SmartHawk

7.0

高危

61 个模型检测该样本为恶意！

重新分析

下载样本

f5cffd780367ce051b550f171bdac33d5a4eba0b12acfac1bcfa63669c94104b

0757361cb0940d08653963807aaa496a.exe

分析耗时

110s

最近分析

文件大小

713.5KB

静态报毒动态报毒 100% AGEN AGENTTESLA AI SCORE=85 AIDETECTVM ALI2000015 ANDROM AWTI BT3BOP CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELDORADO EMOY FAREIT GDSDA HIGH CONFIDENCE HNCNSH HPLOKI IGENT KCLOUD LOKIBOT MALWARE1 MALWARE@#821BRD5QLAE0 SCORE SGW@AOXZN6HI SIGGEN2 SMBD STATIC AI SUSGEN SUSPICIOUS PE TSCOPE TSPY UNSAFE X2085 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FVZ!0757361CB094	20201228	6.0.6.653
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201228	21.1.5827.0
Kingsoft	Win32.Hack.Undef.(kcloud)	20201228	2017.9.26.565
Tencent	Win32.Backdoor.Androm.Eol	20201228	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (39 个事件)

Time & API	Arguments	Status
1619134514.594053 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49348420 registers.edi: 0 registers.eax: 0 registers.ebp: 49348488 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152849.118751 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd9f14ad	success
1619152848.290001 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35192644 registers.edi: 0 registers.eax: 0 registers.ebp: 35192712 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152854.212001 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48693060 registers.edi: 0 registers.eax: 0 registers.ebp: 48693128 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152856.322126 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75164de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfda214ad	success
1619152856.322374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49151812 registers.edi: 0 registers.eax: 0 registers.ebp: 49151880 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152859.462126 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48955204 registers.edi: 0 registers.eax: 0 registers.ebp: 48955272 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152860.759876 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfdbc14ad	success
1619152861.103251 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34275140 registers.edi: 0 registers.eax: 0 registers.ebp: 34275208 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152864.337374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48693060 registers.edi: 0 registers.eax: 0 registers.ebp: 48693128 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152865.822876 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75164de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff4314ad	success
1619152866.572626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35782468 registers.edi: 0 registers.eax: 0 registers.ebp: 35782536 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152869.978126 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35585860 registers.edi: 0 registers.eax: 0 registers.ebp: 35585928 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152872.509251 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfdc814ad	success
1619152873.259626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34930500 registers.edi: 0 registers.eax: 0 registers.ebp: 34930568 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152878.306751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34406212 registers.edi: 0 registers.eax: 0 registers.ebp: 34406280 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152880.556001 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75164de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd8414ad	success
1619152880.681626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 36306756 registers.edi: 0 registers.eax: 0 registers.ebp: 36306824 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152885.165251 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34275140 registers.edi: 0 registers.eax: 0 registers.ebp: 34275208 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152886.478251 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff5214ad	success
1619152887.072501 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35716932 registers.edi: 0 registers.eax: 0 registers.ebp: 35717000 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152889.493626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50593604 registers.edi: 0 registers.eax: 0 registers.ebp: 50593672 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152891.306251 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x750c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x750c4de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd8f14ad	success
1619152891.384751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49938244 registers.edi: 0 registers.eax: 0 registers.ebp: 49938312 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152894.165001 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152895.462374 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75164de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd8914ad	success
1619152896.072499 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34012996 registers.edi: 0 registers.eax: 0 registers.ebp: 34013064 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152898.587626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152901.353251 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x750c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x750c4de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfda114ad	success
1619152900.790751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34078532 registers.edi: 0 registers.eax: 0 registers.ebp: 34078600 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152904.447251 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49413956 registers.edi: 0 registers.eax: 0 registers.ebp: 49414024 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152907.322626 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff3214ad	success
1619152907.197251 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48430916 registers.edi: 0 registers.eax: 0 registers.ebp: 48430984 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152911.118751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 33947460 registers.edi: 0 registers.eax: 0 registers.ebp: 33947528 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152913.556626 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff1e14ad	success
1619152914.040251 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 36241220 registers.edi: 0 registers.eax: 0 registers.ebp: 36241288 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152918.259751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34930500 registers.edi: 0 registers.eax: 0 registers.ebp: 34930568 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success
1619152921.868374 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3 0757361cb0940d08653963807aaa496a+0x40a4d @ 0x440a4d 0757361cb0940d08653963807aaa496a+0x39254 @ 0x439254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff3f14ad	success
1619152922.290374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49872708 registers.edi: 0 registers.eax: 0 registers.ebp: 49872776 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 0757361cb0940d08653963807aaa496a+0x5e00e exception.instruction: div eax exception.module: 0757361cb0940d08653963807aaa496a.exe exception.exception_code: 0xc0000094 exception.offset: 385038 exception.address: 0x45e00e	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 429 个事件)

