13.6
0-day
该样本未表现出任何异常！
重新分析
更多

37d51be7f6011c1acebd7ef1833f3403d87706095e74ee2568936bc0047d2374

2057241b6d8625551e2c5d35312167a3.exe

分析耗时

131s

最近分析

文件大小

412.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (10 个事件)
Time & API Arguments Status Return Repeated
1619305323.234999
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305337.234999
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305335.954626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305337.922749
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305338.140999
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305351.031999
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305351.859999
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305352.359999
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619305365.407124
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619305365.407124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619305351.265999
IsDebuggerPresent
failed 0 0
Command line console output was observed (3 个事件)
Time & API Arguments Status Return Repeated
1619305340.797749
WriteConsoleW
buffer: 成功: 成功创建计划任务 "N0mFUQoa"。
console_handle: 0x00000007
success 1 0
1619305362.407124
WriteConsoleW
buffer: vssadmin 1.1 - 卷影复制服务管理命令行工具 (C) 版权所有 2001-2005 Microsoft Corp.
console_handle: 0x00000007
success 1 0
1619305365.688124
WriteConsoleW
buffer: 错误: 意外故障: 没有注册类
console_handle: 0x00000007
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\MachineGuid
The file contains an unknown PE resource name possibly indicative of a packer (3 个事件)
resource name BIN
resource name PNG
resource name None
One or more processes crashed (50 out of 30388 个事件)
Time & API Arguments Status Return Repeated
1619305323.250999
__exception__
stacktrace: 
lineGetAddressStatusW+0x50 lineGetAddressStatusA-0x14 tapi32+0x87c0 @ 0x752987c0
2057241b6d8625551e2c5d35312167a3+0x3d49 @ 0x403d49
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635372
registers.edi: 3000464
registers.eax: 0
registers.ebp: 1635512
registers.edx: 8
registers.ebx: 1635528
registers.esi: 2
registers.ecx: 2
exception.instruction_r: 8b 00 89 45 c0 c7 45 fc fe ff ff ff ff 75 c0 ff
exception.symbol: phoneGetMessage+0xc14 lineAccept-0x96e tapi32+0x6495
exception.instruction: mov eax, dword ptr [eax]
exception.module: TAPI32.dll
exception.exception_code: 0xc0000005
exception.offset: 25749
exception.address: 0x75296495
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 4294965373
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 4294965373
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 4294963450
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 4294963450
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 248566471
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 248566471
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 497136788
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 497136788
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 745707105
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 745707105
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 994277422
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 994277422
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1242847739
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1242847739
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1491418056
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1491418056
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1739988373
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1739988373
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1988558690
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1988558690
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2237129007
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2237129007
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2485699324
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2485699324
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2734269641
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2734269641
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.296999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2982839958
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2982839958
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3231410275
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3231410275
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3479980592
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3479980592
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3728550909
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3728550909
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3977121226
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3977121226
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 4225691543
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 4225691543
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 179294564
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 179294564
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 427864881
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 427864881
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 676435198
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 676435198
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 925005515
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 925005515
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1173575832
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1173575832
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1422146149
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1422146149
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1670716466
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1670716466
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1919286783
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1919286783
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2167857100
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2167857100
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.312999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2416427417
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2416427417
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2664997734
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2664997734
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2913568051
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2913568051
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3162138368
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3162138368
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3410708685
