391 7382 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7386 7ff6d7be131c 7382->7386 7387 7ff6d7bd5390 3 API calls 7383->7387 7384 7ff6d7be1b9e _invalid_parameter_noinfo_noreturn 7384->7383 7385 7ff6d7be1b73 7385->7382 7386->7114 7386->7121 7388 7ff6d7be1ba9 7387->7388 7390 7ff6d7bdba10 19 API calls 7389->7390 7390->7391 7391->7384 7391->7385 7393 7ff6d7bdc310 7392->7393 7393->7393 7394 7ff6d7bd56f0 6 API calls 7393->7394 7396 7ff6d7bdc324 7394->7396 7395 7ff6d7bdc36f 7397 7ff6d7bdc379 7395->7397 7400 7ff6d7bdc39a 7395->7400 7396->7395 7399 7ff6d7bdc3fa _invalid_parameter_noinfo_noreturn 7396->7399 7402 7ff6d7bd56f0 6 API calls 7397->7402 7398 7ff6d7bdc3c5 7398->7398 7401 7ff6d7bda600 6 API calls 7398->7401 7400->7398 7624 7ff6d7bdd030 7400->7624 7404 7ff6d7bdc398 7401->7404 7402->7404 7405 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7404->7405 7406 7ff6d7bdc3ea 7405->7406 7406->7145 7408 7ff6d7bd5313 7407->7408 7409 7ff6d7bd533c 7407->7409 7408->7409 7410 7ff6d7bd535b _invalid_parameter_noinfo_noreturn 7408->7410 7409->7113 7412 7ff6d7bd9488 _wfopen 7411->7412 7413 7ff6d7bd9720 7412->7413 7414 7ff6d7bdba10 19 API calls 7413->7414 7415 7ff6d7bd972c 7414->7415 7416 7ff6d7bdba10 19 API calls 7415->7416 7417 7ff6d7bd9738 7416->7417 7418 7ff6d7be449c _CxxThrowException 2 API calls 7417->7418 7419 7ff6d7bd9751 7418->7419 7420 7ff6d7bdba10 19 API calls 7419->7420 7421 7ff6d7bd975d 7420->7421 7422 7ff6d7bdba10 19 API calls 7421->7422 7423 7ff6d7bd9769 7422->7423 7424 7ff6d7be449c _CxxThrowException 2 API calls 7423->7424 7425 7ff6d7bd9782 _invalid_parameter_noinfo_noreturn 7424->7425 7426 7ff6d7bd97a3 7425->7426 7428 7ff6d7bdc518 7427->7428 7429 7ff6d7bd53b0 4 API calls 7428->7429 7432 7ff6d7bdc521 _Yarn 7428->7432 7429->7432 7430 7ff6d7bdc725 7634 7ff6d7bdd200 7430->7634 7432->7430 7434 7ff6d7bdc664 7432->7434 7433 7ff6d7bdc748 7435 7ff6d7bda600 6 API calls 7433->7435 7437 7ff6d7bd56f0 6 API calls 7434->7437 7436 7ff6d7bdc762 7435->7436 7438 7ff6d7bdd030 6 API calls 7436->7438 7439 7ff6d7bdc6bf 7437->7439 7440 7ff6d7bdc76f 7438->7440 7441 7ff6d7bdd030 6 API calls 7439->7441 7444 7ff6d7bdc7d6 _invalid_parameter_noinfo_noreturn 7440->7444 7447 7ff6d7bdc720 7440->7447 7442 7ff6d7bdc6ce 7441->7442 7446 7ff6d7bdc7dc _invalid_parameter_noinfo_noreturn 7442->7446 7442->7447 7443 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7445 7ff6d7bdc7bb 7443->7445 7444->7446 7445->7134 7445->7182 7447->7443 7449 7ff6d7be0a8a 7448->7449 7458 7ff6d7be0acf 7448->7458 7450 7ff6d7bd56f0 6 API calls 7449->7450 7451 7ff6d7be0ab3 7450->7451 7643 7ff6d7bdced0 7451->7643 7453 7ff6d7be0b2b 7459 7ff6d7bdbc60 4 API calls 7453->7459 7454 7ff6d7be0b69 7657 7ff6d7bdc7f0 7454->7657 7457 7ff6d7be10dd _invalid_parameter_noinfo_noreturn 7462 7ff6d7be10e3 _invalid_parameter_noinfo_noreturn 7457->7462 7458->7453 7458->7454 7458->7457 7460 7ff6d7be0b44 7459->7460 7470 7ff6d7bd56f0 6 API calls 7460->7470 7495 7ff6d7be0b62 7460->7495 7464 7ff6d7be10e9 _invalid_parameter_noinfo_noreturn 7462->7464 7465 7ff6d7be10ef _invalid_parameter_noinfo_noreturn 7464->7465 7468 7ff6d7be10f5 _invalid_parameter_noinfo_noreturn 7465->7468 7466 7ff6d7be0ba1 7475 7ff6d7bdbc60 4 API calls 7466->7475 7467 7ff6d7be0bca 7677 7ff6d7bdeb90 7467->7677 7472 7ff6d7be10fb _invalid_parameter_noinfo_noreturn 7468->7472 7470->7495 7471 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7474 7ff6d7be10b2 7471->7474 7476 7ff6d7be1101 _invalid_parameter_noinfo_noreturn 7472->7476 7474->7170 7485 7ff6d7be0bc8 7475->7485 7478 7ff6d7be111e 7476->7478 7479 7ff6d7be1127 7476->7479 7477 7ff6d7be0bf9 7481 7ff6d7bdbc60 4 API calls 7477->7481 7482 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7478->7482 7479->7170 7484 7ff6d7be0c16 7481->7484 7482->7479 7484->7485 7489 7ff6d7bd56f0 6 API calls 7484->7489 7487 7ff6d7bd53b0 4 API calls 7485->7487 7490 7ff6d7be0c5a _Yarn 7485->7490 7486 7ff6d7be0be6 7488 7ff6d7bdba10 19 API calls 7486->7488 7487->7490 7522 7ff6d7be0bf2 7488->7522 7489->7485 7491 7ff6d7bdc2c0 17 API calls 7490->7491 7492 7ff6d7be0cbf 7491->7492 7493 7ff6d7bdc2c0 17 API calls 7492->7493 7494 7ff6d7be0ccf 7493->7494 7720 7ff6d7bddf40 7494->7720 7495->7471 7497 7ff6d7be10d7 _invalid_parameter_noinfo_noreturn 7497->7457 7499 7ff6d7bdeb90 27 API calls 7500 7ff6d7be0cf2 7499->7500 7501 7ff6d7be0d04 7500->7501 7502 7ff6d7bde2c0 53 API calls 7500->7502 7503 7ff6d7bdd200 6 API calls 7501->7503 7521 7ff6d7be0dd1 7501->7521 7502->7501 7505 7ff6d7be0d67 7503->7505 7504 7ff6d7bdba10 19 API calls 7506 7ff6d7be0e72 7504->7506 7507 7ff6d7bda600 6 API calls 7505->7507 7508 7ff6d7bdba10 19 API calls 7506->7508 7509 7ff6d7be0d7e 7507->7509 7510 7ff6d7be0e7e 7508->7510 7511 7ff6d7bda600 6 API calls 7509->7511 7512 7ff6d7bdba10 19 API calls 7510->7512 7513 7ff6d7be0d9a 7511->7513 7514 7ff6d7be0e8a 7512->7514 7515 7ff6d7bda600 6 API calls 7513->7515 7730 7ff6d7bdc840 7514->7730 7517 7ff6d7be0db1 7515->7517 7519 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7517->7519 7519->7521 7520 7ff6d7bdba10 19 API calls 7520->7522 7521->7462 7521->7504 7522->7464 7522->7465 7522->7468 7522->7472 7522->7476 7522->7495 7522->7497 7524 7ff6d7bdf308 7523->7524 7525 7ff6d7bd53b0 4 API calls 7524->7525 7526 7ff6d7bdf311 _Yarn 7524->7526 7525->7526 7527 7ff6d7bdf382 LoadLibraryExW 7526->7527 7528 7ff6d7bdfac0 39 API calls 7526->7528 7529 7ff6d7bdf3dc GetModuleHandleExW 7527->7529 7530 7ff6d7bdf3a6 GetLastError 7527->7530 7531 7ff6d7bdf37e 7528->7531 7533 7ff6d7bdf3fd 7529->7533 7536 7ff6d7bdf425 7529->7536 7532 7ff6d7bdf3b0 7530->7532 7531->7527 7531->7530 7534 7ff6d7bdba10 19 API calls 7532->7534 7535 7ff6d7bdba10 19 API calls 7533->7535 7545 7ff6d7bdf3d5 7534->7545 7535->7545 7536->7545 7792 7ff6d7bddba0 7536->7792 7538 7ff6d7bdf4dd 7539 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7538->7539 7541 7ff6d7bdf4f1 7539->7541 7541->7180 7541->7181 7542 7ff6d7bdbc60 4 API calls 7542->7545 7543 7ff6d7bdf509 _invalid_parameter_noinfo_noreturn 7544 7ff6d7bdf50f _invalid_parameter_noinfo_noreturn 7543->7544 7545->7538 7545->7543 7545->7544 7547 7ff6d7bdeebb 7546->7547 7548 7ff6d7bdeeca 7546->7548 7549 7ff6d7bdbc60 4 API calls 7547->7549 7548->7189 7548->7190 7549->7548 7551 7ff6d7bdddf5 7550->7551 7552 7ff6d7bd5370 3 API calls 7551->7552 7553 7ff6d7bddf0d MultiByteToWideChar 7552->7553 7555 7ff6d7be005c 7553->7555 7556 7ff6d7be00b7 7553->7556 7557 7ff6d7be007d 7555->7557 7559 7ff6d7be0065 MultiByteToWideChar 7555->7559 7556->7346 7557->7556 7558 7ff6d7bddd90 3 API calls 7557->7558 7558->7556 7559->7556 7562 7ff6d7bdf157 7561->7562 7563 7ff6d7bdf16b 7562->7563 7564 7ff6d7bdf256 7562->7564 7569 7ff6d7bdf17e _Yarn 7563->7569 7570 7ff6d7bdd9e0 7563->7570 7579 7ff6d7bd5390 7564->7579 7568 7ff6d7bdf249 7568->7361 7569->7361 7571 7ff6d7bdda0e 7570->7571 7572 7ff6d7bddb4b 7570->7572 7574 7ff6d7bd53b0 4 API calls 7571->7574 7573 7ff6d7bd5370 3 API calls 7572->7573 7575 7ff6d7bddb50 7573->7575 7576 7ff6d7bdda61 _Yarn 7574->7576 7577 7ff6d7bddaec _Yarn 7576->7577 7578 7ff6d7bddb45 _invalid_parameter_noinfo_noreturn 7576->7578 7577->7568 7578->7572 7582 7ff6d7be20c8 7579->7582 7587 7ff6d7be2014 7582->7587 7585 7ff6d7be449c _CxxThrowException 2 API calls 7586 7ff6d7be20ea 7585->7586 7588 7ff6d7be43e4 __std_exception_copy free 7587->7588 7589 7ff6d7be204b 7588->7589 7589->7585 7591 7ff6d7bd55e5 7590->7591 7609 7ff6d7bd55c4 _Yarn 7590->7609 7592 7ff6d7bd56e3 7591->7592 7593 7ff6d7bd55f8 7591->7593 7594 7ff6d7bd5370 3 API calls 7592->7594 7595 7ff6d7bd5662 7593->7595 7596 7ff6d7bd5634 7593->7596 7603 7ff6d7bd5674 _Yarn 7594->7603 7599 7ff6d7bd5667 7595->7599 7595->7603 7598 7ff6d7be3404 std::locale::_Locimp::_New_Locimp 3 API calls 7596->7598 7597 7ff6d7bd56e9 _invalid_parameter_noinfo_noreturn 7601 7ff6d7bd56f0 7597->7601 7602 7ff6d7bd564b 7598->7602 7600 7ff6d7be3404 std::locale::_Locimp::_New_Locimp 3 API calls 7599->7600 7600->7602 7604 7ff6d7bd5807 7601->7604 7605 7ff6d7bd5757 7601->7605 7608 7ff6d7bd571a _Yarn 7601->7608 7602->7597 7602->7603 7603->7597 7603->7609 7606 7ff6d7bd5370 3 API calls 7604->7606 7611 7ff6d7bd53b0 4 API calls 7605->7611 7610 7ff6d7bd580c 7606->7610 7608->7374 7609->7374 7612 7ff6d7bd580d _invalid_parameter_noinfo_noreturn 7610->7612 7613 7ff6d7bd578e _Yarn 7611->7613 7613->7612 7614 7ff6d7bd57e0 7613->7614 7614->7608 7616 7ff6d7bdffd5 MultiByteToWideChar 7615->7616 7618 7ff6d7be005c 7616->7618 7619 7ff6d7be00b7 7616->7619 7620 7ff6d7be007d 7618->7620 7622 7ff6d7be0065 MultiByteToWideChar 7618->7622 7619->7377 7619->7380 7620->7619 7621 7ff6d7bddd90 5 API calls 7620->7621 7621->7619 7622->7619 7625 7ff6d7bdd051 7624->7625 7630 7ff6d7bdd07c 7624->7630 7625->7398 7626 7ff6d7bdd180 7627 7ff6d7bd5370 3 API calls 7626->7627 7629 7ff6d7bdd185 7627->7629 7628 7ff6d7bd53b0 4 API calls 7631 7ff6d7bdd0e0 _Yarn 7628->7631 7630->7626 7630->7628 7632 7ff6d7bdd13d _Yarn 7631->7632 7633 7ff6d7bdd17a _invalid_parameter_noinfo_noreturn 7631->7633 7632->7398 7633->7626 7635 7ff6d7bdd21c 7634->7635 7642 7ff6d7bdd2e5 _Yarn 7634->7642 7636 7ff6d7bdd37e 7635->7636 7637 7ff6d7bdd25d 7635->7637 7641 7ff6d7bdd294 _Yarn 7635->7641 7635->7642 7638 7ff6d7bd5370 3 API calls 7636->7638 7639 7ff6d7bd53b0 4 API calls 7637->7639 7638->7641 7639->7641 7640 7ff6d7bdd384 _invalid_parameter_noinfo_noreturn 7641->7640 7641->7642 7642->7433 7644 7ff6d7bdcf10 7643->7644 7645 7ff6d7bd53b0 4 API calls 7644->7645 7646 7ff6d7bdcf19 _Yarn 7644->7646 7645->7646 7647 7ff6d7bdc2c0 17 API calls 7646->7647 7648 7ff6d7bdcf8b 7647->7648 7649 7ff6d7bddf40 40 API calls 7648->7649 7650 7ff6d7bdcf95 7649->7650 7652 7ff6d7bd56f0 6 API calls 7650->7652 7653 7ff6d7bdcf99 7650->7653 7651 7ff6d7bdd005 7654 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7651->7654 7652->7653 7653->7651 7655 7ff6d7bdd025 _invalid_parameter_noinfo_noreturn 7653->7655 7656 7ff6d7bdd01a 7654->7656 7656->7458 7768 7ff6d7bdf280 GetCurrentProcess IsWow64Process 7657->7768 7660 7ff6d7bd56f0 6 API calls 7661 7ff6d7bdc837 7660->7661 7662 7ff6d7bdcba0 7661->7662 7663 7ff6d7bdcbd9 7662->7663 7664 7ff6d7bdf010 25 API calls 7663->7664 7665 7ff6d7bdcbff 7664->7665 7666 7ff6d7bdfac0 39 API calls 7665->7666 7671 7ff6d7bdcc3b 7665->7671 7668 7ff6d7bdcc0f 7666->7668 7667 7ff6d7bdcc9a 7672 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7667->7672 7669 7ff6d7bdcc13 7668->7669 7670 7ff6d7bdcc3f 7668->7670 7669->7671 7676 7ff6d7bd56f0 6 API calls 7669->7676 7673 7ff6d7bdbe70 shared_ptr 2 API calls 7670->7673 7671->7667 7674 7ff6d7bdccba _invalid_parameter_noinfo_noreturn 7671->7674 7675 7ff6d7bdccaf 7672->7675 7673->7671 7675->7466 7675->7467 7676->7671 7678 7ff6d7bdebd5 7677->7678 7679 7ff6d7bdec02 7678->7679 7680 7ff6d7bdec2d 7678->7680 7681 7ff6d7bd56f0 6 API calls 7679->7681 7705 7ff6d7bdec25 7679->7705 7682 7ff6d7bdec50 RegOpenKeyExW 7680->7682 7681->7705 7683 7ff6d7bdec82 7682->7683 7684 7ff6d7bdec95 RegGetValueW 7682->7684 7685 7ff6d7bdbe70 shared_ptr 2 API calls 7683->7685 7686 7ff6d7bdeda5 7684->7686 7687 7ff6d7bdecca 7684->7687 7685->7705 7692 7ff6d7bdbe70 shared_ptr 2 API calls 7686->7692 7687->7686 7691 7ff6d7bdecd5 7687->7691 7688 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7693 7ff6d7bdee5e 7688->7693 7689 7ff6d7bdee77 _invalid_parameter_noinfo_noreturn 7695 7ff6d7bdee7d _invalid_parameter_noinfo_noreturn 7689->7695 7690 7ff6d7bdee49 7690->7688 7696 7ff6d7bdb6f0 7 API calls 7691->7696 7694 7ff6d7bdedb3 RegCloseKey 7692->7694 7693->7477 7706 7ff6d7bde2c0 7693->7706 7694->7705 7697 7ff6d7bdee83 _invalid_parameter_noinfo_noreturn 7695->7697 7698 7ff6d7bdece7 RegGetValueW 7696->7698 7699 7ff6d7bded36 7698->7699 7700 7ff6d7bded19 