Time & API	Arguments	Status
1619134514.453053 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ec0000	success
1619134514.594053 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045e000	success
1619134514.609053 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fc0000	success
1619152848.056751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619152848.103751 NtAllocateVirtualMemory	process_identifier: 2544 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01d70000	success
1619152848.103751 NtAllocateVirtualMemory	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01da0000	success
1619152848.103751 NtAllocateVirtualMemory	process_identifier: 2544 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success
1619152848.103751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 118784 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619152848.306751 NtAllocateVirtualMemory	process_identifier: 2544 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01fd0000	success
1619152848.306751 NtAllocateVirtualMemory	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02160000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004f2000	success
1619152849.087751 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619152848.275001 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619152848.290001 NtProtectVirtualMemory	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045e000	success
1619152848.322001 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f70000	success
1619152854.197001 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007e0000	success
1619152854.228001 NtProtectVirtualMemory	process_identifier: 420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045e000	success
1619152854.243001 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fc0000	success
1619152855.743126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619152855.743126 NtAllocateVirtualMemory	process_identifier: 1376 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01ee0000	success
1619152855.743126 NtAllocateVirtualMemory	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02050000	success
1619152855.743126 NtAllocateVirtualMemory	process_identifier: 1376 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004c0000	success
1619152855.743126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 118784 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x004c2000	success
1619152855.790126 NtAllocateVirtualMemory	process_identifier: 1376 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02090000	success
1619152855.790126 NtAllocateVirtualMemory	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x021b0000	success
1619152856.259126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00522000	success
1619152856.259126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619152856.259126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00522000	success
1619152856.259126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619152856.259126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00522000	success
1619152856.259126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619152856.259126 NtProtectVirtualMemory	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00522000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (33 个事件)

Time & API	Arguments	Status	Return
1619152856.337374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 1932	success	1
1619152864.353374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 2032	success	1
1619152866.587626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 1812	success	1
1619152866.587626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3120	success	1
1619152866.587626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3200	success	1
1619152870.228126 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3292	success	1
1619152873.275626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3368	success	1
1619152873.275626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3456	success	1
1619152878.322751 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3496	success	1
1619152878.322751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3552	success	1
1619152880.712626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3572	success	1
1619152880.712626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3724	success	1
1619152885.228251 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3928	success	1
1619152885.228251 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3984	success	1
1619152887.165501 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 4000	success	1
1619152887.165501 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 4060	success	1
1619152887.165501 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3132	success	1
1619152887.165501 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3144	success	1
1619152889.587626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 2964	success	1
1619152891.384751 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3280	success	1
1619152891.384751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3348	success	1
1619152894.181001 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3240	success	1
1619152896.228499 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 1664	success	1
1619152896.243499 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3472	success	1
1619152900.806751 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3728	success	1
1619152907.322251 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3268	success	1
1619152907.322251 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000104 process_identifier: 3384	success	1
1619152907.322251 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 1160	success	1
1619152911.134751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3920	success	1
1619152914.306251 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x00000104 process_identifier: 3180	success	1
1619152914.306251 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3248	success	1
1619152914.322251 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3516	success	1
1619152922.322374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 1892	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.33472976973963

section

{'size_of_data': '0x00041400', 'virtual_address': '0x00078000', 'entropy': 7.33472976973963, 'name': '.rsrc', 'virtual_size': '0x00041284'}

description

A section with a high entropy has been found

entropy

0.3663157894736842

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

0757361cb0940d08653963807aaa496a.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (25 个事件)

Time & API	Arguments	Status
1619134514.609053 Process32NextW	process_name: conhost.exe snapshot_handle: 0x00000104 process_identifier: 2620	failed
1619152853.775001 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x000001b8 process_identifier: 2080	failed
1619152854.353001 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 2440	failed
1619152858.759374 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000154 process_identifier: 1404	failed
1619152859.478126 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 1688	failed
1619152863.775251 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000150 process_identifier: 708	failed
1619152864.353374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 2032	failed
1619152869.462626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000154 process_identifier: 3120	failed
1619152870.228126 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3292	failed
1619152877.212626 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000168 process_identifier: 3368	failed
1619152878.322751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3552	failed
1619152884.525626 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x00000154 process_identifier: 3888	failed
1619152885.228251 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3984	failed
1619152888.790501 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000130 process_identifier: 4060	failed
1619152889.587626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3208	failed
1619152893.618751 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000148 process_identifier: 3280	failed
1619152894.181001 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 1244	failed
1619152897.806499 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000130 process_identifier: 1664	failed
1619152898.650626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3940	failed
1619152903.868751 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x0000014c process_identifier: 4076	failed
1619152904.603251 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3252	failed
1619152910.478251 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x0000014c process_identifier: 3528	failed
1619152911.134751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3780	failed
1619152916.150251 Process32NextW	process_name: 0757361cb0940d08653963807aaa496a.exe snapshot_handle: 0x00000120 process_identifier: 2184	failed
1619152918.384751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3960	failed