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3410708685
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3659279002
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3659279002
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3907849319
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3907849319
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 4156419636
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 4156419636
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 110022657
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 110022657
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 358592974
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 358592974
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.328999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 607163291
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 607163291
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.343999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 855733608
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 855733608
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.343999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1104303925
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1104303925
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.343999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1352874242
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1352874242
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.343999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1601444559
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1601444559
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.343999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 1850014876
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 1850014876
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.359999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2098585193
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2098585193
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.359999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2347155510
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2347155510
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.359999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2595725827
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2595725827
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.359999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 2844296144
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 2844296144
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
1619305323.359999
__exception__
stacktrace: 
NDRCContextMarshall+0x2b7 NDRCContextBinding-0x12 rpcrt4+0x183ad @ 0x75c883ad
NdrClientCall2+0x1f9 RpcAsyncInitializeHandle-0x10 rpcrt4+0xb01fe @ 0x75d201fe
RegSetValueA+0xcf9 GetServiceKeyNameA-0x5a advapi32+0x61b3a @ 0x765a1b3a
GetServiceKeyNameA+0x37 GetServiceDisplayNameA-0x66 advapi32+0x61bcb @ 0x765a1bcb
2057241b6d8625551e2c5d35312167a3+0x4200 @ 0x404200
2057241b6d8625551e2c5d35312167a3+0xa670 @ 0x40a670
2057241b6d8625551e2c5d35312167a3+0xa3bd @ 0x40a3bd
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634388
registers.edi: 1985271814
registers.eax: 3092866461
registers.ebp: 1634428
registers.edx: 0
registers.ebx: 1635532
registers.esi: 1
registers.ecx: 3092866461
exception.instruction_r: 81 78 04 98 ba dc fe 0f 85 50 da 03 00 c7 45 fc
exception.symbol: NDRCContextBinding+0x13 NdrCorrelationInitialize-0x3a0 rpcrt4+0x183d2
exception.instruction: cmp dword ptr [eax + 4], 0xfedcba98
exception.module: RPCRT4.dll
exception.exception_code: 0xc0000005
exception.offset: 99282
exception.address: 0x75c883d2
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 313 个事件)
Time & API Arguments Status Return Repeated
1619305332.718999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 1974272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02600000
success 0 0
1619305332.718999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026d0000
success 0 0
1619305334.078999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.109999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.140999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.171999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.203999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.218999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.250999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.265999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.296999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.328999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.359999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.375999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.375999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.421999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.437999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.453999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.484999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.484999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.531999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.578999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.625999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.656999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.703999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.750999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.765999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.796999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.812999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.843999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.875999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.890999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.921999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.953999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305334.968999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.000999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.015999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.046999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.062999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.093999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.125999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.156999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.171999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.187999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.203999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.203999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.234999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.250999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.250999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