7698->7700 7703 7ff6d7bd56f0 6 API calls 7699->7703 7701 7ff6d7bdbe70 shared_ptr 2 API calls 7700->7701 7702 7ff6d7bded27 RegCloseKey 7701->7702 7702->7705 7704 7ff6d7bded56 RegCloseKey 7703->7704 7704->7705 7705->7689 7705->7690 7705->7695 7705->7697 7707 7ff6d7bde30c 7706->7707 7708 7ff6d7bde310 7707->7708 7709 7ff6d7bde33a GetCurrentProcess IsWow64Process 7707->7709 7711 7ff6d7bd56f0 6 API calls 7708->7711 7713 7ff6d7bde338 7708->7713 7710 7ff6d7bde356 7709->7710 7712 7ff6d7bdcba0 47 API calls 7710->7712 7711->7713 7714 7ff6d7bde37a 7712->7714 7715 7ff6d7bde3cc 7713->7715 7719 7ff6d7bde3ec _invalid_parameter_noinfo_noreturn 7713->7719 7714->7713 7718 7ff6d7bdc2c0 17 API calls 7714->7718 7716 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7715->7716 7717 7ff6d7bde3e1 7716->7717 7717->7477 7717->7486 7718->7713 7721 7ff6d7bddf74 7720->7721 7722 7ff6d7bddf7b 7720->7722 7723 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7721->7723 7725 7ff6d7bd53b0 4 API calls 7722->7725 7727 7ff6d7bddf94 _Yarn 7722->7727 7724 7ff6d7bde04c 7723->7724 7724->7499 7724->7501 7724->7522 7725->7727 7726 7ff6d7bdfac0 39 API calls 7728 7ff6d7bddffb 7726->7728 7727->7726 7728->7721 7729 7ff6d7bde05c _invalid_parameter_noinfo_noreturn 7728->7729 7731 7ff6d7bd56f0 6 API calls 7730->7731 7734 7ff6d7bdc8a2 7731->7734 7732 7ff6d7bdc935 7733 7ff6d7bda600 6 API calls 7732->7733 7735 7ff6d7bdc95d 7733->7735 7734->7732 7736 7ff6d7bda600 6 API calls 7734->7736 7737 7ff6d7bda600 6 API calls 7735->7737 7738 7ff6d7bdc8e4 7736->7738 7739 7ff6d7bdc972 7737->7739 7742 7ff6d7bda600 6 API calls 7738->7742 7740 7ff6d7bda600 6 API calls 7739->7740 7741 7ff6d7bdc987 7740->7741 7743 7ff6d7bdf010 25 API calls 7741->7743 7749 7ff6d7bdc906 7742->7749 7744 7ff6d7bdc9a8 7743->7744 7745 7ff6d7bdc9ac 7744->7745 7770 7ff6d7bde070 memset LoadLibraryA 7744->7770 7747 7ff6d7bda600 6 API calls 7745->7747 7748 7ff6d7bdcb16 7747->7748 7752 7ff6d7bda600 6 API calls 7748->7752 7749->7735 7753 7ff6d7bda600 6 API calls 7749->7753 7750 7ff6d7bdc9e6 7756 7ff6d7bdca91 7750->7756 7757 7ff6d7bdcb94 _invalid_parameter_noinfo_noreturn 7750->7757 7759 7ff6d7bd56f0 6 API calls 7750->7759 7755 7ff6d7bdcb30 7752->7755 7753->7732 7754 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7754->7750 7758 7ff6d7bdcb68 7755->7758 7764 7ff6d7bdcb8e _invalid_parameter_noinfo_noreturn 7755->7764 7756->7745 7760 7ff6d7bda600 6 API calls 7756->7760 7762 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7758->7762 7761 7ff6d7bdca7e 7759->7761 7763 7ff6d7bdcac2 7760->7763 7765 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7761->7765 7766 7ff6d7bdcb7c 7762->7766 7767 7ff6d7bda600 6 API calls 7763->7767 7764->7757 7765->7756 7766->7520 7767->7745 7769 7ff6d7bdc7fe 7768->7769 7769->7660 7771 7ff6d7bde0f8 GetProcAddress 7770->7771 7790 7ff6d7bde160 7770->7790 7774 7ff6d7bde111 7771->7774 7771->7790 7772 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7773 7ff6d7bdc9d1 7772->7773 7773->7750 7773->7754 7775 7ff6d7bde193 7774->7775 7776 7ff6d7bde143 7774->7776 7774->7790 7780 7ff6d7bda600 6 API calls 7775->7780 7775->7790 7777 7ff6d7bde14b 7776->7777 7778 7ff6d7bde17c 7776->7778 7781 7ff6d7bde165 7777->7781 7782 7ff6d7bde150 7777->7782 7779 7ff6d7bda600 6 API calls 7778->7779 7779->7790 7785 7ff6d7bde1b1 7780->7785 7784 7ff6d7bda600 6 API calls 7781->7784 7783 7ff6d7bda600 6 API calls 7782->7783 7783->7790 7784->7790 7786 7ff6d7bde227 7785->7786 7787 7ff6d7bd56f0 6 API calls 7785->7787 7788 7ff6d7bda600 6 API calls 7786->7788 7787->7786 7789 7ff6d7bde24d 7788->7789 7789->7790 7791 7ff6d7bde2b8 _invalid_parameter_noinfo_noreturn 7789->7791 7790->7772 7793 7ff6d7bddbf0 7792->7793 7794 7ff6d7bddc1e GetModuleFileNameW 7793->7794 7795 7ff6d7bddd90 5 API calls 7793->7795 7794->7793 7796 7ff6d7bddc4a 7794->7796 7795->7794 7797 7ff6d7bddc58 7796->7797 7799 7ff6d7bddd90 5 API calls 7796->7799 7800 7ff6d7bddc4f 7796->7800 7797->7800 7804 7ff6d7bd56f0 6 API calls 7797->7804 7798 7ff6d7bddcdb 7801 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7798->7801 7799->7797 7800->7798 7802 7ff6d7bddcff _invalid_parameter_noinfo_noreturn 7800->7802 7803 7ff6d7bddcef 7801->7803 7803->7542 7804->7800 7806 7ff6d7bda600 6 API calls 7805->7806 7807 7ff6d7bdb554 7806->7807 7808 7ff6d7bda600 6 API calls 7807->7808 7809 7ff6d7bdb569 7808->7809 7810 7ff6d7bda600 6 API calls 7809->7810 7811 7ff6d7bdb589 7810->7811 7812 7ff6d7bda600 6 API calls 7811->7812 7813 7ff6d7bdb5a0 7812->7813 7814 7ff6d7bda600 6 API calls 7813->7814 7815 7ff6d7bdb5b5 7814->7815 7815->7815 7816 7ff6d7bda600 6 API calls 7815->7816 7817 7ff6d7bdb5cd 7816->7817 7818 7ff6d7bda600 6 API calls 7817->7818 7819 7ff6d7bdb5df 7818->7819 7820 7ff6d7bda600 6 API calls 7819->7820 7821 7ff6d7bdb5f6 7820->7821 7822 7ff6d7bda600 6 API calls 7821->7822 7823 7ff6d7bdb61c 7822->7823 7824 7ff6d7bda600 6 API calls 7823->7824 7825 7ff6d7bdb62e ReportEventW DeregisterEventSource 7824->7825 7826 7ff6d7bdb6b9 7825->7826 7827 7ff6d7bdb68b 7825->7827 7828 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7826->7828 7827->7826 7829 7ff6d7bdb6e6 _invalid_parameter_noinfo_noreturn 7827->7829 7830 7ff6d7bdb3ef GetModuleHandleW 7828->7830 7830->7225 7830->7231 7832 7ff6d7bdcd67 7831->7832 7835 7ff6d7bdccd6 7831->7835 7895 7ff6d7bd2070 7832->7895 7834 7ff6d7bdcd6f 7834->7223 7835->7832 7836 7ff6d7bdcd1d 7835->7836 7837 7ff6d7bdcd3b 7836->7837 7838 7ff6d7bdcd78 7836->7838 7841 7ff6d7bd56f0 6 API calls 7837->7841 7839 7ff6d7bd5390 3 API calls 7838->7839 7840 7ff6d7bdcd7d 7839->7840 7842 7ff6d7bdcd5e 7841->7842 7842->7223 7844 7ff6d7bda99c 7843->7844 7845 7ff6d7bdf010 25 API calls 7844->7845 7859 7ff6d7bdb1b7 7844->7859 7846 7ff6d7bda9d3 7845->7846 7849 7ff6d7bd56f0 6 API calls 7846->7849 7853 7ff6d7bdb0ca 7846->7853 7847 7ff6d7be3560 __FrameHandler3::UnwindNestedFrames 8 API calls 7848 7ff6d7bdb1cb 7847->7848 7848->7231 7850 7ff6d7bdaa2d 7849->7850 7851 7ff6d7bdaadf 7850->7851 7852 7ff6d7bdaa4c 7850->7852 7868 7ff6d7bdaa72 7851->7868 7899 7ff6d7bd7190 7851->7899 7854 7ff6d7bdc840 41 API calls 7852->7854 7858 7ff6d7bdb1e3 _invalid_parameter_noinfo_noreturn 7853->7858 7853->7859 7885 7ff6d7bdb21f _invalid_parameter_noinfo_noreturn 7853->7885 7887 7ff6d7bdb225 _invalid_parameter_noinfo_noreturn 7853->7887 7856 7ff6d7bdaa5d 7854->7856 7864 7ff6d7bd5300 _invalid_parameter_noinfo_noreturn 7856->7864 7856->7868 7857 7ff6d7bda600 6 API calls 7861 7ff6d7bdb023 7857->7861 7863 7ff6d7bdb1e9 _invalid_parameter_noinfo_noreturn 7858->7863 7859->7847 7865 7ff6d7bda600 6 API calls 7861->7865 7866 7ff6d7bdb1ef _invalid_parameter_noinfo_noreturn 7863->7866 7864->7868 7867 7ff6d7bdb039 7865->7867 7869 7ff6d7bdb1f5 _invalid_parameter_noinfo_noreturn 7866->7869 7870 7ff6d7bda600 6 API calls 7867->7870 7868->7857 7868->7863 7886 7ff6d7bdb219 _invalid_parameter_noinfo_noreturn 7868->7886 7873 7ff6d7bdb1fb _invalid_parameter_noinfo_noreturn 7869->7873 7871 7ff6d7bdb04f 7870->7871 7874 7ff6d7bdbe70 shared_ptr 2 API calls 7871->7874 7875 7ff6d7bdb201 7873->7875 7876 7ff6d7bdb06f MessageBoxW 7874->7876 7877 7ff6d7bd5390 3 API calls 7875->7877 7876->7853 7878 7ff6d7bdb09c ShellExecuteW 7876->7878 7880 7ff6d7bdb206 _invalid_parameter_noinfo_noreturn 7877->7880 7878->7853 7882 7ff6d7bdb20d _invalid_parameter_noinfo_noreturn 7880->7882 7884 7ff6d7bdb213 _invalid_parameter_noinfo_noreturn 7882->7884 7884->7886 7885->7887 7886->7885 7896 7ff6d7bd209f 7895->7896 7897 7ff6d7bd53b0 4 API calls 7896->7897 7898 7ff6d7bd20a8 _Yarn 7896->7898 7897->7898 7898->7834 7949 7ff6d7bd5820 7899->7949 7950 7ff6d7bd5836 7949->7950 7957 7ff6d7bd7320 7950->7957 7952 7ff6d7bd586b 7967 7ff6d7bd2790 7952->7967 7977 7ff6d7be2a14 7957->7977 7959 7ff6d7bd7355 7959->7952 7960 7ff6d7bd7351 7960->7959 7961 7ff6d7bd738f 7960->7961 7964 7ff6d7bd73c0 7960->7964 7962 7ff6d7bd55a0 7 API calls 7961->7962 7963 7ff6d7bd73b7 7962->7963 7963->7952 7964->7964 7965 7ff6d7bd55a0 7 API calls 7964->7965 7966 7ff6d7bd73f7 7965->7966 7966->7952 7968 7ff6d7bd27e0 7967->7968 7968->7968 7969 7ff6d7bd55a0 7 API calls 7968->7969 7970 7ff6d7bd27f4 7969->7970 7983 7ff6d7bd24e0 7970->7983 7979 7ff6d7be3140 7977->7979 7978 7ff6d7be3179 7978->7960 7979->7978 7980 7ff6d7be31fa SetLastError 7979->7980 7981 7ff6d7be319d SwitchToThread 7979->7981 7982 7ff6d7be31d1 7979->7982 7980->7978 7981->7979 7982->7978 7982->7980 7984 7ff6d7bd2524 _Yarn 7983->7984 7986 7ff6d7bd4f80 7984->7986 7987 7ff6d7bd4fc5 7986->7987 7988 7ff6d7bd4fd5 _Yarn 7986->7988 7987->7988 7998 7ff6d7bd1850 7987->7998 8010 7ff6d7bd5420 7988->8010 7999 7ff6d7bd19c3 7998->7999 8000 7ff6d7bd187e 7998->8000 8001 7ff6d7bd5370 3 API calls 7999->8001 8003 7ff6d7bd18ff 8000->8003 8004 7ff6d7bd18d1 8000->8004 8002 7ff6d7bd19c8 8001->8002 8006 7ff6d7be3404 std::locale::_Locimp::_New_Locimp 3 API calls 8003->8006 8008 7ff6d7bd18e8 _Yarn 8003->8008 8005 7ff6d7be3404 std::locale::_Locimp::_New_Locimp 3 API calls 8004->8005 8005->8008 8006->8008 8007 7ff6d7bd19bd _invalid_parameter_noinfo_noreturn 8007->7999 8008->8007 8009 7ff6d7bd1970 _Yarn 8008->8009 8009->7988 8011 7ff6d7bd5482 8010->8011 8012 7ff6d7bd1850 5 API calls 8011->8012 8157->7238 6868 7ff6d7be38f0 6869 7ff6d7be3900 pre_c_initialization 6868->6869 6881 7ff6d7be36bc 6869->6881 6872 7ff6d7be39a6 __scrt_initialize_default_local_stdio_options 6873 7ff6d7be3925 pre_c_initialization _RTC_Initialize 6879 7ff6d7be3988 pre_c_initialization 6873->6879 6889 7ff6d7be41bc InitializeSListHead 6873->6889 6875 7ff6d7be394f pre_c_initialization 6876 7ff6d7be3973 _configthreadlocale 6875->6876 6877 7ff6d7be397f __scrt_uninitialize_crt 6876->6877 6878 7ff6d7be3983 _initialize_wide_environment 6877->6878 6877->6879 6878->6879 6880 7ff6d7be3996 6879->6880 6890 7ff6d7be3f18 IsProcessorFeaturePresent 6879->6890 6882 7ff6d7be3707 6881->6882 6883 7ff6d7be36d1 6881->6883 6882->6873 6884 7ff6d7be3789 6883->6884 6887 7ff6d7be36da __scrt_acquire_startup_lock 6883->6887 6885 7ff6d7be3f18 __scrt_fastfail 9 API calls 6884->6885 6886 7ff6d7be3793 6885->6886 6887->6882 6888 7ff6d7be36f7 _initialize_onexit_table 6887->6888 6888->6882 6891 7ff6d7be3f3d __scrt_fastfail 6890->6891 6892 7ff6d7be3f4b memset RtlCaptureContext RtlLookupFunctionEntry 6891->6892 6893 7ff6d7be3f85 RtlVirtualUnwind 6892->6893 6894 7ff6d7be3fc1 memset IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6892->6894 6893->6894 6895 7ff6d7be4045 __scrt_fastfail 6894->6895 6895->6872 6901 7ff6d7bda7a0 6902 7ff6d7bda7b0 6901->6902 6907 7ff6d7bda600 6902->6907 6904 7ff6d7bda7ca 6905 7ff6d7bda600 6 API calls 6904->6905 6906 7ff6d7bda7df __acrt_iob_func fputws __acrt_iob_func 6905->6906 6908 7ff6d7bda65e 6907->6908 6914 7ff6d7bda632 _Yarn 6907->6914 6909 7ff6d7bda76e 6908->6909 6911 7ff6d7bda69d 6908->6911 6930 7ff6d7bd5370 6909->6930 6918 7ff6d7bd53b0 6911->6918 6914->6904 6915 7ff6d7bda71c _Yarn 6915->6914 6916 7ff6d7bda6b7 _Yarn 6916->6915 6917 7ff6d7bda768 _invalid_parameter_noinfo_noreturn 6916->6917 6917->6909 6919 7ff6d7bd53d3 6918->6919 6922 7ff6d7bd53eb 6919->6922 6933 7ff6d7be3404 6919->6933 6921 7ff6d7be341e malloc 6921->6922 6923 7ff6d7be3428 6921->6923 6922->6921 6924 7ff6d7bd5415 6922->6924 6925 7ff6d7be342e 6922->6925 6923->6916 6924->6916 6926 7ff6d7be3439 6925->6926 6942 7ff6d7be2060 6925->6942 6946 7ff6d7be3bd4 6926->6946 6955 7ff6d7be20a4 6930->6955 6934 7ff6d7be341e malloc 6933->6934 6935 7ff6d7be3428 6934->6935 6937 7ff6d7be340f 6934->6937 6935->6922 6936 7ff6d7be342e 6938 7ff6d7be3439 6936->6938 6939 7ff6d7be2060 Concurrency::cancel_current_task 2 API calls 6936->6939 6937->6934 6937->6936 6940 7ff6d7be3bd4 Concurrency::cancel_current_task 2 API calls 6938->6940 6939->6938 6941 7ff6d7be343f 6940->6941 6943 7ff6d7be206e std::bad_alloc::bad_alloc 6942->6943 6950 7ff6d7be449c 6943->6950 6945 7ff6d7be207f 6947 7ff6d7be3be2 std::bad_alloc::bad_alloc 6946->6947 6948 7ff6d7be449c _CxxThrowException 2 API calls 6947->6948 6949 7ff6d7be3bf3 6948->6949 6951 7ff6d7be4502 RtlPcToFileHeader 6950->6951 6952 7ff6d7be44e5 6950->6952 6953 7ff6d7be4535 RaiseException 6951->6953 6954 7ff6d7be4524 6951->6954 6952->6951 6953->6945 6954->6953 6960 7ff6d7be1f48 6955->6960 6958 7ff6d7be449c _CxxThrowException 2 API calls 6959 7ff6d7be20c6 6958->6959 6963 7ff6d7be43e4 6960->6963 6964 7ff6d7be1f7f 6963->6964 6965 7ff6d7be4405 6963->6965 6964->6958 6965->6964 6966 7ff6d7be4447 free 6965->6966 6966->6964 9533 7ff6d7bd9d60 9536 7ff6d7bd88d0 9533->9536 9535 7ff6d7bd9d85 __stdio_common_vswprintf 9536->9535