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (26 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 called NtSetContextThread to modify thread in remote process 2544
Process injection	Process 420 called NtSetContextThread to modify thread in remote process 1376
Process injection	Process 2252 called NtSetContextThread to modify thread in remote process 2520
Process injection	Process 1816 called NtSetContextThread to modify thread in remote process 1812
Process injection	Process 3236 called NtSetContextThread to modify thread in remote process 3308
Process injection	Process 3496 called NtSetContextThread to modify thread in remote process 3572
Process injection	Process 3928 called NtSetContextThread to modify thread in remote process 4000
Process injection	Process 2964 called NtSetContextThread to modify thread in remote process 2796
Process injection	Process 3240 called NtSetContextThread to modify thread in remote process 3468
Process injection	Process 3816 called NtSetContextThread to modify thread in remote process 3728
Process injection	Process 3160 called NtSetContextThread to modify thread in remote process 3268
Process injection	Process 3720 called NtSetContextThread to modify thread in remote process 4020
Process injection	Process 1416 called NtSetContextThread to modify thread in remote process 3088
1619134514.828053 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2544	success	0	0
1619152854.978001 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1376	success	0	0
1619152859.743126 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2520	success	0	0
1619152864.712374 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1812	success	0	0
1619152870.759126 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3308	success	0	0
1619152879.040751 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3572	success	0	0
1619152885.447251 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4000	success	0	0
1619152890.212626 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2796	success	0	0
1619152894.493001 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3468	success	0	0
1619152899.040626 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3728	success	0	0
1619152905.478251 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3268	success	0	0
1619152912.118751 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4020	success	0	0
1619152919.978751 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3088	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (26 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 resumed a thread in remote process 2544
Process injection	Process 420 resumed a thread in remote process 1376
Process injection	Process 2252 resumed a thread in remote process 2520
Process injection	Process 1816 resumed a thread in remote process 1812
Process injection	Process 3236 resumed a thread in remote process 3308
Process injection	Process 3496 resumed a thread in remote process 3572
Process injection	Process 3928 resumed a thread in remote process 4000
Process injection	Process 2964 resumed a thread in remote process 2796
Process injection	Process 3240 resumed a thread in remote process 3468
Process injection	Process 3816 resumed a thread in remote process 3728
Process injection	Process 3160 resumed a thread in remote process 3268
Process injection	Process 3720 resumed a thread in remote process 4020
Process injection	Process 1416 resumed a thread in remote process 3088
1619134515.609053 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2544	success	0	0
1619152855.572001 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 1376	success	0	0
1619152860.134126 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2520	success	0	0
1619152865.103374 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 1812	success	0	0
1619152871.556126 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3308	success	0	0
1619152880.009751 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3572	success	0	0
1619152885.806251 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 4000	success	0	0
1619152890.743626 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2796	success	0	0
1619152894.931001 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3468	success	0	0
1619152900.025626 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3728	success	0	0
1619152906.072251 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3268	success	0	0
1619152912.978751 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 4020	success	0	0
1619152920.462751 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3088	success	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 103 个事件)