1619305335.250999
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x022a0000
success 0 0
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f252888.vbs
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe
Creates a suspicious process (4 个事件)
cmdline bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
cmdline "C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
cmdline bcdedit.exe /set {default} recoveryenabled no
cmdline schtasks /CREATE /TN "N0mFUQoa" /TR "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f252888.vbs
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2057241b6d8625551e2c5d35312167a3.exe
A process created a hidden window (3 个事件)
Time & API Arguments Status Return Repeated
1619305337.234999
ShellExecuteExW
parameters: /CREATE /TN "N0mFUQoa" /TR "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
filepath: schtasks
filepath_r: schtasks
show_type: 0
success 1 0
1619305344.703999
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f252888.vbs
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\f252888.vbs
show_type: 0
success 1 0
1619305361.062999
ShellExecuteExW
parameters: delete shadows /all /quiet
filepath: vssadmin.exe
filepath_r: vssadmin.exe
show_type: 0
success 1 0
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619305344.718999
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2057241b6d8625551e2c5d35312167a3.exe
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2057241b6d8625551e2c5d35312167a3.exe
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.0273172228143 section {'size_of_data': '0x0002b000', 'virtual_address': '0x0003e000', 'entropy': 7.0273172228143, 'name': '.rsrc', 'virtual_size': '0x0002a72c'} description A section with a high entropy has been found
entropy 0.4215686274509804 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619305362.376124
LookupPrivilegeValueW
system_name:
privilege_name: SeBackupPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
cmdline schtasks /CREATE /TN "N0mFUQoa" /TR "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Enumerates services, possibly for anti-virtualization (1 个事件)
Time & API Arguments Status Return Repeated
1619305358.843999
EnumServicesStatusW
service_handle: 0x0648e360
service_type: 48
service_status: 3
success 1 0
Installs itself for autorun at Windows startup (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
cmdline schtasks /CREATE /TN "N0mFUQoa" /TR "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
Runs bcdedit commands specific to ransomware (2 个事件)
cmdline bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
cmdline bcdedit.exe /set {default} recoveryenabled no
Deletes a large number of files from the system indicative of ransomware, wiper malware or system destruction (50 out of 439 个事件)
file C:\Python27\Lib\test\pythoninfo.py
file C:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\__init__.py
file C:\Python27\Lib\site-packages\pip\_vendor\packaging\__init__.py
file C:\Python27\include\pythonrun.h
file C:\Python27\Lib\test\sample_doctest_no_doctests.py
file C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm
file C:\Python27\Lib\test\test_fileinput.py
file C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm
file C:\Python27\Lib\sysconfig.py
file C:\Python27\include\dtoa.h
file C:\Python27\Lib\test\badsyntax_future4.py
file C:\Python27\Lib\test\test_cl.py
file C:\Python27\Lib\test\test_capi.py
file C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm
file C:\Python27\Lib\site-packages\pip\_vendor\requests\compat.py
file C:\Python27\Lib\test\test_defaultdict.py
file C:\Python27\Lib\test\test_file.py
file C:\Python27\tcl\tix8.4.3\bitmaps\plusarm.xpm
file C:\Python27\Lib\symtable.py
file C:\Python27\Lib\site-packages\pip\_vendor\progress\spinner.py
file C:\Python27\Lib\test\test_bigmem.py
file C:\Python27\Lib\sre_compile.py
file C:\Python27\Lib\test\leakers\test_dictself.py
file C:\Python27\include\pyerrors.h
file C:\Python27\Lib\test\crashers\borrowed_ref_2.py
file C:\Python27\include\intrcheck.h
file C:\Python27\Lib\test\test_codecmaps_hk.py
file C:\Python27\Lib\symbol.py
file C:\Python27\Lib\test\test_binop.py
file C:\Python27\Lib\site-packages\pip\_vendor\pep517\check.py
file C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm
file C:\Python27\Lib\test\test_contextlib.py
file C:\Python27\include\symtable.h
file C:\Python27\Lib\test\reperf.py
file C:\Python27\Lib\test\test_email.py
file C:\Python27\Lib\test\crashers\infinite_loop_re.py
file C:\Python27\Lib\test\test_bytes.py
file C:\Python27\Lib\test\crashers\warnings_del_crasher.py
file C:\Python27\Lib\test\sample_doctest.py
file C:\Python27\Lib\site-packages\pip\_vendor\pytoml\parser.py
file C:\Python27\include\warnings.h
file C:\Python27\tcl\tix8.4.3\pref\Gray.cs
file C:\Python27\Lib\test\test_bigaddrspace.py
file C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm
file C:\Python27\Lib\test\test_codecs.py
file C:\Python27\Lib\test\make_ssl_certs.py
file C:\Python27\include\bytearrayobject.h
file C:\Python27\Lib\site-packages\pip\_vendor\urllib3\contrib\__init__.py
file C:\Python27\Lib\test\crashers\decref_before_assignment.py
file C:\Python27\Lib\idlelib\Icons\idle.ico
Removes the Shadow Copy to avoid recovery of the system (1 个事件)
cmdline vssadmin.exe delete shadows /all /quiet
Uses suspicious command line tools or Windows utilities (2 个事件)
cmdline vssadmin.exe delete shadows /all /quiet
cmdline "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
The process wscript.exe wrote an executable file to disk (1 个事件)
file C:\Windows\SysWOW64\wscript.exe
Detects VirtualBox through the presence of a device (2 个事件)
file \??\VBoxGuest
file \??\VBoxMiniRdrDN
Detects VirtualBox through the presence of a file (1 个事件)
dll C:\Windows\system32\VBoxMRXNP.dll
Generates some ICMP traffic
Performs 441 file moves indicative of a ransomware file encryption process (50 out of 441 个事件)
Time & API Arguments Status Return Repeated
1619305344.718999
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2057241b6d8625551e2c5d35312167a3.exe
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2057241b6d8625551e2c5d35312167a3.exe
success 1 0
1619305344.812999
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f252888.vbs
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\f252888.vbs
success 1 0
1619305369.671999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem
newfilepath: C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem...