      Executed Functions

      Control-flow Graph

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionFilterUnhandled
      • String ID:
      • API String ID: 3192549508-0
      • Opcode ID: 57872dc2d23df0eab6a31249a5f201045b01e9191cc3fdc47eb59b1df613ed68
      • Instruction ID: 2b900814663392f007bc870920bb7ed424bf5465e089e8b662fd4ac74bf39997
      • Opcode Fuzzy Hash: 57872dc2d23df0eab6a31249a5f201045b01e9191cc3fdc47eb59b1df613ed68
      • Instruction Fuzzy Hash: 2BC04860E8F94AC2E5083BA258420BD11909F86300F2002B3E00AC6783DC1C22B2AA13
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 0 7ff6d7be1260-7ff6d7be12c7 call 7ff6d7bdee90 3 7ff6d7be1973-7ff6d7be198d call 7ff6d7bdba10 0->3 4 7ff6d7be12cd-7ff6d7be12da call 7ff6d7bdfac0 0->4 10 7ff6d7be1992-7ff6d7be19ce call 7ff6d7bd5300 call 7ff6d7be3560 3->10 4->3 9 7ff6d7be12e0-7ff6d7be131e call 7ff6d7be19e0 4->9 15 7ff6d7be1320-7ff6d7be1331 call 7ff6d7bdba10 9->15 16 7ff6d7be1336-7ff6d7be135d call 7ff6d7bdd190 9->16 23 7ff6d7be1950-7ff6d7be1971 call 7ff6d7bd5300 * 3 15->23 24 7ff6d7be1372 16->24 25 7ff6d7be135f 16->25 23->10 27 7ff6d7be1379-7ff6d7be1381 call 7ff6d7bd9dc0 24->27 28 7ff6d7be1362-7ff6d7be1366 25->28 37 7ff6d7be1387-7ff6d7be13bb 27->37 38 7ff6d7be15b8-7ff6d7be15d0 call 7ff6d7bdc4c0 27->38 29 7ff6d7be13cf-7ff6d7be13d2 28->29 30 7ff6d7be1368-7ff6d7be1370 28->30 29->24 35 7ff6d7be13d4-7ff6d7be13da 29->35 30->24 30->28 35->27 41 7ff6d7be13bd-7ff6d7be13cd 37->41 42 7ff6d7be13dc-7ff6d7be140e call 7ff6d7bd53b0 call 7ff6d7be4b80 37->42 47 7ff6d7be15d2-7ff6d7be15f9 call 7ff6d7bd5300 38->47 48 7ff6d7be15fc-7ff6d7be1604 38->48 45 7ff6d7be1412-7ff6d7be1446 call 7ff6d7bd9440 41->45 42->45 56 7ff6d7be14a1-7ff6d7be14b7 45->56 57 7ff6d7be1448-7ff6d7be1480 call 7ff6d7bdba10 call 7ff6d7bd5300 * 3 call 7ff6d7be1140 45->57 47->48 53 7ff6d7be1565-7ff6d7be1590 call 7ff6d7bdc2c0 call 7ff6d7bdfac0 48->53 54 7ff6d7be160a-7ff6d7be1620 48->54 81 7ff6d7be1645-7ff6d7be165b call 7ff6d7bdc4c0 53->81 82 7ff6d7be1596-7ff6d7be15a9 call 7ff6d7bdba10 53->82 59 7ff6d7be1622-7ff6d7be1635 54->59 60 7ff6d7be163b-7ff6d7be1640 call 7ff6d7be3440 54->60 63 7ff6d7be14c7-7ff6d7be14fd call 7ff6d7bd53b0 call 7ff6d7be4b80 56->63 64 7ff6d7be14b9-7ff6d7be14c5 56->64 57->23 115 7ff6d7be1486-7ff6d7be149c call 7ff6d7bd5300 call 7ff6d7be3440 57->115 59->60 66 7ff6d7be19d5-7ff6d7be19da _invalid_parameter_noinfo_noreturn 59->66 60->53 69 7ff6d7be1501-7ff6d7be1548 call 7ff6d7bd5300 * 4 call 7ff6d7be1140 63->69 64->69 120 7ff6d7be1560 69->120 121 7ff6d7be154a-7ff6d7be155b call 7ff6d7bd5300 call 7ff6d7be3440 69->121 94 7ff6d7be168d-7ff6d7be1695 81->94 95 7ff6d7be165d-7ff6d7be168a call 7ff6d7bd5300 81->95 91 7ff6d7be15ae-7ff6d7be15b3 82->91 91->23 97 7ff6d7be16cd-7ff6d7be1707 call 7ff6d7be0a30 94->97 98 7ff6d7be1697-7ff6d7be16ad 94->98 95->94 113 7ff6d7be1713-7ff6d7be1724 call 7ff6d7bdf2c0 97->113 114 7ff6d7be1709-7ff6d7be170e 97->114 102 7ff6d7be16af-7ff6d7be16c2 98->102 103 7ff6d7be16c8 call 7ff6d7be3440 98->103 102->103 108 7ff6d7be19cf-7ff6d7be19d4 _invalid_parameter_noinfo_noreturn 102->108 103->97 108->66 127 7ff6d7be1772-7ff6d7be1789 call 7ff6d7bdeea0 113->127 128 7ff6d7be1726-7ff6d7be176d call 7ff6d7bdba10 * 3 113->128 117 7ff6d7be193b-7ff6d7be194f call 7ff6d7bd5300 * 2 114->117 115->23 117->23 120->53 121->120 140 7ff6d7be178f-7ff6d7be17a2 127->140 141 7ff6d7be18b9-7ff6d7be18c2 127->141 128->117 143 7ff6d7be17a4-7ff6d7be17a7 140->143 144 7ff6d7be17a9-7ff6d7be17b2 140->144 145 7ff6d7be18c4-7ff6d7be18cb 141->145 146 7ff6d7be18cd-7ff6d7be18fd call 7ff6d7bdbc60 call 7ff6d7bdbbe0 call 7ff6d7bdeea0 141->146 148 7ff6d7be17b7-7ff6d7be17bd 143->148 144->148 149 7ff6d7be191b-7ff6d7be192b call 7ff6d7bdba10 145->149 168 7ff6d7be190f-7ff6d7be1914 146->168 169 7ff6d7be18ff-7ff6d7be190d 146->169 153 7ff6d7be17bf-7ff6d7be17ca 148->153 154 7ff6d7be17d0-7ff6d7be1869 call 7ff6d7bdbc60 * 4 call 7ff6d7bdeea0 call 7ff6d7bdbbe0 call 7ff6d7bdbc40 148->154 159 7ff6d7be1930-7ff6d7be193a call 7ff6d7bd4f70 149->159 153->154 181 7ff6d7be1883-7ff6d7be18a4 154->181 182 7ff6d7be186b-7ff6d7be186e 154->182 159->117 168->149 169->159 185 7ff6d7be18b7 181->185 186 7ff6d7be18a6-7ff6d7be18a9 181->186 182->181 183 7ff6d7be1870-7ff6d7be1880 182->183 183->181 185->159 186->185 188 7ff6d7be18ab-7ff6d7be18b6 186->188 188->185
      APIs
        • Part of subcall function 00007FF6D7BDFAC0: GetFileAttributesExW.KERNEL32 ref: 00007FF6D7BDFBAE
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE19CF
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE19D5
        • Part of subcall function 00007FF6D7BDBA10: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDBA48
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBA7E
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAC9
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAF4
        • Part of subcall function 00007FF6D7BDBA10: fputws.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAFF
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB07
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB12
        • Part of subcall function 00007FF6D7BDBA10: OutputDebugStringW.KERNEL32 ref: 00007FF6D7BDBB25
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB39
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB66
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB73
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: __acrt_iob_func$__stdio_common_vswprintf_invalid_parameter_noinfo_noreturnfputwc$AttributesCriticalDebugEnterFileOutputSectionString__stdio_common_vfwprintffputws
      • String ID: %s$ - Installing .NET Core prerequisites might help resolve this problem.$A fatal error was encountered. Could not extract contents of the bundle$A fatal error was encountered. This executable was not bound to load a managed DLL.$App path: [%s]$Dotnet path: [%s]$Failed to resolve full path of the current executable [%s]$Host path: [%s]$Invoking fx resolver [%s] v1$Invoking fx resolver [%s] v2$The application to execute does not exist: '%s'.$The library %s was found, but loading it from %s failed$The required library %s does not contain the expected entry point.$The required library %s does not support relative app dll paths.$hostfxr.dll$hostfxr_main$hostfxr_main_startupinfo$hostfxr_set_error_writer$https://go.microsoft.com/fwlink/?linkid=798306
      • API String ID: 230286161-431793245
      • Opcode ID: df642a779e81a87ff3fe8cf309a0888b4443c4f5cae2d3f4a59fa34e8d3698a3
      • Instruction ID: 43c269b4e1c305573efa3c76a2278089918c4fe36c36b0241543cd910fbe607f
      • Opcode Fuzzy Hash: df642a779e81a87ff3fe8cf309a0888b4443c4f5cae2d3f4a59fa34e8d3698a3
      • Instruction Fuzzy Hash: FE22B132A09B4A84EB00DF24D8412FD2771FF96398F901137EA4ED6AA9DF78E595C341
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__p___argc__p___wargv__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize_cexit_exit_get_initial_wide_environment_register_thread_local_exe_atexit_callback
      • String ID:
      • API String ID: 3120079559-0
      • Opcode ID: c7cf2ab23ab5935e4ee8e52d753a4477fbb02829f3d25565f6636966045ef73e
      • Instruction ID: 0aa82bcacbaca85d939777ddca6325a726334fa2f7380047c97909711817c8e4
      • Opcode Fuzzy Hash: c7cf2ab23ab5935e4ee8e52d753a4477fbb02829f3d25565f6636966045ef73e
      • Instruction Fuzzy Hash: E8314A31E0E24B41FA14AF2495513BD6291AF87784F4450BBEA4ECB3D3DE2DA8698743
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: __acrt_iob_func$CriticalSection__stdio_common_vswprintffputwc$DebugEnterLeaveOutputString__stdio_common_vfwprintffputwsmemset
      • String ID:
      • API String ID: 286819346-0
      • Opcode ID: 2e2da0c66c6123c3b157633372f5ce75a5568420504a49f2955768eb5517ce3b
      • Instruction ID: f29fe3cec45edeb3c0db7aedbe886a5ca571869225199718a819ee1257e76853
      • Opcode Fuzzy Hash: 2e2da0c66c6123c3b157633372f5ce75a5568420504a49f2955768eb5517ce3b
      • Instruction Fuzzy Hash: 7541A23260AA8581EA10DF11E8007AEA350EF86BE0F545236EA9E877D9DF3CD460C705
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • RegisterEventSourceW.ADVAPI32 ref: 00007FF6D7BDB51F
        • Part of subcall function 00007FF6D7BDA600: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDA768
      • ReportEventW.ADVAPI32 ref: 00007FF6D7BDB670
      • DeregisterEventSource.ADVAPI32 ref: 00007FF6D7BDB679
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB6E6
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: Event$Source_invalid_parameter_noinfo_noreturn$DeregisterRegisterReport
      • String ID: .NET Runtime$Application: $Description: A .NET Core application failed.$Message: $Path:
      • API String ID: 1921289036-1764938453
      • Opcode ID: b1ec05c9d9af0461ab206e65f1a6e761dfd3f2647df3162c4b0540abc95a5e04
      • Instruction ID: de8245337e44e52382ba38f8c76000b1b91181cbec86fe37ed85a5be16107435
      • Opcode Fuzzy Hash: b1ec05c9d9af0461ab206e65f1a6e761dfd3f2647df3162c4b0540abc95a5e04
      • Instruction Fuzzy Hash: 0351F471B1AB8685EA10DF16E4002AD6361FB86BE0F400233DA5EC37A5DF3CE4A4C745
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • shared_ptr.LIBCMT ref: 00007FF6D7BE1C29
        • Part of subcall function 00007FF6D7BDBC60: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDBC93
        • Part of subcall function 00007FF6D7BDBC60: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBCBC
        • Part of subcall function 00007FF6D7BDBC60: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBCC9
        • Part of subcall function 00007FF6D7BDBC60: LeaveCriticalSection.KERNEL32 ref: 00007FF6D7BDBCD6
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: CriticalSection$EnterLeave__stdio_common_vfwprintffputwcshared_ptr
      • String ID: --- Invoked %s [version: %s, commit hash: %s] main = {$3.1.0$65f04fb6db7a5e198d05dbebd5c4ad21eb018f89$apphost
      • API String ID: 2890140739-3927037831
      • Opcode ID: eaeb8fe4246f00b8e35ceda68fc044ce18e8dfa7e31ccc33e7e92eaa24c389e1
      • Instruction ID: e5b860863798f913df3f14c91ce744b313fac758e603c4fb4f80be4d55cecc7c
      • Opcode Fuzzy Hash: eaeb8fe4246f00b8e35ceda68fc044ce18e8dfa7e31ccc33e7e92eaa24c389e1
      • Instruction Fuzzy Hash: 83113031A1EA4E81E600AF61E4810FF6310FF86780F48107BE94ECB3A7DE6CE5658746
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn$HandleModule
      • String ID:
      • API String ID: 542465422-0
      • Opcode ID: 6c0ffa5e150be4bbc700599ca38b54331dd231dceb1c3a68fe3597fb2f6eef7e
      • Instruction ID: ca38e8711578a3d7afe0f07e0734868221ffb0d15dc68b96679d255521d4164c
      • Opcode Fuzzy Hash: 6c0ffa5e150be4bbc700599ca38b54331dd231dceb1c3a68fe3597fb2f6eef7e
      • Instruction Fuzzy Hash: 2451CF72B16B8584EB00CF38C4553BD2361EB867A8F405636DA2D87BD9DF78D1A5C305
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: __acrt_iob_func$fputws
      • String ID:
      • API String ID: 3984006290-0