Time & API	Arguments	Status	Return
1619134514.781053 CreateProcessInternalW	thread_identifier: 2120 thread_handle: 0x00000108 process_identifier: 2544 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000010c inherit_handles: 0	success	1
1619134514.781053 NtUnmapViewOfSection	process_identifier: 2544 region_size: 4096 process_handle: 0x0000010c base_address: 0x00400000	success	0
1619134514.797053 NtMapViewOfSection	section_handle: 0x00000114 process_identifier: 2544 commit_size: 520192 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000010c allocation_type: 0 () section_offset: 0 view_size: 520192 base_address: 0x00400000	success	0
1619134514.828053 NtGetContextThread	thread_handle: 0x00000108	success	0
1619134514.828053 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2544	success	0
1619134515.609053 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2544	success	0
1619134515.765053 CreateProcessInternalW	thread_identifier: 2712 thread_handle: 0x00000110 process_identifier: 2080 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" 2 2544 30087515 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000118 inherit_handles: 0	success	1
1619152853.884001 CreateProcessInternalW	thread_identifier: 3004 thread_handle: 0x000001bc process_identifier: 420 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x000001c0 inherit_handles: 0	success	1
1619152854.915001 CreateProcessInternalW	thread_identifier: 2344 thread_handle: 0x00000108 process_identifier: 1376 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000010c inherit_handles: 0	success	1
1619152854.915001 NtUnmapViewOfSection	process_identifier: 1376 region_size: 4096 process_handle: 0x0000010c base_address: 0x00400000	success	0
1619152854.931001 NtMapViewOfSection	section_handle: 0x00000114 process_identifier: 1376 commit_size: 520192 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000010c allocation_type: 0 () section_offset: 0 view_size: 520192 base_address: 0x00400000	success	0
1619152854.962001 NtGetContextThread	thread_handle: 0x00000108	success	0
1619152854.978001 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1376	success	0
1619152855.572001 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 1376	success	0
1619152855.697001 CreateProcessInternalW	thread_identifier: 2428 thread_handle: 0x00000110 process_identifier: 1404 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" 2 1376 30095250 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000120 inherit_handles: 0	success	1
1619152858.931374 CreateProcessInternalW	thread_identifier: 2236 thread_handle: 0x00000158 process_identifier: 2252 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000015c inherit_handles: 0	success	1
1619152859.712126 CreateProcessInternalW	thread_identifier: 340 thread_handle: 0x00000108 process_identifier: 2520 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000010c inherit_handles: 0	success	1
1619152859.712126 NtUnmapViewOfSection	process_identifier: 2520 region_size: 4096 process_handle: 0x0000010c base_address: 0x00400000	success	0
1619152859.712126 NtMapViewOfSection	section_handle: 0x00000114 process_identifier: 2520 commit_size: 520192 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000010c allocation_type: 0 () section_offset: 0 view_size: 520192 base_address: 0x00400000	success	0
1619152859.743126 NtGetContextThread	thread_handle: 0x00000108	success	0
1619152859.743126 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2520	success	0
1619152860.134126 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2520	success	0
1619152860.493126 CreateProcessInternalW	thread_identifier: 1208 thread_handle: 0x00000110 process_identifier: 708 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" 2 2520 30099812 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000120 inherit_handles: 0	success	1
1619152863.947251 CreateProcessInternalW	thread_identifier: 2040 thread_handle: 0x00000154 process_identifier: 1816 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000158 inherit_handles: 0	success	1
1619152864.681374 CreateProcessInternalW	thread_identifier: 1208 thread_handle: 0x00000108 process_identifier: 1812 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000010c inherit_handles: 0	success	1
1619152864.681374 NtUnmapViewOfSection	process_identifier: 1812 region_size: 4096 process_handle: 0x0000010c base_address: 0x00400000	success	0
1619152864.681374 NtMapViewOfSection	section_handle: 0x00000114 process_identifier: 1812 commit_size: 520192 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000010c allocation_type: 0 () section_offset: 0 view_size: 520192 base_address: 0x00400000	success	0
1619152864.712374 NtGetContextThread	thread_handle: 0x00000108	success	0
1619152864.712374 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1812	success	0
1619152865.103374 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 1812	success	0
1619152865.962374 CreateProcessInternalW	thread_identifier: 3124 thread_handle: 0x00000110 process_identifier: 3120 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" 2 1812 30104781 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000120 inherit_handles: 0	success	1
1619152869.556626 CreateProcessInternalW	thread_identifier: 3240 thread_handle: 0x00000158 process_identifier: 3236 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000015c inherit_handles: 0	success	1
1619152870.681126 CreateProcessInternalW	thread_identifier: 3312 thread_handle: 0x00000108 process_identifier: 3308 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000010c inherit_handles: 0	success	1
1619152870.681126 NtUnmapViewOfSection	process_identifier: 3308 region_size: 4096 process_handle: 0x0000010c base_address: 0x00400000	success	0
1619152870.712126 NtMapViewOfSection	section_handle: 0x00000114 process_identifier: 3308 commit_size: 520192 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000010c allocation_type: 0 () section_offset: 0 view_size: 520192 base_address: 0x00400000	success	0
1619152870.759126 NtGetContextThread	thread_handle: 0x00000108	success	0
1619152870.759126 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3308	success	0
1619152871.556126 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3308	success	0
1619152872.415126 CreateProcessInternalW	thread_identifier: 3372 thread_handle: 0x00000110 process_identifier: 3368 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" 2 3308 30111234 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000120 inherit_handles: 0	success	1
1619152877.431626 CreateProcessInternalW	thread_identifier: 3500 thread_handle: 0x0000016c process_identifier: 3496 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000170 inherit_handles: 0	success	1
1619152878.993751 CreateProcessInternalW	thread_identifier: 3576 thread_handle: 0x00000108 process_identifier: 3572 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000010c inherit_handles: 0	success	1
1619152878.993751 NtUnmapViewOfSection	process_identifier: 3572 region_size: 4096 process_handle: 0x0000010c base_address: 0x00400000	success	0
1619152879.009751 NtMapViewOfSection	section_handle: 0x00000114 process_identifier: 3572 commit_size: 520192 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000010c allocation_type: 0 () section_offset: 0 view_size: 520192 base_address: 0x00400000	success	0
1619152879.040751 NtGetContextThread	thread_handle: 0x00000108	success	0
1619152879.040751 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4708160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3572	success	0
1619152880.009751 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3572	success	0
1619152880.040751 CreateProcessInternalW	thread_identifier: 3728 thread_handle: 0x00000110 process_identifier: 3724 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" 2 3572 30119687 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000120 inherit_handles: 0	success	1
1619152884.775626 CreateProcessInternalW	thread_identifier: 3932 thread_handle: 0x00000158 process_identifier: 3928 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000015c inherit_handles: 0	success	1
1619152885.400251 CreateProcessInternalW	thread_identifier: 4004 thread_handle: 0x00000108 process_identifier: 4000 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0757361cb0940d08653963807aaa496a.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000010c inherit_handles: 0	success	1
1619152885.400251 NtUnmapViewOfSection	process_identifier: 4000 region_size: 4096 process_handle: 0x0000010c base_address: 0x00400000	success	0