success 1 0
1619305369.843999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\nokia.pem
newfilepath: C:\Python27\Lib\test\nokia.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\nokia.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\nokia.pem...
success 1 0
1619305369.890999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\nullcert.pem
newfilepath: C:\Python27\Lib\test\nullcert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\nullcert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\nullcert.pem...
success 1 0
1619305369.921999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\nullbytecert.pem
newfilepath: C:\Python27\Lib\test\nullbytecert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\nullbytecert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\nullbytecert.pem...
success 1 0
1619305369.984999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ssl_key.passwd.pem
newfilepath: C:\Python27\Lib\test\ssl_key.passwd.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.passwd.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.passwd.pem...
success 1 0
1619305370.046999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\pycacert.pem
newfilepath: C:\Python27\Lib\test\pycacert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\pycacert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\pycacert.pem...
success 1 0
1619305370.078999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ssl_key.pem
newfilepath: C:\Python27\Lib\test\ssl_key.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.pem...
success 1 0
1619305370.125999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\badkey.pem
newfilepath: C:\Python27\Lib\test\badkey.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\badkey.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\badkey.pem...
success 1 0
1619305370.140999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\talos-2019-0758.pem
newfilepath: C:\Python27\Lib\test\talos-2019-0758.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\talos-2019-0758.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\talos-2019-0758.pem...
success 1 0
1619305370.296999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
newfilepath: C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem...
success 1 0
1619305370.390999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert4.pem
newfilepath: C:\Python27\Lib\test\keycert4.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert4.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert4.pem...
success 1 0
1619305370.781999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ssl_cert.pem
newfilepath: C:\Python27\Lib\test\ssl_cert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ssl_cert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ssl_cert.pem...
success 1 0
1619305370.781999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert3.pem
newfilepath: C:\Python27\Lib\test\keycert3.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert3.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert3.pem...
success 1 0
1619305370.937999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\allsans.pem
newfilepath: C:\Python27\Lib\test\allsans.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\allsans.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\allsans.pem...
success 1 0
1619305370.984999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\badcert.pem
newfilepath: C:\Python27\Lib\test\badcert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\badcert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\badcert.pem...
success 1 0
1619305371.125999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ffdh3072.pem
newfilepath: C:\Python27\Lib\test\ffdh3072.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ffdh3072.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ffdh3072.pem...
success 1 0
1619305371.203999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert2.pem
newfilepath: C:\Python27\Lib\test\keycert2.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert2.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert2.pem...
success 1 0
1619305371.234999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert.passwd.pem
newfilepath: C:\Python27\Lib\test\keycert.passwd.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert.passwd.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert.passwd.pem...
success 1 0
1619305371.328999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert.pem
newfilepath: C:\Python27\Lib\test\keycert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert.pem...
success 1 0
1619305371.343999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\185test.db
newfilepath: C:\Python27\Lib\test\185test.db.sage
newfilepath_r: \\?\C:\Python27\Lib\test\185test.db.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\185test.db...
success 1 0
1619305371.406999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\Sine-1000Hz-300ms.aif
newfilepath: C:\Python27\Lib\test\Sine-1000Hz-300ms.aif.sage
newfilepath_r: \\?\C:\Python27\Lib\test\Sine-1000Hz-300ms.aif.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\Sine-1000Hz-300ms.aif...
success 1 0
1619305371.453999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\idlelib\Icons\idle.ico
newfilepath: C:\Python27\Lib\idlelib\Icons\idle.ico.sage
newfilepath_r: \\?\C:\Python27\Lib\idlelib\Icons\idle.ico.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\idlelib\Icons\idle.ico...