      • Opcode ID: 083b6522c4eea2bfde63dca00aec79e37161f30771e27d241205d341d5ae5933
      • Instruction ID: cd2e9ada8aeb26f365988acf21d50a005fc490dbec80e6865d368da87ffa29e0
      • Opcode Fuzzy Hash: 083b6522c4eea2bfde63dca00aec79e37161f30771e27d241205d341d5ae5933
      • Instruction Fuzzy Hash: 51F03760F0A10E41FA04AF6294153BD41514F57BB0F146736D93ECF3C2DD5C98E58346
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      Control-flow Graph

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: AddressProc$EncodeHandleModulePointer
      • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
      • API String ID: 73157160-295688737
      • Opcode ID: 173f8d78763da1d0bd2cccb3a2ef2de7f8ea94962ad3b40df91b7dc9daab1eef
      • Instruction ID: 52e0292ece26ea1a854a5112c856f26825926d40f98da4de740c89a300fd080b
      • Opcode Fuzzy Hash: 173f8d78763da1d0bd2cccb3a2ef2de7f8ea94962ad3b40df91b7dc9daab1eef
      • Instruction Fuzzy Hash: 6EE14678A1AF4B95FA04DF15F85856963B6BF4AB44B801477C80DCA334EE7DA169C303
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc_invalid_parameter_noinfo_noreturnmemset
      • String ID: RtlGetVersion$ntdll.dll$win$win7$win8$win81
      • API String ID: 3866494120-238241336
      • Opcode ID: 9ff83c73d286eb1ab95303b9d3defa2a5a56a122c04846bfb99b855c0cf7adc8
      • Instruction ID: b9eb34404432b18eafeb1492f583c9857efa2ed44b1c935562bdfd1a099a49a7
      • Opcode Fuzzy Hash: 9ff83c73d286eb1ab95303b9d3defa2a5a56a122c04846bfb99b855c0cf7adc8
      • Instruction Fuzzy Hash: 3B51A071A1A78681E6249F55E4412AD7361FBC6B90F80013BDA8EC3B98DF3CE550CB4A
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn$AttributesFileFullNamePath
      • String ID: Error resolving full path [%s]
      • API String ID: 561720233-1390578158
      • Opcode ID: 8d186e2991f1d36aa4e496d5c4ea3377daa59a2fb7233c9e6685f99929d0327b
      • Instruction ID: 78d98d16923c11668de7b687aeacfefc641db0276b7601ef8ccfcf15ffb71d3e
      • Opcode Fuzzy Hash: 8d186e2991f1d36aa4e496d5c4ea3377daa59a2fb7233c9e6685f99929d0327b
      • Instruction Fuzzy Hash: FED1E832A0EA4680EB108F15E4542AD6761EBC67E4F540233EA6E837E8DF3CD5A5C745
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • frexp.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF6D7BD611E
      • memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D7BD619D
        • Part of subcall function 00007FF6D7BD19D0: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,FFFFFFFF,7FFFFFFFFFFFFFFE,00007FF6D7BD5498), ref: 00007FF6D7BD1AC5
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BD632C
      • frexp.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF6D7BD63DE
      • memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D7BD645D
        • Part of subcall function 00007FF6D7BD19D0: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,FFFFFFFF,7FFFFFFFFFFFFFFE,00007FF6D7BD5498), ref: 00007FF6D7BD1B0F
        • Part of subcall function 00007FF6D7BD19D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,FFFFFFFF,7FFFFFFFFFFFFFFE,00007FF6D7BD5498), ref: 00007FF6D7BD1B3E
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BD65F0
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: memset$_invalid_parameter_noinfo_noreturn$frexp
      • String ID:
      • API String ID: 10557478-0
      • Opcode ID: 27d0d52fdc3390ab0c455a8896656758d0baa64622768b55f841b66910500884
      • Instruction ID: 7332e15f8b9bc6f4d3cb063671ca6f4f533a8b2731eee7334a31eef46c1122a8
      • Opcode Fuzzy Hash: 27d0d52fdc3390ab0c455a8896656758d0baa64622768b55f841b66910500884
      • Instruction Fuzzy Hash: ED022422B19A8489FB248F65D4503FD27A1AB86BCCF044232DE4D97B89DE3CD591C346
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 6a19b76800375448ec742403ea022dea4df6794fefe97625285216b393b4c92c
      • Instruction ID: 9d86d4c412e6da594c98f51da813fe47e7f41224bea5c94f53f1a8cc68f67c0e
      • Opcode Fuzzy Hash: 6a19b76800375448ec742403ea022dea4df6794fefe97625285216b393b4c92c
      • Instruction Fuzzy Hash: C6A0017190A80AE5E6448F01A8541292224BB52304B4004B6E00DC12A2DE2CA528C203
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 422 7ff6d7be0a30-7ff6d7be0a88 423 7ff6d7be0a8a-7ff6d7be0ad1 call 7ff6d7bd56f0 call 7ff6d7bdced0 422->423 424 7ff6d7be0ad9 422->424 423->424 440 7ff6d7be0ad3-7ff6d7be0ad7 423->440 425 7ff6d7be0adb-7ff6d7be0adf 424->425 428 7ff6d7be0ae1-7ff6d7be0aee 425->428 429 7ff6d7be0b27-7ff6d7be0b29 425->429 428->429 431 7ff6d7be0af0-7ff6d7be0b07 428->431 432 7ff6d7be0b2b-7ff6d7be0b30 429->432 433 7ff6d7be0b69-7ff6d7be0b9f call 7ff6d7bdc7f0 call 7ff6d7bdcba0 429->433 436 7ff6d7be0b22 call 7ff6d7be3440 431->436 437 7ff6d7be0b09-7ff6d7be0b1c 431->437 438 7ff6d7be0b32 432->438 439 7ff6d7be0b35-7ff6d7be0b47 call 7ff6d7bdbc60 432->439 456 7ff6d7be0ba1-7ff6d7be0ba9 433->456 457 7ff6d7be0bca 433->457 436->429 437->436 442 7ff6d7be10dd-7ff6d7be10e2 _invalid_parameter_noinfo_noreturn 437->442 438->439 448 7ff6d7be0b62-7ff6d7be0b64 439->448 449 7ff6d7be0b49-7ff6d7be0b4e 439->449 440->425 447 7ff6d7be10e3-7ff6d7be10e8 _invalid_parameter_noinfo_noreturn 442->447 451 7ff6d7be10e9-7ff6d7be10ee _invalid_parameter_noinfo_noreturn 447->451 455 7ff6d7be10a6-7ff6d7be10d6 call 7ff6d7be3560 448->455 453 7ff6d7be0b53-7ff6d7be0b5d call 7ff6d7bd56f0 449->453 454 7ff6d7be0b50 449->454 452 7ff6d7be10ef-7ff6d7be10f4 _invalid_parameter_noinfo_noreturn 451->452 458 7ff6d7be10f5-7ff6d7be10fa _invalid_parameter_noinfo_noreturn 452->458 453->448 454->453 462 7ff6d7be0bae-7ff6d7be0bc8 call 7ff6d7bdbc60 456->462 463 7ff6d7be0bab 456->463 459 7ff6d7be0bcf call 7ff6d7bdeb90 457->459 464 7ff6d7be10fb-7ff6d7be1100 _invalid_parameter_noinfo_noreturn 458->464 465 7ff6d7be0bd4-7ff6d7be0bd6 459->465 472 7ff6d7be0c3e-7ff6d7be0c4f 462->472 463->462 468 7ff6d7be1101-7ff6d7be111c _invalid_parameter_noinfo_noreturn 464->468 469 7ff6d7be0bf9-7ff6d7be0c1e call 7ff6d7bdbc60 465->469 470 7ff6d7be0bd8 465->470 473 7ff6d7be111e-7ff6d7be1133 call 7ff6d7bd5300 468->473 474 7ff6d7be1139-7ff6d7be113e 468->474 469->472 486 7ff6d7be0c20-7ff6d7be0c39 call 7ff6d7bd56f0 469->486 475 7ff6d7be0bdd call 7ff6d7bde2c0 470->475 480 7ff6d7be0c54-7ff6d7be0c58 472->480 481 7ff6d7be0c51 472->481 473->474 478 7ff6d7be0be2-7ff6d7be0be4 475->478 478->469 485 7ff6d7be0be6-7ff6d7be0bf4 call 7ff6d7bdba10 478->485 482 7ff6d7be0c6b-7ff6d7be0c87 480->482 483 7ff6d7be0c5a-7ff6d7be0c69 480->483 481->480 488 7ff6d7be0c8b call 7ff6d7bd53b0 482->488 487 7ff6d7be0cab-7ff6d7be0cda call 7ff6d7bdc2c0 * 2 call 7ff6d7bddf40 483->487 496 7ff6d7be1013-7ff6d7be101b 485->496 486->472 513 7ff6d7be0ce0-7ff6d7be0ce6 487->513 514 7ff6d7be0f8d-7ff6d7be0fbe call 7ff6d7be0480 487->514 491 7ff6d7be0c90-7ff6d7be0ca7 call 7ff6d7be4b80 488->491 491->487 499 7ff6d7be1053-7ff6d7be106e 496->499 500 7ff6d7be101d-7ff6d7be1033 496->500 503 7ff6d7be10a3 499->503 504 7ff6d7be1070-7ff6d7be1087 499->504 501 7ff6d7be1035-7ff6d7be1048 500->501 502 7ff6d7be104e call 7ff6d7be3440 500->502 501->468 501->502 502->499 503->455 507 7ff6d7be109e call 7ff6d7be3440 504->507 508 7ff6d7be1089-7ff6d7be109c 504->508 507->503 508->507 510 7ff6d7be10d7-7ff6d7be10dc _invalid_parameter_noinfo_noreturn 508->510 510->442 516 7ff6d7be0d04-7ff6d7be0d32 call 7ff6d7bde920 513->516 517 7ff6d7be0ce8 513->517 523 7ff6d7be0fc1-7ff6d7be0fc9 514->523 525 7ff6d7be0e1b-7ff6d7be0e4d 516->525 526 7ff6d7be0d38-7ff6d7be0de2 call 7ff6d7bdd200 call 7ff6d7bda600 * 3 call 7ff6d7bd5300 516->526 518 7ff6d7be0ced call 7ff6d7bdeb90 517->518 521 7ff6d7be0cf2-7ff6d7be0cf8 518->521 521->516 524 7ff6d7be0cfa 521->524 527 7ff6d7be1001-7ff6d7be100e 523->527 528 7ff6d7be0fcb-7ff6d7be0fe1 523->528 529 7ff6d7be0cff call 7ff6d7bde2c0 524->529 530 7ff6d7be0e52-7ff6d7be0e9f call 7ff6d7bdba10 * 3 call 7ff6d7bdc840 525->530 531 7ff6d7be0e4f 525->531 526->525 555 7ff6d7be0de4-7ff6d7be0dfb 526->555 527->496 533 7ff6d7be0fe3-7ff6d7be0ff6 528->533 534 7ff6d7be0ffc call 7ff6d7be3440 528->534 529->516 552 7ff6d7be0ea4-7ff6d7be0ebd call 7ff6d7bdba10 530->552 553 7ff6d7be0ea1 530->553 531->530 533->464 533->534 534->527 561 7ff6d7be0ebf-7ff6d7be0ed6 552->561 562 7ff6d7be0ef7-7ff6d7be0eff 552->562 553->552 557 7ff6d7be0dfd-7ff6d7be0e10 555->557 558 7ff6d7be0e16 call 7ff6d7be3440 555->558 557->447 557->558 558->525 563 7ff6d7be0ef1-7ff6d7be0ef6 call 7ff6d7be3440 561->563 564 7ff6d7be0ed8-7ff6d7be0eeb 561->564 565 7ff6d7be0f01-7ff6d7be0f17 562->565 566 7ff6d7be0f37-7ff6d7be0f51 562->566 563->562 564->451 564->563 570 7ff6d7be0f32 call 7ff6d7be3440 565->570 571 7ff6d7be0f19-7ff6d7be0f2c 565->571 567 7ff6d7be0f53-7ff6d7be0f69 566->567 568 7ff6d7be0f89-7ff6d7be0f8b 566->568 572 7ff6d7be0f84 call 7ff6d7be3440 567->572 573 7ff6d7be0f6b-7ff6d7be0f7e 567->573 568->523 570->566 571->452 571->570 572->568 573->458 573->572
      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE10D7
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE10DD
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE10E3
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE10E9
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE10EF
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE10F5
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE10FB
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE1101
        • Part of subcall function 00007FF6D7BDBA10: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDBA48
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBA7E
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAC9
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAF4
        • Part of subcall function 00007FF6D7BDBA10: fputws.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAFF
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB07
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB12
        • Part of subcall function 00007FF6D7BDBA10: OutputDebugStringW.KERNEL32 ref: 00007FF6D7BDBB25
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB39
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB66
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB73
      Strings
      • - %s, xrefs: 00007FF6D7BE0EA7
      • Detected latest fxr version=[%s]..., xrefs: 00007FF6D7BE0735
      • Using environment variable %s=[%s] as runtime location., xrefs: 00007FF6D7BE0BBC
      • A fatal error occurred, the required library %s could not be found in [%s], xrefs: 00007FF6D7BE08E0
      • The .NET Core runtime can be found at:, xrefs: 00007FF6D7BE0E7E
      • Reading fx resolver directory=[%s], xrefs: 00007FF6D7BE04CD
      • hostfxr.dll, xrefs: 00007FF6D7BE075B, 00007FF6D7BE08D9, 00007FF6D7BE0AA2, 00007FF6D7BE0E5F
      • A fatal error occurred. The required library %s could not be found.If this is a self-contained application, that library should e, xrefs: 00007FF6D7BE0E66
      • Resolved fxr [%s]..., xrefs: 00007FF6D7BE07D6, 00007FF6D7BE0B38
      • A fatal error occurred, the folder [%s] does not contain any version-numbered child folders, xrefs: 00007FF6D7BE0672
      • Considering fxr version=[%s]..., xrefs: 00007FF6D7BE0521
      • A fatal error occurred, the default install location cannot be obtained., xrefs: 00007FF6D7BE0BE6
      • or register the runtime location in [, xrefs: 00007FF6D7BE0D6D
      • fxr, xrefs: 00007FF6D7BE0CBF
      • Using global installation location [%s] as runtime location., xrefs: 00007FF6D7BE0C0A
      • host, xrefs: 00007FF6D7BE0CAF
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn$__acrt_iob_func$__stdio_common_vswprintffputwc$CriticalDebugEnterOutputSectionString__stdio_common_vfwprintffputws