File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.0757361cb0940d08
McAfee	Fareit-FVZ!0757361CB094
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.cb0940
Arcabit	Trojan.Delf.FareIt.Gen.7
Cyren	W32/Injector.ABY.gen!Eldorado
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Fareit-8701980-0
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
BitDefender	Trojan.Delf.FareIt.Gen.7
NANO-Antivirus	Trojan.Win32.Androm.hncnsh
Paloalto	generic.ml
AegisLab	Trojan.Win32.Androm.m!c
Rising	Trojan.Injector!1.C97E (CLASSIC)
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Sophos	Mal/Generic-S
Comodo	Malware@#821brd5qlae0
F-Secure	Heuristic.HEUR/AGEN.1136559
DrWeb	Trojan.PWS.Siggen2.51485
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPLOKI.SMBD
McAfee-GW-Edition	BehavesLike.Win32.Fareit.bc
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
SentinelOne	Static AI - Suspicious PE
Jiangmin	Backdoor.Androm.awti
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1136559
Antiy-AVL	Trojan[Backdoor]/Win32.Androm
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	PWS:Win32/Fareit.AN!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
GData	Trojan.Delf.FareIt.Gen.7
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2085
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZelphiF.34700.SGW@aOXzN6hi
ALYac	Trojan.Delf.FareIt.Gen.7
MAX	malware (ai score=85)
VBA32	TScope.Trojan.Delf
Malwarebytes	Spyware.AgentTesla
Zoner	Trojan.Win32.91490

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46b154 DeleteCriticalSection

• 0x46b158 LeaveCriticalSection

• 0x46b15c EnterCriticalSection

• 0x46b160 InitializeCriticalSection

• 0x46b164 VirtualFree

• 0x46b168 VirtualAlloc

• 0x46b16c LocalFree

• 0x46b170 LocalAlloc

• 0x46b174 GetVersion

• 0x46b178 GetCurrentThreadId

• 0x46b17c InterlockedDecrement

• 0x46b180 InterlockedIncrement

• 0x46b184 VirtualQuery

• 0x46b188 WideCharToMultiByte

• 0x46b18c MultiByteToWideChar

• 0x46b190 lstrlenA

• 0x46b194 lstrcpynA

• 0x46b198 LoadLibraryExA

• 0x46b19c GetThreadLocale

• 0x46b1a0 GetStartupInfoA

• 0x46b1a4 GetProcAddress

• 0x46b1a8 GetModuleHandleA

• 0x46b1ac GetModuleFileNameA

• 0x46b1b0 GetLocaleInfoA

• 0x46b1b4 GetCommandLineA

• 0x46b1b8 FreeLibrary

• 0x46b1bc FindFirstFileA

• 0x46b1c0 FindClose

• 0x46b1c4 ExitProcess

• 0x46b1c8 WriteFile

• 0x46b1cc UnhandledExceptionFilter

• 0x46b1d0 RtlUnwind

• 0x46b1d4 RaiseException

• 0x46b1d8 GetStdHandle

Library user32.dll:

• 0x46b1e0 GetKeyboardType

• 0x46b1e4 LoadStringA

• 0x46b1e8 MessageBoxA

• 0x46b1ec CharNextA

Library advapi32.dll:

• 0x46b1f4 RegQueryValueExA

• 0x46b1f8 RegOpenKeyExA

• 0x46b1fc RegCloseKey

Library oleaut32.dll:

• 0x46b204 SysFreeString

• 0x46b208 SysReAllocStringLen

• 0x46b20c SysAllocStringLen

Library kernel32.dll:

• 0x46b214 TlsSetValue

• 0x46b218 TlsGetValue

• 0x46b21c LocalAlloc

• 0x46b220 GetModuleHandleA

Library advapi32.dll:

• 0x46b228 RegQueryValueExA

• 0x46b22c RegOpenKeyExA

• 0x46b230 RegCloseKey

Library kernel32.dll:

• 0x46b238 lstrcpyA

• 0x46b23c lstrcmpA

• 0x46b240 WriteFile

• 0x46b244 WaitForSingleObject

• 0x46b248 VirtualQuery

• 0x46b24c VirtualProtectEx

• 0x46b250 VirtualAlloc

• 0x46b254 Sleep

• 0x46b258 SizeofResource

• 0x46b25c SetThreadLocale

• 0x46b260 SetFilePointer

• 0x46b264 SetEvent

• 0x46b268 SetErrorMode

• 0x46b26c SetEndOfFile

• 0x46b270 ResetEvent

• 0x46b274 ReadFile

• 0x46b278 MulDiv

• 0x46b27c LockResource

• 0x46b280 LoadResource

• 0x46b284 LoadLibraryA

• 0x46b288 LeaveCriticalSection

• 0x46b28c InitializeCriticalSection

• 0x46b290 GlobalUnlock

• 0x46b294 GlobalSize

• 0x46b298 GlobalReAlloc

• 0x46b29c GlobalHandle

• 0x46b2a0 GlobalLock

• 0x46b2a4 GlobalFree

• 0x46b2a8 GlobalFindAtomA

• 0x46b2ac GlobalDeleteAtom

• 0x46b2b0 GlobalAlloc

• 0x46b2b4 GlobalAddAtomA

• 0x46b2b8 GetVersionExA

• 0x46b2bc GetVersion

• 0x46b2c0 GetTickCount

• 0x46b2c4 GetThreadLocale

• 0x46b2c8 GetSystemInfo

• 0x46b2cc GetStringTypeExA

• 0x46b2d0 GetStdHandle

• 0x46b2d4 GetProfileStringA

• 0x46b2d8 GetProcAddress

• 0x46b2dc GetModuleHandleA

• 0x46b2e0 GetModuleFileNameA

• 0x46b2e4 GetLocaleInfoA

• 0x46b2e8 GetLocalTime

• 0x46b2ec GetLastError

• 0x46b2f0 GetFullPathNameA

• 0x46b2f4 GetDiskFreeSpaceA

• 0x46b2f8 GetDateFormatA

• 0x46b2fc GetCurrentThreadId

• 0x46b300 GetCurrentProcessId

• 0x46b304 GetCurrentProcess

• 0x46b308 GetCPInfo

• 0x46b30c GetACP

• 0x46b310 FreeResource

• 0x46b314 InterlockedExchange

• 0x46b318 FreeLibrary

• 0x46b31c FormatMessageA

• 0x46b320 FindResourceA

• 0x46b324 EnumCalendarInfoA

• 0x46b328 EnterCriticalSection

• 0x46b32c DeleteCriticalSection

• 0x46b330 CreateThread

• 0x46b334 CreateFileA

• 0x46b338 CreateEventA

• 0x46b33c CompareStringA

• 0x46b340 CloseHandle

Library version.dll:

• 0x46b348 VerQueryValueA

• 0x46b34c GetFileVersionInfoSizeA

• 0x46b350 GetFileVersionInfoA

Library gdi32.dll:

• 0x46b358 UnrealizeObject

• 0x46b35c StretchBlt

• 0x46b360 SetWindowOrgEx

• 0x46b364 SetViewportOrgEx

• 0x46b368 SetTextColor

• 0x46b36c SetStretchBltMode

• 0x46b370 SetROP2

• 0x46b374 SetPixel

• 0x46b378 SetDIBColorTable

• 0x46b37c SetBrushOrgEx

• 0x46b380 SetBkMode

• 0x46b384 SetBkColor

• 0x46b388 SelectPalette

• 0x46b38c SelectObject

• 0x46b390 SelectClipRgn

• 0x46b394 SaveDC

• 0x46b398 RestoreDC

• 0x46b39c Rectangle

• 0x46b3a0 RectVisible

• 0x46b3a4 RealizePalette

• 0x46b3a8 Polyline

• 0x46b3ac PatBlt

• 0x46b3b0 MoveToEx

• 0x46b3b4 MaskBlt

• 0x46b3b8 LineTo

• 0x46b3bc IntersectClipRect

• 0x46b3c0 GetWindowOrgEx

• 0x46b3c4 GetTextMetricsA

• 0x46b3c8 GetTextExtentPoint32A

• 0x46b3cc GetSystemPaletteEntries

• 0x46b3d0 GetStockObject

• 0x46b3d4 GetPixel

• 0x46b3d8 GetPaletteEntries

• 0x46b3dc GetObjectA

• 0x46b3e0 GetDeviceCaps

• 0x46b3e4 GetDIBits

• 0x46b3e8 GetDIBColorTable

• 0x46b3ec GetDCOrgEx

• 0x46b3f0 GetCurrentPositionEx

• 0x46b3f4 GetClipBox

• 0x46b3f8 GetBrushOrgEx

• 0x46b3fc GetBitmapBits

• 0x46b400 ExcludeClipRect

• 0x46b404 EndPath

• 0x46b408 EndPage

• 0x46b40c EndDoc

• 0x46b410 DeleteObject

• 0x46b414 DeleteDC

• 0x46b418 CreateSolidBrush

• 0x46b41c CreatePenIndirect

• 0x46b420 CreatePen

• 0x46b424 CreatePalette

• 0x46b428 CreateICA

• 0x46b42c CreateHalftonePalette

• 0x46b430 CreateFontIndirectA

• 0x46b434 CreateDIBitmap

• 0x46b438 CreateDIBSection

• 0x46b43c CreateDCA

• 0x46b440 CreateCompatibleDC

• 0x46b444 CreateCompatibleBitmap

• 0x46b448 CreateBrushIndirect

• 0x46b44c CreateBitmap

• 0x46b450 BitBlt

Library user32.dll:

• 0x46b458 CreateWindowExA

• 0x46b45c WindowFromPoint

• 0x46b460 WinHelpA

• 0x46b464 WaitMessage

• 0x46b468 ValidateRect

• 0x46b46c UpdateWindow

• 0x46b470 UnregisterClassA

• 0x46b474 UnhookWindowsHookEx

• 0x46b478 TranslateMessage

• 0x46b47c TranslateMDISysAccel

• 0x46b480 TrackPopupMenu

• 0x46b484 SystemParametersInfoA

• 0x46b488 ShowWindow

• 0x46b48c ShowScrollBar

• 0x46b490 ShowOwnedPopups

• 0x46b494 ShowCursor

• 0x46b498 SetWindowsHookExA

• 0x46b49c SetWindowTextA

• 0x46b4a0 SetWindowPos

• 0x46b4a4 SetWindowPlacement

• 0x46b4a8 SetWindowLongA

• 0x46b4ac SetTimer

• 0x46b4b0 SetScrollRange

• 0x46b4b4 SetScrollPos

• 0x46b4b8 SetScrollInfo

• 0x46b4bc SetRect

• 0x46b4c0 SetPropA

• 0x46b4c4 SetParent

• 0x46b4c8 SetMenuItemInfoA

• 0x46b4cc SetMenu

• 0x46b4d0 SetForegroundWindow

• 0x46b4d4 SetFocus

• 0x46b4d8 SetCursor

• 0x46b4dc SetClassLongA

• 0x46b4e0 SetCapture

• 0x46b4e4 SetActiveWindow

• 0x46b4e8 SendMessageA

• 0x46b4ec ScrollWindow

• 0x46b4f0 ScreenToClient

• 0x46b4f4 RemovePropA

• 0x46b4f8 RemoveMenu

• 0x46b4fc ReleaseDC

• 0x46b500 ReleaseCapture

• 0x46b504 RegisterWindowMessageA

• 0x46b508 RegisterClipboardFormatA

• 0x46b50c RegisterClassA

• 0x46b510 RedrawWindow

• 0x46b514 PtInRect

• 0x46b518 PostQuitMessage

• 0x46b51c PostMessageA

• 0x46b520 PeekMessageA

• 0x46b524 OffsetRect

• 0x46b528 OemToCharA

• 0x46b52c MessageBoxA

• 0x46b530 MapWindowPoints

• 0x46b534 MapVirtualKeyA

• 0x46b538 LoadStringA

• 0x46b53c LoadKeyboardLayoutA

• 0x46b540 LoadIconA

• 0x46b544 LoadCursorA

• 0x46b548 LoadBitmapA

• 0x46b54c KillTimer

• 0x46b550 IsZoomed

• 0x46b554 IsWindowVisible

• 0x46b558 IsWindowEnabled

• 0x46b55c IsWindow

• 0x46b560 IsRectEmpty

• 0x46b564 IsIconic

• 0x46b568 IsDialogMessageA

• 0x46b56c IsChild

• 0x46b570 InvalidateRect

• 0x46b574 IntersectRect

• 0x46b578 InsertMenuItemA

• 0x46b57c InsertMenuA

• 0x46b580 InflateRect

• 0x46b584 GetWindowThreadProcessId

• 0x46b588 GetWindowTextA

• 0x46b58c GetWindowRect

• 0x46b590 GetWindowPlacement

• 0x46b594 GetWindowLongA

• 0x46b598 GetWindowDC

• 0x46b59c GetTopWindow

• 0x46b5a0 GetSystemMetrics

• 0x46b5a4 GetSystemMenu

• 0x46b5a8 GetSysColorBrush

• 0x46b5ac GetSysColor

• 0x46b5b0 GetSubMenu

• 0x46b5b4 GetScrollRange

• 0x46b5b8 GetScrollPos

• 0x46b5bc GetScrollInfo

• 0x46b5c0 GetPropA

• 0x46b5c4 GetParent

• 0x46b5c8 GetWindow

• 0x46b5cc GetMenuStringA

• 0x46b5d0 GetMenuState

• 0x46b5d4 GetMenuItemInfoA

• 0x46b5d8 GetMenuItemID

• 0x46b5dc GetMenuItemCount

• 0x46b5e0 GetMenu

• 0x46b5e4 GetLastActivePopup

• 0x46b5e8 GetKeyboardState

• 0x46b5ec GetKeyboardLayoutList

• 0x46b5f0 GetKeyboardLayout

• 0x46b5f4 GetKeyState

• 0x46b5f8 GetKeyNameTextA

• 0x46b5fc GetIconInfo

• 0x46b600 GetForegroundWindow

• 0x46b604 GetFocus

• 0x46b608 GetDesktopWindow

• 0x46b60c GetDCEx

• 0x46b610 GetDC

• 0x46b614 GetCursorPos

• 0x46b618 GetCursor

• 0x46b61c GetClientRect

• 0x46b620 GetClassNameA

• 0x46b624 GetClassInfoA

• 0x46b628 GetCapture

• 0x46b62c GetActiveWindow

• 0x46b630 FrameRect

• 0x46b634 FindWindowA

• 0x46b638 FillRect

• 0x46b63c EqualRect

• 0x46b640 EnumWindows

• 0x46b644 EnumThreadWindows

• 0x46b648 EndPaint

• 0x46b64c EndDeferWindowPos

• 0x46b650 EnableWindow

• 0x46b654 EnableScrollBar

• 0x46b658 EnableMenuItem

• 0x46b65c DrawTextA

• 0x46b660 DrawMenuBar

• 0x46b664 DrawIconEx

• 0x46b668 DrawIcon

• 0x46b66c DrawFrameControl

• 0x46b670 DrawEdge

• 0x46b674 DispatchMessageA

• 0x46b678 DestroyWindow

• 0x46b67c DestroyMenu

• 0x46b680 DestroyIcon

• 0x46b684 DestroyCursor

• 0x46b688 DeleteMenu

• 0x46b68c DeferWindowPos

• 0x46b690 DefWindowProcA

• 0x46b694 DefMDIChildProcA

• 0x46b698 DefFrameProcA

• 0x46b69c CreatePopupMenu

• 0x46b6a0 CreateMenu

• 0x46b6a4 CreateIcon

• 0x46b6a8 ClientToScreen

• 0x46b6ac CheckMenuItem

• 0x46b6b0 CallWindowProcA

• 0x46b6b4 CallNextHookEx

• 0x46b6b8 BeginPaint

• 0x46b6bc BeginDeferWindowPos

• 0x46b6c0 CharNextA

• 0x46b6c4 CharLowerA

• 0x46b6c8 CharToOemA

• 0x46b6cc AdjustWindowRectEx

• 0x46b6d0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x46b6d8 Sleep

Library oleaut32.dll:

• 0x46b6e0 SafeArrayPtrOfIndex

• 0x46b6e4 SafeArrayGetUBound

• 0x46b6e8 SafeArrayGetLBound

• 0x46b6ec SafeArrayCreate

• 0x46b6f0 VariantChangeType

• 0x46b6f4 VariantCopy

• 0x46b6f8 VariantClear

• 0x46b6fc VariantInit

Library ole32.dll:

• 0x46b704 CoTaskMemAlloc

• 0x46b708 CoCreateInstance

• 0x46b70c CoUninitialize

• 0x46b710 CoInitialize

Library comctl32.dll:

• 0x46b718 ImageList_SetIconSize

• 0x46b71c ImageList_GetIconSize

• 0x46b720 ImageList_Write

• 0x46b724 ImageList_Read

• 0x46b728 ImageList_GetDragImage

• 0x46b72c ImageList_DragShowNolock

• 0x46b730 ImageList_SetDragCursorImage

• 0x46b734 ImageList_DragMove

• 0x46b738 ImageList_DragLeave

• 0x46b73c ImageList_DragEnter

• 0x46b740 ImageList_EndDrag

• 0x46b744 ImageList_BeginDrag

• 0x46b748 ImageList_Remove

• 0x46b74c ImageList_DrawEx

• 0x46b750 ImageList_Draw

• 0x46b754 ImageList_GetBkColor

• 0x46b758 ImageList_SetBkColor

• 0x46b75c ImageList_ReplaceIcon

• 0x46b760 ImageList_Add

• 0x46b764 ImageList_GetImageCount

• 0x46b768 ImageList_Destroy

• 0x46b76c ImageList_Create

• 0x46b770 InitCommonControls

Library winspool.drv:

• 0x46b778 OpenPrinterA

• 0x46b77c EnumPrintersA

• 0x46b780 DocumentPropertiesA

• 0x46b784 ClosePrinter

Library comdlg32.dll:

• 0x46b78c PrintDlgA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	51811	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.