success 1 0
1619305371.453999
MoveFileWithProgressW
oldfilepath: C:\Python27\DLLs\py.ico
newfilepath: C:\Python27\DLLs\py.ico.sage
newfilepath_r: \\?\C:\Python27\DLLs\py.ico.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\DLLs\py.ico...
success 1 0
1619305371.531999
MoveFileWithProgressW
oldfilepath: C:\Python27\DLLs\pyc.ico
newfilepath: C:\Python27\DLLs\pyc.ico.sage
newfilepath_r: \\?\C:\Python27\DLLs\pyc.ico.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\DLLs\pyc.ico...
success 1 0
1619305371.578999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\imghdrdata\python.tiff
newfilepath: C:\Python27\Lib\test\imghdrdata\python.tiff.sage
newfilepath_r: \\?\C:\Python27\Lib\test\imghdrdata\python.tiff.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\imghdrdata\python.tiff...
success 1 0
1619305371.625999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm...
success 1 0
1619305371.671999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm...
success 1 0
1619305371.750999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm...
success 1 0
1619305371.781999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm...
success 1 0
1619305371.890999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm...
success 1 0
1619305372.062999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm...
success 1 0
1619305372.062999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm...
success 1 0
1619305372.171999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm...
success 1 0
1619305372.250999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm...
success 1 0
1619305372.296999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm...
success 1 0
1619305372.453999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm...
success 1 0
1619305372.468999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm...
success 1 0
1619305373.031999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm...
success 1 0
1619305373.156999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm...
success 1 0
1619305373.171999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm...
success 1 0
1619305373.328999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm...
success 1 0
1619305373.437999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm...
success 1 0
1619305373.437999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm...
success 1 0
1619305373.500999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm...
success 1 0
1619305373.515999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm...
success 1 0
1619305373.609999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm...
success 1 0
1619305373.687999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm...
success 1 0
1619305373.718999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm...
success 1 0
Appends a new file extension or content to 441 files indicative of a ransomware file encryption process (50 out of 441 个事件)
Time & API Arguments Status Return Repeated
1619305344.718999
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2057241b6d8625551e2c5d35312167a3.exe
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2057241b6d8625551e2c5d35312167a3.exe
success 1 0
1619305344.812999
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f252888.vbs
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\f252888.vbs
success 1 0
1619305369.671999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem
newfilepath: C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\site-packages\pip\_vendor\certifi\cacert.pem...
success 1 0
1619305369.843999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\nokia.pem
newfilepath: C:\Python27\Lib\test\nokia.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\nokia.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\nokia.pem...
success 1 0
1619305369.890999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\nullcert.pem
newfilepath: C:\Python27\Lib\test\nullcert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\nullcert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\nullcert.pem...
success 1 0
1619305369.921999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\nullbytecert.pem
newfilepath: C:\Python27\Lib\test\nullbytecert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\nullbytecert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\nullbytecert.pem...
success 1 0
1619305369.984999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ssl_key.passwd.pem
newfilepath: C:\Python27\Lib\test\ssl_key.passwd.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.passwd.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.passwd.pem...
success 1 0
1619305370.046999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\pycacert.pem
newfilepath: C:\Python27\Lib\test\pycacert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\pycacert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\pycacert.pem...
success 1 0
1619305370.078999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ssl_key.pem
newfilepath: C:\Python27\Lib\test\ssl_key.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ssl_key.pem...
success 1 0
1619305370.125999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\badkey.pem
newfilepath: C:\Python27\Lib\test\badkey.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\badkey.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\badkey.pem...
success 1 0
1619305370.140999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\talos-2019-0758.pem
newfilepath: C:\Python27\Lib\test\talos-2019-0758.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\talos-2019-0758.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\talos-2019-0758.pem...
success 1 0
1619305370.296999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
newfilepath: C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\selfsigned_pythontestdotnet.pem...