      • String ID: - %s$ or register the runtime location in [$A fatal error occurred, the default install location cannot be obtained.$A fatal error occurred, the folder [%s] does not contain any version-numbered child folders$A fatal error occurred, the required library %s could not be found in [%s]$A fatal error occurred. The required library %s could not be found.If this is a self-contained application, that library should e$Considering fxr version=[%s]...$Detected latest fxr version=[%s]...$Reading fx resolver directory=[%s]$Resolved fxr [%s]...$The .NET Core runtime can be found at:$Using environment variable %s=[%s] as runtime location.$Using global installation location [%s] as runtime location.$fxr$host$hostfxr.dll
      • API String ID: 3397661578-2114547534
      • Opcode ID: d68178f76d575c5075f411f6be1255edcb13aceb440f132623c26a2bca4b76be
      • Instruction ID: 4f9eee133ab26fc9140245a51edda526143c050656231416e690971058dd3a70
      • Opcode Fuzzy Hash: d68178f76d575c5075f411f6be1255edcb13aceb440f132623c26a2bca4b76be
      • Instruction Fuzzy Hash: 4B12B272E1978A81EA009F65D8442BD2321FB86398F505277EA9DD77D9DF3CE4A4C301
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 577 7ff6d7bda950-7ff6d7bda99a 578 7ff6d7bda99c-7ff6d7bda9a2 577->578 579 7ff6d7bda9a8-7ff6d7bda9d5 call 7ff6d7bdf010 577->579 578->579 580 7ff6d7bdb1bc-7ff6d7bdb1e2 call 7ff6d7be3560 578->580 584 7ff6d7bda9fc-7ff6d7bdaa46 call 7ff6d7bd56f0 579->584 585 7ff6d7bda9d7-7ff6d7bda9f6 call 7ff6d7be00e0 579->585 592 7ff6d7bdaadf-7ff6d7bdaae5 584->592 593 7ff6d7bdaa4c-7ff6d7bdaa67 call 7ff6d7bdc840 584->593 585->584 591 7ff6d7bdb17a-7ff6d7bdb185 585->591 591->580 594 7ff6d7bdb187-7ff6d7bdb1a0 591->594 595 7ff6d7bdaaeb-7ff6d7bdabe5 call 7ff6d7bd7190 call 7ff6d7bda150 592->595 596 7ff6d7bdb00a-7ff6d7bdb09a call 7ff6d7bda600 * 3 call 7ff6d7bdbe70 MessageBoxW 592->596 606 7ff6d7bdaa91-7ff6d7bdaa9c 593->606 607 7ff6d7bdaa69-7ff6d7bdaa8d call 7ff6d7bd5300 593->607 598 7ff6d7bdb1a2-7ff6d7bdb1b5 594->598 599 7ff6d7bdb1b7 call 7ff6d7be3440 594->599 621 7ff6d7bdabe6-7ff6d7bdac06 call 7ff6d7bd9dd0 595->621 635 7ff6d7bdb0ca-7ff6d7bdb0d2 596->635 636 7ff6d7bdb09c-7ff6d7bdb0c9 ShellExecuteW 596->636 598->599 603 7ff6d7bdb1e3-7ff6d7bdb1e8 _invalid_parameter_noinfo_noreturn 598->603 599->580 610 7ff6d7bdb1e9-7ff6d7bdb1ee _invalid_parameter_noinfo_noreturn 603->610 606->596 613 7ff6d7bdaaa2-7ff6d7bdaabb 606->613 607->606 615 7ff6d7bdb1ef-7ff6d7bdb1f4 _invalid_parameter_noinfo_noreturn 610->615 618 7ff6d7bdb005 call 7ff6d7be3440 613->618 619 7ff6d7bdaac1-7ff6d7bdaad4 613->619 623 7ff6d7bdb1f5-7ff6d7bdb1fa _invalid_parameter_noinfo_noreturn 615->623 618->596 619->610 620 7ff6d7bdaada 619->620 620->618 632 7ff6d7bdafbc-7ff6d7bdafd2 call 7ff6d7bd3740 621->632 633 7ff6d7bdac0c-7ff6d7bdacbd call 7ff6d7bd56f0 * 3 call 7ff6d7bdd390 621->633 627 7ff6d7bdb1fb-7ff6d7bdb200 _invalid_parameter_noinfo_noreturn 623->627 630 7ff6d7bdb201-7ff6d7bdb206 call 7ff6d7bd5390 627->630 644 7ff6d7bdb207-7ff6d7bdb20c _invalid_parameter_noinfo_noreturn 630->644 632->596 648 7ff6d7bdafd4-7ff6d7bdafea 632->648 666 7ff6d7bdad15-7ff6d7bdad2a call 7ff6d7bdd390 633->666 667 7ff6d7bdacbf-7ff6d7bdacd4 call 7ff6d7bdc450 633->667 640 7ff6d7bdb0d4-7ff6d7bdb0ea 635->640 641 7ff6d7bdb10a-7ff6d7bdb127 635->641 636->635 646 7ff6d7bdb105 call 7ff6d7be3440 640->646 647 7ff6d7bdb0ec-7ff6d7bdb0ff 640->647 649 7ff6d7bdb162-7ff6d7bdb172 641->649 650 7ff6d7bdb129-7ff6d7bdb142 641->650 645 7ff6d7bdb20d-7ff6d7bdb212 _invalid_parameter_noinfo_noreturn 644->645 652 7ff6d7bdb213-7ff6d7bdb218 _invalid_parameter_noinfo_noreturn 645->652 646->641 647->646 653 7ff6d7bdb21f-7ff6d7bdb224 _invalid_parameter_noinfo_noreturn 647->653 648->618 654 7ff6d7bdafec-7ff6d7bdafff 648->654 649->591 656 7ff6d7bdb144-7ff6d7bdb157 650->656 657 7ff6d7bdb15d call 7ff6d7be3440 650->657 659 7ff6d7bdb219-7ff6d7bdb21e _invalid_parameter_noinfo_noreturn 652->659 660 7ff6d7bdb225-7ff6d7bdb22a _invalid_parameter_noinfo_noreturn 653->660 654->618 654->659 656->657 656->660 657->649 659->653 673 7ff6d7bdae3f-7ff6d7bdae6c 666->673 674 7ff6d7bdad30-7ff6d7bdad3b 666->674 667->666 672 7ff6d7bdacd6-7ff6d7bdad13 call 7ff6d7bda600 * 2 667->672 672->674 673->630 676 7ff6d7bdae72-7ff6d7bdaec0 call 7ff6d7bd56f0 call 7ff6d7bd5300 673->676 677 7ff6d7bdad3d-7ff6d7bdad56 674->677 678 7ff6d7bdad76-7ff6d7bdad9b 674->678 698 7ff6d7bdaec2-7ff6d7bdaedb 676->698 699 7ff6d7bdaefb-7ff6d7bdaf20 676->699 680 7ff6d7bdad71 call 7ff6d7be3440 677->680 681 7ff6d7bdad58-7ff6d7bdad6b 677->681 682 7ff6d7bdad9d-7ff6d7bdadb6 678->682 683 7ff6d7bdadd6-7ff6d7bdadfb 678->683 680->678 681->615 681->680 687 7ff6d7bdadd1 call 7ff6d7be3440 682->687 688 7ff6d7bdadb8-7ff6d7bdadcb 682->688 683->621 689 7ff6d7bdae01-7ff6d7bdae1a 683->689 687->683 688->623 688->687 693 7ff6d7bdae35-7ff6d7bdae3a call 7ff6d7be3440 689->693 694 7ff6d7bdae1c-7ff6d7bdae2f 689->694 693->621 694->627 694->693 701 7ff6d7bdaedd-7ff6d7bdaef0 698->701 702 7ff6d7bdaef6 call 7ff6d7be3440 698->702 703 7ff6d7bdaf22-7ff6d7bdaf3b 699->703 704 7ff6d7bdaf5b-7ff6d7bdaf80 699->704 701->644 701->702 702->699 706 7ff6d7bdaf3d-7ff6d7bdaf50 703->706 707 7ff6d7bdaf56 call 7ff6d7be3440 703->707 704->632 708 7ff6d7bdaf82-7ff6d7bdaf9b 704->708 706->645 706->707 707->704 710 7ff6d7bdaf9d-7ff6d7bdafb0 708->710 711 7ff6d7bdafb6-7ff6d7bdafbb call 7ff6d7be3440 708->711 710->652 710->711 711->632
      APIs
      • MessageBoxW.USER32 ref: 00007FF6D7BDB091
      • ShellExecuteW.SHELL32 ref: 00007FF6D7BDB0C3
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB1E3
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB1E9
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB1EF
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB1F5
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB1FB
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB207
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB20D
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB213
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB219
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB21F
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB225
        • Part of subcall function 00007FF6D7BD7190: std::locale::_Init.LIBCPMT ref: 00007FF6D7BD71FF
        • Part of subcall function 00007FF6D7BD7190: std::ios_base::_Addstd.LIBCPMT ref: 00007FF6D7BD72AB
        • Part of subcall function 00007FF6D7BDA150: std::locale::_Init.LIBCPMT ref: 00007FF6D7BDA19E
        • Part of subcall function 00007FF6D7BD56F0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6D7BD106D), ref: 00007FF6D7BD580D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn$Initstd::locale::_$AddstdExecuteMessageShellstd::ios_base::_
      • String ID: - https://aka.ms/dotnet-core-applaunch?$&apphost_version=$' was not found.$3.1.0$DOTNET_DISABLE_GUI_ERRORS$Showing error dialog for application: '%s' - error code: 0x%x - url: '%s'$The framework '$To run this application, you must install .NET Core.$Would you like to download it now?$open
      • API String ID: 3599303172-3147670804
      • Opcode ID: f95b3e1e6d6a90d55b508cc466be18d9f55381060a0c216e57f08e94cf1ec102
      • Instruction ID: c83a5369cd249632c6859628b1884e50435f93d39014e7fd2764ff28da4011c2
      • Opcode Fuzzy Hash: f95b3e1e6d6a90d55b508cc466be18d9f55381060a0c216e57f08e94cf1ec102
      • Instruction Fuzzy Hash: DD32B272A16BC685EF208F24D8443ED2361FB867A8F405236D65D87BE9DF78D294C306
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      Strings
      • Temporary directory used to extract bundled files is [%s], xrefs: 00007FF6D7BD95C5
      • Failure extracting contents of the application bundle., xrefs: 00007FF6D7BD98BF
      • Failed to determine location for extracting embedded files, xrefs: 00007FF6D7BD9401
      • Extraction completed by another process, aborting current extraction., xrefs: 00007FF6D7BD965D
      • Failed to commit extracted files to directory [%s], xrefs: 00007FF6D7BD96FB
      • Retrying extraction due to EACCES trying to rename the extraction folder to [%s]., xrefs: 00007FF6D7BD96C8
      • Failed to create directory [%s] for extracting bundled files, xrefs: 00007FF6D7BD8F89
      • Failure processing application bundle; possible file corruption., xrefs: 00007FF6D7BD9751, 00007FF6D7BD985B, 00007FF6D7BD988D
      • Failed to open file [%s] for writing, xrefs: 00007FF6D7BD9247
      • I/O failure when writing extracted files., xrefs: 00007FF6D7BD98CB
      • DOTNET_BUNDLE_EXTRACT_BASE_DIR is not set, and temp-directory doesn't exist or is not readable/writable., xrefs: 00007FF6D7BD940D
      • Couldn't open host binary for reading contents, xrefs: 00007FF6D7BD972C
      • I/O failure reading contents of the bundle., xrefs: 00007FF6D7BD9867
      • Files embedded within the bundled will be extracted to [%s] directory, xrefs: 00007FF6D7BD9386
      • .net, xrefs: 00007FF6D7BD92C3
      • I/O seek failure within the bundle., xrefs: 00007FF6D7BD975D, 00007FF6D7BD9899
      • Failure processing application bundle., xrefs: 00007FF6D7BD8F72, 00007FF6D7BD922F, 00007FF6D7BD93F5, 00007FF6D7BD96E4, 00007FF6D7BD9720
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: CreateDirectoryExceptionThrow_invalid_parameter_noinfo_noreturn
      • String ID: .net$Couldn't open host binary for reading contents$DOTNET_BUNDLE_EXTRACT_BASE_DIR is not set, and temp-directory doesn't exist or is not readable/writable.$Extraction completed by another process, aborting current extraction.$Failed to commit extracted files to directory [%s]$Failed to create directory [%s] for extracting bundled files$Failed to determine location for extracting embedded files$Failed to open file [%s] for writing$Failure extracting contents of the application bundle.$Failure processing application bundle.$Failure processing application bundle; possible file corruption.$Files embedded within the bundled will be extracted to [%s] directory$I/O failure reading contents of the bundle.$I/O failure when writing extracted files.$I/O seek failure within the bundle.$Retrying extraction due to EACCES trying to rename the extraction folder to [%s].$Temporary directory used to extract bundled files is [%s]
      • API String ID: 783064793-1211900883
      • Opcode ID: 1e050cea03aa33f3f5759576cc4d0d792dcc55a44c290b453a5a8e065ac8e47f
      • Instruction ID: db0839594403dc27b0d82fe4e9a43155b54f96ed43cf59ad4b2d188827e125b7
      • Opcode Fuzzy Hash: 1e050cea03aa33f3f5759576cc4d0d792dcc55a44c290b453a5a8e065ac8e47f
      • Instruction Fuzzy Hash: BC21D171A1AA4740EE10AF24E4452FD2312EFD7BA4F040673E96ECB2D6DE2CE0608306
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 749 7ff6d7bdeb90-7ff6d7bdebd3 750 7ff6d7bdebd5 749->750 751 7ff6d7bdebd8-7ff6d7bdec00 call 7ff6d7bdd650 749->751 750->751 754 7ff6d7bdec02-7ff6d7bdec09 751->754 755 7ff6d7bdec2d-7ff6d7bdec80 call 7ff6d7bde400 RegOpenKeyExW 751->755 756 7ff6d7bdec25-7ff6d7bdec28 754->756 757 7ff6d7bdec0b-7ff6d7bdec20 call 7ff6d7bd56f0 754->757 762 7ff6d7bdec82-7ff6d7bdec90 call 7ff6d7bdbe70 755->762 763 7ff6d7bdec95-7ff6d7bdecc4 RegGetValueW 755->763 760 7ff6d7bdee12-7ff6d7bdee1a 756->760 757->756 764 7ff6d7bdee4e-7ff6d7bdee76 call 7ff6d7be3560 760->764 765 7ff6d7bdee1c-7ff6d7bdee32 760->765 780 7ff6d7bdedbd 762->780 769 7ff6d7bdeda5-7ff6d7bdedb7 call 7ff6d7bdbe70 RegCloseKey 763->769 770 7ff6d7bdecca-7ff6d7bdeccf 763->770 767 7ff6d7bdee34-7ff6d7bdee47 765->767 768 7ff6d7bdee49 call 7ff6d7be3440 765->768 767->768 773 7ff6d7bdee77-7ff6d7bdee7c _invalid_parameter_noinfo_noreturn 767->773 768->764 769->780 770->769 775 7ff6d7bdecd5-7ff6d7bded17 call 7ff6d7bdb6f0 RegGetValueW 770->775 779 7ff6d7bdee7d-7ff6d7bdee82 _invalid_parameter_noinfo_noreturn 773->779 785 7ff6d7bded36-7ff6d7bded3d 775->785 786 7ff6d7bded19-7ff6d7bded34 call 7ff6d7bdbe70 RegCloseKey 775->786 782 7ff6d7bdee83-7ff6d7bdee88 _invalid_parameter_noinfo_noreturn 779->782 783 7ff6d7bdedc0-7ff6d7bdedc8 780->783 787 7ff6d7bdee00-7ff6d7bdee0d 783->787 788 7ff6d7bdedca-7ff6d7bdede0 783->788 790 7ff6d7bded40-7ff6d7bded49 785->790 796 7ff6d7bded63-7ff6d7bded66 786->796 787->760 791 7ff6d7bdede2-7ff6d7bdedf5 788->791 792 7ff6d7bdedfb call 7ff6d7be3440 788->792 790->790 794 7ff6d7bded4b-7ff6d7bded60 call 7ff6d7bd56f0 RegCloseKey 790->794 791->782 791->792 792->787 794->796 796->783 799 7ff6d7bded68-7ff6d7bded80 796->799 800 7ff6d7bded82-7ff6d7bded95 799->800 801 7ff6d7bded9b-7ff6d7bdeda3 call 7ff6d7be3440 799->801 800->779 800->801 801->783