success 1 0
1619305370.390999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert4.pem
newfilepath: C:\Python27\Lib\test\keycert4.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert4.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert4.pem...
success 1 0
1619305370.781999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ssl_cert.pem
newfilepath: C:\Python27\Lib\test\ssl_cert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ssl_cert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ssl_cert.pem...
success 1 0
1619305370.781999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert3.pem
newfilepath: C:\Python27\Lib\test\keycert3.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert3.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert3.pem...
success 1 0
1619305370.937999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\allsans.pem
newfilepath: C:\Python27\Lib\test\allsans.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\allsans.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\allsans.pem...
success 1 0
1619305370.984999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\badcert.pem
newfilepath: C:\Python27\Lib\test\badcert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\badcert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\badcert.pem...
success 1 0
1619305371.125999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\ffdh3072.pem
newfilepath: C:\Python27\Lib\test\ffdh3072.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\ffdh3072.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\ffdh3072.pem...
success 1 0
1619305371.203999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert2.pem
newfilepath: C:\Python27\Lib\test\keycert2.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert2.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert2.pem...
success 1 0
1619305371.234999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert.passwd.pem
newfilepath: C:\Python27\Lib\test\keycert.passwd.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert.passwd.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert.passwd.pem...
success 1 0
1619305371.328999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\keycert.pem
newfilepath: C:\Python27\Lib\test\keycert.pem.sage
newfilepath_r: \\?\C:\Python27\Lib\test\keycert.pem.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\keycert.pem...
success 1 0
1619305371.343999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\185test.db
newfilepath: C:\Python27\Lib\test\185test.db.sage
newfilepath_r: \\?\C:\Python27\Lib\test\185test.db.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\185test.db...
success 1 0
1619305371.406999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\Sine-1000Hz-300ms.aif
newfilepath: C:\Python27\Lib\test\Sine-1000Hz-300ms.aif.sage
newfilepath_r: \\?\C:\Python27\Lib\test\Sine-1000Hz-300ms.aif.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\Sine-1000Hz-300ms.aif...
success 1 0
1619305371.453999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\idlelib\Icons\idle.ico
newfilepath: C:\Python27\Lib\idlelib\Icons\idle.ico.sage
newfilepath_r: \\?\C:\Python27\Lib\idlelib\Icons\idle.ico.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\idlelib\Icons\idle.ico...
success 1 0
1619305371.453999
MoveFileWithProgressW
oldfilepath: C:\Python27\DLLs\py.ico
newfilepath: C:\Python27\DLLs\py.ico.sage
newfilepath_r: \\?\C:\Python27\DLLs\py.ico.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\DLLs\py.ico...
success 1 0
1619305371.531999
MoveFileWithProgressW
oldfilepath: C:\Python27\DLLs\pyc.ico
newfilepath: C:\Python27\DLLs\pyc.ico.sage
newfilepath_r: \\?\C:\Python27\DLLs\pyc.ico.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\DLLs\pyc.ico...
success 1 0
1619305371.578999
MoveFileWithProgressW
oldfilepath: C:\Python27\Lib\test\imghdrdata\python.tiff
newfilepath: C:\Python27\Lib\test\imghdrdata\python.tiff.sage
newfilepath_r: \\?\C:\Python27\Lib\test\imghdrdata\python.tiff.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\Lib\test\imghdrdata\python.tiff...
success 1 0
1619305371.625999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\combobox.xpm...
success 1 0
1619305371.671999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\code.xpm...
success 1 0
1619305371.750999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\drivea.xpm...
success 1 0
1619305371.781999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\filebox.xpm...
success 1 0
1619305371.890999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\exit.xpm...
success 1 0
1619305372.062999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\select.xpm...
success 1 0
1619305372.062999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\optmenu.xpm...
success 1 0
1619305372.171999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\harddisk.xpm...
success 1 0
1619305372.250999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\network.xpm...
success 1 0
1619305372.296999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\netw.xpm...
success 1 0
1619305372.453999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minus.xpm...
success 1 0
1619305372.468999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.xpm...
success 1 0
1619305373.031999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\minusarm.xpm...
success 1 0
1619305373.156999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\file.xpm...
success 1 0
1619305373.171999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\act_fold.xpm...
success 1 0
1619305373.328999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\info.xpm...
success 1 0
1619305373.437999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\demos\bitmaps\about.xpm...
success 1 0
1619305373.437999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\folder.xpm...
success 1 0
1619305373.500999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\warning.xpm...
success 1 0
1619305373.515999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\textfile.xpm...
success 1 0
1619305373.609999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\plus.xpm...
success 1 0
1619305373.687999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\openfold.xpm...
success 1 0
1619305373.718999
MoveFileWithProgressW
oldfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm
newfilepath: C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm.sage
newfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm.sage
flags: 1
oldfilepath_r: \\?\C:\Python27\tcl\tix8.4.3\bitmaps\srcfile.xpm...
success 1 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2017-04-12 20:17:22

Imports

Library KERNEL32.dll:
• 0x42c070 GetStringTypeW
• 0x42c074 GetStringTypeA
• 0x42c078 LCMapStringW
• 0x42c07c LCMapStringA
• 0x42c080 LoadLibraryA
• 0x42c084 MultiByteToWideChar
• 0x42c088 GetConsoleMode
• 0x42c08c GetConsoleCP
• 0x42c090 FlushFileBuffers
• 0x42c094 SetHandleCount
• 0x42c0a4 GetCurrentProcessId
• 0x42c0ac GetOEMCP
• 0x42c0b0 GetACP
• 0x42c0b4 VirtualAlloc
• 0x42c0b8 VirtualFree
• 0x42c0bc HeapCreate
• 0x42c0c0 HeapDestroy
• 0x42c0c4 HeapReAlloc
• 0x42c0c8 GetModuleFileNameA
• 0x42c0cc ExitProcess
• 0x42c0d0 WideCharToMultiByte
• 0x42c0d4 OutputDebugStringW
• 0x42c0d8 GetProcAddress
• 0x42c0dc WriteConsoleW
• 0x42c0e0 GetLastError
• 0x42c0e4 WriteFile
• 0x42c0e8 GetStdHandle
• 0x42c0ec GetLocaleInfoA
• 0x42c0f0 SetFilePointer
• 0x42c0f4 SetStdHandle
• 0x42c0f8 WriteConsoleA
• 0x42c0fc GetConsoleOutputCP
• 0x42c100 CloseHandle
• 0x42c104 CreateFileA
• 0x42c108 GetCPInfo
• 0x42c10c DebugBreak
• 0x42c110 LoadLibraryW
• 0x42c114 lstrcatA
• 0x42c118 lstrcpyA
• 0x42c11c lstrlenA
• 0x42c120 SetLastError
• 0x42c124 TlsFree
• 0x42c128 GetCurrentThreadId
• 0x42c12c TlsSetValue
• 0x42c130 TlsAlloc
• 0x42c134 TlsGetValue
• 0x42c138 FatalAppExitA
• 0x42c13c GetStartupInfoA
• 0x42c140 GetProcessHeap
• 0x42c144 HeapAlloc
• 0x42c148 GetVersionExA
• 0x42c14c HeapFree
• 0x42c150 GetCommandLineA
• 0x42c154 RtlUnwind
• 0x42c158 IsBadReadPtr
• 0x42c15c HeapValidate