      APIs
      • RegOpenKeyExW.ADVAPI32 ref: 00007FF6D7BDEC78
      • RegGetValueW.ADVAPI32 ref: 00007FF6D7BDECBC
      • RegGetValueW.ADVAPI32 ref: 00007FF6D7BDED0F
      • RegCloseKey.ADVAPI32 ref: 00007FF6D7BDED2B
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDEE77
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDEE7D
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDEE83
        • Part of subcall function 00007FF6D7BDBE70: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDBEA3
        • Part of subcall function 00007FF6D7BDBE70: LeaveCriticalSection.KERNEL32 ref: 00007FF6D7BDBEE6
      Strings
      • _DOTNET_TEST_GLOBALLY_REGISTERED_PATH, xrefs: 00007FF6D7BDEBF2
      • Can't get the size of the SDK location registry value or it's empty, result: 0x%X, xrefs: 00007FF6D7BDEDA7
      • Can't get the value of the SDK location registry value, result: 0x%X, xrefs: 00007FF6D7BDED1B
      • Can't open the SDK installed location registry key, result: 0x%X, xrefs: 00007FF6D7BDEC84
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn$CriticalSectionValue$CloseEnterLeaveOpen
      • String ID: Can't get the size of the SDK location registry value or it's empty, result: 0x%X$Can't get the value of the SDK location registry value, result: 0x%X$Can't open the SDK installed location registry key, result: 0x%X$_DOTNET_TEST_GLOBALLY_REGISTERED_PATH
      • API String ID: 3288147984-3444099095
      • Opcode ID: d40b12b63c1d8ab4cd41b2a3d4d033efa4409dc075a97034872af587ea42a8da
      • Instruction ID: c136109d9838ecc1649acb534767aa310fd078cf582d400c03c05b2c5f7bf988
      • Opcode Fuzzy Hash: d40b12b63c1d8ab4cd41b2a3d4d033efa4409dc075a97034872af587ea42a8da
      • Instruction Fuzzy Hash: FB81C232B1AA4685EB00CF24D8502AD2361FF8A7A8F400236DA5E97BD9DF3CD565C345
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      • Failure processing application bundle; possible file corruption., xrefs: 00007FF6D7BD9751, 00007FF6D7BD985B, 00007FF6D7BD988D
      • Failed to open file [%s] for writing, xrefs: 00007FF6D7BD9247
      • Failed to determine location for extracting embedded files, xrefs: 00007FF6D7BD9401
      • DOTNET_BUNDLE_EXTRACT_BASE_DIR is not set, and temp-directory doesn't exist or is not readable/writable., xrefs: 00007FF6D7BD940D
      • Couldn't open host binary for reading contents, xrefs: 00007FF6D7BD972C
      • Files embedded within the bundled will be extracted to [%s] directory, xrefs: 00007FF6D7BD9386
      • I/O seek failure within the bundle., xrefs: 00007FF6D7BD975D, 00007FF6D7BD9899
      • Failure processing application bundle., xrefs: 00007FF6D7BD8F72, 00007FF6D7BD922F, 00007FF6D7BD93F5, 00007FF6D7BD96E4, 00007FF6D7BD9720
      • DOTNET_BUNDLE_EXTRACT_BASE_DIR, xrefs: 00007FF6D7BD92A3
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _wfopen
      • String ID: Couldn't open host binary for reading contents$DOTNET_BUNDLE_EXTRACT_BASE_DIR$DOTNET_BUNDLE_EXTRACT_BASE_DIR is not set, and temp-directory doesn't exist or is not readable/writable.$Failed to determine location for extracting embedded files$Failed to open file [%s] for writing$Failure processing application bundle.$Failure processing application bundle; possible file corruption.$Files embedded within the bundled will be extracted to [%s] directory$I/O seek failure within the bundle.
      • API String ID: 3448808716-2341051844
      • Opcode ID: 460bc4627581364dd2b21e4482862c42517eed3a9059b0afb611d4c85d7f785b
      • Instruction ID: 89ea512fe9aeb2bc2112a239b7ba829432f8dd8b41bbc2ab779d0cad9817c1f4
      • Opcode Fuzzy Hash: 460bc4627581364dd2b21e4482862c42517eed3a9059b0afb611d4c85d7f785b
      • Instruction Fuzzy Hash: 5321B371A1AB4A80EA20DF11EC4127D7264FF86790F400236E98DC67A6DF3CE522C702
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDCB8E
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDCB94
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID: &arch=$&framework_version=$&rid=$DOTNET_RUNTIME_ID$framework=$https://aka.ms/dotnet-core-applaunch?$ios_base::failbit set$missing_runtime=true$win10$x64
      • API String ID: 3668304517-1600443800
      • Opcode ID: 2157c60d1ce5e98fb59c43d9db44fd4bc937c325be0b3e27e4cd7301c120fb09
      • Instruction ID: a6c15510d7a961df14592b8b9361cc2172cc8276d82c02cdbae6261a05bb45f4
      • Opcode Fuzzy Hash: 2157c60d1ce5e98fb59c43d9db44fd4bc937c325be0b3e27e4cd7301c120fb09
      • Instruction Fuzzy Hash: D291C332F1A74688FB00DF64C4003BC2371AB46798F405236DE5E966DADF3CA5A6C34A
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _Getcvt.LIBCPMT ref: 00007FF6D7BD456F
        • Part of subcall function 00007FF6D7BE21B4: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF6D7BE21CC
        • Part of subcall function 00007FF6D7BE21B4: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF6D7BE21DB
        • Part of subcall function 00007FF6D7BE21B4: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF6D7BE21F6
      • _Getcvt.LIBCPMT ref: 00007FF6D7BD45C6
      • calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D7BD45E6
      • calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D7BD467E
      • calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D7BD472F
      • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D7BD485F
      • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D7BD4865
      • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D7BD486A
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: Concurrency::cancel_current_taskcalloc$Getcvt$___lc_codepage_func___lc_locale_name_func__pctype_func
      • String ID: ,$false$true
      • API String ID: 1533061592-760133229
      • Opcode ID: 84e4a24a609d5e1411c90350f8292d76fcc4b2d2bd7797231b2b15fb93aff811
      • Instruction ID: c2f6b0fb40cfd096f3328b5fccf004e5e5db2788e42c678eee5d04a62c710af3
      • Opcode Fuzzy Hash: 84e4a24a609d5e1411c90350f8292d76fcc4b2d2bd7797231b2b15fb93aff811
      • Instruction Fuzzy Hash: F091A43261AB8982E6108F21E5402AEB7A4FF86790F541272EF9DC7B95EF3CD561C701
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • LoadLibraryExW.KERNEL32 ref: 00007FF6D7BDF398
      • GetLastError.KERNEL32 ref: 00007FF6D7BDF3A6
      • GetModuleHandleExW.KERNEL32 ref: 00007FF6D7BDF3F3
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDF509
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDF50F
        • Part of subcall function 00007FF6D7BDBA10: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDBA48
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBA7E
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAC9
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAF4
        • Part of subcall function 00007FF6D7BDBA10: fputws.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAFF
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB07
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB12
        • Part of subcall function 00007FF6D7BDBA10: OutputDebugStringW.KERNEL32 ref: 00007FF6D7BDBB25
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB39
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB66
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB73
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: __acrt_iob_func$__stdio_common_vswprintf_invalid_parameter_noinfo_noreturnfputwc$CriticalDebugEnterErrorHandleLastLibraryLoadModuleOutputSectionString__stdio_common_vfwprintffputws
      • String ID: Failed to load the dll from [%s], HRESULT: 0x%X$Failed to pin library [%s] in [%s]$Loaded library from %s$pal::load_library
      • API String ID: 482845221-4234151505
      • Opcode ID: 4b51a27f6a35d8d9a04db3e029c10f933eca28ece943c549d54e379a90ae1c42
      • Instruction ID: adb4808fbe9f315f053dbdd02df90ef950a6d802a1872115518b05014378e2d8
      • Opcode Fuzzy Hash: 4b51a27f6a35d8d9a04db3e029c10f933eca28ece943c549d54e379a90ae1c42
      • Instruction Fuzzy Hash: 5B61B332F06A5688FB00CFA5D8442EC2362BB867A8F504232DE6E976D9EF68D055C305
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDB86C
      • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDB877
        • Part of subcall function 00007FF6D7BDF010: GetEnvironmentVariableW.KERNEL32(?,?,00000000,00007FF6D7BDB894), ref: 00007FF6D7BDF044
        • Part of subcall function 00007FF6D7BDF010: GetLastError.KERNEL32(?,?,00000000,00007FF6D7BDB894), ref: 00007FF6D7BDF051
        • Part of subcall function 00007FF6D7BDF010: GetLastError.KERNEL32(?,?,00000000,00007FF6D7BDB894), ref: 00007FF6D7BDF05E
      • LeaveCriticalSection.KERNEL32 ref: 00007FF6D7BDB96D
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB9F9
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDB9FF
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: CriticalErrorLastSection_invalid_parameter_noinfo_noreturn$EnterEnvironmentLeaveVariable__acrt_iob_func
      • String ID: COREHOST_TRACEFILE$COREHOST_TRACE_VERBOSITY$Unable to open COREHOST_TRACEFILE=%s for writing
      • API String ID: 1003891545-3560840189
      • Opcode ID: 86f93047c2c31673f241c1f988ddc5dd337df52e1ba6b0d0887a4138a62a1742
      • Instruction ID: 24c60c0956000946086a6fdd5ad26d535736caa5d41e7555a7e5b8c7c8407c76
      • Opcode Fuzzy Hash: 86f93047c2c31673f241c1f988ddc5dd337df52e1ba6b0d0887a4138a62a1742
      • Instruction Fuzzy Hash: AA519F71A1AA8681EA008F14E44027EA361EFC67A0F501237E69DC77D9DF7CE4A1CB06
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • fread.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BD9928
        • Part of subcall function 00007FF6D7BDBA10: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDBA48
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBA7E
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAC9
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAF4
        • Part of subcall function 00007FF6D7BDBA10: fputws.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBAFF
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB07
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB12
        • Part of subcall function 00007FF6D7BDBA10: OutputDebugStringW.KERNEL32 ref: 00007FF6D7BDBB25
        • Part of subcall function 00007FF6D7BDBA10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB39
        • Part of subcall function 00007FF6D7BDBA10: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB66
        • Part of subcall function 00007FF6D7BDBA10: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBB73
      • _CxxThrowException.LIBVCRUNTIME ref: 00007FF6D7BD998D
        • Part of subcall function 00007FF6D7BE449C: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D7BE20C6), ref: 00007FF6D7BE4511
        • Part of subcall function 00007FF6D7BE449C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D7BE20C6), ref: 00007FF6D7BE4543
      • _CxxThrowException.LIBVCRUNTIME ref: 00007FF6D7BD99BF
      • _CxxThrowException.LIBVCRUNTIME ref: 00007FF6D7BD99F1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: Exception$Throw__acrt_iob_func$__stdio_common_vswprintffputwc$CriticalDebugEnterFileHeaderOutputRaiseSectionString__stdio_common_vfwprintffputwsfread
      • String ID: Failure processing application bundle; possible file corruption.$I/O failure reading contents of the bundle.$Path length encoding read beyond two bytes$Path length is zero or too long
      • API String ID: 2673117985-3676025953
      • Opcode ID: ff638b004bceb0b0f118d29e8f29715b9d8c495869c4819fc7f1c120396bbd65
      • Instruction ID: 7f4721f58bf3ea9b66aa7dae6ad9474d05521e87d7d026ceadf90dfaeb3ca52b
      • Opcode Fuzzy Hash: ff638b004bceb0b0f118d29e8f29715b9d8c495869c4819fc7f1c120396bbd65
      • Instruction Fuzzy Hash: 5C218071A2E55A52EA50DF10D8902BD2328FFD3350F800077E68FD66A2DF2DE528C702
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE1B9E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID: 74e592c2fa383d4a3960714caef0c4f2$Agent.Listener.dll$The managed DLL bound to this executable could not be retrieved from the executable image.$The managed DLL bound to this executable is: '%s'$This executable is not bound to a managed DLL to execute. The binding value is: '%s'$c3ab8ff13720e8ad9047dd39466b3c89
      • API String ID: 3668304517-2690528063
      • Opcode ID: 166cd1ce1a5fb8bff783e07aae9e22c6c1853ea8f6ae17c8acf653912255957b
      • Instruction ID: e4270a4332a6f4c78518eadb1f0b3a32c3eca0f67541aa6af751c4974e2175da
      • Opcode Fuzzy Hash: 166cd1ce1a5fb8bff783e07aae9e22c6c1853ea8f6ae17c8acf653912255957b
      • Instruction Fuzzy Hash: D4410931B0E64980EA108F24D4402BE6391EB467E0F501673E6ADC7BE9EF3CD4A1C702
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: Process$CurrentWow64_invalid_parameter_noinfo_noreturn
      • String ID: ProgramFiles$ProgramFiles(x86)$_DOTNET_TEST_DEFAULT_INSTALL_PATH$dotnet
      • API String ID: 1909928518-1903759158
      • Opcode ID: b11f0bb641a3da1a93a6219d5a7adfed1a1f56552376549667290bfa042478ee
      • Instruction ID: 4b63df8e8f01abae26ce51a61e429afdac42170e6e888fa1720cbf0ab8b4be54
      • Opcode Fuzzy Hash: b11f0bb641a3da1a93a6219d5a7adfed1a1f56552376549667290bfa042478ee
      • Instruction Fuzzy Hash: 8531AF71A1EA4681EE108F19E4401BE6361EFC6BA4F401237EA9EC7799DF6CD094C706
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn$DirectoryRemove_wremove
      • String ID: Failed to remove temporary directory [%s].$Failed to remove temporary file [%s].
      • API String ID: 933438758-3585224255
      • Opcode ID: 1cab06fc2d08581fcd2f46dfe1463e0963f529719e6bc567aa901a36364d032a
      • Instruction ID: 5bb8c5bcf3c8323c7c02bd79a69cf8e7b8e6346a5a1bc47e15b7174812d2dcb0
      • Opcode Fuzzy Hash: 1cab06fc2d08581fcd2f46dfe1463e0963f529719e6bc567aa901a36364d032a
      • Instruction Fuzzy Hash: 9951D672A1A64641EE108F25E54436E5351EFC7BF4F1C4332EA6E876D9DE2CE4A08705
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcvtLocinfoLocinfo::_Register
      • String ID:
      • API String ID: 2452388251-0
      • Opcode ID: 016008fb02fc2036bae7372bc0850d84a856387e68ba40db640f432f0acdb9a7
      • Instruction ID: 78c0c1e6da87f82dee3bd3f23dbf20a1d9ed22c3354f8af00d493e2932d267cb
      • Opcode Fuzzy Hash: 016008fb02fc2036bae7372bc0850d84a856387e68ba40db640f432f0acdb9a7
      • Instruction Fuzzy Hash: 46518F36A0AB8981EB25CF14D4402BC7761FB96B84F059237DA4E873A5DF7DE4A1C305
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
        • Part of subcall function 00007FF6D7BE3404: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,7FFFFFFFFFFFFFFE), ref: 00007FF6D7BE341E
      • std::locale::_Init.LIBCPMT ref: 00007FF6D7BD71FF
        • Part of subcall function 00007FF6D7BE273C: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6D7BE275A
        • Part of subcall function 00007FF6D7BE273C: std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00007FF6D7BE276E
        • Part of subcall function 00007FF6D7BE273C: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF6D7BE2779
        • Part of subcall function 00007FF6D7BE273C: _Yarn.LIBCPMT ref: 00007FF6D7BE2790
        • Part of subcall function 00007FF6D7BE273C: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6D7BE27D5
      • std::ios_base::_Addstd.LIBCPMT ref: 00007FF6D7BD72AB
      • _CxxThrowException.LIBVCRUNTIME ref: 00007FF6D7BD7317
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: std::locale::_$Lockitstd::_$AddstdExceptionInitLocimpLocimp::_Lockit::_Lockit::~_New_SetgloballocaleThrowYarnmallocstd::ios_base::_
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 3567259056-1866435925
      • Opcode ID: fd989cc221b98bd7f90221de703621eac1e6018d6a039304b2235e53310a1e0b
      • Instruction ID: 17c2dddda6310f78d5dfa6555498c44161e017cf324f122a35ab32b1f800a2e9
      • Opcode Fuzzy Hash: fd989cc221b98bd7f90221de703621eac1e6018d6a039304b2235e53310a1e0b
      • Instruction Fuzzy Hash: 3941C032606B8982EB14CF15D8802AC33A4FF86BC4F540136DA5E87BA5DF39E467C345
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _errnomemsetwcstoul
      • String ID: 0123456789$invalid stoul argument$stoul argument out of range
      • API String ID: 2954855158-67083455
      • Opcode ID: 78f53a9261fa3df71a212c73c62bb73f4f9ee5a7041629874a573c2fe2864f85
      • Instruction ID: bcc7cbd56d3b4451732c9bfbce8ff99bc1433c1ad3541e506c3de443963b7fdc
      • Opcode Fuzzy Hash: 78f53a9261fa3df71a212c73c62bb73f4f9ee5a7041629874a573c2fe2864f85
      • Instruction Fuzzy Hash: A5410476B0A64681EE20DF15D4102BD6390EB96794F5442B3DA9EC3BD4DF3CE462C306
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FF6D7BD8ED1), ref: 00007FF6D7BDE05C
      Strings
      • HKEY_CURRENT_USER\, xrefs: 00007FF6D7BDE4BD
      • HKCU\, xrefs: 00007FF6D7BDE97C
      • \Setup\InstalledVersions\, xrefs: 00007FF6D7BDE69B
      • InstallLocation, xrefs: 00007FF6D7BDE816
      • HKLM\, xrefs: 00007FF6D7BDE983
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID: HKCU\$HKEY_CURRENT_USER\$HKLM\$InstallLocation$\Setup\InstalledVersions\
      • API String ID: 3668304517-3617692720
      • Opcode ID: 66b41d66ca3da3a2858181afa674f61dd03b2199ef3c1f3ecd31c869895a6a14
      • Instruction ID: ae0c6f51de1a22dd550894915d430bcbc9ccd5e264c1fe5b8dd8aebed554ab03
      • Opcode Fuzzy Hash: 66b41d66ca3da3a2858181afa674f61dd03b2199ef3c1f3ecd31c869895a6a14
      • Instruction Fuzzy Hash: 3A31C672A09B8181EA108F14E4452AE7361EBC6BF4F240337E6AD87BE9DE2CD091C745
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ErrorLast$EnvironmentVariable
      • String ID: Failed to read environment variable [%s], HRESULT: 0x%X
      • API String ID: 2691138088-3628523914
      • Opcode ID: 2e866c2d62abafe6626ebb0693f82ff7aafbeee1e2802f72c84ca2787d6efb62
      • Instruction ID: fb8e880db91851bca4f0f83e8efc290c4e207c9e980d83b3c0027232d4c395d2
      • Opcode Fuzzy Hash: 2e866c2d62abafe6626ebb0693f82ff7aafbeee1e2802f72c84ca2787d6efb62
      • Instruction Fuzzy Hash: C031F431B0E64685EB509F22A8011BE2794FB86BD0F441176EE6EC7B92DF2CD4658706
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::_Register
      • String ID:
      • API String ID: 1750885376-0
      • Opcode ID: d665c5730150284d53c114677c8b607f97d52e7708cf14043c329c49cf8dc8d0
      • Instruction ID: 34c2986a7f0b99440ab4ccba8beb09e4605bf9f2930376f4aab1eab60d04bde8
      • Opcode Fuzzy Hash: d665c5730150284d53c114677c8b607f97d52e7708cf14043c329c49cf8dc8d0
      • Instruction Fuzzy Hash: D8416C36A0BA4A80EA259F15D8403FD6361EB96B94F095237DA0EC73A5DF3CE461C346
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::_Register
      • String ID:
      • API String ID: 1750885376-0
      • Opcode ID: 8e7bf3fdcce59a318b6324e283e7ea7ebb489fc34c4bf2b90e5df120560296b4
      • Instruction ID: c75e4cffc21a0d5c1b75e59e2f324efc8c4f917a9a16e9bd017e2c20e4c637c3
      • Opcode Fuzzy Hash: 8e7bf3fdcce59a318b6324e283e7ea7ebb489fc34c4bf2b90e5df120560296b4
      • Instruction Fuzzy Hash: 9E418E36A0BB8A82EA25DF15D4503BD7361EB96B90F155137CA4E833A5DF3CE461C306
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: CriticalSection__acrt_iob_funcfflush$EnterLeave
      • String ID:
      • API String ID: 1572519478-0
      • Opcode ID: b4a84f31e360ae71112358312a87073eebc612c76551cf0491f1c09fdb6f5945
      • Instruction ID: 197ec4f905c129d66ec2e84010d3431c275b86d4d910d622518963087c4a9a12
      • Opcode Fuzzy Hash: b4a84f31e360ae71112358312a87073eebc612c76551cf0491f1c09fdb6f5945
      • Instruction Fuzzy Hash: 69E0C938E4B55A55E900FF6198161BC5210AFD3720F90137BD42ECA3E3DD1CA9628306
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID:
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 0-1866435925
      • Opcode ID: e5ed97f47fa836179bd15ba7743112b0ee344e36124bf0b09b9ecaddf2b8f6ae
      • Instruction ID: b4045f6f530a481cad2daba0fa0f49de11fd780b45a92a58c7256b73dff8d5bd
      • Opcode Fuzzy Hash: e5ed97f47fa836179bd15ba7743112b0ee344e36124bf0b09b9ecaddf2b8f6ae
      • Instruction Fuzzy Hash: 2CA1903261AA4581DB148F19D4803BD7761FB8AB84F448137EA4EC77A4DF3DE865C346
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrow__std_exception_copy
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 1552479455-1866435925
      • Opcode ID: 37481502faf58e0590d70c6ba19113f079a0dcceb528932c209b093df1e989f0
      • Instruction ID: 108fdc9767568dbca1b1ceb5bbd147270434939286dacababe15162efa07637f
      • Opcode Fuzzy Hash: 37481502faf58e0590d70c6ba19113f079a0dcceb528932c209b093df1e989f0
      • Instruction Fuzzy Hash: 0D517F72606F8981EB14CF19E5802AC77A0FB89F94F588232DA5EC37A5DF38D4A5C341
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: terminate
      • String ID: MOC$RCC$csm
      • API String ID: 1821763600-2671469338
      • Opcode ID: e11c029d6bdf9d65650cb03c76dfe546346437e76b71599202c1952e0a907006
      • Instruction ID: 44a2595c3086751548aeb24a83bed0d157e77200c75588f24de6b1060c983a4d
      • Opcode Fuzzy Hash: e11c029d6bdf9d65650cb03c76dfe546346437e76b71599202c1952e0a907006
      • Instruction Fuzzy Hash: BFF05439D1A10FC6E2682F65444627C3260EF45705F9525F2D70DC6782CFBC74605A23
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrow
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 432778473-1866435925
      • Opcode ID: 50f025c5f69a63b7d35461e0b5e680a0b62095b7508f6bef42fd1b2ca9fa3814
      • Instruction ID: 3182bc628a0e1ed0f24a3c7f2802a157f7f0c1ff5e0e015c38043fed34e9d9fe
      • Opcode Fuzzy Hash: 50f025c5f69a63b7d35461e0b5e680a0b62095b7508f6bef42fd1b2ca9fa3814
      • Instruction Fuzzy Hash: 6B718032A0AA4681EB60CF19D4943BD6761EBC1B88F548133CA4EC73A5DF3DD866C746
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6D7BD1CDE), ref: 00007FF6D7BD32B6
      • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6D7BD1CDE), ref: 00007FF6D7BD32CB
      • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6D7BD1CDE), ref: 00007FF6D7BD32DE
      • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6D7BD1CDE), ref: 00007FF6D7BD32F1
      • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6D7BD1CDE), ref: 00007FF6D7BD3304
      • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6D7BD1CDE), ref: 00007FF6D7BD3317
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: free
      • String ID:
      • API String ID: 1294909896-0
      • Opcode ID: 592b0a966272c2f21661b252875627fe9a2a6a5544d2309b85859987ccd38131
      • Instruction ID: b26c1100218d1d16af2716ad7348f4cd470212fa59751fa407b6fe9a49f603e4
      • Opcode Fuzzy Hash: 592b0a966272c2f21661b252875627fe9a2a6a5544d2309b85859987ccd38131
      • Instruction Fuzzy Hash: 86119E31A0770580EF14DF7190914BC73A4EF83F94B281236CA5EC37C6CE29D8A0C246
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrow
      • String ID: Failed to remove temporary directory [%s].$Failed to remove temporary file [%s].$Failure processing application bundle; possible file corruption.$I/O failure reading contents of the bundle.