• 0x42c160 GetModuleFileNameW
• 0x42c164 IsDebuggerPresent
• 0x42c170 GetCurrentProcess
• 0x42c174 TerminateProcess
• 0x42c178 RaiseException
• 0x42c17c OutputDebugStringA
• 0x42c180 GetModuleHandleA
• 0x42c184 GetTickCount
• 0x42c18c GetFileType
Library USER32.dll:
• 0x42c200 CreateWindowExA
• 0x42c204 FillRect
• 0x42c208 GetClientRect
• 0x42c20c GetWindow
• 0x42c210 GetDesktopWindow
• 0x42c214 GetDialogBaseUnits
• 0x42c21c GetForegroundWindow
• 0x42c220 BeginPaint
• 0x42c224 SendDlgItemMessageA
• 0x42c228 GetIconInfo
• 0x42c22c GetDlgItem
• 0x42c230 GetWindowRect
• 0x42c234 ScreenToClient
• 0x42c238 SetRect
• 0x42c23c DestroyIcon
• 0x42c240 EndPaint
• 0x42c244 IsIconic
• 0x42c248 InvalidateRect
• 0x42c250 GetSystemMetrics
• 0x42c254 GetCursorInfo
• 0x42c258 DrawIcon
• 0x42c25c LoadStringA
• 0x42c260 LoadAcceleratorsA
• 0x42c264 GetMessageA
• 0x42c26c TranslateMessage
• 0x42c270 DispatchMessageA
• 0x42c274 GetDC
• 0x42c278 ShowWindow
• 0x42c27c UpdateWindow
• 0x42c280 GetWindowLongA
• 0x42c284 GetSystemMenu
• 0x42c288 GetMenuItemInfoA
• 0x42c28c IsDlgButtonChecked
• 0x42c290 SendMessageA
• 0x42c294 UnionRect
• 0x42c298 GetDlgItemTextA
• 0x42c29c wsprintfA
• 0x42c2a0 PostQuitMessage
• 0x42c2a4 DefWindowProcA
• 0x42c2a8 SetDlgItemTextA
• 0x42c2ac LoadIconA
• 0x42c2b0 CharLowerA
• 0x42c2b4 SetWindowTextA
• 0x42c2b8 SetWindowLongA
• 0x42c2bc SetWindowPos
• 0x42c2c4 EnumDisplayDevicesA
• 0x42c2c8 GetWindowTextA
Library GDI32.dll:
• 0x42c028 CreateCompatibleDC
• 0x42c030 SelectObject
• 0x42c034 BitBlt
• 0x42c038 StretchBlt
• 0x42c03c GetPixel
• 0x42c040 CreateFontIndirectA
• 0x42c044 DeleteObject
• 0x42c048 GetTextMetricsA
• 0x42c04c SetTextColor
• 0x42c050 TextOutA
• 0x42c054 SetBkColor
• 0x42c058 GetBkColor
• 0x42c05c CreateSolidBrush
• 0x42c060 DeleteDC
• 0x42c064 GetStockObject
• 0x42c068 GetObjectA
Library comdlg32.dll:
• 0x42c2ec ChooseFontA
Library ADVAPI32.dll:
• 0x42c004 GetServiceKeyNameA
Library SHELL32.dll:
• 0x42c1ec DragAcceptFiles
Library OLEAUT32.dll:
• 0x42c1e4 SysAllocStringLen
Library ODBC32.dll:
• 0x42c1b0
• 0x42c1b4
• 0x42c1b8
• 0x42c1bc
• 0x42c1c0
• 0x42c1c4
• 0x42c1c8
• 0x42c1cc
• 0x42c1d0
• 0x42c1d4
• 0x42c1d8
• 0x42c1dc
Library WS2_32.dll:
• 0x42c2dc WSAStringToAddressA
Library WinSCard.dll:
Library WINMM.dll:
• 0x42c2d0 waveOutGetNumDevs
• 0x42c2d4 mmioOpenA
Library CRYPTUI.dll:
• 0x42c020 CryptUIWizImport
Library COMCTL32.dll:
• 0x42c014 ImageList_Create
• 0x42c018
Library TAPI32.dll:

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49186 192.168.56.1 139
192.168.56.101 49187 192.168.56.1 139
192.168.56.101 49189 192.168.56.1 139

UDP

Source Source Port Destination Destination Port
192.168.56.1 137 192.168.56.101 137
192.168.56.1 138 192.168.56.101 138
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 60221 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57236 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.