      • API String ID: 432778473-1682126097
      • Opcode ID: 59462e074bce528d541ff4d22d45386684297e76699447ef0533494c5fc18164
      • Instruction ID: 3a17041b0cb5de3d38a233384889ce65abdee50b2a64d1839e8b5a0904c9c0fa
      • Opcode Fuzzy Hash: 59462e074bce528d541ff4d22d45386684297e76699447ef0533494c5fc18164
      • Instruction Fuzzy Hash: 31E09BB1A1A54E40EA54EF50D8811FD2214EF9A380F541437E54ED63A2EE2CE5A48712
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BD86F4
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BD86FA
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID: .$Unknown exception
      • API String ID: 3668304517-4018657147
      • Opcode ID: 9e38ec0696ec9c2bbb0303ec6793bc0e2ef0e1e7fafd1762dbbda354190d3827
      • Instruction ID: b9d56d012c758c5bea8a0d32a45a5c4c7fdbbd9c022d522dbaeb127d5c4be717
      • Opcode Fuzzy Hash: 9e38ec0696ec9c2bbb0303ec6793bc0e2ef0e1e7fafd1762dbbda354190d3827
      • Instruction Fuzzy Hash: 22611772A1AA5680EE149F15D5442BD2321EBC2BF5F584233EB6E877E4DF7CD0A08309
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDD614
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDD61A
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDD620
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID: .exe
      • API String ID: 3668304517-4119554291
      • Opcode ID: e3c2499c8efcd1ec1d3cd9df43387d40d35214eb63459daff86ba13ec6786ffb
      • Instruction ID: 430e0dd70d2afc62665083ae976a18f84e02cc784ae9349eb13e5b6ba3427904
      • Opcode Fuzzy Hash: e3c2499c8efcd1ec1d3cd9df43387d40d35214eb63459daff86ba13ec6786ffb
      • Instruction Fuzzy Hash: A451D572A1AB8581EA109F65E04436D6321FB867E4F105233EAAE87BD9DF3CE4908705
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
        • Part of subcall function 00007FF6D7BDF010: GetEnvironmentVariableW.KERNEL32(?,?,00000000,00007FF6D7BDB894), ref: 00007FF6D7BDF044
        • Part of subcall function 00007FF6D7BDF010: GetLastError.KERNEL32(?,?,00000000,00007FF6D7BDB894), ref: 00007FF6D7BDF051
        • Part of subcall function 00007FF6D7BDF010: GetLastError.KERNEL32(?,?,00000000,00007FF6D7BDB894), ref: 00007FF6D7BDF05E
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDBE55
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BDBE5B
        • Part of subcall function 00007FF6D7BDB810: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDB86C
        • Part of subcall function 00007FF6D7BDB810: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDB877
        • Part of subcall function 00007FF6D7BDB810: LeaveCriticalSection.KERNEL32 ref: 00007FF6D7BDB96D
        • Part of subcall function 00007FF6D7BDBC60: EnterCriticalSection.KERNEL32 ref: 00007FF6D7BDBC93
        • Part of subcall function 00007FF6D7BDBC60: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBCBC
        • Part of subcall function 00007FF6D7BDBC60: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D7BDBCC9
        • Part of subcall function 00007FF6D7BDBC60: LeaveCriticalSection.KERNEL32 ref: 00007FF6D7BDBCD6
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: CriticalSection$EnterErrorLastLeave_invalid_parameter_noinfo_noreturn$EnvironmentVariable__acrt_iob_func__stdio_common_vfwprintffputwc
      • String ID: COREHOST_TRACE$Tracing enabled @ %s
      • API String ID: 1981972018-2113631315
      • Opcode ID: 3b7562a23a7226a36ca1fa3422f2a21b5c1d60890e4dc0f92d1c6b8d3f355465
      • Instruction ID: 7fcb820e32d8bc9c80ae21655fc9b6210db2df7c945e1975ec712f887876b028
      • Opcode Fuzzy Hash: 3b7562a23a7226a36ca1fa3422f2a21b5c1d60890e4dc0f92d1c6b8d3f355465
      • Instruction Fuzzy Hash: 04319671A0A64A41EE109F28E49526E5361EBC77B0F501732E7ADC37E9DF2CD590CB06
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrowfread
      • String ID: Failure processing application bundle; possible file corruption.$I/O failure reading contents of the bundle.
      • API String ID: 1304442913-4132748757
      • Opcode ID: 06c34c690bed10d287031533c9f7dc394e4124476481717a80fa5445bd2739a7
      • Instruction ID: 145d529412a64bf85f77c422b15ae6a7434029e0e205a569f49178243b54166e
      • Opcode Fuzzy Hash: 06c34c690bed10d287031533c9f7dc394e4124476481717a80fa5445bd2739a7
      • Instruction Fuzzy Hash: B001D63160A68640EA119F11E8401FDA314EF82BE4F480236EA9ECB7E6DE6CE4618702
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrow
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 432778473-1866435925
      • Opcode ID: 9ee0c69d5343f8de65fec1ede7631c8dddbda1c2230b1057fc92260c74e12c55
      • Instruction ID: 62a64bbfd2664a86bd86f4bcb05cac822725544e9335565e3e96d47338b3c7fe
      • Opcode Fuzzy Hash: 9ee0c69d5343f8de65fec1ede7631c8dddbda1c2230b1057fc92260c74e12c55
      • Instruction Fuzzy Hash: E0715C7260AA4981EB608F09D48036DA7A0FB85B88F559133DA4FC77A4DF3DD8A6C705
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrow
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 432778473-1866435925
      • Opcode ID: 59c449501c0dac791889150995d0ba98547410802b4387c6a8bb7385163cd524
      • Instruction ID: 825eb42924ad9a04e0cdec74f6e56e51c9ce559ca6d0179e30dbcc4b5b4792f9
      • Opcode Fuzzy Hash: 59c449501c0dac791889150995d0ba98547410802b4387c6a8bb7385163cd524
      • Instruction Fuzzy Hash: 1381507260AA4981EB608F19D48037DB7A0FB85F94F559132DA5EC37A0DF3DD4A5C305
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
        • Part of subcall function 00007FF6D7BD1D30: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6D7BD1D61
        • Part of subcall function 00007FF6D7BD1D30: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6D7BD1D84
        • Part of subcall function 00007FF6D7BD1D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6D7BD1DB1
        • Part of subcall function 00007FF6D7BD1D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6D7BD1EA7
      • _CxxThrowException.LIBVCRUNTIME ref: 00007FF6D7BD36ED
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: Lockitstd::_$Lockit::_Lockit::~_$ExceptionThrow
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 4074540200-1866435925
      • Opcode ID: 0936e05498534d0aad18e25cda7809ff89677333a63544c14b85e552fa39bea8
      • Instruction ID: 8ed8ee772f67877b87b736e4c8120f149363a73abe6107599b177e53e94ed2e7
      • Opcode Fuzzy Hash: 0936e05498534d0aad18e25cda7809ff89677333a63544c14b85e552fa39bea8
      • Instruction Fuzzy Hash: DE516F7260AB8A82EB10CF19D4803AD67A0FB85B85F054137DA9EC37A5DF3CD459C701
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE7FD4
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE8044
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE80B4
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BE8124
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID:
      • API String ID: 3668304517-0
      • Opcode ID: d57ecb23a2b367757518789a5ee85edf4bbdb6a078eb246473dd5b25e14c0def
      • Instruction ID: b310ba91f89a4dd3d0cc95ab67671b68bff23b4f2204b5e546358da3111c80ea
      • Opcode Fuzzy Hash: d57ecb23a2b367757518789a5ee85edf4bbdb6a078eb246473dd5b25e14c0def
      • Instruction Fuzzy Hash: 61414D74E1A99B80EE049F29E84937C93A2AF47B84F905073C64CC6766EF5DA4E08346
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrow
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 432778473-1866435925
      • Opcode ID: b5ac97474ec81a6b4baa91836d4cbc510ffd23db2eab7565554e3612df1d3485
      • Instruction ID: b1a2fecb921ae17775470845987c736aac0fa8480ea8a553b2a13c7fea28854c
      • Opcode Fuzzy Hash: b5ac97474ec81a6b4baa91836d4cbc510ffd23db2eab7565554e3612df1d3485
      • Instruction Fuzzy Hash: EB313D72A06A0A81EE108F19D49127D6760EF86F95F548636DE1EC33B5CF2DE866C306
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ExceptionThrow
      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
      • API String ID: 432778473-1866435925
      • Opcode ID: 35a75d28eeec6ce6299e3e38f5676196b8e830b5dace7f4ac50a968d2d95313c
      • Instruction ID: 2e1acb94d541d1083accf5efad248a4501481411e6ee122b5c678e6169a5bfed
      • Opcode Fuzzy Hash: 35a75d28eeec6ce6299e3e38f5676196b8e830b5dace7f4ac50a968d2d95313c
      • Instruction Fuzzy Hash: 30117F72A09A0A85EB108F14D4823AC6760EF91BA4F544232DA6FC72F5DF7CD5A6C346
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: CriticalSection$EnterLeave__stdio_common_vfwprintffputwc
      • String ID:
      • API String ID: 4070124032-0
      • Opcode ID: 3631f259820f72840ba806f3b9eaffa72981748bbb200ca3f5cb54406c6c067b
      • Instruction ID: 7130ceaee01a82e378a4e56efd05de0ce79865e42d3b9a007a4535131c231c6b
      • Opcode Fuzzy Hash: 3631f259820f72840ba806f3b9eaffa72981748bbb200ca3f5cb54406c6c067b
      • Instruction Fuzzy Hash: 30F08F36A0AB4581D6009F10F80106EA260FBE67A0F445237E9ADC6BE5DF3CD460C701
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: CriticalSection$EnterLeave__stdio_common_vfwprintffputwc
      • String ID:
      • API String ID: 4070124032-0
      • Opcode ID: 506df26790994aec55af147e9ae0f7fc88275834824a933ecf84201c5ab73d2d
      • Instruction ID: 57f44692a4bcb86b7c0edc21514daf37c53d2a552f5d73b9c17a7691aa025c26
      • Opcode Fuzzy Hash: 506df26790994aec55af147e9ae0f7fc88275834824a933ecf84201c5ab73d2d
      • Instruction Fuzzy Hash: DBF04F76A4AB4591D6009F10F8410ADA360FBE67A0F445237E9ADC6BE5DF3CD560C701
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
        • Part of subcall function 00007FF6D7BD56F0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6D7BD106D), ref: 00007FF6D7BD580D
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BD2AC9
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D7BD2ACF
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID: \\.\
      • API String ID: 3668304517-2900601889
      • Opcode ID: 39929ddb092aeb3beedf9b8ad0dc3fd40b998326936849417770b2e816e2574d
      • Instruction ID: ce4e2ce86b0667e99525cac104dab647ff27b4fae8e142030c743c4c24185618
      • Opcode Fuzzy Hash: 39929ddb092aeb3beedf9b8ad0dc3fd40b998326936849417770b2e816e2574d
      • Instruction Fuzzy Hash: 9E51E332A19BC581EB509F19E4486AE7368FF85BA0F411336EAAD877D5DF78D091C304
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6D7BD106D), ref: 00007FF6D7BD580D
      Strings
      • \\.\, xrefs: 00007FF6D7BD55AC, 00007FF6D7BD58A9
      • ios_base::badbit set, xrefs: 00007FF6D7BD583F
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: _invalid_parameter_noinfo_noreturn
      • String ID: \\.\$ios_base::badbit set
      • API String ID: 3668304517-1001580282
      • Opcode ID: 97c9fdd27dd6b3fb96513825c91b978d0dae015116470a523353784e4b73b692
      • Instruction ID: 1c6fc0aa4c7a9d7425d19c6a36541e9597ab2484de70f4eba9c62214a9f844fb
      • Opcode Fuzzy Hash: 97c9fdd27dd6b3fb96513825c91b978d0dae015116470a523353784e4b73b692
      • Instruction Fuzzy Hash: 6431DF32B06B8685EA04DF26E5451AD6260FF46FD0F680132DB5E87786DEBCD1A18309
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: ErrorLast
      • String ID: \\.\
      • API String ID: 1452528299-2900601889
      • Opcode ID: 44b72b347e53abd465bc3d2782b8434811b50389858b5f523d03e7c26b03bf01
      • Instruction ID: 405a402b5447fbc8a0a374fbdad1f9cba11c73464d76f1a71738bb8ec662ac7b
      • Opcode Fuzzy Hash: 44b72b347e53abd465bc3d2782b8434811b50389858b5f523d03e7c26b03bf01
      • Instruction Fuzzy Hash: 99215E32A0A759C5E7118F22980416E67A1BF4AFD0F4544BACD4EC7754DE3DE46AC343
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • try_get_function.LIBVCRUNTIME ref: 00007FF6D7BE6E41
      • TlsSetValue.KERNEL32(?,?,00000000,00007FF6D7BE545E,?,?,?,00007FF6D7BE53F9,?,?,?,?,00007FF6D7BE4AEE), ref: 00007FF6D7BE6E58
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.345636473.00007FF6D7BD1000.00000020.00020000.sdmp, Offset: 00007FF6D7BD0000, based on PE: true
      • Associated: 00000000.00000002.345632360.00007FF6D7BD0000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345650287.00007FF6D7BE9000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.345667267.00007FF6D7BF8000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.345671517.00007FF6D7BFA000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_7ff6d7bd0000_Agent.jbxd
      Similarity
      • API ID: Valuetry_get_function
      • String ID: FlsSetValue
      • API String ID: 738293619-3750699315
      • Opcode ID: 5eaf56c7917e201bf85f6a15d9a922fa1527d3899fde4020daae6f6bf7da0d77
      • Instruction ID: e76f7de11fde43e49e89afd0a6ef997a37ad0768d9c278c9dcaf7d7ca48013d1
      • Opcode Fuzzy Hash: 5eaf56c7917e201bf85f6a15d9a922fa1527d3899fde4020daae6f6bf7da0d77
      • Instruction Fuzzy Hash: 8BE06D72A0A64A95FA094F65F4404BC6321AF4AB84F985077D91DCA398CE3DE879C303
      Uniqueness

      Uniqueness Score: -1.00%